Description

Vulnerability discovery is the cornerstone of securing software systems, combining offensive research and defensive protection to address the ever-evolving threat landscape. By systematically identifying weaknesses in code, configuration, and execution environments, vulnerability discovery empowers organizations to understand and mitigate risks before adversaries can exploit them. For offensive security research, this process reveals vulnerable code paths and inputs, enabling the development of targeted mitigations and comprehensive security assessments. In defensive contexts, vulnerability discovery enables proactive systems safeguards by discovering unknown vulnerabilities, prioritizing patching efforts, and strengthening resilience against attacks.  Aarno Labs focuses on developing and applying advanced static and dynamic techniques for scaling vulnerability discovery, reducing false positives, and uncovering elusive vulnerabilities in real-world programs.

Solutions

  • CodeHawk: Analysis and Patching Platform
  • DIODE: Input Synthesis Engine

Projects

DroidSafe

Best-in-class static analysis to vet untrusted Android mobile applications.

PI: Michael Gordon

Technical Areas: Static Analysis, Vulnerability Discovery, Vulnerability Reachability

Funding: DARPA (APAC)

AMdP

Vulnerability remediation capabilities for EoL medical devices with firmware change understanding.

PI: Ricardo Baratto

Technical Areas: Static Analysis, Binary Patching, Vulnerability Discovery, Vulnerability Remediation

Funding: ARPA-H (DIGIHEALS)

Dark Corners

Identify and mitigate the sources of static analysis imprecision in large, real-world programs.

PI: Jeff Perkins

Technical Areas: Static Analysis, Software Correctness, Vulnerability Discovery

Funding: DARPA (APAC)

ClearScope

Precise and comprehensive runtime monitoring of sensitive behaviors in Android apps.

PI: Michael Gordon

Technical Areas: Dynamic Analysis, Runtime Protection, Supply Chain Security, Vulnerability Discovery

Funding: DARPA (TC)

Arya (TA2)

Automated exploitation and vulnerability validation across diverse systems

PI: Jeff Perkins

Technical Areas: Dynamic Analysis, Supply Chain Security, Vulnerability Discovery

Funding: DARPA (HACCS)

Aria

Transforming AppSec with in-application, zero-trust privileges and secure computation offloading.

PI: Ricardo Baratto

Technical Areas: Runtime Protection, Supply Chain Security, Vulnerability Discovery, Vulnerability Remediation, Vulnerability Reachability

Funding: DARPA (OPS-5G)

Papers