Saswat Anand - Academia.edu (original) (raw)

Uploads

Papers by Saswat Anand

We present a technique to mine explicit information flow specifications from concrete executions.... more We present a technique to mine explicit information flow
specifications from concrete executions. These specifications
can be consumed by a static taint analysis, enabling static
analysis to work even when method definitions are missing
or portions of the program are too difficult to analyze statically
(e.g., due to dynamic features such as reflection). We
present an implementation of our technique for the Android
platform. When compared to a set of manually written specifications for 309 methods across 51 classes, our technique
is able to recover 96.36% of these manual specifications and
produces many more correct annotations that our manual
models missed. We incorporate the generated specifications
into an existing static taint analysis system, and show that
they enable it to find additional true flows. Although our
implementation is Android-specific, our approach is applicable
to other application frameworks.

We present a technique to mine explicit information flow specifications from concrete executions.... more We present a technique to mine explicit information flow
specifications from concrete executions. These specifications
can be consumed by a static taint analysis, enabling static
analysis to work even when method definitions are missing
or portions of the program are too difficult to analyze statically
(e.g., due to dynamic features such as reflection). We
present an implementation of our technique for the Android
platform. When compared to a set of manually written specifications for 309 methods across 51 classes, our technique
is able to recover 96.36% of these manual specifications and
produces many more correct annotations that our manual
models missed. We incorporate the generated specifications
into an existing static taint analysis system, and show that
they enable it to find additional true flows. Although our
implementation is Android-specific, our approach is applicable
to other application frameworks.

Log In