Project description

Security breach has become a popular connotation for all the major headlines in the modern society. As Internet of Things (IoT) is present in all the sections of technology, ranging from consumer electronics, industrial and even key government operations, the chances of security breach have expanded to a very large extent. There are several software testing and verification techniques available to find vulnerabilities in IoT devices, but once the vulnerability is revealed, a considerable effort is spent to correctly fix it. One promising technique to automatically help repair buggy programs is program synthesis. Program synthesis refers to the automatic construction of software from a given high-level specification. State-of-the-art synthesisers are tools that allow developers to provide a description of what is to be achieved and thus relieve them from the task to think about how the problem is to be solved. Therefore, given a high-level specification in an appropriate logical calculus of what the software should do, the program synthesiser generates a correct-by-construction implementation that provably satisfies that specification. Thus, the main goals of this PhD research are: (1) localise faults related to various security vulnerabilities analysis tasks such as buffer overflow, zero-day vulnerabilities and crash reproduction using existing symbolic execution and fuzzing techniques; (2) propose repairs using state-of-the-art program synthesisers by analysing a buggy program against a set of selected tests to infer the specification of the intended program behaviour; and (3) produce patches that can automatically fix bugs related to software vulnerabilities to contribute to the vision of self-healing software.