TWC: Medium: Toward Trustworthy Mutable Replay for Security Patches

社会越来越依赖软件，但部署的软件包含安全漏洞和其他可能威胁隐私、财产甚至人类生命的漏洞。当发现安全漏洞或严重错误时，会发布软件补丁程序来尝试修复问题，但补丁程序本身可能是不正确、不充分的，并且必然会破坏功能。该项目研究了完整的工作流程，以便开发人员快速诊断漏洞或错误的根本原因，测试预期的补丁是否确实完全消除了缺陷，并允许用户在采用补丁之前检查已发布的补丁的配置和工作负载。这个项目探索了可变重放的使用，以帮助复制、诊断和修复软件错误。低开销记录器在发生故障或利用漏洞时记录软件的执行，允许开发人员重播记录的日志以重现问题。可变重播允许在关键补丁程序典型的适度代码更改后重播使用错误版本记录的日志，以显示补丁程序正确工作以解决检测到的问题。该项目利用开发人员随时可用的语义信息来执行易于理解的静态和动态分析，以正确转换记录的日志，从而实现可变回放。这项研究的结果将简化和加速补丁的生成和验证，最终使软件更可靠和更安全，从而使社会和个人受益。

Society is increasingly reliant on software, but deployed software contains security vulnerabilities and other bugs that can threaten privacy, property and even human lives. When a security vulnerability or critical error is discovered, a software patch is issued to attempt to fix the problem, but patches themselves can be incorrect, inadequate, and break necessarily functionality. This project investigates the full workflow for the developer to rapidly diagnose the root cause of the vulnerability or error, for the developer to test that a prospective patch indeed completely removes the defect, and for users to check the issued patch on their own configurations and workloads before adopting the patch. This project explores the use of mutable replay to help reproduce, diagnose, and fix software bugs. A low-overhead recorder records the execution of software in case a failure or exploit occurs, allowing the developer to replay the recorded log to reproduce the problem. Mutable replay allows logs recorded with the buggy version to be replayed after the modest code changes typical of critical patches to show that patches work correctly to resolve detected problems. This project leverages semantic information readily available to the developer to conduct well-understood static and dynamic analyses to correctly transform the recorded log to enable mutable replay. The results of this research will benefit society and individuals by simplifying and hastening both generation and validation of patches, ultimately making software more reliable and secure.