Detecting latent cross-platform API violations

Rasley, Jeff; Gessiou, Eleni; Ohmann, Tony; Brun, Yuriy; Krishnamurthi, Shriram; Cappos, Justin

doi:10.1109/issre.2015.7381841

Cited by 3 publications

(2 citation statements)

References 53 publications

(42 reference statements)

Supporting

Mentioning

Contrasting

Order By: Relevance

“…When the p-value is very low (0.05 or 0.01), the experimenter will only observe this error 5% or 1% of the time. Before applying the appropriate statistical test, 2 , the experimenter selects an appropriate significance level called α, which is also a very low probability (0.10, 0.05, or 0.01). α is the experimenter's threshold for statistical significance: the test is statistically significant if the produced p-value ≤ α.…”

Section: Methodsmentioning

confidence: 99%

“…Unpredictability in OS behavior can cause bugs and security vulnerabilities in applications. These bugs or vulnerabilities can arise from: (i) different ways OSes handle network events and protocols [1], and (ii) subtle and undocumented differences in the behavior of common APIs across different platforms [2] and from OS changes over time. Further, the OS can be buggy or malicious, which breaks the predictability assumption.…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Bear: A Framework for Understanding Application Sensitivity to OS (Mis) Behavior

Sun

Lee

Chen

et al. 2016

2016 IEEE 27th International Symposium on Software Reliability Engineering (ISSRE)

View full text Add to dashboard Cite

Abstract-Applications are generally written assuming a predictable and well-behaved OS. In practice, they experience unpredictable misbehavior at the OS level and across OSes: different OSes can handle network events differently, APIs can behave differently across OSes, and OSes may be compromised or buggy. This unpredictability is challenging because its sources typically manifest during deployment and are hard to reproduce. This paper introduces Bear, a framework for statistical analysis of application sensitivity to OS unpredictability that can help developers build more resilient software, discover challenging bugs and identify the scenarios that most need validation. Bear analyzes a program with a set of perturbation strategies on a set of commonly used system calls in order to discover the most sensitive system calls for each application, the most impactful strategies, and how they predict abnormal program outcome. We evaluated Bear with 113 CPU and IO-bound programs, and our results show that null memory dereferencing and erroneous buffer operations are the most impactful strategies for predicting abnormal program execution and that their impacts increase tenfold with workload increase (e.g. number of network requests from 10 to 1000). Generic system calls are more sensitive than specialized system calls-for example, write and sendto can both be used to send data through a socket, but the sensitivity of write is twice that of sendto. System calls with an array parameter (e.g. read) are more sensitive to perturbations than those having a struct parameter with a buffer (e.g readv).Moreover, the fewer parameters a system call has, the more sensitive it is.

show abstract

Section: Methodsmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%