Fantastic Bugs and How to Find Them

Catalog description

This advanced course studies the nature of software bugs and security vulnerabilities arising in complex application domains and surveys specialized program analysis + automated testing techniques for identifying such issues proactively. The course will take a tour of various domains such as mobile systems, databases, web browsers, distributed and networked systems, autonomous vehicles, and smart contracts. For each domain, the class will review case studies of high-impact software bugs that have manifested in production and will then discuss state-of-the-art research techniques that aim to uncover such bugs automatically. Apart from the literature review, students will engage significantly with software system design and engineering via hands-on assignments and a semester-long project involving real-world applications and analysis tools for one or more domains. Students completing this course will be able to (a) identify practical challenges of applying well-known program analysis and testing techniques to complex application domains, (b) formulate and leverage domain-specific assumptions for making analysis techniques tractable in a specialized setting, and (c) build practical tools for improving software quality in large-scale systems. The course assumes that students have some background in reasoning about software quality, system security, and/or working with program representations. The course builds upon mathematical principles introduced in foundational classes on program analysis, verification, or compiler design, as well as system design principles encountered in introductory security or software engineering courses. Please check the course website for classes that qualify as sufficient pre-requisites, or contact the instructor to discuss your background. Course Website: https://cmu-fantastic-bugs.github.io/