(Press-News.org) At the Association for Computing Machinery's Programming Language Design and Implementation this month, MIT researchers presented a new system that repairs dangerous software bugs by automatically importing functionality from other, more secure applications.
Remarkably, the system, dubbed CodePhage, doesn't require access to the source code of the applications whose functionality it's borrowing. Instead, it analyzes the applications' execution and characterizes the types of security checks they perform. As a consequence, it can import checks from applications written in programming languages other than the one in which the program it's repairing was written.
Once it's imported code into a vulnerable application, CodePhage can provide a further layer of analysis that guarantees that the bug has been repaired.
"We have tons of source code available in open-source repositories, millions of projects, and a lot of these projects implement similar specifications," says Stelios Sidiroglou-Douskos, a research scientist at CSAIL who led the development of CodePhage. "Even though that might not be the core functionality of the program, they frequently have subcomponents that share functionality across a large number of projects."
With CodePhage, he says, "over time, what you'd be doing is building this hybrid system that takes the best components from all these implementations."
Sidiroglou-Douskos and his coauthors -- MIT professor of computer science and engineering Martin Rinard, graduate student Fan Long, and Eric Lahtinen, a researcher in Rinard's group -- refer to the program CodePhage is repairing as the "recipient" and the program whose functionality it's borrowing as the "donor." To begin its analysis, CodePhage requires two sample inputs: one that causes the recipient to crash and one that doesn't. A bug-locating program that the same group reported in March, dubbed DIODE, generates crash-inducing inputs automatically. But a user may simply have found that trying to open a particular file caused a crash.
Carrying the past
First, CodePhage feeds the "safe" input -- the one that doesn't induce crashes -- to the donor. It then tracks the sequence of operations the donor executes and records them using a symbolic expression, a string of symbols that describes the logical constraints the operations impose.
At some point, for instance, the donor may check to see whether the size of the input is below some threshold. If it is, CodePhage will add a term to its growing symbolic expression that represents the condition of being below that threshold. It doesn't record the actual size of the file -- just the constraint imposed by the check.
Next, CodePhage feeds the donor the crash-inducing input. Again, it builds up a symbolic expression that represents the operations the donor performs. When the new symbolic expression diverges from the old one, however, CodePhage interrupts the process. The divergence represents a constraint that the safe input met and the crash-inducing input does not. As such, it could be a security check missing from the recipient.
CodePhage then analyzes the recipient to find locations at which the input meets most, but not quite all, of the constraints described by the new symbolic expression. The recipient may perform different operations in a different order than the donor does, and it may store data in different forms. But the symbolic expression describes the state of the data after it's been processed, not the processing itself.
At each of the locations it identifies, CodePhage can dispense with most of the constraints described by the symbolic expression -- the constraints that the recipient, too, imposes. Starting with the first location, it translates the few constraints that remain into the language of the recipient and inserts them into the source code. Then it runs the recipient again, using the crash-inducing input.
If the program holds up, the new code has solved the problem. If it doesn't, CodePhage moves on to the next candidate location in the recipient. If the program is still crashing, even after CodePhage has tried repairs at all the candidate locations, it returns to the donor program and continues building up its symbolic expression, until it arrives at another point of divergence.
Automated future
The researchers tested CodePhage on seven common open-source programs in which DIODE had found bugs, importing repairs from between two and four donors for each. In all instances, CodePhage was able to patch up the vulnerable code, and it generally took between two and 10 minutes per repair.
As the researchers explain, in modern commercial software, security checks can take up 80 percent of the code -- or even more. One of their hopes is that future versions of CodePhage could drastically reduce the time that software developers spend on grunt work, by automating those checks' insertion.
"The longer-term vision is that you never have to write a piece of code that somebody else has written before," Rinard says. "The system finds that piece of code and automatically puts it together with whatever pieces of code you need to make your program work."
INFORMATION:
Additional background
ARCHIVE: Better debugger
ARCHIVE: Harnessing error-prone chips
ARCHIVE: Writing programs using ordinary language
WASHINGTON - Tremendous variability in wait times for health care appointments exists throughout the U.S., ranging from same day service to several months, says a new report from the Institute of Medicine. However, there is currently an opportunity to develop "systems-based approaches" -- similar to systems-based engineering approaches applied successfully in industries beyond health care -- that aim to provide immediate engagement of a patient's concern at the point of initial contact and can be used in in-person appointments as well as alternatives such as team-based ...
