Promising Breaks and Breaking Promises: Program Analysis in Theory and Practice
David Evans
SDWest 2006
17 March 2006
Program analysis tools offer the promise of automated detection of security vulnerabilities and high assurance establishment of essential program properties. Over the past 15 years, advanced static analysis tools have gone from academic curiosities to essential parts of industrial development processes. Despite this progress, there remain fundamental limits to what can be checked statically, practical problems with increasing the level of automation in program analysis, and perhaps most importantly, beyond a few generic simple properties, remarkably little awareness of what properties it is actually useful to check. This session will survey the current state of the art in commercial program analysis tools, emerging trends in the research community, and speculate on the short and long term future of program analysis.
Bio: David Evans is an Assistant Professor at the University of Virginia. He has SB, SM and PhD degrees in Computer Science from MIT. His research interests include program analysis, exploiting properties of the physical world for security, and applications of cryptography. He was the lead developer of the LCLint and Splint annotation-assisted lightweight static analysis tools, and a lead investigator on NSF and DARPA-funded projects on system security, networking, and programming languages. He teaches courses on computer science, software engineering, security, and cryptography at the University of Virginia. For more information, see http://www.cs.virginia.edu/evans/
Links:
SDWest Page
Perracotta
N-Variant systems Project
|
David Evans - Talks University of Virginia Department of Computer Science |
David Evans evans@virginia.edu |