FastSpec: Scalable Generation and Detection of Spectre Gadgets Using
  Neural Embeddings
  Several techniques have been proposed to detect vulnerable Spectre gadgets in
widely deployed commercial software. Unfortunately, detection techniques
proposed so far rely on hand-written rules which fall short in covering subtle
variations of known Spectre gadgets as well as demand a huge amount of time to
analyze each conditional branch in software. Moreover, detection tool
evaluations are based only on a handful of these gadgets, as it requires
arduous effort to craft new gadgets manually.
  In this work, we employ both fuzzing and deep learning techniques to automate
the generation and detection of Spectre gadgets. We first create a diverse set
of Spectre-V1 gadgets by introducing perturbations to the known gadgets. Using
mutational fuzzing, we produce a data set with more than 1 million Spectre-V1
gadgets which is the largest Spectre gadget data set built to date. Next, we
conduct the first empirical usability study of Generative Adversarial Networks
(GANs) in the context of assembly code generation without any human
interaction. We introduce SpectreGAN which leverages masking implementation of
GANs for both learning the gadget structures and generating new gadgets. This
provides the first scalable solution to extend the variety of Spectre gadgets.
  Finally, we propose FastSpec which builds a classifier with the generated
Spectre gadgets based on a novel high dimensional Neural Embeddings technique
(BERT). For the case studies, we demonstrate that FastSpec discovers potential
gadgets with a high success rate in OpenSSL libraries and Phoronix benchmarks.
Further, FastSpec offers much greater flexibility and time-related performance
gain compared to the existing tools and therefore can be used for gadget
detection in large-scale software.
