Section: New Results

Leakage Analysis

Participants : Matteo Zanioli [Correspondent] , Pietro Ferrara [ETH, Zurich] , Agostino Cortesi [Università Ca' Foscari] .

Abstract interpretation, Information leakage analysis, Object-oriented software, Static analysis.

In [28] , we present Sails , a new tool that combines Sample , a generic static analyzer, and a sophisticated domain for leakage analysis. This tool does not require to modify the original language, since it works with mainstream languages like Java ™, and it does not require any manual annotation. Sails can combine the information leakage analysis with different heap abstractions, inferring information leakage over programs with complex data structures. Sails has been applied to the analysis of the SecuriBench-micro suite. The experimental results underline the effectiveness of the analysis, since Sails is in position to analyze several benchmarks in about 1 second without producing false alarms in more than 90% of the programs.