IS661: Advanced Software Security (고급 소프트웨어 보안)
Logistics
- Instructor: Kihong Heo (허기홍, kihong.heo@prosys.kaist.ac.kr)
- TAs (mailing list: is661.ta@prosys.kaist.ac.kr)
- Yeonhee Ryou (류연희)
- Jaeseong Kwon (권재성)
- Time: Tue/Thr 09:00 - 10:15
- Location: N5 2243
- Office hours:
- Instructor: Mon 10:30 - 11:30
- TAs: Wed 10:30 - 11:30
Course Description
The goal of this course is to develop scientific communication skills. Students will learn how to write a research paper, give a technical talk, and review a research paper. Students will propose and complete a research project during the semester.
Grading
- Homework: 40%
- Final project: 50%
- Participation: 10%
Project Theme: Understandable & Explainable Programming Systems
Observation is the beginning of all sciences. For example, Heliocentrism, one of the most important scientific discoveries, started from several critical observations by Galileo Galilei. This observation led to the development of modern astronomy. Computer science is no exception. Only when we observe the behavior of large and complicated software systems, we can understand how they work and discover new knowledge.
The project theme of this course is "Be Galileo of Programming Systems". Students will make a visualization tool for understandable and explainable programming systems (e.g., program analyzer, fuzzer, synthesizer, compiler, etc). The visualization tool should help users understand the behavior of the underlying programming system. For example, such tools can provide the following benefits:
- Help computer scientists (e.g., yourself) find new research problems in programming language, software engineering, or security.
- Help non-expert users understand the behavior of software analyzers.
Students can refer to the following projects for inspiration:
Paper & Proposal Review
We use HotCRP.
Academic Integrity Violation
Students who violate academic integrity will get an F. See the KAIST CS honor code.
Student Artifacts
Visit this page and have fun with student artifacts.
Schedule
| Date | Topics | Watching | Homework |
|---|---|---|---|
| 2/27 | Introduction | ||
| 2/29 | You and Your Research |  |
|
| 3/5 | Discussion | HW1: Essay (due: 3/3 23:59:59) | |
| 3/7 | How to Write a Great Research Paper | |
|
| 3/12 | How to Write Papers So People Can Read Them | |
|
| Data Visualization | |
||
| 3/14 | Discussion | HW2: Your quick sort paper (due: 3/12 23:59:59) | |
| 3/19 | How to Give a Great Research Talk | |
|
| 3/21 | Research Talk 1 | HW3: Review (due: 3/21 23:59:59) | |
| 3/26 | Research Talk 2 | ||
| 3/28 | Research Talk 3 | ||
| 4/2 | How to Write a Grant Proposal | |
|
| 4/4 | Project Proposal Talk 1 | HW4: Project Proposal (due: 4/2 23:59:59) | |
| 4/9 | Project Proposal Talk 2 | ||
| 4/11 | Project Proposal Talk 3 | ||
| 4/16 | Mid term week (no class) | ||
| 4/18 | Mid term week (no class) | ||
| 4/23 | Paper Presentation 1 | ||
| 4/25 | Paper Presentation 2 | ||
| 4/30 | Paper Presentation 3 | ||
| 5/2 | Paper Presentation 4 | ||
| 5/7 | Paper Presentation 5 | ||
| 5/9 | Paper Presentation 6 | ||
| 5/14 | Paper Presentation 7 | HW5: Paper Review (due: 5/14 23:59:59) | |
| 5/16 | Final Project Presentation 1 | ||
| 5/21 | No Class | ||
| 5/23 | Final Project Presentation 2 | ||
| 5/28 | Final Project Presentation 3 | ||
| 5/30 | Final Project Presentation 4 | ||
| 6/4 | Final Project Presentation 5 | Project: Paper (due: 6/5 23:59:59) |
Papers
Program Analysis & Testing
- On-The-Fly Static Analysis via Dynamic Bidirected Dyck Reachability, POPL'24
- UBfuzz: Finding Bugs in Sanitizer Implementations, ASPLOS'24
- Abstract Interpretation of Fixpoint Iterators with Applications to Neural Networks, PLDI'23
- Compiler Test-Program Generation via Memoized Configuration Search, ICSE'23
- Return of CFA: Call-Site Sensitivity Can Be Superior to Object Sensitivity Even for Object-Oriented Programs, POPL'22
- Finding Real Bugs in Big Programs with Incorrectness Logic, OOPSLA'22
- Demanded Abstract Interpretation, PLDI'21
- Incremental Whole-Program Analysis in Datalog with Lattices, PLDI'21
- Abacus: Precise Side-Channel Analysis, ICSE'21
- Incorrectness logic, POPL'20
Program Verification
- Formally Verified Native Code Generation in an Effectful JIT: Turning the CompCert Backend into a Formally Verified JIT Compiler, POPL'23
- Alive2: bounded translation validation for LLVM, PLDI'21
- Towards a Verified Range Analysis for JavaScript JITs, PLDI'20
Program Synthesis
- Optimal Program Synthesis via Abstract Interpretation, POPL'24
- babble: Learning Better Abstractions with E-Graphs and Anti-unification, POPL'23
- FlashFill++: Scaling Programming by Example by Cutting to the Chase, POPL'23
- Inductive Synthesis of Structurally Recursive Functional Programs from Non-recursive Expressions, POPL'23
- DPGen: Automated Program Synthesis for Differential Privacy, CCS'21
- Data-Driven Synthesis of Provably Sound Side Channel Analyses, ICSE'21
- Optimizing Homomorphic Evaluation Circuits by Program Synthesis and Term Rewriting, PLDI'20
AI-based Programming Systems & Large Language Models
- Large Language Models for Code: Security Hardening and Adversarial Testing, CCS'23
- Monitor-Guided Decoding of Code LMs with Static Analysis of Repository Context, NeurIPS'23
- Prompting Is Programming: A Query Language for Large Language Models, PLDI'23
- Scallop: A Language for Neurosymbolic Programming, PLDI'23