1. TRUST:Team for Research in Ubiquitous Secure Technologies
Program Analysis and
System Composition
Alex Aiken
Stanford University
NSF STC Review
September 6, 2004

2. Program Analysis
Recent work shows program analysis can find security holes
Wagner’s thesis work
The challenge
Scale: Handling big programs
10M’s lines of code
Precision
And analyzing them in detail
Avoiding approximations
NSF STC Review
December 1, 2018

3. Scale and Accuracy We find many more bugs whenever we
Can increase the lines of code analyzed together by 10X
Can improve the precision of the analysis
Current techniques
1M’s lines of code with low precision
Type, dataflow based
100K lines of code with high precision
Model checking, theorem-proving based
The Challenge
10M’s lines of code with high precision
Track record suggests that we can accomplish this goal
NSF STC Review
December 1, 2018

4. Another Dimension Must deal with software heterogeneity
Components written in multiple languages
Exceptionally weak composition semantics
Newer attacks exploit such weaknesses
E.g., code injection attacks
Current research efforts are disjointed
Scope of the problem is not even known
Significant engineering challenges
NSF STC Review
December 1, 2018