Title - APISan: Sanitizing API Usages through Semantic Cross-checking

Speaker - Taesoo Kim (Professor of Georgia Tech.)
Date - 2017.12.21(Thu) 18:00 ~ 19:00
Location - #604, Woojung CIC Building

Abstract:
API misuse is a well-known source of bugs. Some of them (e.g., incorrect use of SSL API, and integer overflow of memory allocation size) can cause serious security vulnerabilities (e.g., man-in-the-middle (MITM) attack, and privilege escalation). Moreover, modern APIs, which are large, complex, and fast evolving, are error-prone. However, existing techniques to help finding bugs require manual effort by developers (e.g., providing specification or model) or are not scalable to large real-world software comprising millions of lines of code.
In this paper, we present APISAN, a tool that automatically infers correct API usages from source code without manual effort. The key idea in APISAN is to extract likely correct usage patterns in four different aspects (e.g., causal relation, and semantic relation on arguments) by considering semantic constraints. APISAN is tailored to check various properties with security implications. We applied APISAN to 92 million lines of code, including Linux Kernel, and OpenSSL, found 76 previously unknown bugs, and provided patches for all the bugs.


Bio:
Taesoo Kim is an Assistant Professor in the School Computer Science at Georgia Tech. He is interested in building a system that has underline principles for why it should be secure. Those principles include the design of a system, analysis of its implementation, and clear separation of trusted components. He holds a B.S. from KAIST (2009), a S.M. (2011) and a Ph.D. (2014) from MIT.