Search

Context: Sensitive information such as passwords often leaks inadvertently because of implementation defects.Objective: Our objective is to use dynamic techniques to prevent information leakage before it occurs. We also aim to develop techniques that incur low overheads, and are safe in the presence of aliasing.Method: We use a dynamic approach to track secret values and safe locations. We assume that programs have annotations which identify values and locations that need to be protected against disclosure. We instrument a program with statements that record relevant values and locations and assertions to relevant assignments to determine if they leak information. At run-time the values being assigned to unsafe locations are analysed. If a particular assignment leads to information leakage an assertion violation is triggered. We evaluate our approach by experimentation which uses our prototype implementation for C programs to analyse security-oriented UNIX utilities and programs chosen from the SPEC CPU datasets.Results: Our experiments show that the overhead to detect problems such as password disclosure in real software does not exceed 1%. The overheads associated with detection of CWE security vulnerabilities in real applications are still acceptable; however, tracking a large number of values incurs higher overheads (over 10 times in certain cases).Conclusion: Our dynamic approach to detecting information leaks can be used in various contexts. For a program that tracks only a limited number of values the overhead is marginal. Thus, our instrumentation can be used in release versions. However, if an application has a large number of secret values, our technique is useful in a testing phase. The overheads in this case are too high for a real use, but still within an acceptable range to be used for detection of potential leaks during testing.

SESSION TITLE: Fellows Critical Care Posters SESSION TYPE: Fellow Case Report Posters PRESENTED ON: October 18-21, 2020 INTRODUCTION: Tracheoesophageal fistula (TEF) can present as either congenital or acquired abnormality Acquired TEF is usually secondary to malignant tumors Prolonged mechanical ventilation with cuff related injury leading to a non-malignant TEF usually presents post extubation although it has become rare with the introduction of high-volume low-pressure cuffs(1) Occurrence of TEF & its early identification in a mechanically ventilated patient is of critical importance to prevent severe ventilator inefficiency, sepsis and compromised nutrition Here we present a case of TEF presenting in a ventilator dependent patient CASE PRESENTATION: A 69 year old female with past medical history of diabetes and hypertension presented with hypoxemic respiratory failure due to COVID-19 pneumonia requiring mechanical ventilation Course was complicated by methicillin resistant Staphylococcus aureus (MRSA) bacteremia treated with intravenous Vancomycin After 3 weeks of mechanical ventilation, surgical tracheostomy was performed One week later, she developed tracheostomy site MRSA infection Two weeks later, the patient developed sudden severe abdominal distension and tachypnea with higher oxygen requirements Abdominal x-ray showed severely distended bowel loops which improved with orogastric (OG) tube suctioning but recurred when it was turned off (fig 1) The ventilator volume graphs revealed a large air leak despite an adequately inflated cuff and the external tip of the OG tube under water showed continuous bubbling Above findings raised suspicion of TEF which was confirmed by CT imaging (fig 2) As patient was unstable for surgical intervention, the regular tracheostomy tube replaced with an extended length (XLT) tracheostomy tube which led to resolution of air leak DISCUSSION: Acquired TEF can occur in the setting of prolonged mechanical ventilation, indwelling tracheal or esophageal stents, mediastinal infections and trauma or iatrogenic injuries Common presenting complaint is persistent cough upon food consumption post extubation It is a rare complication occurring in less than 1% of patients undergoing tracheostomy In ventilator dependent patients, presenting signs include persistent air leak even with a fully inflated cuff, abdominal distension and airway contamination with gastric contents(2) Endoscopy is considered the best diagnostic method, though small TEFs may be missed in the esophageal folds Bronchoscopy with methylene blue installation identifies the defect better Imaging with CT/MRI is preferred in ventilator dependent patients The mainstay of treatment of TEF in ventilated patients is usually conservative management with XLT tracheostomy tube or esophageal stenting CONCLUSIONS: TEF is a rare complication Acute bowel distension with a large continuous air leak on the ventilator & through OG tube (bubbling underwater), despite a fully inflated cuff should raise clinical suspicion Reference #1: 1 Reed MF, Mathisen DJ Tracheoesophageal fistula Chest Surg Clin N Am 2003;13(2):271-289 doi:10 1016/s1052-3359(03)00030-9 Reference #2: 2 Paraschiv M Tracheoesophageal fistula–a complication of prolonged tracheal intubation J Med Life 2014;7(4):516-521 DISCLOSURES: No relevant relationships by padmanabhan krishnan, source=Web Response No relevant relationships by Chetana Pendkar, source=Web Response No relevant relationships by Sumedha Sonde, source=Web Response No relevant relationships by Nishanth Vallumsetla, source=Web Response

