JTalos: Leveraging Structured Error Handling For Increased Security : Broad software vulnerability mitigation through enabling Security Workarounds for Rapid Response in Java

The pre-patch window of Vulnerability remains a critical challenge in cybersecurity, leaving systems exposed to exploits before patches are deployed. The paper \textit{`Talos: Neutralizing Vulnerabilities with Security Workarou-\\nds for Rapid Response`} by Zhen Huang et al.~proposes an algorithm that detects error-handling code and instruments it with security workar-\\ounds, allowing developers to disable vulnerable segments temporarily. This thesis aims to extend and reproduce the claims made in the Talos paper. Since the algorithm's heuristics focus on languages without structured exception handling and experiments are only performed on programs written in C/C++, there is as mentioned in their future works potential to expand Talos functionality to cover these languages. The program JTalos was then developed for this purpose. Using Soot it provides the ability to disable any method in a Java application given its fully qualified name. Five Experiments were performed exploring JTalos ability to neutralize a known vulnerability occurring in open source software. The results of these experiments, supplemented by a theoretical examination of the OWASP top 10 vulnerabilities 2021 indicated that JTalos would be able to neutralize any vulnerability. However its best use case would be disabling loosely coupled components which expose a vulnerability which requires a significant amount of effort to patch. By extending Talos to Java, this research strengthens its viability as a mitigation strategy and provides a proof of concept for its applicability in languages with structured exception handling. The motivation for this thesis is then to improve the pre-patch window of vulnerability for applications developed in Java and so contribute to the broader field of cybersecurity.