Marcel Böhme is a 2019 ARC DECRA Fellow and Senior Lecturer (A/Prof) at Monash University, Australia. He completed his PhD at National University of Singapore advised by Prof Abhik Roychoudhury in 2014. It followed a postdoctoral stint at the CISPA-Helmholtz Zentrum Saarbrücken with Prof. Andreas Zeller and a role as senior research fellow at the TSUNAMi Security Research Centre in Singapore. Marcel leads his group with a reproducibility policy (https://mboehme.github.io/manifesto), such that all tools and data are made available as open-source, and in some cases have been upstreamed for integration into popular fuzzers, such as AFL and LibFuzzer. His fuzzers discovered 100+ bugs in widely-used software systems, more than 60 of which are security-critical vulnerabilities registered as CVEs at the US National Vulnerability Database. His most recent fuzzer, Entropic, powers the two largest continuous fuzzing platforms at Google and Microsoft.

SWS   Info

AG Audience

English

60 Minutes

Saarbrücken

To establish software security at scale, we need efficient automated vulnerability discovery techniques that can run on thousands of machines. In this talk, we will discuss the abundant opportunities and fundamental limitations of fuzzing, one of the most successful vulnerability discovery techniques. We will explore why only an exponential number of machines will allow us to discover software bugs at a linear rate. We will discuss the kind of correctness guarantees that we can expect from automatic vulnerability discovery, anywhere from formally proving the absence of bugs to statistical claims about program correctness. We shall touch upon unexpected connections to ecological biostatistics and information theory which allow us to address long-standing scientific and practical problems in automatic software testing. Finally, we will take a forward looking view and discuss our larger vision for the field of software security.

--

Please contact MPI-SWS Office for Zoom link information

Danielle Dalton

+49 681 9303 9106

--email hidden

passcode not visible

logged in users only