SaTC 2.0: RES: Breaking Barriers in Point-To Analysis: Unified "Type x Flow" Foundations and Analysis for Security

This project develops new techniques that help software tools understand how a program uses memory and connects different parts of its code. This capability is essential for finding security weaknesses, checking whether a software repair is correct, and enforcing protections that stop attackers from redirecting a program's behavior. Existing techniques face a difficult tradeoff: some are accurate but too slow for large, real-world programs, while others are fast but too imprecise to support strong security decisions. The project's novelties are a unified way to combine two complementary sources of information: how data moves through a program and what types of objects the program is designed to manipulate. The project's broader significance is that it creates a more practical foundation for securing complex software systems, including operating systems, servers, open-source software, and other code that supports modern digital infrastructure. The project also strengthens education through new security course materials and hands-on student training. The project establishes a unified Type x Flow foundation for point-to analysis, a core program-analysis technique that determines which memory objects a program reference may access. It treats type-based and flow-based reasoning as cooperating parts of one analysis: type information provides scalable structure, while flow information provides precision by refining broad groups into more accurate subgroups. The project develops this combined abstraction and designs analysis algorithms that preserve precision while scaling to large systems software. It also makes the analysis path-aware, which enables security tools to distinguish real risks from infeasible behaviors. The resulting advances support stronger vulnerability detection, exploitability assessment, patch checking, and control-flow protection. The expected impact is more accurate, scalable, and usable tools for finding vulnerabilities and enforcing software security protections. This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.