Quantitative Robustness for Vulnerability Assessment
summary
Defines quantitative robustness as the maximum proportion of uncontrolled inputs that hit a target location for some fixed controlled input and implements quantitative robust symbolic execution that reduces pathwise measurement to functional E‑MAJSAT. Implementation inside binc measures thresholds (example threshold 20%), finds paths with >99% and 50% robustness, reproduces CVE-2019-20839 case study, shows fewer false negatives than robust SE, compares solvers (naive and relax do best), and publishes reusable artifacts.
AI-written summary · about
chapters (11)
- 0:00Quantitative robustness intro
- 1:30Robustness in bug assessment
- 3:41Robustness vs reachability
- 5:03Formal robustness definition
- 6:30Path merging in analysis
- 7:35Reduction to functional image
- 9:41Experimental results
- 11:07Stack canary case study
- 12:13Best solvers for image set
- 12:54Future improvements
- 13:36Q&A
related talks
23mSecurity Outgunned: Measuring Software Defined Attack Surface
12mRepresentativeness in the Benchmark for Vulnerability Analysis Tools (B-VAT)
22mWhen is a vulnerability not a vulnerability? Overcoming the...
19mInference of Robust Reachability Constraints
38mEffective Usage Analysis: Boosting Developer Productivity Via Innovative, Noise-reduced Vulnerability Analysis
53mMetrics that Matter.Confidence & Resilience in Your Security Program
28mAccuracy Is Not Enough: Detecting Hidden Risk in CVE Impact Prediction
59mMadness of Vulnerability Management in Modern Cloud, Container, How to Win the Battle...