Engineering topics

Sayre, Kirk D

Publications and source records attributed to Sayre, Kirk D.

3 records

DOE OSTI2013

Computing Legacy Software Behavior to Understand Functionality and Security Properties: An IBM/370 Demonstration

Organizations maintaining mainframe legacy software can benefit from code modernization and incorporation of security capabilities to address the current threat environment. Oak Ridge National Laboratory is developing the Hyperion system to compute the behavior of software as a means to gain understanding of software functionality and security properties. Computation of functionality is critical to revealing security attributes, which are in fact specialized functional behaviors of software. Oak Ridge is collaborating with MITRE Corporation to conduct a demonstration project to compute behavior of legacy IBM Assembly Language code for a federal agency. The ultimate goal is to understand functionality and security vulnerabilities as a basis for code modernization. This paper reports on the first phase, to define functional semantics for IBM Assembly instructions and conduct behavior computation experiments.

reverse engineering↗

DOE OSTI2012

Automated Vulnerability Detection for Compiled Smart Grid Software

While testing performed with proper experimental controls can provide scientifically quantifiable evidence that software does not contain unintentional vulnerabilities (bugs), it is insufficient to show that intentional vulnerabilities exist, and impractical to certify devices for the expected long lifetimes of use. For both of these needs, rigorous analysis of the software itself is essential. Automated software behavior computation applies rigorous static software analysis methods based on function extraction (FX) to compiled software to detect vulnerabilities, intentional or unintentional, and to verify critical functionality. This analysis is based on the compiled firmware, takes into account machine precision, and does not rely on heuristics or approximations early in the analysis.

99 GENERAL AND MISCELLANEOUS↗

DOE OSTI2011

Behavior Computation for Smart Grid Software Analysis

Smart grid embedded software is subject to intrusion and compromise with potentially serious consequences. Current methods of cybersecurity analysis are increasingly challenged by the scope the problem. Oak Ridge National Laboratory (ORNL) is pioneering the new technology of software behavior computation to help address these risks. Software behavior computation and its instantiation in Function eXtraction (FX) systems apply mathematical foundations of denotational semantics to compute the behavior of software in all circumstances of use. Research has shown how to make the effects of recursion-theoretic limitations on this process arbitrarily small. Behavior computation operates on the functional semantics of programs, and is not subject to the limitations of syntactic recognition or testing. ORNL is applying FX technology to help evaluate cyber security properties in smart grid systems, with initial focus on vulnerabilities in embedded software that controls smart meters.

denotational semantics↗