Adding diversity and realism to LAVA, a vulnerability addition system
Name
1081042589-MIT.pdf
Description
Full printable version
Size
876.23 KB
Format
Adobe PDF
Checksum (MD5)
90959332daf780ae0e60e022b6429ac8
Author(s)
Sridhar, Rahul
Advisor(s)
Timothy Leek.
Date Issued
2018
Publisher
Massachusetts Institute of Technology
Abstract
In this thesis, I designed and implemented several modifications to LAVA, a vulnerability addition system, with the goal of improving realism and diversity of the injected bugs. Specifically, I describe three separate improvements: a method to add fake bugs alongside real ones in order to decrease bug discoverability, two approaches to increase the complexity of the data flow of the inserted bugs, and a standalone program that uses equality saturation to diversify C-source codebases that can be added as a final stage to LAVA. Finally, I present two instances of bug-finding competitions-AutoCTF and Rode0day-that I helped design and run, which leveraged LAVA and the augmentations described in this thesis in order to accomplish their respective goals.
Description
Thesis: M. Eng., Massachusetts Institute of Technology, Department of Electrical Engineering and Computer Science, 2018.
This electronic version was submitted by the student author. The certified thesis is available in the Institute Archives and Special Collections.
Cataloged from student-submitted PDF version of thesis.
Includes bibliographical references (pages 63-64).
Subjects
Electrical Engineering and Computer Science.
MIT Department
Massachusetts Institute of Technology. Department of Electrical Engineering and Computer Science
Terms of Use
MIT theses are protected by copyright. They may be viewed, downloaded, or printed from this source but further reproduction or distribution in any format is prohibited without written permission.
Persistent DSpace Link
