CS 7301-002: Language-based Security

Course Information

Title: CS 7301-002: Language-based Security
Course Registration Number: 21422
Times: TR 2:30-3:45
Location: ECSS 2.203
Instructor: Dr. Kevin Hamlen (hamlen AT utdallas)
Instructor's Office Hours: TBA, ECSS 3.704

Course Summary

This course will introduce and survey the emerging field of Language-based Security, in which techniques from compilers and programming language theory are leveraged to address issues in computer security. Topics include:

1. Certifying Compilers
2. In-lined Reference Monitors
3. Typed Intermediate Languages
4. Typed Assembly Languages
5. Automated Theorem Provers
6. Model-checking
7. Software Fault Isolation

The aim of the course is to allow each student to develop a solid understanding of at least one of these topics, along with a more general familiarity with the range of research in the field. In-course discussion will highlight opportunities for cutting-edge research in each area. If you do research involving software security, this course will provide you with an array of powerful tools for addressing software security issues. If you do research involving programming languages or compilers, this course will show you how to take techniques that you already know and apply them to a new and important problem domain. If your career involves management or development of high-assurance software systems, this course will provide a comparative analysis of traditional versus language-based techniques.

The course is open to Ph.D. students and Masters students. Interested undergraduates should see the instructor for permission to take the course.

Suggested (non-mandatory) prerequisite: CS 6371 Advanced Programming Languages (or taken concurrently)

Grading

Homework: Homeworks will consist of assigned readings, usually one required paper per class session. Students must thoroughly read each paper before class in order to adequately prepare for in-class quizzes and discussions.

Quizzes (25%): Each class will begin with a short quiz testing the students comprension of the assigned reading for the day. Questions will typically be multiple choice or short answer. The easier questions will be designed to test whether the student has read the material at all, and the harder ones will test deep understanding of more subtle points.

Presentations (25%): Each student will be assigned 1-2 days during the semester during which they will present the assigned reading for that day in a 45-minute lecture. Each presentation should provide a technical overview of the paper, a description of how the paper fits into the broader context of the material covered in the course, and should pose interesting questions or challenges for in-class discussion. Students will also present their class projects at the conclusion of the class (see below), and this constitutes part of their presentation grade.

Class Participation (10%): Students are expected to come to class having read the assigned paper(s), and prepared with questions, critiques, and discussion topics. Regular attendance and class participation will count 10% towards their grades in the course.

Project (40%): Students will work individually or in a team of two to four to complete a course-related project. All project ideas are individually approved by the instructor. Project proposals will be due early in the semester (deadline to be announced). A typical project involves implementing one of the concepts described in one of the assigned readings, or by using one or more of the research-level software packages covered in class to do an interesting program analysis or to address a non-trivial vulnerability. Some overlap of class projects with the student's doctoral or masters thesis research is both permitted and encouraged.

Texts

The course has no required textbook, but two electronic texts available through the UTD library may be useful:

• Benjamin C. Pierce, ed., Advanced Topics in Types and Programming Languages. MIT Press, Cambridge, MA 2005. (available online from UTD computers)
• Matt Bishop. Computer Security: Art and Science. Addison-Wesley, 2003. (available online from UTD computers)

Tentative Course Schedule