Parfait [1] is a static analysis tool originally developed to find implementation defects in C/C++ systems code. Parfait's focus is on proving both high precision (low false positives) as well as scaling to systems with millions of lines of code (typically requiring ~10 minutes of analysis time per million lines). Parfait has since been extended to detect security vulnerabilities in applications code, supporting the Java EE and PL/SQL server stack. In this abstract we describe some of the challenges we encountered in this process including some of the differences seen between the applications code being analysed, our solutions that enable us to analyse a variety of applications, and a summary of the challenges that remain.

Although examples of variation and diversity exist throughout the nervous system, their importance remains a source of debate. Even neurons of the same molecular type have notable intrinsic differences. Largely unknown, however, is the degree to which these differences impair or assist neural coding. We examined the outputs from a single type of neuron, the mitral cells of the mouse olfactory bulb, to identical stimuli and found that each cell's spiking response was dictated by its unique biophysical fingerprint. Using this intrinsic heterogeneity, diverse populations were able to code for twofold more information than their homogeneous counterparts. In addition, biophysical variability alone reduced pair-wise output spike correlations to low levels. Our results indicate that intrinsic neuronal diversity is important for neural coding and is not simply the result of biological imprecision.

In this position paper we describe how mutation testing can be used to evaluate the quality of test suites from a security viewpoint. Our focus is on measuring the quality of the test suite associated with the Java Development Kit (JDK) because it provides the core security properties for all applications. We describe the challenges associated with identifying security-specific mutation operators that are specific to the Java model and ensuring that our solution can be automated for large code-bases like the JDK.

Points-to analysis is a fundamental static program analysis technique for tools including compilers and bug-checkers. Although object-based context sensitivity is known to improve precision of points-to analysis, scaling it for large Java codebases remains a challenge. In this work, we develop a tunable, client-independent, object-sensitive points-to analysis framework where heap cloning is applied selectively. This approach is aimed at large codebases where standard analysis is typically expensive. Our design includes a pre-analysis that determines program points that contribute to the cost of an object-sensitive points-to analysis. A subsequent analysis then determines the context depth for each allocation site. While our framework can run standalone, it is also possible to tune it – the user of the framework can use the knowledge of the codebase being analysed to influence the selection of expensive program points as well as the process to differentiate the required context-depth. Overall, the approach determines where the cloning is beneficial and where the cloning is unlikely to be beneficial. We have implemented our approach using Souffle (a Datalog compiler) and an extension of the DOOP framework. Our experiments on large programs, including OpenJDK, show that our technique is efficient and precise. For the OpenJDK, our analysis reduces 27% of runtime and 18% of memory usage in comparison with 2O1H points-to analysis for a negligible loss of precision, while for Jython from the DaCapo benchmark suite, the same analysis reduces 91% of runtime for no loss of precision.

Programming languages such as Java and C# execute code with different levels of trust in the same process, and rely on an access control model with fine-grained permissions to protect program code. Permissions are checked programmatically, and rely on programmer discipline. This can lead to subtle errors. To enable automatic security analysis about unauthorised access or information flow, it is necessary to reason about security-sensitive entities in libraries that must be protected by appropriate sanitisation/declassification via permission checks. Unfortunately, security-sensitive entities are not clearly identified. In this paper, we investigate security-sensitive entities used in Java-like languages, and develop a static program analysis technique to identify them in large codebases by analysing the patterns of permission checks. Although the technique is generic, our focus is on Java where checkPermission calls are used to guard potential security-sensitive entities. Our inference analysis uses two parameters called proximity and coverage to reduce false-positive and false-negative reports. The usefulness of the analysis is illustrated by the results obtained while checking the OpenJDK7-b147 for conformance to Java Secure Coding Guidelines that relate to the confidentiality and integrity requirements.

