Adding diversity and realism to LAVA, a vulnerability addition system

In this thesis, I designed and implemented several modifications to LAVA, a vulnerability addition system, with the goal of improving realism and diversity of the injected bugs. Specifically, I describe three separate improvements: a method to add fake bugs alongside real ones in order to decrease bug discoverability, two approaches to increase the complexity of the data flow of the inserted bugs, and a standalone program that uses equality saturation to diversify C-source codebases that can be added as a final stage to LAVA. Finally, I present two instances of bug-finding competitions-AutoCTF and Rode0day-that I helped design and run, which leveraged LAVA and the augmentations described in this thesis in order to accomplish their respective goals.

Department dc:contributor.department

Massachusetts Institute of Technology. Department of Electrical Engineering and Computer Science.

Grantor dc:publisher

Massachusetts Institute of Technology

Year dc:date.issued

2018

Author dc:creator

• Sridhar, Rahul

Advisor dc:contributor.advisor

• Timothy Leek.

• Electrical Engineering and Computer Science.

Statement dc:rights

• MIT theses are protected by copyright. They may be viewed, downloaded, or printed from this source but further reproduction or distribution in any format is prohibited without written permission.

Licence dc:rights.uri

• http://dspace.mit.edu/handle/1721.1/7582

Language dc:language.iso

eng

Handle dc:identifier.uri

http://hdl.handle.net/1721.1/119922

OAI identifier oai:identifier

oai:dspace.mit.edu:1721.1/119922