Change Impact Analysis, Root Cause Analysis, and AI-based Repair for Safe and Secure Software Evolution

Informations projet

FORTE

N° de convention de subvention: 101189510

DOI

10.3030/101189510

Projet clôturé

Date de signature de la CE 10 Octobre 2024

Date de début 1 Novembre 2024

Date de fin 30 Avril 2026

Financé au titre de

• European Research Council (ERC)

Coût total

Aucune donnée

Contribution de l’UE

€ 150 000,00

Coordonné par

IMPERIAL COLLEGE OF SCIENCE TECHNOLOGY AND MEDICINE
United Kingdom

Periodic Reporting for period 1 - FORTE (Change Impact Analysis, Root Cause Analysis, and AI-based Repair for Safe and Secure Software Evolution)

Période du rapport: 2024-11-01 au 2026-04-30

Résumé du contexte et des objectifs généraux du projet

Software is the driving force of today's world. Used in almost any system, it has a wide-ranging impact on every area of private and public life, from health, to finance, education, entertainment, business, and government.

Developing software is a cognitively demanding task. Coming up with a software solution for a problem is already challenging, and continuous changes in requirements and in the environment where software is used make it even harder. As a result, bugs and security vulnerabilities are often introduced during software development. To make things worse, even when these issues are discovered and reported, many of them remain unfixed due to a lack of developer time.

Generative AI promises to change the game by being able to automatically repair code, but requires developers to validate that the proposed software fixes correctly address the issues, while simultaneously checking that they do not introduce unintended behaviour.

FORTE combines automated change-impact analysis based on symbolic execution and AI-based repair to enable safe and secure software development. Our goal with FORTE is to help developers confidently change software without breaking it in unexpected ways, and embrace generative AI to simplify the process of writing and fixing code. To demonstrate the usefulness of FORTE, we plan to use it with real-world software that is publicly available.

Travail effectué depuis le début du projet jusqu’à la fin de la période considérée dans le rapport et principaux résultats atteints jusqu’à présent

In FORTE, we have focused on making the results of our main ERC research more practical for real-world software.
To this end, we have built HyperKLEE, an extended version of KLEE which incorporates some of the technique designed as part of our ERC Consolidator Grant called PASS: Program Analysis for Safe and Secure Software Evolution.
We have applied HyperKLEE to real-world software, showcasing its ability to generate effective test suites that have revealed bugs in these applications.
We have responsibly reported all these bugs to developers, as we have found them, helping them improve their software and eliminate potential security vulnerabilities.
We have also experimented with using the HyperKLEE-generated bug reports to automatically generate patches that fix those bugs.
Finally, we have experimented with an educational version of KLEE, where users receive personalised feedback while solving software development tasks.

Progrès au-delà de l’état des connaissances et impact potentiel prévu (y compris l’impact socio-économique et les conséquences sociétales plus larges du projet jusqu’à présent)

We are using our experience with FORTE and associated results to explore commercialisation opportunities, primarily via a start-up.