Formal Methods for Software Verification, Security and Computer Science

COMP63101 Formal Methods for Software Verification, Security and Computer Science 15 Semester 1 Postgraduate Taught Level 6 Renate Schmidt Unit coordinator 1 FHEQ level (Framework for Higher Education Qualifications) ' Masters/Integrated Masters P4 ' European Credit Transfer & Accumulation System Rating : 7.5 The course unit aims to provide a foundation for formal methods in software verification, software security, software engineering and computer science. Formal methods heavily rely on automated reasoning which will be the central focus of the course. It covers basic mathematical foundations and formalisms to model and reason about different aspects of complex systems and programs. In laboratory sessions students gain practical experience for the use of state-of-the art automated reasoning tools that are widely used for formal methods and verification of security protocols and programs. Formal methods are widely used in the software and hardware industries in areas such as analysis, verification and security of software and hardware, but also play an important role in other areas of computer science such as knowledge engineering, AI and computational mathematics which require support from automated reasoning tools. Formal methods and automated reasoning tools are, for example, used in large software and hardware companies such as Microsoft and Intel for software and hardware analysis, synthesis and verification. An important part of the systems development processes concerns formalising and reasoning about the behaviour of the systems in order to verify the correctness of the behaviour. Also, in web and agent technologies such methods are used for the intelligent processing of ontologies, for decision making based on knowledge bases of structured data, and for formal specification and verification of web services. The motivation of the course is the introduction and study of a subset of the most important methods, techniques and tools used nowadays. These include propositional reasoners (SAT solvers), theory reasoners (SMT solvers) and first-order reasoners. The course aims at providing an understanding of the foundation of propositional logic, first-order logic and important theories for modelling and reasoning specifying properties of programs. It covers practical and theoretical techniques and results that form the basis of resolution reasoning systems and the DPLL reasoning algorithm, which is used in SAT and SMT solvers. Verification and automated analysis of security protocols are discussed as important application domains. 1. Describe and compare approaches to modelling and representation of knowledge in logical form in propositional logic and first-order logic. 2. Describe and compare approaches underpinning modern automated reasoning and verification systems.  3. Explain techniques that make such systems efficient and suitable to verify large pieces of software. 4. Formalise and describe properties of relations, the specification of a program, a security protocol or constraints of a combinatorial problem. 5. Solve a variety of reasoning problems in software verification and security protocol analysis. 6. Use a state-of-the art first-order reasoner to establish properties of relations and analyse a security protocol.  7. Use a state-of-the-art SAT/SMT solver to verify properties of data structures. 8. Independently study a chosen relevant topic which may involve contrasting different approaches to modelling and reasoning, applying reasoning approaches to a special fragment or evaluating an advanced reasoning technique. Analytical skills Problem solving Research Written communication - Introduction - Propositional reasoning<ul><li>Language of propositional logic, semantics, truth tables</li><li>Satisfiability, validity, equivalence, decidability</li><li>Normal forms, CNF, clauses</li><li>Propositional resolution, redundancy elimination</li><li>DPLL and CDCL for SAT-solving</li><li>Logical modelling</li><li>Using SAT solver (demo & lab)  </li></ul>- General first-order reasoning<ul><li>Language of first-order logic, modelling</li><li>substitution, semantics</li><li>Normal forms, clauses</li><li>Herbrand interpretations</li><li>Soundness, literal & clause orderings, saturation</li><li>Unication for general resolution</li><li>Basic general resolution, ordering & selection refinements</li><li>Automated analysis of security protocols</li><li>Using SPASS (demo & lab)  </li></ul>- Reasoning modulo theories (SMT)<ul><li>Equality reasoning, theory of arrays, linear arithmetic, SMT algorithm</li><li>Property checking related to software</li><li>Using SMT solver (demo & lab)</li></ul> Delivery and learning are via a range of materials and sessions: video lectures, quizzes, flipped classroom sessions, drop-in sessions, feedback sessions and supervised practical laboratory sessions. Lecture notes are made available online. Together with the videos and the slides of the flipped classroom sessions they comprise the formal content of the course unit. The videos explain the material more informally with emphasis on key concepts, examples and exercises. The practical work involves learning to use and getting experience with current reasoners and systems used for program verification and analysis. These systems will be used in the Software Security course unit. 0 Other 50% 1 Written exam 50% Other:Assessed coursework 35%Assessed practical work 15%Mini-Project (formative) For assessed coursework there are face-to-face sessions with GTAs in which cohort-level feedback is provided on common mistakes along with marks.Each practical assessment piece is checked, and face-to-face cohort level feedback is provided in feedback sessions along with marks.Individual feedback is provided in feedback sessions on formative mini-projects.For the exam cohort level feedback is given along with individual marks after marking and official exam board meetings. COMP63342 Software Security Co-Requisite Recommended Y Mathematical Logic for Computer ScienceBen-Ari, Mordechai, 2012. Springer, London The Calculus of Computation: Decision Procedures with Applications to Verification Bradley, Aaron R. and Manna, Zohar, 2007. Springer, Berlin/Heidelberg Assessment written exam 2 Demonstration 2 Lectures 11 Practical classes & workshops 10 0 113 Other non-listed Scheduled activities for Scheduled activity hours:<ul><li>Coursework drop-in sessions 5 hours</li><li>Coursework feedback sessions 5 hours</li><li>Exam revision Q&A Session 2 hours</li></ul> Additional information regarding Non-scheduled/Independent study hours:<ul><li>Video content 20 hours</li><li>Coursework 30 hours</li></ul> More information regarding this Unit:<ul><li>This is a Mandatory course in Secure Software Engineering Theme and MSc in Cyber Security</li><li>Please contact the unit lead to get permission to do the unit if you are not a Comp Sci student/ unable to enrol onto the unit.</li></ul>