Several techniques have been proposed to detect vulnerable Spectre gadgets in widely deployed commercial software. Unfortunately, detection techniques proposed so far rely on hand-written rules which fall short in covering subtle variations of known Spectre gadgets as well as demand a huge amount of time to analyze each conditional branch in software. Moreover, detection tool evaluations are based only on a handful of these gadgets, as it requires arduous effort to craft new gadgets manually. In this work, we employ both fuzzing and deep learning techniques to automate the generation and detection of Spectre gadgets. We first create a diverse set of Spectre-V1 gadgets by introducing perturbations to the known gadgets. Using mutational fuzzing, we produce a data set with more than 1 million Spectre-V1 gadgets which is the largest Spectre gadget data set built to date. Next, we conduct the first empirical usability study of Generative Adversarial Networks (GANs) in the context of assembly code generation without any human interaction. We introduce SpectreGAN which leverages masking implementation of GANs for both learning the gadget structures and generating new gadgets. This provides the first scalable solution to extend the variety of Spectre gadgets. Finally, we propose FastSpec which builds a classifier with the generated Spectre gadgets based on a novel high dimensional Neural Embeddings technique (BERT). For the case studies, we demonstrate that FastSpec discovers potential gadgets with a high success rate in OpenSSL libraries and Phoronix benchmarks. Further, FastSpec offers much greater flexibility and time-related performance gain compared to the existing tools and therefore can be used for gadget detection in large-scale software.
翻译:在广泛部署的商业软件中,人们提出了数种技术来探测脆弱的 Spectre 工具。 不幸的是,迄今为止提出的检测技术依靠手写规则,这些规则不足以涵盖已知的 Spectre 工具的微妙变异,还需要大量时间来分析软件中每个有条件的分支。此外,检测工具评价仅仅基于其中的一小部分工具,因为它需要艰苦的努力来手工制作新的工具。在此工作中,我们使用模糊和深层学习技术来自动生成和探测Spectre 工具。我们首先在编译代码时,我们通过向已知的 Gaddget 引入触摸图来创建一套不同的 Spectre- V1 工具。我们使用突变图来制作一套超过100万 Spectre- V1 工具的数据集,因为它是迄今建造的最大的 Spectretaretget 数据集。接下来,我们用General Adal-al Network (GAN) 进行第一次实验性能研究,我们不用任何人文互动,我们先创建一套Speectreal-real 的Speal real real real real lavelations) 。