CS 5187 — Software Analysis
Monsoon Semester 2026 · 23 July – 12 November 2026 · Dept. of CSE, IIT Guwahati
Schedule
Weeks 1–3: classes Mon / Tue / Wed. From Week 4 (18 Aug): classes Tue / Wed / Thu — Tue 4:00, Wed 3:00, Thu 2:00 PM in Room 5G4. The Thursday slot now carries regular lectures as well as the two quizzes.
| Wk | Mon | Tue | Wed | Thu | Notes |
|---|---|---|---|---|---|
| 1 | Jul 27 · Mon-1 L1. Course intro & motivation | Jul 28 · Tue-1 L2. Static / dynamic / hybrid analysis | Jul 29 · Wed-1 L3. Vulnerability assessment & secure coding | — | Topic 1 |
| 2 | Aug 3 · Mon-2 L4. Soundness, completeness, undecidability | Aug 4 · Tue-2 L5. Precision, recall, F-measure | Aug 5 · Wed-2 L6. Program representation: AST, CFG, IRs | — | Topic 1 |
| 3 | Aug 10 · Mon-3 L7. Clang tutorial: libtooling & AST analysis | Aug 11 · Tue-3 L8. LLVM IR | Aug 12 · Wed-3 L9. LLVM IR (continued): CFGs & class hierarchy | — | Topic 1 HW 1 out |
| — | From Week 4 Classes move to Tuesday / Wednesday / Thursday (announced in L9, Wed 12 Aug). | ||||
| 4 | — | Aug 18 · Tue-4 L10. Specifications, safety & liveness | Aug 19 · Wed-4 L11. Hoare logic | Aug 20 · Thu-4 L12. Invariants & specification inference | Topic 1 HW 1 due Aug 21 |
| 5 | — | Aug 25 · Tue-5 L13. Coverage & mutation testing | Aug 26 · Wed-5 No class — holiday | Aug 27 · Thu-5 L14. Introduction to fuzzing | Topic 1 → 2 |
| 6 | — | Sep 1 · Tue-6 No class — Institute Day | Sep 2 · Wed-6 L15. Fuzzing: black-box & grey-box | Sep 3 · Thu-6 L16. Grammar-based fuzzing | Topic 2 |
| 7 | — | Sep 8 · Tue-7 L17. Data-flow analysis: CFGs & reaching definitions | Sep 9 · Wed-7 L18. Very busy, available & live variables |
Sep 10 · Thu-7
L19. Interval analysis & widening
Quiz 1 · 6:30 PM
|
Topic 3 HW 2 out Sep 7 Quiz 1 |
| — | Sep 13–20 Mid-Semester Examinations | ||||
| 8 | — |
Sep 22 · Tue-8
L20. Interval analysis & widening (cont.)
Industry Talk 1 — “What Makes a Compiler Secure?”
Nirmal Selvarathinam (NVIDIA) · online · 7:00–8:00 PM · recording soon |
Sep 23 · Wed-8 L21. Information flow analysis | Sep 24 · Thu-8 L22. Information flow analysis (cont.) | Project proposal due Sep 20 Industry Talk 1 · evening, online |
| 9 | — | Sep 29 · Tue-9 L23. Pointer analysis | Sep 30 · Wed-9 L24. Pointer analysis (cont.) | Oct 1 · Thu-9 No class — Friday timetable | — |
| 10 | — | Oct 6 · Tue-10 L25. Pointer analysis (cont.) | Oct 7 · Wed-10 L26. Pointer analysis (cont.) | Oct 8 · Thu-10 L27. Constraint-based analysis | — |
| 11 | — | Oct 13 · Tue-11 L28. Constraint-based analysis (cont.) | Oct 14 · Wed-11 L29. Type systems |
Oct 15 · Thu-11
L30. Type systems (cont.)
