Demonstration venue · read-only. Every page can be browsed; the buttons that would change it are switched off. Create an account to run TaxoReview on your own data. A simulation from public publication records: the people listed were not invited and did not agree to review.
? Tutorial for this page

Matthew Pruett

dblp:265/5563 · DBLP profile ↗
← Back
4ranked-venue papers
0as first author
4since 2021 · last 2023
—ORCID · none

Domains — the database's venue-derived domains; a paper can count in several

Security and privacy · 3 · 3 since 2021Software engineering, systems software and programming languages · 1 · 1 since 2021

Expertise — from the expertise taxonomy: the topics of the expert's papers under the CCF categories. A weight counts papers with recency: 1 for a paper about the topic, 0.3 when the topic is its context, halved every five years.

Network and information security
4 papers
Systems and software security · 87% Malware analysis · 13%
Software engineering, system software, and programming languages
3 papers
Program analysis · 60% Compilers and program optimization · 20% Debugging and program repair · 20%

Topics — the 10 heaviest of 12, each with the papers that count most for it

TopicWeightPapersLastEvidence papers
Systems and software security
vulnerability discovery
1.222023
VulChecker: Graph-based Vulnerability Localization in Source Code · USENIX Security Symposium 2023
ARCUS: Symbolic Root Cause Analysis of Exploits in Production Systems · USENIX Security Symposium 2021
Systems and software security › vulnerability discovery
vulnerability localization
0.712023
VulChecker: Graph-based Vulnerability Localization in Source Code · USENIX Security Symposium 2023
Program analysis
graph-based analysis
0.712023
VulChecker: Graph-based Vulnerability Localization in Source Code · USENIX Security Symposium 2023
Program analysis
static analysis
0.712023
VulChecker: Graph-based Vulnerability Localization in Source Code · USENIX Security Symposium 2023
Systems and software security › exploitation
code reuse attack
0.512021
Not so fast: understanding and mitigating negative impacts of compiler optimizations on code reuse gadget sets · Proc. ACM Program. Lang. 2021
Systems and software security › exploitation › code reuse attack
return-oriented programming
0.512021
Not so fast: understanding and mitigating negative impacts of compiler optimizations on code reuse gadget sets · Proc. ACM Program. Lang. 2021
Systems and software security › vulnerability analysis
root cause analysis
0.512021
ARCUS: Symbolic Root Cause Analysis of Exploits in Production Systems · USENIX Security Symposium 2021
Compilers and program optimization
compiler optimization
0.512021
Not so fast: understanding and mitigating negative impacts of compiler optimizations on code reuse gadget sets · Proc. ACM Program. Lang. 2021
Debugging and program repair
fault localization
0.512021
ARCUS: Symbolic Root Cause Analysis of Exploits in Production Systems · USENIX Security Symposium 2021
Program analysis
binary analysis
0.112021
Not so fast: understanding and mitigating negative impacts of compiler optimizations on code reuse gadget sets · Proc. ACM Program. Lang. 2021

Methods — techniques the papers use, named apart from their topics

program dependence graph · 1.3graph neural network · 1.3symbolic execution · 1.0differential binary analysis · 1.0binary recompilation · 1.0memory image analysis · 0.5machine learning · 0.5
YearPublicationVenuePosition
2023 VulChecker: Graph-based Vulnerability Localization in Source Code
Yisroel Mirsky, George Macon, Michael D. Brown, Carter Yagemann, Matthew Pruett, Evan Downing, J. Sukarno Mertoguno, Wenke Lee
USENIX Security Symposium5
2021 Forecasting Malware Capabilities From Cyber Attack Memory Images
Omar Alrawi, Moses Ike, Matthew Pruett, Ranjita Pai Kasturi, Srimanta Barua, Taleb Hirani, Brennan Hill, Brendan Saltaformaggio
USENIX Security Symposium3
2021 ARCUS: Symbolic Root Cause Analysis of Exploits in Production Systems
Carter Yagemann, Matthew Pruett, Simon P. Chung, Kennon Bittick, Brendan Saltaformaggio, Wenke Lee
USENIX Security Symposium2
2021 Not so fast: understanding and mitigating negative impacts of compiler optimizations on code reuse gadget sets
abstract
Despite extensive testing and correctness certification of their functional semantics, a number of compiler optimizations have been shown to violate security guarantees implemented in source code. While prior work has shed light on how such optimizations may introduce semantic security weaknesses into programs, there remains a significant knowledge gap concerning the impacts of compiler optimizations on non-semantic properties with security implications. In particular, little is currently known about how code generation and optimization decisions made by the compiler affect the availability and utility of reusable code segments called gadgets required for implementing code reuse attack methods such as return-oriented programming. In this paper, we bridge this gap through a study of the impacts of compiler optimization on code reuse gadget sets. We analyze and compare 1,187 variants of 20 different benchmark programs built with two production compilers (GCC and Clang) to determine how their optimization behaviors affect the code reuse gadget sets present in program variants with respect to both quantitative and qualitative metrics. Our study exposes an important and unexpected problem; compiler optimizations introduce new gadgets at a high rate and produce code containing gadget sets that are generally more useful to an attacker than those in unoptimized code. Using differential binary analysis, we identify several undesirable behaviors at the root of this phenomenon. In turn, we propose and evaluate several strategies to mitigate these behaviors. In particular, we show that post-production binary recompilation can effectively mitigate these behaviors with negligible performance impacts, resulting in optimized code with significantly smaller and less useful gadget sets.
Michael D. Brown, Matthew Pruett, Robert Bigelow, Girish Mururu, Santosh Pande
Proc. ACM Program. Lang.2