arXiv subjects

Ya Xiao

Publications and source records attributed to Ya Xiao.

At least 37 records · Page 2Linked to original sources

arXiv2021

Evaluation of Static Vulnerability Detection Tools with Java Cryptographic API Benchmarks

Several studies showed that misuses of cryptographic APIs are common in real-world code (e.g., Apache projects and Android apps). There exist several open-sourced and commercial security tools that automatically screen Java programs to detect misuses. To compare their accuracy and security guarantees, we develop two comprehensive benchmarks named CryptoAPI-Bench and ApacheCryptoAPI-Bench. CryptoAPI-Bench consists of 181 unit test cases that cover basic cases, as well as complex cases, including interprocedural, field sensitive, multiple class test cases, and path sensitive data flow of misuse cases. The benchmark also includes correct cases for testing false-positive rates. The ApacheCryptoAPI-Bench consists of 121 cryptographic cases from 10 Apache projects. We evaluate four tools, namely, SpotBugs, CryptoGuard, CrySL, and Coverity using both benchmarks. We present their performance and comparative analysis. The ApacheCryptoAPI-Bench also examines the scalability of the tools. Our benchmarks are useful for advancing state-of-the-art solutions in the space of misuse detection.

cs.CR↗

arXiv2021

Sharing quantum steering among multiple Alices and Bobs via a two-qubit Werner state

Quantum steering, a type of quantum correlation with unique asymmetry, has important applications in asymmetric quantum information tasks. We consider a new quantum steering scenario in which one half of a two-qubit Werner state is sequentially measured by multiple Alices and the other half by multiple Bobs. We find that the maximum number of Alices who can share steering with a single Bob increases from 2 to 5 when the number of measurement settings $N$ increases from 2 to 16. Furthermore, we find a counterintuitive phenomenon that for a fixed $N$, at most 2 Alices can share steering with 2 Bobs, while 4 or more Alices are allowed to share steering with a single Bob. We further analyze the robustness of the steering sharing by calculating the required purity of the initial Werner state, the lower bound of which varies from 0.503(1) to 0.979(5). Finally, we show that our both-sides sequential steering sharing scheme can be applied to control the steering ability, even the steering direction, if an initial asymmetric state or asymmetric measurement is adopted. Our work gives insights into the diversity of steering sharing and can be extended to study the problems such as genuine multipartite quantum steering when the sequential unsharp measurement is applied.

quant-ph↗

arXiv2021

Widening the sharpness modulation region of an entanglement-assisted sequential quantum random access code: Theory, experiment, and application

The sequential quantum random access code (QRAC) allows two or more decoders to obtain a desired message with higher success probability than the best classical bounds by appropriately modulating the measurement sharpness. Here, we propose an entanglement-assisted sequential QRAC protocol which can enable device-independent tasks. By relaxing the equal sharpness and mutually unbiased measurement limits, we widen the sharpness modulation region from a one-dimensional interval to a two-dimensional triangle. Then, we demonstrate our scheme experimentally and get more than 27 standard deviations above the classical bound even when both decoders perform approximately projective measurements. We use the observed success probability to quantify the connection among sequential QRAC, measurement sharpness, measurement biasedness, and measurement incompatibility. Finally, we show that our protocol can be applied to sequential device-independent randomness expansion and our measurement strategy can enhance the success probability of decoding the entire input string. Our results may promote a deeper understanding of the relationship among quantum correlation, quantum measurement, and quantum information processing.

quant-ph↗

arXiv2021

Embedding Code Contexts for Cryptographic API Suggestion:New Methodologies and Comparisons

