Change Impact Analysis, Root Cause Analysis, and AI-based Repair for Safe and Secure Software Evolution

Informazioni relative al progetto

FORTE

ID dell’accordo di sovvenzione: 101189510

DOI

10.3030/101189510

Progetto chiuso

Data della firma CE 10 Ottobre 2024

Data di avvio 1 Novembre 2024

Data di completamento 30 Aprile 2026

Finanziato da

• European Research Council (ERC)

Costo totale

Nessun dato

Contributo UE

€ 150 000,00

Coordinato da

IMPERIAL COLLEGE OF SCIENCE TECHNOLOGY AND MEDICINE
United Kingdom

Periodic Reporting for period 1 - FORTE (Change Impact Analysis, Root Cause Analysis, and AI-based Repair for Safe and Secure Software Evolution)

Periodo di rendicontazione: 2024-11-01 al 2026-04-30

Sintesi del contesto e degli obiettivi generali del progetto

Software is the driving force of today's world. Used in almost any system, it has a wide-ranging impact on every area of private and public life, from health, to finance, education, entertainment, business, and government.

Developing software is a cognitively demanding task. Coming up with a software solution for a problem is already challenging, and continuous changes in requirements and in the environment where software is used make it even harder. As a result, bugs and security vulnerabilities are often introduced during software development. To make things worse, even when these issues are discovered and reported, many of them remain unfixed due to a lack of developer time.

Generative AI promises to change the game by being able to automatically repair code, but requires developers to validate that the proposed software fixes correctly address the issues, while simultaneously checking that they do not introduce unintended behaviour.

FORTE combines automated change-impact analysis based on symbolic execution and AI-based repair to enable safe and secure software development. Our goal with FORTE is to help developers confidently change software without breaking it in unexpected ways, and embrace generative AI to simplify the process of writing and fixing code. To demonstrate the usefulness of FORTE, we plan to use it with real-world software that is publicly available.

Lavoro eseguito dall’inizio del progetto fino alla fine del periodo coperto dalla relazione e principali risultati finora ottenuti

In FORTE, we have focused on making the results of our main ERC research more practical for real-world software.
To this end, we have built HyperKLEE, an extended version of KLEE which incorporates some of the technique designed as part of our ERC Consolidator Grant called PASS: Program Analysis for Safe and Secure Software Evolution.
We have applied HyperKLEE to real-world software, showcasing its ability to generate effective test suites that have revealed bugs in these applications.
We have responsibly reported all these bugs to developers, as we have found them, helping them improve their software and eliminate potential security vulnerabilities.
We have also experimented with using the HyperKLEE-generated bug reports to automatically generate patches that fix those bugs.
Finally, we have experimented with an educational version of KLEE, where users receive personalised feedback while solving software development tasks.

Progressi oltre lo stato dell’arte e potenziale impatto previsto (incluso l’impatto socioeconomico e le implicazioni sociali più ampie del progetto fino ad ora)

We are using our experience with FORTE and associated results to explore commercialisation opportunities, primarily via a start-up.