CRII: SHF: EVID: Evidence-Assisted Detection and Elimination of Memory Errors in Single and Multi-threaded Programs

标题：CRII：SHF：VIED：证据辅助检测和消除单线程和多线程程序中的内存错误尽管经过了几十年的努力，大多数现实世界的C/C软件仍然部署有内存错误。现有的方法要么引入了显著的性能开销(用于检测)，要么仅部分消除了内存错误。这个项目的智力优势是一种证据辅助方法(VIED)，用于动态分析和预防记忆错误。该项目更广泛的意义和重要性在于：(A)有效和精确的检测工具，可大大减少查找和修复记忆错误的人工劳动；(B)提高软件系统的可用性和安全性；(C)与西班牙裔学生等代表性不足的群体进行接触。该项目提出了几种检测和预防内存错误的技术，可以极大地减少零日漏洞，提高软件系统的可靠性/安全性。Evid采用了以下见解：通常可以在事后发现错误的证据，如缓冲区溢出、释放后使用和内存泄漏。在证据的帮助下，该项目利用确定性和仪表化的重新执行来查明单线程和多线程程序中内存错误的确切原因。VIED进一步提出了一种创新的系统，该系统可以自动消除检测到的内存错误，而不需要重新启动软件或影响其可用性。因此，项目中开发的工具对提高国家网络基础设施的稳健性具有直接影响。

Title: CRII: SHF: EVID: Evidence-Assisted Detection and Elimination of Memory Errors in Single and Multi-threaded ProgramsDespite decades of efforts, most real-world C/C++ software is still deployed with memory errors. Existing approaches either introduce significant performance overhead (for detection) or only partially defeat memory errors. The intellectual merits of this project are an evidence-assisted approach (EVID) for dynamic analysis and prevention of memory errors. The project's broader significance and importance are in (a) efficient and precise detection tools that significantly reduce manual effort in locating and fixing memory errors; (b) the improvement of availability and security of software systems; and (c) outreach to underrepresented groups such as Hispanic students. This project proposes several techniques to detect and prevent memory errors, which can greatly reduce zero-day vulnerabilities and improve the reliability/security of software systems. EVID employs the following insight: it is often possible to discover the evidence of errors such as buffer overflows, use-after-frees, and memory leaks, after-the-fact. Assisted by the evidence, this project utilizes deterministic and instrumented re-execution to pinpoint the exact causes of memory errors in both single and multithreaded programs. EVID further proposes an innovative system that automatically eliminates detected memory errors, without restarting the software or compromising its availability. Thus the tools developed in the project have a direct impact on improving robustness of national cyberinfrastructure.