Despite recent research efforts, the vision of automatic code generation through API recommendation has not been realized. Accuracy and expressiveness challenges of API recommendation needs to be systematically addressed. We present a new neural network-based approach, Multi-HyLSTM for API recommendation --targeting cryptography-related code. Multi-HyLSTM leverages program analysis to guide the API embedding and recommendation. By analyzing the data dependence paths of API methods, we train embedding and specialize a multi-path neural network architecture for API recommendation tasks that accurately predict the next API method call. We address two previously unreported programming language-specific challenges, differentiating functionally similar APIs and capturing low-frequency long-range influences. Our results confirm the effectiveness of our design choices, including program-analysis-guided embedding, multi-path code suggestion architecture, and low-frequency long-range-enhanced sequence learning, with high accuracy on top-1 recommendations. We achieve a top-1 accuracy of 91.41% compared with 77.44% from the state-of-the-art tool SLANG. In an analysis of 245 test cases, compared with the commercial tool Codota, we achieve a top-1 recommendation accuracy of 88.98%, which is significantly better than Codota's accuracy of 64.90%. We publish our data and code as a large Java cryptographic code dataset.

cs.SE↗

arXiv2021

Data-Driven Vulnerability Detection and Repair in Java Code

Java platform provides various APIs to facilitate secure coding. However, correctly using security APIs is usually challenging for developers who lack cybersecurity training. Prior work shows that many developers misuse security APIs; such misuses can introduce vulnerabilities into software, void security protections, and present security exploits to hackers. To eliminate such API-related vulnerabilities, this paper presents SEADER -- our new approach that detects and repairs security API misuses. Given an exemplar, insecure code snippet, and its secure counterpart, SEADER compares the snippets and conducts data dependence analysis to infer the security API misuse templates and corresponding fixing operations. Based on the inferred information, given a program, SEADER performs inter-procedural static analysis to search for any security API misuse and to propose customized fixing suggestions for those vulnerabilities. To evaluate SEADER, we applied it to 25 code pairs, and SEADER successfully inferred 18 unique API misuse templates and related fixes. With these vulnerability repair patterns, we further applied SEADER to 10 open-source projects that contain in total 32 known vulnerabilities. Our experiment shows that SEADER detected vulnerabilities with 100% precision, 84% recall, and 91% accuracy. Additionally, we applied SEADER to 100 Apache open-source projects and detected 988 vulnerabilities; SEADER always customized repair suggestions correctly. Based on SEADER's outputs, we filed 60 pull requests. Up till now, developers of 18 projects have offered positive feedbacks on SEADER's suggestions. Our results indicate that SEADER can effectively help developers detect and fix security API misuses. Whereas prior work either detects API misuses or suggests simple fixes, SEADER is the first tool to do both for nontrivial vulnerability repairs.

cs.CR↗

arXiv2021

Deep Learning-Based Anomaly Detection in Cyber-Physical Systems: Progress and Opportunities

Anomaly detection is crucial to ensure the security of cyber-physical systems (CPS). However, due to the increasing complexity of CPSs and more sophisticated attacks, conventional anomaly detection methods, which face the growing volume of data and need domain-specific knowledge, cannot be directly applied to address these challenges. To this end, deep learning-based anomaly detection (DLAD) methods have been proposed. In this paper, we review state-of-the-art DLAD methods in CPSs. We propose a taxonomy in terms of the type of anomalies, strategies, implementation, and evaluation metrics to understand the essential properties of current methods. Further, we utilize this taxonomy to identify and highlight new characteristics and designs in each CPS domain. Also, we discuss the limitations and open problems of these methods. Moreover, to give users insights into choosing proper DLAD methods in practice, we experimentally explore the characteristics of typical neural models, the workflow of DLAD methods, and the running performance of DL models. Finally, we discuss the deficiencies of DL approaches, our findings, and possible directions to improve DLAD methods and motivate future research.

cs.CR↗

arXiv2020

Methodologies for Quantifying (Re-)randomization Security and Timing under JIT-ROP

