Junwha Hong

Sanghoon Jung

Taeyeong Hwang

The Software and Systems Security Laboratory addresses software and systems security problems. Research focuses on designing and implementing advanced bug sanitization and mitigation techniques. These techniques protect operating systems and user applications in existing (e.g., mobile or web) and emerging areas (e.g., autonomous driving, drones, or ships) by leveraging compiler-based, fuzzing, and AI techniques. The laboratory is seeking motivated undergraduate/graduate students and postdocs interested in software and system security.

소프트웨어 및 시스템 보안 연구실에서는 소프트웨어 및 시스템 보안 문제 해결에 주력한다. 주요 연구는 고급 버그 제거 및 완화 기술 설계 및 구현에 중점을 두며, 컴파일러 기반, 퍼징 및 AI 기술을 활용하여 기존(예: 모바일 또는 웹) 및 새로운 영역(예: 자율 주행, 드론 또는 선박)에서 운영 체제 및 사용자 애플리케이션을 보호한다. 소프트웨어 및 시스템 보안에 관심 있는 학부/대학원생 및 박사후 연구원을 모집한다.

In-Context Probing for Membership Inference in Fine-Tuned Language Models

Intent-aware Fuzzing for Android Hardened Application

Lightweight Concolic Testing via Path-Condition Synthesis for Deep Learning Libraries

CMASan: Custom Memory Allocator-aware Address Sanitizer

Type++: Prohibiting Type Confusion with Inline Type Information

On the Robustness of Graph Reduction Against GNN Backdoor

ERASAN: Efficient Rust Address Sanitizer

DryJIN: Detecting Information Leaks in Android Applications

Pspray: Timing Side-Channel based Linux Kernel Heap Exploitation Technique

Perfect Spray: A Journey From Finding a New Type of Logical Flaw at Linux Kernel To Developing a New Heap Exploitation Technique

DriveFuzz: Discovering Autonomous Driving Bugs through Driving Quality-Guided Fuzzing

ShadowAuth: Backward-Compatible Automatic CAN Authentication for Legacy ECUs

SwarmFlawFinder: Discovering and Exploiting Logic Flaws of Swarm Algorithms

Certified Malware in South Korea: A Localized Study of Breaches of Trust in Code-Signing PKI Ecosystem

FuZZan: Efficient Sanitizer Metadata Design for Fuzzing

PoLPer: Process-Aware Restriction of Over-Privileged Setuid Calls in Legacy Applications

HexType: Efficient Detection of Type Confusion Errors for C++

TypeSan: Practical Type Confusion Detection

A Distributed Monitoring Architecture for AMIs

LT-OLSR: Attack-Tolerant OLSR against Link Spoofing

TypeSan: Practical type confusion detection

Hextype: Efficient detection of type confusion errors for c++

Drivefuzz: Discovering autonomous driving bugs through driving quality-guided fuzzing

{FuZZan}: Efficient sanitizer metadata design for fuzzing

Pspray: Timing {Side-Channel} based linux kernel heap exploitation technique

Swarmflawfinder: Discovering and exploiting logic flaws of swarm algorithms

LT-OLSR: Attack-tolerant OLSR against link spoofing

A survey of privacy threats and defense in vertical federated learning: From model life cycle perspective

Erasan: Efficient rust address sanitizer

Certified malware in south korea: A localized study of breaches of trust in code-signing PKI ecosystem

ShadowAuth: Backward-compatible automatic CAN authentication for legacy ECUs

Polper: Process-aware restriction of over-privileged setuid calls in legacy applications

On the robustness of graph reduction against GNN backdoor

type++: Prohibiting Type Confusion with Inline Type Information.