MADISON - A group of University of Wisconsin-Madison engineers and a collaborator from China have developed a nanogenerator that harvests energy from a car's rolling tire friction.
An innovative method of reusing energy, the nanogenerator ultimately could provide automobile manufacturers a new way to squeeze greater efficiency out of their vehicles.
The researchers reported their development, which is the first of its kind, in a paper published May 6, 2015, in the journal Nano Energy.
Xudong Wang, the Harvey D. Spangler fellow and an associate professor of materials ...
NEW YORK -- June 29, 2015 /Press Release/ -- Scientists from the Icahn School of Medicine at Mount Sinai have developed a new approach to build nearly complete genomes by combining high-throughput DNA sequencing with genome mapping. The methodology enabled researchers to detect complex forms of genomic variation, critically important for their association with human disease, but previously difficult to detect. The study was published today in Nature Methods, and is a collaboration with scientists at European Molecular Biology Lab, Weill Cornell Medical College, Cold Spring ...
Will next Saturday's Tour de France prologue in Utrecht get the winner it deserves? New aerodynamic research at Eindhoven University of Technology (TU/e) shows that riders in a time trial can save vital seconds by riding closer to the following team car. Over a short distance like the prologue of the Tour de France, that can save as much as 6 seconds: enough to make the difference between winning and losing. On longer time trials and events like world championships, the effect can even add up to tens of seconds. Which is why aerodynamics professor Bert Blocken is advising ...
US researchers extol the virtues of high-altitude balloons for science education in a research paper published in the International Journal of Learning Technology. According to Jeremy Straub of the University of North Dakota in Grand Forks, "High-altitude balloons can carry student and scientific payloads to the boundaries of space."
This, he suggests, gives students the opportunity to carry out experiments in a cold, near-vacuum, higher-radiation environment at such very high altitudes. "In the process, students experience the awe of space exploration as, through their ...
Nyon, Switzerland - June 29, 2015 While there is good understanding of how bone mass, and more recently bone architecture, affects fracture risk, far less is known about the material properties of bone, or how these can impart resilience or fragility to the skeleton. This is changing thanks to the development of new state-of-the-art imaging and other technologies which now allow researchers to gain new insights into the different material properties of bone and their role in bone fragility.
Bringing together eight invited contributions by the field's leading experts, ...
CHICAGO (June 29, 2015): A scoring system that can identify periods of high activity and increased trauma patient deaths in hospital emergency rooms may help hospitals better prepare for surges in trauma patient volume that come with catastrophic events like the Boston Marathon bombing (April 2013) or disasters like the Amtrak train crash (May 2015) in Philadelphia.
Trauma surgeon Peter C. Jenkins, MD, MSc, and a team of investigators from Indiana University and multiple centers developed the scoring system, called the Trauma Surge Index (TSI). They reported their observations ...
WASHINGTON, June 29, 2015 -- If you're firing up the barbecue this week for an Independence Day cookout, you don't want to miss this week's Reactions video. We've got chemistry knowledge that will impress your guests like, "Why is red meat red?" You'll also learn about the amazing Maillard reaction that turns that red meat into a delicious grilled brown. We also settle, once and for all, the age-old debate of gas vs. charcoal. It's all in our latest video: https://youtu.be/RqUEh-B-U-k.
Subscribe to the series at http://bit.ly/ACSReactions, and follow us on Twitter @ACSreactions ...
HOUSTON, June 29 -- Many parents have heard the night-time cry of "my ear hurts." For some children, this might happen frequently beginning in infancy and even persist into adulthood. An international consortium led by those at Baylor College of Medicine may have taken the first step on the road to understanding why only some people get frequent painful or chronic middle ear infections. The culprit may be rare genetic variants in a gene called A2ML1.
A report on their work appears online in the journal Nature Genetics.
In studies led by Dr. Regie Lyn P. Santos-Cortez, ...
New research released today in Nature Neuroscience reveals for the first time that pain is processed in male and female mice using different cells. These findings have far-reaching implications for our basic understanding of pain, how we develop the next generation of medications for chronic pain--which is by far the most prevalent human health condition--and the way we execute basic biomedical research using mice.
"Research has demonstrated that men and women have different sensitivity to pain and that more women suffer from chronic pain than men, but the assumption ...