Just-in-time return-oriented programming (JIT-ROP) allows one to dynamically discover instruction pages and launch code reuse attacks, effectively bypassing most fine-grained address space layout randomization (ASLR) protection. However, in-depth questions regarding the impact of code (re-)randomization on code reuse attacks have not been studied. For example, how would one compute the re-randomization interval effectively by considering the speed of gadget convergence to defeat JIT-ROP attacks?; how do starting pointers in JIT-ROP impact gadget availability and gadget convergence time?; what impact do fine-grained code randomizations have on the Turing-complete expressive power of JIT-ROP payloads? We conduct a comprehensive measurement study on the effectiveness of fine-grained code randomization schemes, with 5 tools, 20 applications including 6 browsers, 1 browser engine, and 25 dynamic libraries. We provide methodologies to measure JIT-ROP gadget availability, quality, and their Turing-complete expressiveness, as well as to empirically determine the upper bound of re-randomization intervals in re-randomization schemes using the Turing-complete (TC), priority, MOV TC, and payload gadget sets. Experiments show that the upper bound ranges from 1.5 to 3.5 seconds in our tested applications. Besides, our results show that locations of leaked pointers used in JIT-ROP attacks have no impacts on gadget availability, but have an impact on how fast attackers find gadgets. Our results also show that instruction-level single-round randomization thwarts current gadget finding techniques under the JIT-ROP threat model.

cs.CR↗

arXiv2019

Neural Cryptanalysis: Metrics, Methodology, and Applications in CPS Ciphers

Many real-world cyber-physical systems (CPS) use proprietary cipher algorithms. In this work, we describe an easy-to-use black-box security evaluation approach to measure the strength of proprietary ciphers without having to know the algorithms. We quantify the strength of a cipher by measuring how difficult it is for a neural network to mimic the cipher algorithm. We define new metrics (e.g., cipher match rate, training data complexity and training time complexity) that are computed from neural networks to quantitatively represent the cipher strength. This measurement approach allows us to directly compare the security of ciphers. Our experimental demonstration utilizes fully connected neural networks with multiple parallel binary classifiers at the output layer. The results show that when compared with round-reduced DES, the security strength of Hitag2 (a popular stream cipher used in the keyless entry of modern cars) is weaker than 3-round DES.

cs.CR↗

arXiv2019

Experimental Simultaneous Learning of Multiple Non-Classical Correlations

Non-classical correlations can be regarded as resources for quantum information processing. However, the classification problem of non-classical correlations for quantum states remains a challenge, even for finite-size systems. Although there exists a set of criteria for determining individual non-classical correlations, a unified framework that is capable of simultaneously classifying multiple correlations is still missing. In this work, we experimentally explored the possibility of applying machine-learning methods for simultaneously identifying non-classical correlations. Specifically, by using partial information, we applied artificial neural networks, support vector machines, and decision trees for learning entanglement, quantum steering, and non-locality. Overall, we found that for a family of quantum states, all three approaches can achieve high accuracy for the classification problem. Moreover, the run time of the machine-learning methods to output the state label is experimentally found to be significantly less than that of state tomography.

quant-ph↗

arXiv2019

Zonal reconstruction of photonic wavefunction via momentum weak measurement

Direct measurement of wave functions has attracted great interests and many different methods have been developed. However, the precision of current techniques is limited by the use of Fourier transform lenses. These measurements require to shear cut the part of particles with momentum P=0, which greatly restricts the efficiency and application of the approaches. Here, we propose and experimentally demonstrate a method to directly measure two-dimensional photonic wave functions by combining the momentum weak measurement technology and the zonal wavefront restoration algorithm. Both the Gaussian and Laguerre-Gaussian wave functions are experimentally well reconstructed. Our method avoids using the Fourier lens and post selection on the momentum P=0. We further apply it to measure wavefronts with ultra-high spatial frequency, which is difficult for traditional Shack-Hartmann wavefront sensing technologies. Our work extends the ability of quantum weak measurement and would be useful for wavefront sensing.