Industry Talk 2 — “Static Analysis at Scale: An Industrial Perspective”
Madhukar Yerraguntla (Qualcomm) · online · 7:00–8:00 PM |
Progress meeting 1 · Oct 11–16 Industry Talk 2 · evening, online |
| 12 | — | — | Oct 21 · Wed-12 L32. Type systems (cont.) | Oct 22 · Thu-12 L33. Symbolic execution | HW 2 due Oct 26 No Tue class this week (institute calendar). |
| 13 | — | Oct 27 · Tue-13 L34. Symbolic execution (cont.) | Oct 28 · Wed-13 L35. Concolic execution | Oct 29 · Thu-13 L36. Concolic execution (cont.) | Progress meeting 2 · Oct 26–30 |
| 14 | — | Nov 3 · Tue-14 L37 | Nov 4 · Wed-14 L38 |
Nov 5 · Thu-14
L39
Quiz 2 · 6:00–7:00 PM
|
Quiz 2 |
| 15 | — |
Nov 10 · Tue-15
Selected project presentations
last teaching day · teams with upstream-accepted bugs
Industry Talk 3 — evening, online · 6:00–7:00 PM
|
Nov 11 · Wed-15 — | Nov 12 · Thu-15 — | Industry Talk 3 Paper + repo due Fri Nov 13, 23:59 IST |
| — | Nov 14–21 End-Semester Examinations · final project presentations (Calendly booking soon) | ||||
Syllabus
| # | Topic | Sessions | Count |
|---|---|---|---|
| 1 | Foundations & Program Representation (incl. Clang / LLVM IR, specifications, Hoare logic & invariants) | L1–L12 | 12 |
| 2 | Testing (coverage, mutation, fuzzing, grammar-based) | L13–L16 | 4 |
| 3 | Dataflow Analysis (incl. interval analysis & information flow) | L17–L22 | 6 |
| 4 | Pointer Analysis | L23–L24 | 2 |
| 5 | Constraint-Based Analysis | L25–L28 | 4 |
| 6 | Type Systems | L29–L30, L32 | 3 |
| 7 | Symbolic & Concolic Execution | L33–L38 | 6 |
| 8 | Automated Test Generation | L39 | 1 |
| — | Industry talks (guest sessions) | Three evening sessions (IT1–IT3) | — |
| — | Total | L1–L39 (L31 vacant) | 38 |
Logistics
- Classroom
- Room 5G4, Core 5
- Lecture days
- Weeks 1–3: Mon / Tue / Wed · Week 4 onwards (from 18 Aug): Tue / Wed / Thu
- Lecture times
- Mon 5:00–5:55 PM · Tue 4:00–4:55 PM · Wed 3:00–3:55 PM · Thu 2:00–2:55 PM
- Thursday slot
- Now a regular lecture day. Both quizzes are held in the evening (Quiz 1 at 6:30 PM, Quiz 2 at 6:00–7:00 PM), so the afternoon slot is a lecture even on quiz days. It also carries Quiz 1 (Thu 10 Sep), Quiz 2 (Thu 5 Nov). The final project presentations are held during end-semester week (14–21 Nov).
- Office hours
- By appointment · email the instructor/TAs
- Discussion
- Microsoft Teams (CS 5187 channel) · course email list
- Handouts & slides
- Course Website
- Progress meetings
- Microsoft Teams (scheduled 1:1 or per group) or offline
- Prerequisites
- Data structures, C/C++ or Java, basic OS & compilers
Grading
- End-semester exam
- 30 %
- Mid-semester exam
- 25 %
- H/W assignments (3)
- 10 %
- Quizzes (2)
- 10 % (5 % each)
- Term project
- 20 % (see Project for internal breakdown)
- Attendance
- 5 %
- Total
- 100 %
Quizzes (10 %)
- Quiz 1
- Thu 10 September 2026, 6:30 PM · covers Topics 1–3 (Foundations, Testing, Dataflow). Held in the evening, so the afternoon lecture slot runs as usual.
