Obtaining Information Leakage Bounds via Approximate Model Counting

Information leaks are a significant problem in modern software systems. In recent years, information theoretic concepts, such as Shannon entropy, have been applied to quantifying programs. One approach is use symbolic execution together with model counting constraints solvers order quantify leakage. There at least two reasons for unsoundness leakage using this approach: 1) Symbolic may not be able explore all paths, 2) Model provide an exact count. We present sound quantitative flow analysis that bounds the both cases where program behavior fully explored and constraint solver unable precise count but provides upper lower bound. implemented our extension KLEE computing C