Dynamic techniques for finding errors and preventing security violations

苏珊·霍维茨威斯康星大学麦迪逊分校编写正确、安全的软件是非常困难的。像C这样具有弱类型系统的语言使程序员很容易在他们的代码中引入错误和潜在的安全漏洞，从而加剧了这个问题。这个项目的目标是设计、实现和评估C程序的动态错误检测和安全实施工具。现有的动态错误检测工具受到覆盖率较低的限制：它们只能检测在给定程序执行期间实际发生的错误行为。这一限制将通过使用创新的动态技术来解决，以增加“数据覆盖率”(查找在不同输入值的情况下可能发生的错误)和“路径”覆盖率(查找在整个程序中遵循不同路径可能发生的错误)。安全执行工具将以较低的开销提供针对广泛攻击的保护，不需要修改现有源代码，也不需要程序员放弃对数据表示或内存管理的控制。

0305387Susan HorwitzUniversity of Wisconsin-MadisonWriting correct, secure software is very difficult. Languages like C that have weak type systems exacerbate the problem by making it easy for programmers to introduce errors and potential security holes intheir code.The goal of this project is the design, implementation, and evaluation of dynamic error-detection and security-enforcement tools for C programs. Existing dynamic error-detection tools are limited by poorcoverage: they can only detect erroneous behaviors that actually occur during a given program execution. That limitation will be addressed by the use of innovative new dynamic techniques for increasing both"data coverage" (finding errors that could occur given different input values) and "path" coverage (finding errors that could occur if a different path were followed through the program). The security-enforcement tool will provide protection against a wide range of attacks, with low overhead, without requiring modifications to existing source code, and without requiring the programmer to give up control over data representations or memory management.