Dynamic techniques for finding errors and preventing security violations

0305387苏珊Horwitz威斯康星大学麦迪逊分校写作正确，安全的软件是非常困难的。 像C这样的语言有着弱类型系统，这使得程序员很容易在代码中引入错误和潜在的安全漏洞，从而加剧了这个问题。本项目的目标是为C程序设计、实现和评估动态错误检测和安全执行工具。 现有的动态错误检测工具受到覆盖率低的限制：它们只能检测在给定程序执行期间实际发生的错误行为。 将通过使用创新的新的动态技术来解决这一限制，以增加“数据覆盖面”（发现在不同输入值下可能发生的错误）和“路径”覆盖面（发现在程序中遵循不同路径时可能发生的错误）。 安全执行工具将提供针对各种攻击的保护，开销低，不需要修改现有的源代码，也不需要程序员放弃对数据表示或内存管理的控制。

0305387Susan HorwitzUniversity of Wisconsin-MadisonWriting correct, secure software is very difficult. Languages like C that have weak type systems exacerbate the problem by making it easy for programmers to introduce errors and potential security holes intheir code.The goal of this project is the design, implementation, and evaluation of dynamic error-detection and security-enforcement tools for C programs. Existing dynamic error-detection tools are limited by poorcoverage: they can only detect erroneous behaviors that actually occur during a given program execution. That limitation will be addressed by the use of innovative new dynamic techniques for increasing both"data coverage" (finding errors that could occur given different input values) and "path" coverage (finding errors that could occur if a different path were followed through the program). The security-enforcement tool will provide protection against a wide range of attacks, with low overhead, without requiring modifications to existing source code, and without requiring the programmer to give up control over data representations or memory management.