CSR: Large: Collaborative Research: SemGrep: a System for Improving Software Reliability Through Semantic Similarity Bug Search

据报道，软件漏洞每年都会夺走生命，并造成数十亿美元的损失。 研究表明，许多错误是“克隆”的（即，复制和粘贴）到许多地方。 不幸的是，现有的错误检测工具还没有为程序员提供有效搜索错误克隆的能力。 因此，他们不得不求助于特别的手工方法，例如在源代码树中查找错误克隆。这个项目旨在通过自动检测和修复新发现的漏洞的错误克隆来提高软件的可靠性和完整性。 它将研究一个新的维度，代码相似性，用于检测软件错误。 具体来说，它将研究一种方法的可行性，该方法从新的错误补丁或现有的静态或动态错误检测工具中获取错误“种子”，搜索大型代码库（可能跨管理域）以查找错误克隆，并自动保护错误克隆。 这种方法可以在许多现有技术由于代码复杂性而无法检测的情况下检测错误：检测代码之间的相似性比解构其含义更容易。如果成功，该项目将产生准确的工具，有助于早期检测和修复软件漏洞。 程序员将使用这些工具来检测和修复错误克隆只要适用。 企业、政府和个人所依赖的软件的可靠性和安全性的提高将对社会产生积极的影响。 该项目将提供一个更可靠、更强大的计算基础设施，能够抵御新的威胁和攻击。 将建议的研究纳入CS课程将促进可靠性和安全意识。

Software bugs have been reported to take lives and cost billions of dollars annually. Studies have shown that many bugs are "cloned" (i.e., copied-and-pasted) to many places. Unfortunately, existing error detection tools have not provided programmers the ability to efficiently search for bug clones. Thus, they have to resort to ad hoc manual approaches such as grepping the source tree for bug clones.This project aims to improve software reliability and integrity through automatic detection and repair of bug clones given a newly discovered vulnerability. It will investigate a new dimension, code similarity, for detecting software bugs. Specifically, it will investigate the feasibility of an approach that derives bug "seeds" from a new bug patch or existing static or dynamic error detection tools, searches a large code base (potentially across administrative domains) for bug clones, and automatically protects the bug clones. This approach can detect bugs in cases where many existing techniques cannot due to code complexity: detecting similarity between code is easier than deconstructing its meaning.If successful, this project will result in accurate tools that will help to detect and repair software vulnerabilities early. Programmers will use these tools to detect and repair bug clones whenever applicable. Improvements in the reliability and security of software on which business, government, and individuals depend on will positively impact society. This project will provide a more reliable and robust computing infrastructure resilient to new threats and attacks. Integrating the proposed research into the CS curriculum will as promote reliability and security awareness.