Software Vulnerabilities (SVs) are increasing in complexity and scale, posing great security
risks to many software systems. Given the limited resources in practice, SV assessment and …

In the era of the internet of things (IoT), software-enabled inter-connected devices are of
paramount importance. The embedded systems are very frequently used in both security …

Security testing aims at verifying that the software meets its security properties. In modern
Web systems, however, this often entails the verification of the outputs generated when …

Fuzzing and symbolic execution are popular techniques for finding vulnerabilities and
generating test-cases for programs. Fuzzing, a blackbox method that mutates seed input …

We present MemFix, an automated technique for fixing memory deallocation errors in C
programs. MemFix aims to fix memory-leak, double-free, and use-after-free errors, which …

Security testing verifies that the data and the resources of software systems are protected
from attackers. Unfortunately, it suffers from the oracle problem, which refers to the …

Today's software systems tend to be long-living and often process security-critical data, so
keeping up with ever-changing security measures, attacks, and mitigations is critical to …

To facilitate communication among stakeholders, software security requirements are
typically written in natural language and capture both positive requirements (ie, what the …

Symbolic execution is a systematic technique for checking programs, which forms a basis for
various software testing and verification techniques. It provides a powerful analysis in …

Testing is the most widely employed method to find vulnerabilities in real-world software
programs. Compositional analysis, based on symbolic execution, is an automated testing …