Within the framework of a partnership (you can choose between)

• not applicable

The goal is to develop methods, techniques and tools to prevent deserialization attacks in applications.

Is regular travel foreseen for this post ? No

Assignments :
The recruited person will be taken to: (1) develop a modular approach to vulnerability analysis, (2) build a tool dedicated to the automatic generation of attack chains via fuzzing and mutation and (3) study the history and semantics of code changes for the understanding of attacks. Prototypes will be developed in the Pharo language.

For a better knowledge of the proposed research subject :
A state of the art, bibliography and scientific references are available at the following URL, do not hesitate to log in: 

https://www.inria.fr/fr/evref.

Collaboration :

The recruited person will be in connection with the members of the EVREF team who have skills in software analysis and software quality to meet the challenges defined in this thesis.

Responsibilities :

The person recruited is responsible for: 

• Conducting original research related to the problem of vulnerability detection within the framework of this thesis.
• Performing scientific monitoring to stay up to date with advancements in the field of software analysis for vulnerability detection.
• Carrying out simulations and analyses of existing software attacks to define their behavior.
• Writing scientific papers and present work at national and international conferences.
• Collaborating with other researchers in the EVREF team and take part in team and GL working group meetings in the laboratory.
• Participating in team meetings and activities (including EVREF Sprints and presentations).
• Writing and defending thesis in front of a jury at the end of this research work.

Steering/Management :

The person recruited will be in charge of:

• Managing his/her research project by planning the various stages of the thesis topic and meeting deadlines.
• Coordinating collaborations with other researchers in the software security field and with the EVREF team's  industrial partner Berger-Levrault.
• Leading weekly follow-up meetings with supervisors.
• Contributing to the writing of deliverables and scientific papers.

Main activities :

• study of the state of the art in software attacks, static/dynamic analysis techniques and fuzzing
• analysis of existing attacks and extraction of their behavior
• definition of attack model
• design and evaluation of a tool-based approach for detecting and preventing attack (using the Pharo language (www.pharo.org))
• writing deliverables and reports

Additional activities :

• validation of the proposed approach by analyzing existing attacks and referring to attack catalogs and databases (Mitre, NVD, etc.)
• qualitative/quantitative experimentation of the developed prototype 
• dissemination of results to security communities at national (e.g. GDR days) and international level in top venues (conferences, journals, etc.)