- Quiz 2
- Thu 5 November 2026, 6:00–7:00 PM · covers everything from after the mid-semester exam onwards — Information flow (L21–L22) and Topics 4–8 (Pointer, Constraint-based, Types, Symbolic & concolic execution, Test generation). Held in the evening, so the afternoon lecture slot runs as usual.
Term Project (20 %)
Term project ideas.
They are only examples; you are free to propose your own.
Accept the term project assignment.
- Implementation & results
- 50 % — Does the analyzer find real vulnerabilities and generate successful exploits or fixes?
Full marks on this component require a bug accepted by upstream maintainers.
- Progress meetings & final presentation
- 25 % — Can you present and explain your work? Evaluated across 3 progress meetings + the final presentation.
- Report (FSE format)
- 25 % — Is the work clearly described and illustrated?
Team & individual accountability
- Group size: 2–3 members per team.
- Each member must justify their contribution (a signed statement in the report plus commit history in the repo).
- At every progress meeting and at the final presentation, each member must be able to answer any question about any part of the project. “That was X's part” is not an acceptable answer.
Timeline
- Proposal submitted
- Immediately after the mid-semester exam · by Sun 20 Sep 2026, on the
project proposal form.
One submission per team. The team leader fills the form on behalf of the group — other members must not submit it again.
- Proposal approved
- Within one week · do not start work before written approval.
- Progress meeting 1
- 11 – 16 Oct 2026 · scope firmed up, target OSS accessible, initial pipeline running. Book a slot on Teams.
- Progress meeting 2
- 26 – 30 Oct 2026 · first end-to-end results, first bug candidates, evaluation plan.
- Final presentation
- During end-semester week (14 – 21 Nov 2026) · 10–15 min per group + Q&A · Calendly booking link coming soon.
- Paper + repo due
- Fri 13 Nov 2026, 23:59 IST · Overleaf project link + PDF + public GitHub repo + reproducibility instructions submitted via Teams before end-sem week.
Target open-source project
- Must be widely used — think Linux kernel Chromium/V8 FFmpeg OpenSSL SQLite Postgres Node.js CPython LLVM and similar. Popular runtimes, browsers, kernels, media libraries, cryptography libraries, and databases are on-scope.
- You cannot pick an obscure repo and simply point your tool at it. Rule of thumb: the project should have a large public user base and a functioning security / bug-triage process.
- Get the target on the proposal so I can green-light it before you invest time.
Deliverables
- Proposal (2 pages): problem, target OSS project, technique, plan, team & role split. Submitted by the team leader on the proposal form by 20 Sep 2026.
- Paper in FSE format: motivation, technique, implementation, evaluation, related work, threats to validity. Use the ACM Primary Article Template (LaTeX
sigconf), written in an Overleaf project shared with the instructor. PDF submitted with the artifact. - Public GitHub repo containing:
- Source code with a permissive license
README.mdwith build + run instructions, exact dependencies, and one-command reproduction of the headline result- Bug reports / PRs / patches you filed upstream, linked with their state (open / acknowledged / merged)
What earns full marks on the “implementation” component
- Your tool finds at least one real, previously-unknown bug in the target project and
- The bug report / patch is accepted by upstream maintainers (merged PR, accepted CVE, or acknowledged advisory).
- Partial credit is available for high-quality tooling and reproducible evaluation even if no bug lands; the ceiling on this component is capped without an upstream-accepted finding.
Staff
- Instructor
- Bernard Nongpoh · bnongpoh@iitg.ac.in
- Teaching assistants
-
-
Shruti Yadav shruti.yadav@iitg.ac.in
-
Kunal Upadhyay k.upadhyay@iitg.ac.in
-
Rhythm Jamwal rhythm.jamwal@iitg.ac.in
-
Yatharth Sonteke y.sonteke@iitg.ac.in
-
Leisel Rangsuo Koireng leisel.koireng@iitg.ac.in
-
Policies
Collaboration. Discuss ideas freely; write up assignments individually. Cite any external references you consulted. Academic honesty. Standard institute rules apply. LLM use must be disclosed and cannot replace your own understanding of the material.