Program Analysis for Vulnerability Detection Cristian-Alexandru Staicu

News

Currently, no news are available
 

Description

For registration, please apply for this seminar through the central seminar assignment system.

Program analysis is a mature research area at the intersection of programming languages, formal methods, and software engineering. One of its main applications is automatic vulnerability detection. However, the complexity of modern systems is overwhelming and the vulnerabilities to be detected are increasingly sophisticated. To account for these particularities, many recent approaches advocate for lightweight program analysis techniques or hybrid methods, i.e., static and dynamic analysis. This seminar explores the trade-offs involved in designing a program analysis that scales to analyzing the security of real systems. In this seminar, we will discuss recent research papers in the area in a reading group format. Each week, one student will present papers covering a given topic, followed by a discussion. All participants are expected to actively participate in the discussion by asking questions.

Logistics

Instructor: Cristian-Alexandru Staicu,

Time: Wednesday, 10 am,

Location: Zoom (Disclaimer).

Semester Plan

  • 27th of October - kickoff meeting
  • 17th of November - presentation slot
  • 24th of November - presentation slot
  • 1st of December - presentation slot
  • 8th of December - presentation slot
  • 15th of December - presentation slot
  • 6th of January - presentation slot
  • 13th of January - presentation slot
  • 20th of January - presentation slot
  • 27th of January - presentation slot
  • 3rd of February - presentation slot
  • 10th of February - presentation slot

Grading system

The final grade is an aggregate of the following parts, both presentation and final report are mandatory:

  • 40% the final report,
  • 40% the presentation,
  • 20% for being active in class,
  • bonus: up to 15% for the hands-on exercise. 

Supporting Materials

Please find below a set of useful materials for the seminar:

  • The kick-off presentation's slides contain useful information about the structure and goals of this seminar, but also some required background for the assigned papers.
  • Sample presentation 1 - you should aim for this much content when presenting each of the assigned papers (approx. 10 minutes). See the kick-off presentation for the recommended presentation's structure.
  • Sample presentation 2 - a slightly longer presentation (approx. 15 minutes).
  • Consider using the following template for the report and its associated sources.

Topics

  1. Vulnerabilities in web applications
  2. Vulnerabilities in software components and dependencies
  3. Vulnerabilities in mobile apps
  4. Detect misuses of crypto APIs
  5. Vulnerabilities in low-level programs
  6. Fuzzing low-level programs
  7. Fuzzing compilers and engines
  8. Machine learning-aided vulnerability detection
  9. Availability vulnerabilities
  10. Automatic patching of vulnerabilities
  11. Removing vulnerabilities through debloating
  12. Vulnerability prediction


Privacy Policy | Legal Notice
If you encounter technical problems, please contact the administrators