physics.optics↗

arXiv2019

Experimental investigation of quantum key distribution over water channel

Quantum key distribution (QKD) has undergone significant development in recent decades, particularly with respect to free-space (air) and optical fiber channels. Here, we report the first proof-of-principle experiment for the BB84 protocol QKD over a water channel. Firstly, we demonstrate again the polarization preservation properties of the water channel in optical transmission according to the measured Mueller matrix, which is close to the unit matrix. The reason for the polarization preservation, revealed by Monte Carlo simulation, is that almost all the received photons are unscattered.Then, we performed the first polarization encoding BB84 protocol QKD over a 2.37m water channel. The results show that QKD can be performed with a low quantum bit error rate (QBER), less than 3.5%, with different attenuation coefficients.

quant-ph↗

arXiv2019

CryptoGuard: High Precision Detection of Cryptographic Vulnerabilities in Massive-sized Java Projects

Cryptographic API misuses, such as exposed secrets, predictable random numbers, and vulnerable certificate verification, seriously threaten software security. The vision of automatically screening cryptographic API calls in massive-sized (e.g., millions of LoC) Java programs is not new. However, hindered by the practical difficulty of reducing false positives without compromising analysis quality, this goal has not been accomplished. State-of-the-art crypto API screening solutions are not designed to operate on a large scale. Our technical innovation is a set of fast and highly accurate slicing algorithms. Our algorithms refine program slices by identifying language-specific irrelevant elements. The refinements reduce false alerts by 76% to 80% in our experiments. Running our tool, CrytoGuard, on 46 high-impact large-scale Apache projects and 6,181 Android apps generate many security insights. Our findings helped multiple popular Apache projects to harden their code, including Spark, Ranger, and Ofbiz. We also have made substantial progress towards the science of analysis in this space, including: i) manually analyzing 1,295 Apache alerts and confirming 1,277 true positives (98.61% precision), ii) creating a benchmark with 38-unit basic cases and 74-unit advanced cases, iii) performing an in-depth comparison with leading solutions including CrySL, SpotBugs, and Coverity. We are in the process of integrating CryptoGuard with the Software Assurance Marketplace (SWAMP).

cs.CR↗

arXiv2019

Performance of Underwater Quantum Key Distribution with Polarization Encoding

Underwater quantum key distribution (QKD) has potential applications in absolutely secure underwater communication. However, the performance of underwater QKD is limited by the optical elements, background light, and dark counts of the detector. In this paper, we propose a modified formula for the quantum bit error rate (QBER), which takes into account the effect of detector efficiency on the QBER caused by the background light. Then we calculate the QBER of the polarization encoding BB84 protocol in Jerlov type seawater by analyzing the effect of the background light and optical components in a more realistic situation. Finally, we further analyze the final key rate and the maximum secure communication distance in three propagation modes, i.e., upward, downward and horizontal modes. We find that secure QKD can be performed in the clearest Jerlov type seawater at a distance of hundreds of meters, even in the worst downward propagation mode. Specifically, by optimizing the system parameters, it is possible to securely transmit information with a rate of 67kbits/s at a distance of 100 m in the seawater channel with an attenuation coefficient of 0.03/m at night. For practical underwater QKD, the performance can also be improved by using decoy states. Our results are useful to long distance underwater quantum communication.

quant-ph↗

arXiv2018

General Hardy-Type Paradox Based on Bell inequality and its Experimental Test

Local realistic models cannot completely describe all predictions of quantum mechanics. This is known as Bell's theorem that can be revealed either by violations of Bell inequality, or all-versus-nothing proof of nonlocality. Hardy's paradox is an important all-versus-nothing proof and is considered as "the simplest form of Bell's theorem". In this work, we theoretically build the general framework of Hardy-type paradox based on Bell inequality. Previous Hardy's paradoxes have been found to be special cases within the framework. Stronger Hardy-type paradox has been found even for the two-qubit two-setting case, and the corresponding successful probability is about four times larger than the original one, thus providing a more friendly test for experiment. We also find that GHZ paradox can be viewed as a perfect Hardy-type paradox. Meanwhile, we experimentally test the stronger Hardy-type paradoxes in a two-qubit system. Within the experimental errors, the experimental results coincide with the theoretical predictions.

