research
∙
09/07/2023
Assume but Verify: Deductive Verification of Leaked Information in Concurrent Applications (Extended Version)
We consider the problem of specifying and proving the security of non-tr...
share
research
∙
01/23/2023
Detecting Excessive Data Exposures in Web Server Responses with Metamorphic Fuzzing
APIs often transmit far more data to client applications than they need,...
research
∙
05/13/2022
A Hoare Logic with Regular Behavioral Specifications
We present a Hoare logic that extends program specifications with regula...
research
∙
12/24/2021
State Selection Algorithms and Their Impact on The Performance of Stateful Network Protocol Fuzzing
The statefulness property of network protocol implementations poses a un...
research
∙
09/08/2021
SecRSL: Security Separation Logic for C11 Release-Acquire Concurrency (Extended version with technical appendices)
We present Security Relaxed Separation Logic (SecRSL), a separation logi...
research
∙
08/06/2021
Deductive Verification via the Debug Adapter Protocol
We propose a conceptual integration of deductive program verification in...
research
∙
07/12/2021
Incremental Vulnerability Detection with Insecurity Separation Logic
We present the first compositional, incremental static analysis for dete...
research
∙
10/27/2020
Verified Secure Compilation for Mixed-Sensitivity Concurrent Programs
Proving only over source code that programs do not leak sensitive data l...
research
∙
03/10/2020
An Under-Approximate Relational Logic: Heralding Logics of Insecurity, Incorrect Implementation More
Recently, authors have proposed under-approximate logics for reasoning a...
research
∙
02/15/2020
Legion: Best-First Concolic Testing
Legion is a grey-box concolic tool that aims to balance the complementar...
research
∙
01/30/2020
VERONICA: Expressive and Precise Concurrent Information Flow Security (Extended Version with Technical Appendices)
Methods for proving that concurrent software does not leak its secrets h...
research
∙
07/01/2019
Verifying that a compiler preserves concurrent value-dependent information-flow security
It is common to prove by reasoning over source code that programs do not...
research
∙
05/02/2019
Empirically Analyzing Ethereum's Gas Mechanism
Ethereum's Gas mechanism attempts to set transaction fees in accordance ...
research
∙
01/24/2019
Can We Prove Time Protection?
Timing channels are a significant and growing security threat in compute...
research
∙
09/15/2017
VST-Flow: Fine-grained low-level reasoning about real-world C code
We show how support for information-flow security proofs could be added ...
research
∙
11/13/2015