  Properly benchmarking a system is a difficult and intricate task.
Unfortunately, even a seemingly innocuous benchmarking mistake can compromise
the guarantees provided by a given systems security defense and also put its
reproducibility and comparability at risk. This threat is particularly
insidious as it is generally not a result of malice and can easily go
undetected by both authors and reviewers. Moreover, as modern defenses often
trade off security for performance in an attempt to find an ideal design point
in the performance-security space, the damage caused by benchmarking mistakes
is increasingly worrisome.
  To analyze the magnitude of the phenomenon, we identify a set of 22
"benchmarking crimes" that threaten the validity of systems security
evaluations and perform a survey of 50 defense papers published in top venues.
To ensure the validity of our results, we perform the complete survey twice,
with two independent readers. We find only a very small number of disagreements
between readers, showing that our assessment of benchmarking crimes is highly
reproducible.
  We show that benchmarking crimes are widespread even in papers published at
tier-1 venues. We find that tier-1 papers commit an average of five
benchmarking crimes and we find only a single paper in our sample that
committed no benchmarking crimes. Moreover, we find that the scale of the
problem is constant over time, suggesting that the community is not yet
addressing it despite the problem being now more relevant than ever. This
threatens the scientific process, which relies on reproducibility and
comparability to ensure that published research advances the state of the art.
We hope to raise awareness of these issues and provide recommendations to
improve benchmarking quality and safeguard the scientific process in our
community.
