SAILOR automates the construction of symbolic execution harnesses by combining static analysis and LLM-based synthesis, significantly improving the scalability and effectiveness of vulnerability disco…

The paper proposes a generic memory framework for advanced static program analysis, supporting various memory behaviors from different programming languages using Abstract Interpretation theory.

The paper proposes a novel symbolic execution technique that combines speculative library preloading and custom software hooks to recover Control Flow Graphs (CFGs) from binaries that use dynamic code…

The paper introduces a novel memory forensics framework to perform runtime analysis of Go malware, successfully recovering critical execution state and artifacts that are invisible to traditional stat…

This study conducts a large-scale longitudinal analysis of CodeQL, finding that while the tool is effective at detecting vulnerabilities, its detection capabilities are not guaranteed to be stable acr…

The largest reported verification campaign for the Rust standard library is presented, integrating complementary tools and analyzing effectiveness.

LEAF is a dynamic analysis framework for Rust that captures MIR-level semantic information and delivers it as an event stream through Dynamic MIR.

MemHint is a neuro-symbolic static analysis pipeline that significantly improves memory leak detection in C/C++ by combining LLM semantic understanding with Z3 symbolic reasoning, detecting more leaks…

This paper proposes an automated static verification method for a subset of WebAssembly using a CHCs satisfiability solver, addressing challenges of handling indirect function calls and analyzing larg…

The paper introduces PeAR, a static binary rewriting framework that proves static binary instrumentation (SBI) is a practical and effective alternative to dynamic binary instrumentation (DBI) for high…

The paper proposes a general, compiler-integrated framework for secure content composition that minimizes the syntactic difference between secure and insecure coding practices.

Kani is an open-source model checker for Rust that provides correctness guarantees for safety properties through compilation and a specification language.

SEMBridge is a tagless-final framework that allows a single executable object program to generate multiple program semantics, including weakest-precondition and bounded-checking interpretations, ensur…

This paper presents the formal semantics for unfolding expressions and pure functions in deductive program verifiers for increased modularity.

KoAT is a tool that automatically infers complexity bounds and proves termination of integer programs using an alternating modular analysis approach and a portfolio of techniques.

The paper introduces Heimdall, an automated pipeline that uses LLMs and formal verification to safely and automatically migrate legacy, potentially buggy eBPF programs written in C to memory-safe Rust…

Filament is a novel, compiler-agnostic static information-flow control (IFC) library for Rust that enables fine-grained, Denning-style tracking of both explicit and implicit data flows with minimal pr…

LISA is a novel LLM-based invariant testing framework for software functional bugs, achieving higher bug-detection rates and competitive code coverage than fuzzing and prior LLM-based test generation…

This paper presents CopilotVerifier, a tool that generates proofs of correctness for the compiled output of the Copilot runtime verification framework.