From Constraints to Cracks: Constraint Semantic Inconsistencies as
summary
Empirical study finds over 86% of embedded-system vulnerabilities trace to mismatched input constraints across front end, back-end explicit, and back-end desired checks. Static tool NÜWA extracts unified constraint matrices using HTML/JS parsers, function-summary-based interprocedural analysis, forward/backward slicing and ICFG-aware contract tracking; it out-detects five SOTA tools by +18, +22, +6, +17 and +19 vulnerabilities on a 31-bug dataset and discovers 152 previously unknown vulnerabilities (88 with CVE IDs).
AI-written summary · about
chapters (11)
- 0:00Embedded system security intro
- 0:32Vulnerability root causes
- 1:16Code security contracts
- 2:25Formalizing contract relationships
- 3:31Contract semantics in analysis
- 4:36Tool for contract inconsistencies
- 6:06Function summary and slicing
- 7:36Extracting contracts from code
- 8:40Analyzing ICFG contracts
- 9:42Tool performance evaluation
- 12:31Summary and conclusion
related talks
34mHow To Find And Prevent Entire Classes Of Security Vulnerabilities
43mSecurity Vulnerabilities Decomposition: Another way to look at Vulnerabilities
45mEradicating Vulnerability Classes by Shelving SAST and Embracing Secure Defaults and Invariants
48mKeynote Presentation: Escaping Cantor's Find-Fix Cycle
50mFix The Damned Software
41mVulnerabilities that Hide from your Tools
45mProtection and Verification of Security Design Flaws
01h 03m“Secure Coding Best Practices: Your First Line Is The Last Line Of Defense (2 of 2)”