Textbooks & primary references
- NNH
- Nielson, Nielson, Hankin. Principles of Program Analysis. Springer, 2005.
- M&S
- Møller & Schwartzbach. Static Program Analysis. cs.au.dk/~amoeller/spa/ (free).
- Aho
- Aho, Lam, Sethi, Ullman. Compilers: Principles, Techniques & Tools, 2nd ed.
- FB
- Zeller, Gopinath, Böhme, Fraser, Holler. The Fuzzing Book. fuzzingbook.org.
Readings for this week will be posted when the week begins.
L1. Course intro & motivation
- Slides
- L1 — Course intro & motivation (PDF)
- Handout
- L1 — handout (PDF)
- Follow
- Paper
L2. Static, dynamic, and hybrid analysis; program invariants
- Handout
- L2 — handout (PDF)
- Follow
- NNH §1.1–1.3; RY ch. 1
- Paper
- Ernst, “Static and Dynamic Analysis: Synergy and Duality”, WODA 2003; Ernst, Cockrell, Griswold, Notkin, “Dynamically Discovering Likely Program Invariants…” (Daikon), TSE 2001.
L3. Vulnerability assessment and secure coding
- Slides
- L3 — Vulnerability assessment and secure coding (PDF)
- Handout
- L3 — handout (PDF)
- Follow
- Paper
- Wagner, Foster, Brewer, Aiken. “A First Step Towards Automated Detection of Buffer Overrun Vulnerabilities”, NDSS 2000; One. “Smashing the Stack for Fun and Profit”, Phrack 1996.
Readings for this week will be posted when the week begins.
L4. Soundness, completeness, undecidability
L5. Precision, recall, F-measure for analyzers
L6. Program representation: AST, CFG, intermediate representations
- Slides
- L6 — Program representation (PDF)
- Follow
- Aho ch. 5 & 8; NNH §1.5; Introduction to the Clang AST; CIS 547 — LLVM Framework Primer
- Paper
- Cytron et al. 1991 (SSA).
Readings for this week will be posted when the week begins.
L7. Clang tutorial: libtooling & AST-based analysis
- Slides
- L7 — Clang tutorial (external PDF, KAIST CS492)
- Follow
- LibTooling; RecursiveASTVisitor-based ASTFrontendActions; AST Matchers tutorial
- Note
- Delivered from the KAIST CS492 Clang tutorial deck linked above; the AST material it builds on is in L6.
L8. LLVM IR
- Slides
- L8 — LLVM IR (PDF)
- Follow
- LLVM Language Reference; CIS 547 — LLVM Framework Primer; Lattner & Adve 2004
- Paper
- Lattner & Adve 2004 (LLVM design).
L9. LLVM IR (continued): CFGs & the LLVM class hierarchy
- Slides
- L9 — LLVM IR continued (PDF)
- Follow
- LLVM Programmer's Manual; llvm::Value / llvm::Instruction doxygen
- Announced
- From Week 4 onwards the class meets on Tuesday, Wednesday and Thursday. HW-1 released (due Fri 21 Aug, 23:59 IST).
Timetable change. From this week the class meets on Tuesday, Wednesday and Thursday (announced in L9).
Readings for this week will be posted when the week begins.
L10. Software specifications; safety & liveness
- Slides
- L10 — Software specifications (PDF)
- Follow
- Naik, “Software Specifications”, CIS 5470 (Penn); The Checker Framework manual
- Paper
L11. Hoare logic
- Slides
- L11 — Hoare logic (PDF)
- Follow
- Svendsen, Hoare Logic and Model Checking (Cambridge), lectures 1–3
- Paper
- Hoare, “An Axiomatic Basis for Computer Programming”, CACM 12(10), 1969.
L12. Invariants & specification inference
- Slides
- L12 — Invariants and specification inference (PDF)
- Follow
- Naik, “Software Specifications”, CIS 5470 (Penn); JML
//@invariant///@requiresannotations - Paper
- Flanagan, Leino, “Houdini, an Annotation Assistant for ESC/Java”, FME 2001; Ernst et al., “Dynamically Discovering Likely Program Invariants” (Daikon), TSE 2001.
Wed 26 Aug — no class (holiday).
Readings for this week will be posted when the week begins.
L13. Coverage & mutation testing
- Slides
- L13 — Coverage & mutation testing (PDF)
- Follow
- Zhu, Hall, May, “Software Unit Test Coverage and Adequacy”, ACM CSUR 1997; Aho §9 (CFG background for branch coverage)
- Paper
- Jia, Harman, “An Analysis and Survey of the Development of Mutation Testing”, TSE 2011.
L14. Introduction to fuzzing
- Slides
- L14 — Introduction to fuzzing (PDF)
- Follow
- FB “Introduction to Fuzzing” & “Greybox Fuzzing”; AFL technical whitepaper (M. Zalewski)
- Paper
- Miller, Fredriksen, So, “An Empirical Study of the Reliability of UNIX Utilities”, CACM 1990; Böhme, Pham, Roychoudhury, “Coverage-based Greybox Fuzzing as Markov Chain” (AFLFast), CCS 2016; Fioraldi et al., “AFL++”, WOOT 2020.