LiteRSan: Lightweight memory safety via Rust-specific program analysis and selective instrumentation

CMASan: Custom memory allocator-aware address sanitizer

Dryjin: Detecting information leaks in android applications

Automated blackbox inference of external origin user behavior

Blackbox program privilege flow analysis with inferred program behavior context

Apparatus and method for collecting network data traffic

Yuseok Jeon

The low-level C++ programming language is ubiquitously used for its modularity and performance. Typecasting is a fundamental concept in C++ (and object-oriented programming in general) to convert a pointer from one object type into another. However, downcasting (converting a base class pointer to a derived class pointer) has critical security implications due to potentially different object memory layouts. Due to missing type safety in C++, a downcasted pointer can violate a programmer's intended pointer semantics, allowing an attacker to corrupt the underlying memory in a type-unsafe fashion. This vulnerability class is receiving increasing attention and is known as type confusion (or bad-casting). Several existing approaches detect different forms of type confusion, but these solutions are severely limited due to both high run-time performance overhead and low detection coverage. This paper presents …

Type confusion, often combined with use-after-free, is the main attack vector to compromise modern C++ software like browsers or virtual machines. Typecasting is a core principle that enables modularity in C++. For performance, most typecasts are only checked statically, i.e., the check only tests if a cast is allowed for the given type hierarchy, ignoring the actual runtime type of the object. Using an object of an incompatible base type instead of a derived type results in type confusion. Attackers abuse such type confusion issues to attack popular software products including Adobe Flash, PHP, Google Chrome, or Firefox. We propose to make all type checks explicit, replacing static checks with full runtime type checks. To minimize the performance impact of our mechanism HexType, we develop both low-overhead data structures and compiler optimizations. To maximize detection coverage, we handle specific object …

Autonomous driving has become real; semi-autonomous driving vehicles in an affordable price range are already on the streets, and major automotive vendors are actively developing full self-driving systems to deploy them in this decade. Before rolling the products out to the end-users, it is critical to test and ensure the safety of the autonomous driving systems, consisting of multiple layers intertwined in a complicated way. However, while safety-critical bugs may exist in any layer and even across layers, relatively little attention has been given to testing the entire driving system across all the layers. Prior work mainly focuses on white-box testing of individual layers and preventing attacks on each layer. In this paper, we aim at holistic testing of autonomous driving systems that have a whole stack of layers integrated in their entirety. Instead of looking into the individual layers, we focus on the vehicle states that the …

Fuzzing is one of the most popular and effective techniques for finding software bugs. To detect triggered bugs, fuzzers leverage a variety of sanitizers in practice. Unfortunately, sanitizers target long running experiments—eg, developer test suites—not fuzzing, where execution time is highly variable ranging from extremely short to long. Design decisions made for developer test suites introduce high overhead on short lived fuzzing executions, decreasing the fuzzer’s throughput and thereby reducing effectiveness. The root cause of this sanitization overhead is the heavyweight metadata structure that is optimized for frequent metadata operations over long executions. To address this, we design new metadata structures for sanitizers, and propose FuZZan to automatically select the optimal metadata structure without any user configuration. Our new metadata structures have the same bug detection capabilities as the ones they replace. We implement and apply these ideas to Address Sanitizer (ASan), which is the most popular sanitizer. Our evaluation shows that on the Google fuzzer test suite, FuZZan improves fuzzing throughput over ASan by 48% starting with Google’s provided seeds (52% when starting with empty seeds on the same applications). Due to this improved throughput, FuZZan discovers 13% more unique paths given the same 24 hours and finds bugs 42% faster. Furthermore, FuZZan catches all bugs ASan does; ie, we have not traded precision for performance. Our findings show that sanitizer performance overhead is avoidable when metadata structures are designed for fuzzing, and that the performance difference will have a …

The stealthiness of an attack is the most vital consideration for an attacker to reach their goals without being detected. Therefore, attackers put in a great deal of effort to increase the success rate of attacks in order not to expose information on the attacker and attack attempts resulting from failures. Exploitation of the kernel, which is a prime target for the attacker, usually takes advantage of heap-based vulnerabilities, and these exploits’ success rates fortunately remain low (eg, 56.1% on average) due to the operating principle of the default Linux kernel heap allocator, SLUB. This paper presents PSPRAY, a timing side-channel attackbased exploitation technique that significantly increases the success probability of exploitation. According to our evaluation, with 10 real-world vulnerabilities, PSPRAY significantly improves the success rate of all those vulnerabilities (eg, from 56.1% to 97.92% on average). To prevent this exploitation technique from being abused by the attacker, we further introduce a new defense mechanism to mitigate the threat of PSPRAY. After applying mitigation, the overall success rate of PSPRAY becomes similar to that from before using PSPRAY with negligible performance overhead (0.25%) and memory overhead (0.52%).