quant-ph↗

arXiv2018

Observing momentum disturbance in double-slit "which-way" measurements

Making a "which-way" measurement (WWM) to identify which slit a particle goes through in a double-slit apparatus will reduce the visibility of interference fringes. There has been a long-standing controversy over whether this can be attributed to an uncontrollable momentum transfer. To date, no experiment has characterised the momentum change in a way that relates quantitatively to the loss of visibility. Here, by reconstructing the Bohmian trajectories of single photons, we experimentally obtain the distribution of momentum change, which is observed to be not a momentum kick that occurs at the point of the WWM, but nonclassically accumulates during the propagation of the photons. We further confirm a quantitative relation between the loss of visibility consequent on a WWM and the total (late-time) momentum disturbance. Our results emphasize the role of the Bohmian momentum in giving an intuitive picture of wave-particle duality and complementarity.

quant-ph↗

arXiv2018

Experimentally Robust Self-testing for Bipartite and Tripartite Entangled States

Self-testing refers to a method with which a classical user can certify the state and measurements of quantum systems in a device-independent way. Especially, the self-testing of entangled states is of great importance in quantum information process. A comprehensible example is that violating the CHSH inequality maximally necessarily implies the bipartite shares a singlet. One essential question in self-testing is that, when one observes a non-maximum violation, how close is the tested state to the target state (which maximally violates certain Bell inequality)? The answer to this question describes the robustness of the used self-testing criterion, which is highly important in a practical sense. Recently, J. Kaniewski predicts two analytic self-testing bounds for bipartite and tripartite systems. In this work, we experimentally investigate these two bounds with high quality two-qubit and three-qubit entanglement sources. The results show that these bounds are valid for various of entangled states we prepared, and thus, we implement robust self-testing processes which improve the previous results significantly.

quant-ph↗

arXiv2018

Demonstration of Einstein-Podolsky-Rosen Steering with Enhanced Subchannel Discrimination

Einstein-Podolsky-Rosen (EPR) steering describes a quantum nonlocal phenomenon in which one party can nonlocally affect the other's state through local measurements. It reveals an additional concept of quantum nonlocality, which stands between quantum entanglement and Bell nonlocality. Recently, a quantum information task named as subchannel discrimination (SD) provides a necessary and sufficient characterization of EPR steering. The success probability of SD using steerable states is higher than using any unsteerable states, even when they are entangled. However, the detailed construction of such subchannels and the experimental realization of the corresponding task are still technologically challenging. In this work, we designed a feasible collection of subchannels for a quantum channel and experimentally demonstrated the corresponding SD task where the probabilities of correct discrimination are clearly enhanced by exploiting steerable states. Our results provide a concrete example to operationally demonstrate EPR steering and shine a new light on the potential application of EPR steering.

quant-ph↗

arXiv2017

Experimental nonlocal steering of Bohmian trajectories

Interpretations of quantum mechanics (QM), or proposals for underlying theories, that attempt to present a definite realist picture, such as Bohmian mechanics, require strong non-local effects. Naively, these effects would violate causality and contradict special relativity. However if the theory agrees with QM the violation cannot be observed directly. Here, we demonstrate experimentally such an effect: we steer the velocity and trajectory of a Bohmian particle using a remote measurement. We use a pair of photons and entangle the spatial transverse position of one with the polarization of the other. The first photon is sent to a double-slit-like apparatus, where its trajectory is measured using the technique of Weak Measurements. The other photon is projected to a linear polarization state. The choice of polarization state, and the result, steer the first photon in the most intuitive sense of the word. The effect is indeed shown to be dramatic, while being easy to visualize. We discuss its strength and what are the conditions for it to occur.

quant-ph↗