MASC: A Tool for Mutation-based Evaluation of Static Crypto-API Misuse Detectors
This program is tentative and subject to change.
While software engineers are optimistically adopting crypto-API misuse detectors (or crypto-detectors) in their software development cycles, this momentum must be accompanied by a rigorous understanding of crypto-detectors’ \textit{effectiveness at finding crypto-API misuses in practice}. This demo paper presents the technical details and usage scenarios of our tool, namely \textbf{M}utation \textbf{A}nalysis for evaluating \textbf{S}tatic \textbf{C}rypto-API misuse detectors (MASC). We developed $12$ generalizable, usage-based mutation operators and three mutation scopes, namely \textit{Main Scope}, \textit{Similarity Scope}, and \textit{Exhaustive Scope}, which can be used to expressively instantiate compilable variants of the crypto-API misuse cases. Using MASC, we evaluated nine major crypto-detectors and discovered $19$ unique, undocumented flaws. We designed MASC to be \textit{configurable} and \textit{user-friendly}; a user can configure the parameters to change the nature of generated mutations. Furthermore, MASC comes with both Command Line Interface and Web-based front-end, making it practical for users of different levels of expertise.
Code: https://github.com/Secure-Platforms-Lab-W-M/MASC
Screencast: https://www.youtube.com/watch?v=XF_qmMaXFXw
This program is tentative and subject to change.
Wed 6 DecDisplayed time zone: Pacific Time (US & Canada) change
14:00 - 15:30 | Security IResearch Papers / Demonstrations / Journal First at Golden Gate C3 Chair(s): Abhik Roychoudhury National University of Singapore | ||
14:00 15mTalk | [Remote] Comparison and Evaluation on Static Application Security Testing (SAST) Tools for Java Research Papers Kaixuan Li East China Normal University, Sen Chen College of Intelligence and Computing, Tianjin University, Lingling Fan College of Cyber Science, Nankai University, Ruitao Feng University of New South Wales, Han Liu East China Normal University, Chengwei Liu Nanyang Technological University, Yang Liu Nanyang Technological University, Yixiang Chen East China Normal University Pre-print | ||
14:15 15mTalk | Can the configuration of static analyses make resolving security vulnerabilities more effective? - A user study Journal First Goran Piskachev Amazon Web Services, Matthias Becker Fraunhofer IEM, Eric Bodden University of Paderborn | ||
14:30 15mTalk | [Remote] Input-driven Dynamic Program Debloating for Code-reuse Attack Mitigation Research Papers Xiaoke Wang Wuhan University, Tao Hui Key Laboratory of Aerospace Information Security and Trusted Computing, Ministry of Education, School of Cyber Science and Engineering, Wuhan University, Lei Zhao Key Laboratory of Aerospace Information Security and Trusted Computing, Ministry of Education, School of Cyber Science and Engineering, Wuhan University, Yueqiang Cheng NIO Pre-print | ||
14:45 7mTalk | MASC: A Tool for Mutation-based Evaluation of Static Crypto-API Misuse Detectors Demonstrations Amit Seal Ami William & Mary, Syed Yusuf Ahmed University of Dhaka, Radowan Mahmud Redoy University of Dhaka, Nathan Cooper William & Mary, Kaushal Kafle College of William & Mary, Kevin Moran University of Central Florida, Denys Poshyvanyk William & Mary, Adwait Nadkarni William & Mary | ||
14:53 7mTalk | [Remote] llvm2CryptoLine: Verifying Arithmetic in Cryptographic C Programs Demonstrations Ruiling Chen Shenzhen University, Jiaxiang Liu Shenzhen University, Xiaomu Shi Institute of Software, Chinese Academy of Sciences, Ming-Hsien Tsai National Institute of Cyber Security, Bow-Yaw Wang , Bo-Yin Yang Academia Sinica | ||
15:00 15mTalk | [Remote] TransRacer: Function Dependence-Guided Transaction Race Detection for Smart Contracts Research Papers Chenyang Ma Nanjing University of Science and Technology, Wei Song Nanjing University of Science and Technology, Jeff Huang Texas A&M University DOI Pre-print | ||
15:15 15mTalk | Software Composition Analysis for Vulnerability Detection: An Empirical Study on Java Projects Research Papers Lida Zhao Singapore Management University, Singapore, Sen Chen College of Intelligence and Computing, Tianjin University, Zhengzi Xu Nanyang Technological University, Chengwei Liu Nanyang Technological University, Lyuye Zhang Nanyang Technological University, Wu Jiahui Nanyang Technological University, Jun Sun Singapore Management University, Yang Liu Nanyang Technological University | ||