Static program analysis is a technique to analyse code without executing it, and can be used to find bugs in source code. Many open source and commercial tools have been developed in this space over the past 20 years. Scalability and precision are of importance for the deployment of static code analysis tools - numerous false positives and slow runtime both make the tool hard to be used by development, where integration into a nightly build is the standard goal. This requires one to identify a suitable abstraction for the static analysis which is typically a manual process and can be expensive. In this paper we report our findings on using machine learning techniques to detect defects in C programs. We use three offthe- shelf machine learning techniques and use a large corpus of programs available for use in both the training and evaluation of the results. We compare the results produced by the machine learning technique against the Parfait static program analysis tool used internally at Oracle by thousands of developers. While on the surface the initial results were encouraging, further investigation suggests that the machine learning techniques we used are not suitable replacements for static program analysis tools due to low precision of the results. This could be due to a variety of reasons including not using domain knowledge such as the semantics of the programming language and lack of suitable data used in the training process.

Concurrency in data structures is crucial to the performance of multithreaded programs in shared-memory multiprocessor environments. However, greater concurrency also increases the difficulty of verifying correctness of the data structure. Model checking has been used for verifying concurrent data structures satisfy the correctness condition ‘linearizability’. In particular, ‘automatic’ tools achieve verification without requiring user-specified linearization points. This has several advantages, but is generally not scalable. We examine the automatic checking used by Vechev et al. in their 2009 work to understand the scalability issues of automatic checking in SPIN. We then describe a new, more scalable automatic technique based on these insights, and present the results of a proof-of-concept implementation.

The aim of this book chapter is to generate 3D models of different Thin Dual or Quad Leadless Moulded IC packages and conduct multiphysics based finite element analyses to evaluate the static reliability of IC packages. The performance analyses using die shear, thermal experiments and finite element analysis were conceived and conducted to evaluate the reliability of these packages. Reliability plays a major role at every stage in the manufacturing, testing and use of integrated circuit packages. The coupled influence of operating voltages and joule heating on the mechanical reliability of ICs is discussed here. Die shear tests were conducted on the ICs and the shear strength compared with the values obtained from the finite element results. Thermal tests were carried out on the ICs that were later inspected under a Scanning Acoustic Microscope (SAM) for delaminations arising from hygrothermal stresses. Finally the results of the electro-hygrothermo-mechanical analyses were analyzed and presented at the maximum operating temperature (MOT) that highlight the overall static reliability of the ICs with acceptable factors of safety. The main objective of this investigation is the construction of the failure envelopes through determination of the maximum operating temperatures and test temperatures of the ICs that aid in the evaluation of the overall static reliability of the ICs.

Fatty acid composition of dietary fat plays a vital role in colon tumor development in animal models. Fats containing ω-6 fatty acids (e.g., corn oil) enhanced and ω-3 fatty acids (e.g., flaxseed oil) reduced chemically induced colon tumor development in rats. The objective of the present investigation was to study the effects of dietary canola oil, a source of ω-3 fatty acid on azoxymethane-induced colon cancer development in Fischer rats and compare with dietary corn oil. Dietary canola oil significantly (P

Test automation faces challenges when applied to the testing of asynchronous systems. Automated testing tools need to deal with local non-determinism and, contrarily to most theoretical work, imperfect communication channels. We use event structures as the formalism to reason about the testing process. We differentiate between controllable and observable events but rely only on the sequence of controllable events to generate the test case. Observable events are used mainly as test oracle and to update the system state. We take existing testing tools and enhance them with practical mechanisms that allow them to perform asynchronous testing. These extensions are based on sound theory and have shown practical in dealing with real systems.

Treatment of hypotension caused by calcium channel blocker overdose (CCB) remains a challenge. We describe the successful use of vasopressin in two patients with massive CCB overdoses in whom hypotension was unresponsive to calcium, glucagon, insulin, and conventional vasopressor therapies. While various modes of treatments have been used to treat the hypotension of CCB overdose, this is the first report to our knowledge of the successful use of vasopressin in this clinical setting.

