Dr Adriana Sejfia - University of Edinburgh

The ideal solution would create vulnerability categories that factor in the root cause, enabling highly accurate specialised detection models. These categories can strengthen prevention efforts by pinpointing common vulnerability-inducing coding constructs. Detecting vulnerabilities with high accuracy is necessary but not sufficient. Vulnerabilities are often subtle and invoke various code elements which software engineers need to understand before providing a fix. That is why explanations, ignored by the current black-box techniques, are essential for industry adoption. Vulnerability datasets often include the exploit that triggers each vulnerability, a useful – but thus far unused – source for explanations. Historical exploits can be used to synthesise a new exploit on-demand automatically. 

Automated, explainable vulnerability detection and prevention is crucial for ensuring secure software. To that end, this project will use vulnerability data to: recategorise vulnerabilities through static analysis and machine learning; deliver specialised detection models; discover vulnerability-inducing constructs via code comprehension and graph-mining techniques; and provide explanations via program synthesis.