Abstract:

Neither manual nor totally automated discovery of software vulnerabilities is practical. Manual discovery requires extremely laborious work by highly skilled software analysts and totally automated discovery is riddled with intractable problems.

This tutorial introduces a novel practical approach for machine-enabled human-in-the-loop discovery of software vulnerabilities, and is based on “amplifying human intelligence” rather than trying to replace human intelligence. The approach is supported by a suite of tools with unique capabilities that enable human analysts to quickly identify and understand the relevant parts of large software and perform “what-if experiments” in order to discover highly sophisticated vulnerabilities. These tools are advanced through large Defense Advanced Research Projects Agency (DARPA) projects and their effectiveness has been demonstrated for discovering sophisticated malware challenges.

Venue: 30th IEEE/ACM International Conference on Automated Software Engineering (ASE 2015), Lincoln, Nebraska, November 2015.

Authors: Suresh Kothari, Benjamin Holland

Materials: https://goo.gl/8tWj3n