Tue 1 Sep — no class (Institute Day).
Readings for this week will be posted when the week begins.
L15. Fuzzing: black-box & grey-box
- Slides
- L15 — Black-box & grey-box fuzzing (PDF)
- Follow
- FB “Introduction to Fuzzing” & “Greybox Fuzzing”; afl-fuzz technical whitepaper; libFuzzer and SanitizerCoverage docs
- Paper
- Miller, Fredriksen, So, “An Empirical Study of the Reliability of UNIX Utilities”, CACM 33(12), 1990; Fioraldi et al., “AFL++”, WOOT 2020.
L16. Grammar-based fuzzing
- Slides
- L16 — Grammar-based fuzzing (PDF)
- Follow
- FB “Grammar-based Fuzzing” & “Efficient Grammar Fuzzing”; LibAFL mutator concepts
- Paper
- Godefroid, Kiezun, Levin, “Grammar-based Whitebox Fuzzing”, PLDI 2008; Aschermann et al., “NAUTILUS: Fishing for Deep Bugs with Grammars”, NDSS 2019.
Readings for this week will be posted when the week begins.
Quiz 1 on Thu 10 Sep, 6:30 PM — covers Topics 1–3. The afternoon slot that day is a regular lecture.
L17. Data-flow analysis: CFGs, reaching definitions, lattices & fixed points
- Slides
- L17 — Data-flow analysis (PDF)
- Follow
- NNH §2.1 & ch. 4; Aho §9.2–9.3; Naik, “Data-Flow Analysis”, CIS 5470 (Penn)
- Paper
- Kildall, “A Unified Approach to Global Program Optimization”, POPL 1973; Cousot & Cousot, “Abstract Interpretation”, POPL 1977.
L18. Data-flow analysis: very busy & available expressions, live variables
- Slides
- L18 — Very busy, available & live (PDF)
- Follow
- NNH §2.1.3–2.1.5; Aho §9.2 & §9.4; M&S ch. 4
- Paper
- Cocke, “Global Common Subexpression Elimination”, SIGPLAN Notices 1970; Kildall, “A Unified Approach to Global Program Optimization”, POPL 1973.
L19. Interval analysis, widening & abstract interpretation
Slides, readings and outline posted when this lecture is delivered.
Quiz 1
- Covers
- Topics 1–3 (Foundations, Testing/Fuzzing, Dataflow) — definitions, algorithms, worked examples; closed book.
No classes. Mid-sem exam covers L1–L19 (Topics 1–3).
Project proposal due Sun 20 Sep — one submission per team, filed by the team leader.
Readings for this week will be posted when the week begins.
L21. Type-state analysis
Slides, readings and outline posted when this lecture is delivered.
L22. Taint analysis
Slides, readings and outline posted when this lecture is delivered.
Readings for this week will be posted when the week begins.
L23
Title, topic and materials posted when this lecture is delivered.
L24
Title, topic and materials posted when this lecture is delivered.
L25
Title, topic and materials posted when this lecture is delivered.
Readings for this week will be posted when the week begins.
L26
Title, topic and materials posted when this lecture is delivered.
L27
Title, topic and materials posted when this lecture is delivered.
L28
Title, topic and materials posted when this lecture is delivered.
Readings for this week will be posted when the week begins.
L29
Title, topic and materials posted when this lecture is delivered.
L30
Title, topic and materials posted when this lecture is delivered.
Readings for this week will be posted when the week begins.
L32
Title, topic and materials posted when this lecture is delivered.
L33
Title, topic and materials posted when this lecture is delivered.
Readings for this week will be posted when the week begins.
L34
Title, topic and materials posted when this lecture is delivered.
L35
Title, topic and materials posted when this lecture is delivered.
L36
Title, topic and materials posted when this lecture is delivered.
Readings for this week will be posted when the week begins.
Quiz 2 on Thu 5 Nov, 6:30 PM — covers Topics 4–8. The afternoon slot that day is a regular lecture.
L38
Title, topic and materials posted when this lecture is delivered.
L39
Title, topic and materials posted when this lecture is delivered.
Quiz 2
- Covers
- Topics 4–8 (Pointer, Constraint-based, Types, SymExec, Test generation) — definitions, algorithms, worked examples; closed book.
Readings for this week will be posted when the week begins.
L40
Title, topic and materials posted when this lecture is delivered.
L41
Title, topic and materials posted when this lecture is delivered.
Three guest lectures from industry practitioners, interleaved
with regular lectures to give a working-engineer view of
program analysis in real security/tooling teams. Format: 45 min talk
+ 10 min Q&A. Held in Room 5G4. Speakers
& topics will be filled in as they confirm;
L20. Industry Talk 1
- Speaker
- TBA
L31. Industry Talk 2
- Speaker
- TBA
L37. Industry Talk 3
- Speaker
- TBA