Inspired by swarms in nature, swarm robotics have been developed to conduct various challenging tasks such as environmental monitoring, disaster recovery, logistics, and even military operations. Despite the significant potential impact of the swarm on society, relatively little attention is given to adversarial scenarios against swarm robotics. In this paper, we explore a systematic approach to find logical flaws of the swarm robotics algorithms that adversaries can exploit. Specifically, we develop an automated testing system, SWARMFLAWFINDER, for swarm algorithms. We identify and overcome various challenges in understanding and reasoning about the swarm algorithm execution. In particular, we propose a novel abstraction of robotics behavior, which we call the degree of causal contribution (DCC), based on the idea of counterfactual causality. Then, we build a feedback guided greybox fuzz testing system …

Optimized Link State Routing is a routing protocol that has been extensively studied for mobile ad-hoc networks. Link spoofing, which disturbs the routing service, is one of the critical security problems related to the OLSR protocol. Existing approaches against link spoofing attack have several drawbacks. In this paper, we propose an LT-OLSR protocol that broadcasts Hello messages to neighbors within two-hops to defend networks against link spoofing attacks. Simulation and analysis results show that the LT-OLSR protocol tolerates link spoofing attacks extensively. The contributions presented in this paper are as follows: (1) We design a mechanism to ensure the integrity of a routing table. (2) In addition, our approach against link spoofing attack is not only extensive but also compact. (3) Finally, it can be practically implemented under various types of MANET environments.

Vertical Federated Learning (VFL) is a federated learning paradigm where multiple participants, who share the same set of samples but hold different features, jointly train machine learning models. Although VFL enables collaborative machine learning without sharing raw data, it is still susceptible to various privacy threats. In this paper, we conduct the first comprehensive survey of the state-of-the-art in privacy attacks and defenses in VFL. We provide taxonomies for both attacks and defenses, based on their characterizations, and discuss open challenges and future research directions. Specifically, our discussion is structured around the model's life cycle, by delving into the privacy threats encountered during different stages of machine learning and their corresponding countermeasures. This survey not only serves as a resource for the research community but also offers clear guidance and actionable insights for practitioners to safeguard data privacy throughout the model's life cycle.

Rust is a rapidly growing system programming language that ensures a speed comparable to traditional C/C++ system programming languages, along with the additional benefit of guaranteed memory safety. However, Rust’s strict security rules make implementing and executing some features challenging. To address this, Rust has introduced unsafe Rust, which is less constrained by these strict rules. Nevertheless, these unsafe Rust, where strict Rust security rules are not fully applied, can cause temporal and spatial memory bugs that account for 22% of the Rust bugs reported between 2016 and 2023.In this paper, we propose an efficient address sanitizer design customized for Rust, called ERASan, to detect memory bugs in Rust programs more efficiently than prior work. Based on our thorough analysis of safe and unsafe Rust programming language standards as well as memory bugs found in real-world Rust …

Code-signing PKI ecosystems are vulnerable to abusers. Kim et al. reported such abuse cases, e.g., malware authors misused the stolen private keys of the reputable code-signing certificates to sign their malicious programs. This certified malware exploits the chain of the trust established in the ecosystem and helps an adversary readily bypass security mechanisms such as anti-virus engines. Prior work analyzed the large corpus of certificates collected from the wild to characterize the security problems. However, this practice was typically performed in a global perspective and often left the issues that could happen at a local level behind. Our work revisits the investigations conducted by previous studies with a local perspective. In particular, we focus on code-signing certificates issued to South Korean companies. South Korea employs the code-signing PKI ecosystem with its own regional adaptations; thus, it is a …

