Deian Stefan
University of California-San Diego, CA·Computer Science
Software that billions of people use every day, including web browsers and operating systems, contains bugs that attackers can exploit. This research asks how to make such large real-world systems provably safer without making them slower or too costly to build.
- Fields
Computer Science
Engineering
- Topics
software security
systems security
Rust
- Grants
- 2 known grants, through Sep 2027
What they work on
- Build static analysis tools for the Rust ecosystem that work with human auditors to detect, triage and classify weaknesses in foreign function interfaces between Rust and C/C++.
- Design FFI abstractions based on refinement types, types carrying automatically checkable logical conditions, to verify memory and type safety at the Rust–C/C++ boundary and replace ad hoc glue code.
- Build a lightweight sandboxing layer for calling C/C++ code from Rust that combines existing sandboxing mechanisms with Rust's ownership type system.
- Empirically evaluate the security of JavaScript just-in-time (JIT) compilers to identify the components most vulnerable to attack and most crucial to browser performance.
- Formalize security and correctness for JIT components, extend existing JIT compilers to find and fix bugs with formal guarantees, and design new secure, maintainable JavaScript interpreters and compilers.
More about the research
The two projects attack two of the riskiest weak points. One is the "glue" code that connects new Rust components to older C/C++ code. The other is the just-in-time compilers that run JavaScript in web browsers. Both combine theory, such as formal proofs and type systems, with tools that are integrated into real software.
Why it matters
These projects could reduce security flaws in Firefox, Chrome, Linux and other infrastructure used by billions of people. Safer Rust–C/C++ boundaries would protect software as it migrates to memory-safe languages. Provably secure JavaScript JIT compilers could close the most dangerous attack route on web-connected devices, including attacks aimed at marginalized and at-risk users.
Known grants
From NIH and NSF research grants. Labs often have other funding we can't see.
Closest labs
Isil Dillig
University of Texas at Austin, TX·Computer Science
Evaluate the security of JavaScript just-in-time (JIT) compilers through empirical study, to find which components are most open to attack and which matter most for browser speed.
Milijana Surbatovich
University of Maryland, MD·Computer Science·Early-career
Develop the first formal model of an intermittence-safe operating system, with defined abstraction layers that separate tiers of trust and allow each component to be verified on its own.
Qirun Zhang
Georgia Institute of Technology, GA·Computer Science·Early-career
Characterize what the InterDyck graph abstraction can and cannot express. This is a graph model of programs with matched-edge patterns that represents program meaning for analysis.
The school
University of California-San Diego: 84 labs on PI Pages, $1.9B a year on research, 637 research doctorates a year.
Reach out
A start for your email. Fill in the brackets.