Information Trust Institute (ITI) Calendar

Back to Listing

TSS Seminar: Lin Tan: "AutoISES: Automatically Inferring Security Specifications and Detecting Violations"

Event Type
Seminar/Symposium
Sponsor
Information Trust Institute
Location
2405 Siebel Center
Date
Jul 23, 2008   4:00 pm  
Speaker
Lin Tan, Department of Computer Science, University of Illinois
Originating Calendar
Information Trust Institute (ITI) archival calendar

ABSTRACT:

The importance of software security cannot be overstated. In the past, researchers have applied program analysis techniques to automatically detect security vulnerabilities and verify security properties. However, such techniques have limited success in reality because they require manually provided code-level security specifications. The process of manually writing and generating these code-level security specifications is tedious and error-prone. Additionally, they seldom exist in production software.

We propose a novel method and tool, called AutoISES, which automatically infers security specifications by statically analyzing source code, and then directly use these specifications to automatically detect security violations. Our experiments with the Linux kernel and Xen demonstrated the effectiveness of this approach: AutoISES automatically generated 84 security specifications and detected 8 vulnerabilities in the Linux kernel and Xen, 7 of which have already been confirmed by the corresponding developers.

link for robots only