The size and complexity of modern software poses a great challenge in the context of securing them against cyber attacks. This factor has motivated research in the development of automated techniques and tools for software vulnerability and exploit detection. These researches fall into two basic categories: one targeted at software developers, while another at end-users and system administrators. Because software vulnerabilities continue to increase despite the efforts taken by developers, in this dissertation, we focus on the latter approach to prevent software vulnerabilities from being exploited in successful attacks. Our research significantly expands the classes of attacks that can be addressed using this approach.

In the first part of our research, we develop a technique that provides comprehensive protection against buffer overflows and other attacks that are based on the lack of memory safety in the C programming language. Unlike previous techniques that were targeted at thwarting the steps involved in typical memory error exploits, our approach gets to the root cause of these attacks, namely, memory errors, and prevents them.

In the second part of our research, we significantly extend the scope of our work to address a new generation of attacks that have emerged in the past several years. This class of attacks, which include SQL injection, command injection, cross-site scripting, path traversal and format string attacks, arise due to input validation errors in applications. As a result of these errors, attackers can cause a vulnerable program to execute operations that can compromise its security. Our technique provides the first systematic solution to this class of attacks by tracking the origin of data within programs, and applying policies that can accurately distinguish between benign uses of untrusted data from attacks.

Together, our techniques are applicable to vulnerabilities that account for over 75% of advisories from US-CERT, and about two-thirds of the vulnerabilities reported by CVE, the industry-standard vulnerability dictionary and the main source of US NIST's National Vulnerabiilty Database (NVD).