Binoy Ravindran
Virginia Polytechnic Institute and State University, VA·Computer Science
Attackers exploit flaws in software to steal private data, leak system information and take control of computers. Today's tools for finding exploitable flaws cannot mathematically prove that a flaw they report is truly exploitable.
- Fields
Computer Science
Engineering
- Topics
software security
cybersecurity
exploit generation
- Grants
- 1 known grant, through May 2027
What they work on
- Develop methods that lift binary code into a provably over-approximate high-level model, one that captures both intended and unintended program behavior, for reasoning about exploitable flaws.
- Formulate exploit detection as a reachability problem using program logic triples, a variant of Hoare logic, to compute starting program states guaranteed to reach memory-corruption exploit states.
- Prove each step of the exploit-detection methodology correct in a theorem prover, software that checks mathematical proofs, so detected exploits are provably real.
- Apply the open-source toolchain to industrial production software to detect exploitable vulnerabilities, and integrate it into development environments and decompilers.
More about the research
They also cannot prove that a whole class of exploits is absent. This project aims to build techniques with mathematical guarantees: if a program contains a certain class of memory-corruption vulnerabilities, the method is guaranteed to find them.
Why it matters
Software that runs critical systems often includes old binary programs whose source code is unavailable, and their hidden memory flaws can be used to steal data or hijack machines. Tools that can prove a dangerous flaw exists could help security teams and software vendors find and fix these vulnerabilities more reliably. Open-source releases and plug-ins for common decompilers and development environments could put these tools in practitioners' hands.
Known grants
From NIH and NSF research grants. Labs often have other funding we can't see.
Closest labs
Swarat Chaudhuri
University of Texas at Austin, TX·Computer Science
Develop foundation model programming, which writes scientific hypotheses as programs combining symbolic rules with neural modules and foundation models, to extract interpretable concepts from images and video.
Yuyan Bao
Augusta University, GA·Computer Science
Develop verification methodologies for reasoning about function values — functions handled as data — in industrial programming languages, using first-order assertions and auxiliary logical variables suited to automated reasoning.
Qirun Zhang
Georgia Institute of Technology, GA·Computer Science·Early-career
Characterize what the InterDyck graph abstraction can and cannot express. This is a graph model of programs with matched-edge patterns that represents program meaning for analysis.
The school
Virginia Polytechnic Institute and State University: 35 labs on PI Pages, $657M a year on research, 496 research doctorates a year.
More about Virginia Polytechnic Institute and State University
Reach out
A start for your email. Fill in the brackets.