Static program analysis has many applications including bug checking for large scale code that requires a points-to analysis. To express static program analysis frameworks concisely, it is advantageous to employ a domain-specific language. In the last two decades, Data log has emerged as a domain-specific language for static program analysis. However, existing Data log systems have problems solving large scale code with millions of program variables. This work reports on techniques that translate a Data log program to SQL queries, which are executed on a relational database system. The advantage of a relational database system as an execution platform is the effective use of memory and disks. Further, we can also use an off-the shelf tool to execute the SQL queries. In order to achieve performance, we explore some of the design choices for a source-to-source translation from Data log to SQL that implement stratified negations, totally ordered domains, and comparisons. For each design point, we explain how Data log can be efficiently translated to SQL using the semi-naive evaluation approach. We report the results of our experiments using large data-sets including the OpenJDK7-b147 dataset for points-to, which guided us in the design of our translation schemes.

The predominant work in static program analysis is focused on whole program analysis assuming that the whole program is present at analysis time and the only unknowns are program inputs. However, for library designers it is of paramount importance to perform semantic checks via static program analysis tools without the presence of an application. The literature offers only little research on partial program analysis for object-oriented programming languages including Java. Analyzing libraries statically requires novel abstractions for all possible applications that are not known a-priori. In this work, we present a static program analysis technique that reasons about the state of the library by approximating the behaviour of all possible applications. The key contribution is (1) the combination of type-analysis with points-to analysis and (2) the development of a most-general application (MGA) as a type, which represents the interaction of the library with all possible applications.

In this paper we propose a mechanism called specification for monitoring (SFM) to specify runtime monitoring of programs at a high level, and an abstract API showing how to implement the monitor. SFM enables users to separate the semantic issues related to monitoring and implementation details. This results in compact specifications as the implementation details are delegated to the implementation of the API. We present several specifications to demonstrate that SFM is capable of addressing problems related to runtime fault detection at different levels of abstraction.

A method, system, and computer-readable medium (CRM) for performing a staged points-to analysis of an object-oriented codebase, including obtaining the codebase and a points-to query, slicing the codebase to obtain a program slice, and performing a type analysis of the program slice to compute a type set. The method, system, and CRM include refining the program slice, after performing the type analysis, by resolving virtual dispatch sites based on the type set, and performing, after refining the program slice, a context-insensitive points-to analysis of the program slice to compute a first points-to set. The method, system, and CRM include re-refining the program slice, after performing the context-insensitive points-to analysis, by resolving the virtual dispatch sites based on the first points-to set, and performing, after re-refining the program slice, a context-sensitive points-to analysis of the program slice to compute a second points-to set, which is provided to a developer.

This paper presents a technique for defect detection in large code bases called model-based analysis. It incorporates ideas and techniques from program analysis and model checking. Model checking, while very precise, is unable to handle large code bases that are in the millions of lines of code. Thus we create a number of abstract programs from the large code base which can all be model checked. In order to create these abstract programs, we first identify potential defects quickly via static analysis. Second we create a program slice containing one potential defect. Each slice is then abstracted using a combination of automatic data and predicate abstraction. This abstracted model is then model checked to verify the existence or absence of the defect. By applying model checking to a large number of small models instead of one single large model makes our approach scalable without compromising on precision.

Recent interest has emerged on the role of intrinsic biophysical diversity in neuronal coding. An important question in neurophysiology is understanding which voltage-gated ion channels are responsible for this diversity and how variable expression or activity of one class of ion channels across neurons of a single type affects they way populations carry information. In mitral cells in the olfactory bulb of mice, we found that biophysical diversity was conferred in part by 4-aminopyridine (4-AP)-sensitive potassium channels and reduced following block of those channels. When populations of mitral cells were stimulated with identical inputs, the diversity exhibited in their output spike patterns reduced with the addition of 4-AP, decreasing the stimulus information carried by ensembles of 15 neurons from 437 ± 15 to 397 ± 19 bits/s. Decreases in information were due to reduction in the diversity of population spike patterns generated in response to different features of the stimulus, suggesting that the coding capacity of a population can be altered by changes in the function of single ion channel types.

The last decade has seen the emergence of mobile platform for software applications. An important factor in the remarkable growth in this area is the development of Android and a community of mobile application developers sharing open sourced and free software. While the emphasis for Android has been openness and user control, this brings with it challenges of validating and securing mobile apps. Development of dedicated tools and techniques to test mobile apps for functional and nonfunctional properties has been limited so far. Such an effort is made more difficult given frequent version updates for Android in its short history over ten in ten years. The need for better security and assurance for mobile apps, on the other hand, is ever so more as apps providing important services such as banking, navigation, and identity management emerge. This paper attempts to converge on current concepts and practices of testing mobile apps. We provide a structured checklist approach to vulnerability assessment and permission mapping of mobile apps, which is underpinned by a set of available tools, and ultimately contribute to a framework for certification of mobile apps. The proposed certification process combines diverse sources and has a focus on automation.

