TRUST:Team for Research in Ubiquitous Secure Technologies Program Analysis and System Composition Alex Aiken Stanford University NSF STC Review September 6, 2004

Program Analysis Recent work shows program analysis can find security holes Wagner’s thesis work The challenge Scale: Handling big programs 10M’s lines of code Precision And analyzing them in detail Avoiding approximations NSF STC Review December 1, 2018

Scale and Accuracy We find many more bugs whenever we Can increase the lines of code analyzed together by 10X Can improve the precision of the analysis Current techniques 1M’s lines of code with low precision Type, dataflow based 100K lines of code with high precision Model checking, theorem-proving based The Challenge 10M’s lines of code with high precision Track record suggests that we can accomplish this goal NSF STC Review December 1, 2018

Another Dimension Must deal with software heterogeneity Components written in multiple languages Exceptionally weak composition semantics Newer attacks exploit such weaknesses E.g., code injection attacks Current research efforts are disjointed Scope of the problem is not even known Significant engineering challenges NSF STC Review December 1, 2018