CRII: SHF: EVID: Evidence-Assisted Detection and Elimination of Memory Errors in Single and Multi-threaded Programs

职务名称：中环填海第二期：SHF：EVID：单线程和多线程程序中内存错误的证据辅助检测和消除尽管经过几十年的努力，大多数现实世界的C/C++软件仍然存在内存错误。现有的方法要么引入显著的性能开销（用于检测），要么仅部分地击败存储器错误。这个项目的智力价值是一种用于动态分析和预防记忆错误的证据辅助方法（EVID）。该项目更广泛的意义和重要性在于：（a）有效和精确的检测工具，大大减少了查找和修复内存错误的人工工作;（B）改善软件系统的可用性和安全性;（c）向西班牙裔学生等代表性不足的群体提供服务。该项目提出了几种检测和预防内存错误的技术，可以大大减少零日漏洞，提高软件系统的可靠性/安全性。EVID采用了以下洞察力：通常可以在事后发现错误的证据，例如缓冲区溢出、释放后使用和内存泄漏。在证据的帮助下，该项目利用确定性和仪表化的重新执行来查明单线程和多线程程序中内存错误的确切原因。EVID还提出了一种创新的系统，可以自动消除检测到的内存错误，而无需重新启动软件或损害其可用性。因此，该项目开发的工具对提高国家网络基础设施的稳健性有直接影响。

Title: CRII: SHF: EVID: Evidence-Assisted Detection and Elimination of Memory Errors in Single and Multi-threaded ProgramsDespite decades of efforts, most real-world C/C++ software is still deployed with memory errors. Existing approaches either introduce significant performance overhead (for detection) or only partially defeat memory errors. The intellectual merits of this project are an evidence-assisted approach (EVID) for dynamic analysis and prevention of memory errors. The project's broader significance and importance are in (a) efficient and precise detection tools that significantly reduce manual effort in locating and fixing memory errors; (b) the improvement of availability and security of software systems; and (c) outreach to underrepresented groups such as Hispanic students. This project proposes several techniques to detect and prevent memory errors, which can greatly reduce zero-day vulnerabilities and improve the reliability/security of software systems. EVID employs the following insight: it is often possible to discover the evidence of errors such as buffer overflows, use-after-frees, and memory leaks, after-the-fact. Assisted by the evidence, this project utilizes deterministic and instrumented re-execution to pinpoint the exact causes of memory errors in both single and multithreaded programs. EVID further proposes an innovative system that automatically eliminates detected memory errors, without restarting the software or compromising its availability. Thus the tools developed in the project have a direct impact on improving robustness of national cyberinfrastructure.