Controller Area Network (CAN) is the de-facto standard in-vehicle network system. Despite its wide adoption by automobile manufacturers, the lack of security design makes it vulnerable to attacks. For instance, broadcasting packets without authentication allows the impersonation of electronic control units (ECUs). Prior mitigations, such as message authentication or intrusion detection systems, fail to address the compatibility requirement with legacy ECUs, stealthy and sporadic malicious messaging, or guaranteed attack detection. We propose a novel authentication system called ShadowAuth that overcomes the aforementioned challenges by offering backwardcompatible packet authentication to ECUs without requiring ECU firmware source code. Specifically, our authentication scheme provides transparent CAN packet authentication without modifying existing CAN packet definitions (e.g., J1939) via automatic …

Setuid system calls enable critical functions such as user authentications and modular privileged components. Such operations must only be executed after careful validation. However, current systems do not perform rigorous checks, allowing exploitation of privileges through memory corruption vulnerabilities in privileged programs. As a solution, understanding which setuid system calls can be invoked in what context of a process allows precise enforcement of least privileges. We propose a novel comprehensive method to systematically extract and enforce least privilege of setuid system calls to prevent misuse. Our approach learns the required process contexts of setuid system calls along multiple dimensions: process hierarchy, call stack, and parameter in a process-aware way. Every setuid system call is then restricted to the per-process context by our kernel-level context enforcer. Previous approaches without …

Graph Neural Networks (GNNs) have been shown to be susceptible to backdoor poisoning attacks, which pose serious threats to real-world applications. Meanwhile, graph reduction techniques have recently emerged as effective methods for accelerating GNN training on large-scale graphs. However, the development of graph reduction techniques for large graphs does not yet address how these methods might interact with the potential risks of data poisoning attacks against GNNs, particularly in relation to existing backdoor attacks. This paper conducts a thorough examination of the robustness of graph reduction methods in scalable GNN training in the presence of state-of-the-art backdoor attacks. We performed a comprehensive robustness analysis across six coarsening methods and six sparsification methods for graph reduction, under three GNN backdoor attacks against three GNN architectures. Our findings …

Type confusion, or bad casting, is a common C++ attack vector. Such vulnerabilities cause a program to interpret an object as belonging to a different type, enabling powerful attacks, like control-flow hijacking. C++ restricts runtime checks to polymorphic classes because only those have inline type information. The lack of runtime type information throughout an object’s lifetime makes it challenging to enforce continuous checks and thereby prevent type confusion during downcasting. Current solutions either record type information for all objects disjointly, incurring prohibitive runtime overhead, or restrict protection to a fraction of all objects. Our C++ dialect, type++, enforces the paradigm that each allocated object involved in downcasting carries type information throughout its lifetime, ensuring correctness by enabling type checks wherever and whenever necessary. As not just polymorphic objects but all objects are typed, all down-to casts can now be dynamically verified. Compared to existing solutions, our strategy greatly reduces runtime cost and enables type++ usage both during testing and as mitigation. Targeting SPEC CPU2006 and CPU2017, we compile and run 2,040 kLoC, while changing only 314 LoC. To help developers, our static analysis warns where code changes in target programs may be necessary. Running the compiled benchmarks results in negligible performance overhead (1.19% on SPEC CPU2006 and 0.82% on SPEC CPU2017) verifying a total of 90B casts (compared to 3.8 B for the state-ofthe-art, a 23× improvement). type++ discovers 122 type confusion issues in the SPEC CPU benchmarks among which 14 are new …

Rust is a memory-safe language, and its strong safety guarantees combined with high performance have been attracting widespread adoption in systems programming and security-critical applications. However, Rust permits the use of unsafe code, which bypasses compiler-enforced safety checks and can introduce memory vulnerabilities. A widely adopted approach for detecting memory safety bugs in Rust is Address Sanitizer (ASan). Optimized versions, such as ERASan and RustSan, have been proposed to selectively apply security checks in order to reduce performance overhead. However, these tools still incur significant performance and memory overhead and fail to detect many classes of memory safety vulnerabilities due to the inherent limitations of ASan. In this paper, we present LiteRSan, a novel memory safety sanitizer that addresses the limitations of prior approaches. By leveraging Rust's unique ownership model, LiteRSan performs Rust-specific static analysis that is aware of pointer lifetimes to identify risky pointers. It then selectively instruments risky pointers to enforce only the necessary spatial or temporal memory safety checks. Consequently, LiteRSan introduces significantly lower runtime overhead (18.84% versus 152.05% and 183.50%) and negligible memory overhead (0.81% versus 739.27% and 861.98%) compared with existing ASan-based sanitizers while being capable of detecting memory safety bugs that prior techniques miss.

