filmov
tv
Using Formal Methods to Eliminate Exploitable Bugs • Kathleen Fisher • YOW! 2015
Показать описание
This presentation was recorded at YOW! 2015. #GOTOcon #YOW
Kathleen Fisher - Professor at Tufts University
RESOURCES
ABSTRACT
For decades, formal methods have offered the promise of software that doesn’t have exploitable bugs. Until recently, however, it hasn’t been possible to verify software of sufficient complexity to be useful. Recently, that situation has changed. SeL4 is an open-source operating system microkernel efficient enough to be used in a wide range of practical applications. It has been proven to be fully functionally correct, ensuring the absence of buffer overflows, null pointer exceptions, use-after-free errors, etc., and to enforce integrity and confidentiality properties.
The #CompCert Verifying C Compiler maps source C programs to provably equivalent assembly language, ensuring the absence of exploitable bugs in the compiler. A number of factors have enabled this revolution in the formal methods community, including increased processor speed, better infrastructure like the Isabelle/HOL and #CoqTheorem provers, specialized logics for reasoning about low-level code, increasing levels of automation afforded by tactic languages and SAT/SMT solvers, and the decision to move away from trying to verify existing artifacts and instead focus on co-developing the code and the correctness proof.
In this talk, I will explore the promise and limitations of current formal methods techniques for producing useful software that probably does not contain exploitable bugs. I will discuss these issues in the context of DARPA’s HACMS program, which has as its goal the creation of high-assurance software for vehicles, including quad-copters, helicopters, and automobiles.
RECOMMENDED BOOKS
#Bugs #EliminateBugs #ExploitableBugs #SoftwareEngineering #Security #Programming #KathleenFisher #YOWcon
Looking for a unique learning experience?
SUBSCRIBE TO OUR CHANNEL - new videos posted almost daily.
Kathleen Fisher - Professor at Tufts University
RESOURCES
ABSTRACT
For decades, formal methods have offered the promise of software that doesn’t have exploitable bugs. Until recently, however, it hasn’t been possible to verify software of sufficient complexity to be useful. Recently, that situation has changed. SeL4 is an open-source operating system microkernel efficient enough to be used in a wide range of practical applications. It has been proven to be fully functionally correct, ensuring the absence of buffer overflows, null pointer exceptions, use-after-free errors, etc., and to enforce integrity and confidentiality properties.
The #CompCert Verifying C Compiler maps source C programs to provably equivalent assembly language, ensuring the absence of exploitable bugs in the compiler. A number of factors have enabled this revolution in the formal methods community, including increased processor speed, better infrastructure like the Isabelle/HOL and #CoqTheorem provers, specialized logics for reasoning about low-level code, increasing levels of automation afforded by tactic languages and SAT/SMT solvers, and the decision to move away from trying to verify existing artifacts and instead focus on co-developing the code and the correctness proof.
In this talk, I will explore the promise and limitations of current formal methods techniques for producing useful software that probably does not contain exploitable bugs. I will discuss these issues in the context of DARPA’s HACMS program, which has as its goal the creation of high-assurance software for vehicles, including quad-copters, helicopters, and automobiles.
RECOMMENDED BOOKS
#Bugs #EliminateBugs #ExploitableBugs #SoftwareEngineering #Security #Programming #KathleenFisher #YOWcon
Looking for a unique learning experience?
SUBSCRIBE TO OUR CHANNEL - new videos posted almost daily.
0:46:30
Using Formal Methods to Eliminate Exploitable Bugs • Kathleen Fisher • YOW! 2015
2:40:40
Formal Methods for the Informal Engineer: Day 3 (2021)
0:49:34
BOB Summer 2019 - Kathleen Fisher, Using Formal Methods to Eliminate Exploitable Bugs
0:43:24
Predicting and Preventing Chaos with Formal Methods in TLA+ | Thomas Gebert | Lambda Days 2022
0:18:34
Never Again: Spectre-Proofing Chip Designs with End-to-End Formal Methods
0:23:08
Formal Methods Need Not Be Black Magic
0:27:33
Using Formal Methods in Safety Verification
0:13:50
Formal Methods of Software Design - Time and Space Dependence and Assertions [18/33]
0:04:21
IOHK | Formal Methods - Philipp Kant
0:01:58
Cryptography and Formal Methods
0:07:16
Proofs with Rules of Inference 1 (Propositional Logic for Linguists 15)
0:10:24
SOSP 2021: Using Lightweight Formal Methods to Validate a Key-Value Storage Node in Amazon S3
0:59:32
IOHK | Philipp Kant, Director of Formal Methods.
0:31:45
Formal Verification Made Easy (and fast!) - Daniel Bristot de Oliveira, Red Hat
0:06:41
Formal Methods - When and Where?
0:24:53
Using Formal to Vaccinate RISC-V Designs Against Catastrophic Bugs - Dr. Ashish Darbari, AXIOMISE
0:28:52
Arguing About #Safety – Are #Simulations and Formal Methods Keys?
0:02:29
What is Formal Verification?
0:08:17
Tech Talk: Formal Verification
0:21:30
Philipp Kant - Fusing Flexibility with Formality (...) - Lambda Days 2020
0:57:49
Formal Methods and Proofs of Privacy Properties, Part I
1:07:06
ZKP MOOC Lecture 15: Secure ZK Circuits with Formal Methods
0:52:52
Formal Methods Theory and Practice of Linux Verification Center (Part 1)
0:00:06
Application Letter. How to write a formal application letter.
Комментарии