Change Impact Analysis, Root Cause Analysis, and AI-based Repair for Safe and Secure Software Evolution

Información del proyecto

FORTE

Identificador del acuerdo de subvención: 101189510

DOI

10.3030/101189510

Proyecto cerrado

Fecha de la firma de la CE 10 Octubre 2024

Fecha de inicio 1 Noviembre 2024

Fecha de finalización 30 Abril 2026

Financiado con arreglo a

• European Research Council (ERC)

Coste total

Sin datos

Aportación de la UE

€ 150 000,00

Coordinado por

IMPERIAL COLLEGE OF SCIENCE TECHNOLOGY AND MEDICINE
United Kingdom

Periodic Reporting for period 1 - FORTE (Change Impact Analysis, Root Cause Analysis, and AI-based Repair for Safe and Secure Software Evolution)

Período documentado: 2024-11-01 hasta 2026-04-30

Resumen del contexto y de los objetivos generales del proyecto

Software is the driving force of today's world. Used in almost any system, it has a wide-ranging impact on every area of private and public life, from health, to finance, education, entertainment, business, and government.

Developing software is a cognitively demanding task. Coming up with a software solution for a problem is already challenging, and continuous changes in requirements and in the environment where software is used make it even harder. As a result, bugs and security vulnerabilities are often introduced during software development. To make things worse, even when these issues are discovered and reported, many of them remain unfixed due to a lack of developer time.

Generative AI promises to change the game by being able to automatically repair code, but requires developers to validate that the proposed software fixes correctly address the issues, while simultaneously checking that they do not introduce unintended behaviour.

FORTE combines automated change-impact analysis based on symbolic execution and AI-based repair to enable safe and secure software development. Our goal with FORTE is to help developers confidently change software without breaking it in unexpected ways, and embrace generative AI to simplify the process of writing and fixing code. To demonstrate the usefulness of FORTE, we plan to use it with real-world software that is publicly available.

Trabajo realizado desde el comienzo del proyecto hasta el final del período abarcado por el informe y los principales resultados hasta la fecha

In FORTE, we have focused on making the results of our main ERC research more practical for real-world software.
To this end, we have built HyperKLEE, an extended version of KLEE which incorporates some of the technique designed as part of our ERC Consolidator Grant called PASS: Program Analysis for Safe and Secure Software Evolution.
We have applied HyperKLEE to real-world software, showcasing its ability to generate effective test suites that have revealed bugs in these applications.
We have responsibly reported all these bugs to developers, as we have found them, helping them improve their software and eliminate potential security vulnerabilities.
We have also experimented with using the HyperKLEE-generated bug reports to automatically generate patches that fix those bugs.
Finally, we have experimented with an educational version of KLEE, where users receive personalised feedback while solving software development tasks.

Avances que van más allá del estado de la técnica e impacto potencial esperado (incluida la repercusión socioeconómica y las implicaciones sociales más amplias del proyecto hasta la fecha)

We are using our experience with FORTE and associated results to explore commercialisation opportunities, primarily via a start-up.