Custom Memory Allocator (CMA) replaces the standard memory allocator for various purposes, such as improving memory efficiency or enhancing security. However, memory objects allocated by CMA are vulnerable to memory bugs similar to those allocated by the standard memory allocator. Unfortunately, existing memory bug detection approaches, including Address Sanitizer (ASan), do not work properly with these CMAs because existing approaches are mainly designed for the standard memory allocator. This paper presents CMASan, the first CMA-aware address sanitizer designed to effectively detect memory bugs on CMA objects that ASan misses without requiring expert knowledge, manual code modifications, or changing the unique internal logic of CMAs. According to our evaluation, CMASan successfully identifies 19 previously unknown CMA memory bugs undetected by ASan, including some …

Android devices, handling sensitive data like call records and text messages, are prone to privacy breaches. Existing information flow tracking systems face difficulties in detecting these breaches due to two main challenges: the multi-layered Android platform using different programming languages (Java and C/C++), and the complex, event-driven execution flow of Android apps that complicates tracking, especially across these language barriers. Our system, DryJIN, addresses this by effectively tracking information flow within and across both Java and native modules. Utilizing symbolic execution for native code data flows and integrating it with Java data flows, DryJIN enhances existing static analysis techniques (Argus-SAF, JuCify, and FlowDroid) to cover previously unaddressed information flow patterns. We validated DryJIN ’s effectiveness through a comprehensive evaluation on over 168k apps, including …

Methods and systems for security analysis include deter mining whether a process has an origin internal to a system or external to the system using a processor based on moni tored behavior events associated with the process. A security analysis is performed on only processes that have an exter nal origin to determine if any of the processes having an external origin represent a security threat. A security action is performed if a process having an external origin is determined to represent a security threat.

(57) ABSTRACT A computer-implemented method for performing privilege flow analysis is presented. The computer-implemented method includes monitoring at least one program operating system (OS) event handled by a program, generating a privilege flow graph, determining an inferred program behavior context, and generating, based on a combination of the privilege flow graph and the inferred program behavior context, an inferred behavior context-aware privilege flow graph to distinguish different roles of processes and/or threads within the program.

The present invention relates to an apparatus and method for collecting network data traffic. The apparatus for collecting network data traffic includes a graph creation unit, an initial ization unit, an edge selection unit, a reconstruction unit, an algorithm application unit and a traffic collection route pro vision unit. The reconstruction unit converts the selected edge into an inactive edge and connects the inactive edge to two nodes, so that the reconstruction unit reconstructs the tree structure. The algorithm application unit applies a minimal spanning tree algorithm to the reconstructed tree structure. The traffic collection route provision unit eliminates a leaf node and a leaf edge from the tree structure to which the minimal spanning tree algorithm has been applied, and gen erates a monitoring tree for providing a traffic collection route minimizing a total weight of the edges.

S2Lab

교수님 소개

전유석

연구실 소개

연구실 키워드

알럼나이가 간 회사

연구실 지원 방법

대우 조건

연도별 논문 인용수

저널 & 학회 논문 출판 수

연구실 논문 목록

In-Context Probing for Membership Inference in Fine-Tuned Language Models

Intent-aware Fuzzing for Android Hardened Application

Lightweight Concolic Testing via Path-Condition Synthesis for Deep Learning Libraries

연구실 보유 특허

대학별 입시끈

우리 연구실 모집

교수님 소개

전유석

연구실 키워드

알럼나이가 간 회사

연구실 지원 방법

대우 조건

연도별 논문 인용수

저널 & 학회 논문 출판 수

연구실 논문 목록

In-Context Probing for Membership Inference in Fine-Tuned Language Models

Intent-aware Fuzzing for Android Hardened Application

Lightweight Concolic Testing via Path-Condition Synthesis for Deep Learning Libraries

연구실 보유 특허

최근 3년간 연구실적 높은 연구실

대학별 입시끈

우리 연구실 모집