TWC: Small: Finding and Repairing Semantic Vulnerabilities in Modern Software

软件负责许多重要的政府、商业和教育功能。该项目旨在开发新方法，以发现和修复现代软件中一些最具挑战性、人们知之甚少的安全漏洞，这些漏洞有可能危及国家网络基础设施的安全性和可靠性。该项目的第一个目标是设计和实现一个健壮的程序分析框架，该框架能够在现代应用程序中发现可利用的语义错误，例如意外遗漏访问控制检查，无意将敏感操作（如本机调用和数据库查询）暴露给不受信任的代码或用户，易受拒绝服务影响的高复杂性控制结构，安全策略的错误配置，以及程序安全逻辑中的其他错误。第二个目标是通过应用程序转换，插入适当安全逻辑的正确实现，开发自动修复语义漏洞的方法。

Software is responsible for many critical government, business, and educational functions. This project aims to develop new methods for finding and repairing some of the most challenging, poorly understood security vulnerabilities in modern software that have the potential to jeopardize the security and reliability of the nation's cyber infrastructure.The first objective of this project is to design and implement a robust program analysis framework that is capable of finding exploitable semantic bugs in modern applications, such as accidental omission of access-control checks, unintentional exposure of sensitive operations such as native calls and database queries to untrusted code or users, high-complexity control structures vulnerable to denial of service, misconfigurations of security policies, and other errors in programs' security logic.The second objective is to develop methods for automatically repairing semantic vulnerabilities by applying program transformations that insert correct implementations of appropriate security logic.