Static Analysis and Software Assurance

In the past decade, explosive growth in computer networks has brought security issues to the forefront. One of the greatest challenges in computer security today is the software assurance problem: How do we deal with the fact that our most trusted software, even our security software itself, is often buggy?In this talk, I will discuss how static analysis can help with the software assurance problem. I will describe some recent experience with static analysis tools for vulnerability detection. I will also survey a number of open problems in the field and suggest a few promising directions for future research.