planning for sate v paul e. black national institute of standards and technology ...
TRANSCRIPT
Planning for SATE VPlanning for SATE V
Paul E. BlackNational Institute of Standards and Technology
http://www.nist.gov/
April 19, 2023 Paul E. Black 2
Thorns, Roses, and BudsThorns, Roses, and Buds
What should we … not do again? … continue doing? … start doing?
Well?
April 19, 2023 Paul E. Black 3
Tool Users: What Do You Want Tool Users: What Do You Want From SATE? How Can It Help?From SATE? How Can It Help? SATE IV goals are– Enable empirical research based on large test
sets,– Encourage improvement of tools,– Speed adoption of tools by objectively
demonstrating their use on real software.
April 19, 2023 Paul E. Black 4
What tracks and objects?What tracks and objects?
Keep PHP? Add more languages: C#? Add binaries?– Precompiled, so tool maker doesn’t have to
fiddle with options, compiler, etc. Focus on concurrency and threading?– deadlock detection– race conditions
Malicious code (backdoor) detection?
April 19, 2023 Paul E. Black 5
Procedure or Scope Changes?Procedure or Scope Changes?
Parallel static and black box/dynamic/web app scanner tracks on same test set?
Further: test set is one program and code reviewers, testers, fuzzers, etc. play, too
Go beyond security to general quality & bug finding?
We want to use SAFES format, to receive warning reports, and CCR (Claims Coverage Representation), for declaration of what tools look for.
April 19, 2023 Paul E. Black 6
Possible time linePossible time line
Recruit users for program planning committee
Organizing meeting in the fall, say October Begin concentrated work in Jan/Feb 2013– recruit participants and choose test cases
Release test cases in April 2013 Team submit results in July We finish analysis in October Next workshop in December
April 19, 2023 Paul E. Black 7
Who Participates?Who Participates?
How can we spread invitations wider? Who should we recruit?
Broaden set of organizers– Program planning committee– Analyzers
Don’t share results so more tool makers participate?
April 19, 2023 Paul E. Black 8
On behalf of the organizers, On behalf of the organizers, participants, and program committeeparticipants, and program committee