In the {single rent-to-buy decision} problem, without a priori knowledge of the amount of time a resource will be used we need to decide when to buy the resource, given that we can rent the resource for \$1 per unit time or buy it once and for all for \$$c$. In this paper we study algorithms that make a sequence of single rent-to-buy decisions, using the assumption that the resource use times are independently drawn from an unknown probability distribution. Our study of this rent-to-buy problem is motivated by important systems applications, specifically, problems arising from deciding when to spindown disks to conserve energy in mobile computers~[DKM, LKH, MDK], thread blocking decisions during lock acquisition in multiprocessor applications~[KLM], and virtual circuit holding times in IP-over-ATM networks~[KLP, SaK]. We develop a provably optimal and computationally efficient algorithm for the rent-to-buy problem and evaluate its practical merit for the disk spindown scenario via simulation studies. Our algorithm uses $O(\sqrt{t})$ time and space, and its expected cost for the $t$th resource use converges to optimal as $O(\sqrt{\log t/t})$, for any bounded probability distribution on the resource use times. Alternatively, using $O(1)$ time and space, the algorithm almost converges to optimal. We describe the results of simulating our algorithm for the disk spindown problem using disk access traces obtained from an HP workstation environment. We introduce the natural notion of {\em effective cost\/} which merges the effects of energy conservation and response time performance into one metric based on a user specified parameter~$a$, the relative importance of response time to energy conservation. (The buy cost~$c$ varies linearly with~$a$.) We observe that by varying~$a$, we can model the tradeoff between power and response time well. We also show that our algorithm is best in terms of effective cost for almost all values of~$a$, saving effective cost by 6--25\% over the optimal online algorithm in the competitive model~(i.e., the 2-competitive algorithm that spins down the disk after waiting~$c$ seconds). In addition, for small values of~$a$ (corresponding to when saving energy is critical), our algorithm when compared against the optimal online algorithm in the competitive model reduces excess energy by 17--60\%, and when compared against the 5~second threshold reduces excess energy by 6--42\%.

In this paper we develop a theory for timed systems which relate to time granularity. We use the well known equivalence of bisimulation to study the effect of changing granularity. We identify situations where measuring time more accurately has no effect on the equivalence. Similarly we also present a few situations where measuring time less accurately has no effect on the equivalence. We also present properties of the situations where the semantics is indeed altered by a change in time granularity.

Semi-autonomous vehicles are increasingly serving critical functions in various settings from mining to logistics to defence. A key characteristic of such systems is the presence of the human (drivers) in the control loop. To ensure safety, both the driver needs to be aware of the autonomous aspects of the vehicle and the automated features of the vehicle built to enable safer control. In this paper we propose a framework to combine empirical models describing human behaviour with the environment and system models. We then analyse, via model checking, interaction between the models for desired safety properties. The aim is to analyse the design for safe vehicle-driver interaction. We demonstrate the applicability of our approach using a case study involving semi-autonomous vehicles where the driver fatigue are factors critical to a safe journey., Comment: In Proceedings FTSCS 2012, arXiv:1212.6574

Cell-to-cell variability in molecular, genetic, and physiological features is increasingly recognized as a critical feature of complex biological systems, including the brain. Although such variability has potential advantages in robustness and reliability, how and why biological circuits assemble heterogeneous cells into functional groups is poorly understood. Here, we develop analytic approaches toward answering how neuron-level variation in intrinsic biophysical properties of olfactory bulb mitral cells influences population coding of fluctuating stimuli. We capture the intrinsic diversity of recorded populations of neurons through a statistical approach based on generalized linear models. These models are flexible enough to predict the diverse responses of individual neurons yet provide a common reference frame for comparing one neuron to the next. We then use Bayesian stimulus decoding to ask how effectively different populations of mitral cells, varying in their diversity, encode a common stimulus. We show that a key advantage provided by physiological levels of intrinsic diversity is more efficient and more robust encoding of stimuli by the population as a whole. However, we find that the populations that best encode stimulus features are not simply the most heterogeneous, but those that balance diversity with the benefits of neural similarity.