State of Attack Surface Elimination in a World Plagued by Vulnerable Software
summary
Claims a system called VEDA (Vulnerability Elimination through Deep Analysis) that finds vulnerabilities inside binaries without relying on package versions, using 1,300+ binary features plus reverse‑engineered code blocks, vectorized embeddings and a classifier. It trains on CVE/CWE/CVSS labels, fine‑tunes offline fine‑tuned LLMs (CodeLlama/CodeGen2/Mistral), shows a demo flagging a shellshock variant at 100% confidence, and pairs detection with payload‑agnostic mitigations (config/registry changes) instead of patches.
AI-written summary · about
chapters (8)
- 0:00Introduction
- 1:46Attack surface discovery challenges
- 7:10Veda vulnerability system
- 11:34Feature extraction demo
- 13:02Deep learning for vulnerabilities
- 16:53Code-based mitigations
- 18:17Approach benefits
- 20:46Trial offer and closing
related talks
51mVulnerabilities Without CVEs: Governing the Dark Matter of Internal and Unknown Software
23mSecurity Outgunned: Measuring Software Defined Attack Surface
39mSoftware Security Engineering (Learnings from the past to fix ...)
45mFinding Vulnerabilities through Static Analysis and Scripting
45mEradicating Vulnerability Classes by Shelving SAST and Embracing Secure Defaults and Invariants
38mEffective Usage Analysis: Boosting Developer Productivity Via Innovative, Noise-reduced Vulnerability Analysis
36mUsing AI to Discover Silently Patched Vulnerabilities in Open...
33mWhere is my Code Vulnerable: Matching CVEs and Source Code