CASA - Cluster of Excellence’s Post

Very lucky to receive the ERC Consolidator this year! This is 5-year funding for groundbreaking research. If you are interested in our perspective on software security analysis at scale, stick around and read on 👇. Computer Science has been built on formal foundations where programs are considered mathematical objects. The formal approach has allowed us to define and analyze a program very precisely. Today, however, programs are more like organisms, super complex, ever-evolving systems interacting with others in highly dynamic environments. Project #AT_SCALE will build the next-generation security analysis tools based on empirical methods (e.g., using statistical, causal, or counterfactual reasoning). Think of it this way: When the first computers were built, programming languages were designed for us humans to express precisely what the computer should do: A formal syntax defines the structure of a program while a formal semantics defines how the computer should interpret it. Using the formal syntax and semantics of the language, we would analyze a program's properties by reasoning within a "model of its behaviors" (in-silico). However, as our programs grew more complex, we started to approximate: Today, such tools report security flaws that do not exist or fail to report those that do. Worse, we cannot even formally quantify the loss of accuracy. Now, whenever a system gets too complex for modeling, other sciences use empirical methods, such as observation or experiments to learn about properties of that system "in-vivo". My proposal is precisely that: For program analysis *at scale*, we must explore empirical methods. * If this sounds interesting, check out our website: https://lnkd.in/ePPTtH59 * If you are also a BSc or MSc student with the required background, interested in a PhD on this project, feel free to reach out. Related work: * "Statistical Reasoning about programs": https://lnkd.in/dcxYTej2 * "Software Security Analysis in 2030 and Beyond: A Research Roadmap" https://lnkd.in/dmG-VR6P * "Invivo Fuzzing by amplifying actual executions": https://lnkd.in/dreHgngE European Research Council (ERC) #ERCCoG Max Planck Institute for Security and Privacy (MPI-SP) CASA - Cluster of Excellence