TITLE and ABSTRACT:

Automated Software-Error Detection by Finding Deviations in Binaries

In this talk, I present my work on automatically detecting errors in
software binaries. We observe that software errors usually cause two
implementation of a specification to contain deviations, i.e., differences
in the way they process their inputs. Based on this observation, our
approach finds deviations to detect software errors related to input
processing. Given two binaries implementing the same specification and an
input, our approach builds a symbolic formula for each binary to
characterize how it interprets the input. From the formulas, our approach
generates new inputs that can demonstrate deviations/errors in the two
binaries. By directly working on a binary program, our approach is precisely
faithful to the binary and is not limited by the availability of source
code; by generating inputs from symbolic formulas characterizing program
execution, our approach significantly reduces the number of inputs needed to
find deviations and software errors. Our approach is based on our BitBlaze
binary analysis platform, which has broad applications in software security
and software engineering.

BIO:

Zhenkai Liang is an assistant professor of the Computer Science Department,
National University of Singapore. His main research interest is in the area
of system and software security, with focuses on signature generation for
remote attacks, malicious program analysis and confinement, and web
security. As a co-author, he received the best paper award at the USENIX
Security Symposium in 2007, and the outstanding paper award at the Annual
Computer Security Applications Conference (ACSAC) in 2003.  He got his Ph.D.
degree from Stony Brook University in 2006, and B.S. from Peking University
in 1999.