Jump to content

GrammaTech

Edit links
From Wikipedia, the free encyclopedia

This is an old revision of this page, as edited by CountMacula (talk | contribs) at 02:38, 9 June 2022 (→History: links). The present address (URL) is a permanent link to this revision, which may differ significantly from the current revision.

GrammaTech, Inc.
Company typePrivate
IndustrySoftware Quality
HeadquartersBethesda, Maryland
Key people
CEO: Michael Dager
ProductsCodeSonar, CodeSentry
Websitewww.grammatech.com

GrammaTech is a software-development tools vendor based in Bethesda, Maryland with a research center based in Ithaca, New York. The company was founded in 1988 as a technology spin-off of Cornell University. GrammaTech is a provider of application security testing products (static application security testing, software composition analysis) and software research services.

Products

CodeSonar is a source code and binary code static analysis tool that performs a whole-program, interprocedural analysis on C, C++, C#, Java, and binary executables. It identifies programming bugs and security vulnerabilities in software. CodeSonar is used in the Defense/Aerospace, Medical, Industrial Control, Electronic, Telecom/Datacom and Transportation industries. The U.S. Food and Drug Administration (FDA) Center for Devices and Radiological Health uses it to detect defects in fielded medical devices.[1][2] The U.S. National Highway Traffic Safety Administration (NHTSA) and NASA used it in its Study on Sudden Unintended Acceleration in the electronic throttle control systems of Toyota vehicles.

CodeSentry is derived from GrammaTech’s binary code analysis research.[3] This technology performs deep analysis of object, library and executable files without the need for source code in order to identify known software security vulnerabilities.  Binary analysis is an efficient method for software composition analysis with high precision and recall results and fewer false positives.

Research

GrammaTech's research division undertakes projects for private contractors, including several U.S. government agencies, such as NASA, the NSF, and many branches of the Department of Defense. GrammaTech's research is focused on both static analysis and dynamic analysis, on both source code and binaries.

GrammaTech participated and came in 2nd place in DARPA's 2016 Cyber Grand Challenge, earning $1 million as Team TECHx.[4] GrammaTech led Team TECHx, a collaboration with the University of Virginia, using their co-developed cyber-reasoning system called Xandra.[5]

History

GrammaTech is a 1988 spin-off from Cornell University, where its founders had developed an early Integrated Development Environment in 1978 (the Cornell Program Synthesizer[6]) and a system for generating language-based environments from attribute-grammar specifications in 1982 (the Synthesizer Generator[7][8]). Commercial systems that have been implemented using the Synthesizer Generator include ORA's Ada verification system (Penelope[9]), Terma's Rigorous Approach to Industrial Software Engineering (Raise[10]), and Loral's checker of the SPC Quality and Style Guidelines for Ada.[11] GrammaTech co-founders Tom Reps and Tim Teitelbaum received the 2010 ACM SIGSOFT Retrospective Impact Award [5] for their work on the Synthesizer Generator.[12]

GrammaTech commercialized the Wisconsin Program-Slicing Tool as CodeSurfer for C and C++ in 1999. CodeSonar for C and C++, a static analysis tool, has been available since 2005. GrammaTech co-founder Reps and two other company affiliates shared in a 2011 ACM SIGSOFT Retrospective Impact Award [6] for their paper describing the Wisconsin slicing research.[13]

GrammaTech and the University of Wisconsin have been collaborating since 2001 to develop analysis, reverse-engineering, and anti-tamper tools for binary executables. Byproducts of this research are CodeSurfer/x86[14] (a version of CodeSurfer for the Intel x86 instruction set), CodeSonar/x86 (a bug and vulnerability finding tool for stripped executables), and an approach to creating such systems automatically from formal semantic descriptions of arbitrary instruction set architectures.[15] This research was later commercialized into CodeSonar for Binaries and CodeSentry, a software composition analysis tool.

