Change Impact Analysis, Root Cause Analysis, and AI-based Repair for Safe and Secure Software Evolution

Project Information

FORTE

Grant agreement ID: 101189510

DOI

10.3030/101189510

Project closed

EC signature date 10 October 2024

Start date 1 November 2024

End date 30 April 2026

Funded under

• European Research Council (ERC)

Total cost

No data

EU contribution

€ 150 000,00

Coordinated by

IMPERIAL COLLEGE OF SCIENCE TECHNOLOGY AND MEDICINE
United Kingdom

Periodic Reporting for period 1 - FORTE (Change Impact Analysis, Root Cause Analysis, and AI-based Repair for Safe and Secure Software Evolution)

Reporting period: 2024-11-01 to 2026-04-30

Summary of the context and overall objectives of the project

Software is the driving force of today's world. Used in almost any system, it has a wide-ranging impact on every area of private and public life, from health, to finance, education, entertainment, business, and government.

Developing software is a cognitively demanding task. Coming up with a software solution for a problem is already challenging, and continuous changes in requirements and in the environment where software is used make it even harder. As a result, bugs and security vulnerabilities are often introduced during software development. To make things worse, even when these issues are discovered and reported, many of them remain unfixed due to a lack of developer time.

Generative AI promises to change the game by being able to automatically repair code, but requires developers to validate that the proposed software fixes correctly address the issues, while simultaneously checking that they do not introduce unintended behaviour.

FORTE combines automated change-impact analysis based on symbolic execution and AI-based repair to enable safe and secure software development. Our goal with FORTE is to help developers confidently change software without breaking it in unexpected ways, and embrace generative AI to simplify the process of writing and fixing code. To demonstrate the usefulness of FORTE, we plan to use it with real-world software that is publicly available.

Work performed from the beginning of the project to the end of the period covered by the report and main results achieved so far

In FORTE, we have focused on making the results of our main ERC research more practical for real-world software.
To this end, we have built HyperKLEE, an extended version of KLEE which incorporates some of the technique designed as part of our ERC Consolidator Grant called PASS: Program Analysis for Safe and Secure Software Evolution.
We have applied HyperKLEE to real-world software, showcasing its ability to generate effective test suites that have revealed bugs in these applications.
We have responsibly reported all these bugs to developers, as we have found them, helping them improve their software and eliminate potential security vulnerabilities.
We have also experimented with using the HyperKLEE-generated bug reports to automatically generate patches that fix those bugs.
Finally, we have experimented with an educational version of KLEE, where users receive personalised feedback while solving software development tasks.

Progress beyond the state of the art and expected potential impact (including the socio-economic impact and the wider societal implications of the project so far)

We are using our experience with FORTE and associated results to explore commercialisation opportunities, primarily via a start-up.