Automated Vulnerability Detection for Compiled Smart Grid Software

Conference · Sun Jan 01 00:00:00 EST 2012

OSTI ID:1049792

Prowell, Stacy J ^[1]; Pleszkoch, Mark G ^[1]; Sayre, Kirk D ^[1]; Linger, Richard C ^[1]

---

1. ORNL

While testing performed with proper experimental controls can provide scientifically quantifiable evidence that software does not contain unintentional vulnerabilities (bugs), it is insufficient to show that intentional vulnerabilities exist, and impractical to certify devices for the expected long lifetimes of use. For both of these needs, rigorous analysis of the software itself is essential. Automated software behavior computation applies rigorous static software analysis methods based on function extraction (FX) to compiled software to detect vulnerabilities, intentional or unintentional, and to verify critical functionality. This analysis is based on the compiled firmware, takes into account machine precision, and does not rely on heuristics or approximations early in the analysis.

• Research Organization: Oak Ridge National Lab. (ORNL), Oak Ridge, TN (United States)
• Sponsoring Organization: Work for Others (WFO)
• DOE Contract Number: DE-AC05-00OR22725
• OSTI ID: 1049792
• Resource Relation: Conference: IEEE PES Innovative Smart Grid Technologies Conference, Washington, DC, USA, 20120116, 20120120
• Country of Publication: United States
• Language: English

Related Subjects

99 GENERAL AND MISCELLANEOUS//MATHEMATICS, COMPUTING, AND INFORMATION SCIENCE
ACCURACY
APPROXIMATIONS
DETECTION
TESTING
VULNERABILITY
Smart grids
vulnerability detection
formal verification
reasoning about programs