In 2019, GrammaTech was acquired by Five Points Capital.[16]

References

  1. ^ Quinnell, Richard A. (2008-03-06). "Static analysis stomps on bugs". EETimes. Retrieved 2009-01-23.
  2. ^ Jetley, Raoul; Paul Anderson (April 2008). "Using static analysis to evaluate software in medical devices" (PDF). Embedded Systems Design. United Business Media. {{cite journal}}: Cite journal requires |journal= (help)[permanent dead link]
  3. ^ Gruian, Radu; Teitelbaum, Tim (2005-01-07). "Static Analysis for Detecting Vulnerabilities in COTS". Archived from the original on June 25, 2021. {{cite journal}}: Cite journal requires |journal= (help)
  4. ^ "Cyber Grand Challenge". DARPA. Retrieved February 29, 2020.
  5. ^ "Hackers Don't Have to be Human Anymore. This Bot Battle Proves It". Wired. 2016-08-05.
  6. ^ Teitelbaum, T.; T. Reps (September 1981). "The Cornell Program Synthesizer: A syntax-directed programming environment". Communications of the ACM. 24 (9): 563–573. doi:10.1145/358746.358755. S2CID 14317073.
  7. ^ Reps, T. (1984). Generating Language-Based Environments. Cambridge, MA: The M.I.T. Press. ISBN 978-0-262-18115-0. (Awarded the 1983 ACM Doctoral Dissertation Award.).
  8. ^ Reps, Thomas W.; Teitelbaum, Tim (1988). The Synthesizer Generator: A System for Constructing Language-Based Editors. Cambridge, MA: Springer-Verlag. ISBN 978-0-387-96857-5.
  9. ^ Guaspari, D. (1989). "Proceedings of the conference on Tri-Ada '89 Ada technology in context: Application, development, and deployment - TRI-Ada '89". TRI-Ada '89: Proceedings of the conference on Tri-Ada '89. Pittsburgh, PA: ACM. pp. 216–224. doi:10.1145/74261.74277. ISBN 0897913299.
  10. ^ The RAISE Language Group, CORPORATE (1993). The RAISE specification language. Upper Saddle River, NJ: Prentice-Hall, Inc. ISBN 978-0-13-752833-2.
  11. ^ Software Productivity Consortium (1995). Ada 95 Quality and Style Guide: Guidelines for Professional Programmers (SPC-94093-CMC Version 01.00.10 ed.). Herndon, VA: SPC.
  12. ^ Reps, T.; Teitelbaum, T. (1984). "The Synthesizer Generator [1]". In SDE 1 Proc. of the first ACM SIGSOFT/SIGPLAN Software Engineering Symposium on Practical Software Development Environments. {{cite conference}}: External link in |title= (help)
  13. ^ Reps, T.; Horowitz, S.; Sagiv, M.; Rosay, G. (December 1994). "Speeding Up Slicing [2]". Proc. Second ACM SIGSOFT Symposium on Foundations of Software Engineering. New Orleans, LA, USA. {{cite conference}}: External link in |title= (help)
  14. ^ Balakrishnan, G.; Reps, T. (2004). "Analyzing memory accesses in x86 executables [3]". Proc. Int. Conf. on Compiler Construction. New York, NY: Springer-Verlag. pp. 5–23. (Awarded the EAPLS Best Paper Award at ETAPS 2004.). {{cite conference}}: External link in |title= (help)
  15. ^ Lim, J.; Reps, T. (April 2008). "A system for generating static analyzers for machine instructions [4]". Proc. Int. Conf. on Compiler Construction (CC). New York, NY: Springer-Verlag. (Awarded the EAPLS Best Paper Award at ETAPS 2008.). {{cite conference}}: External link in |title= (help)
  16. ^ "Five Points Capital Completes Acquisition of GrammaTech". PR Newswire. 12 November 2019. Retrieved 14 May 2020.
Retrieved from "https://en.wikipedia.org/w/index.php?title=GrammaTech&oldid=1092246695"