TC: Small: Securing Web Software Systems

万维网已经成为计算机界最成功的故事之一，改变了世界各地的人们交流、计算和开展业务的方式。不幸的是，网络上的安全问题普遍存在，这些问题增加了网站运营商和互联网用户的成本。该项目旨在开发新的网络安全方法，为网站开发商和运营商提供新的和改进的工具，以保护他们的网站和他们的用户。首先，为了帮助保护现有网站，该项目将研究如何加固旧的Web应用程序代码，以防御最常见的攻击。其次，为了为未来的Web系统提供坚实的基础，该项目将研究如何为新开发的代码提供强大的保护。该项目还将研究通过构建是安全的网络开发框架。第三，这个项目将开发工具和技术，逐步将现有的Web应用程序迁移到下一代通过构造安全的Web框架。第四，这个项目将设计和进行用户研究，以严格衡量不同的编程语言、框架和编程实践对Web应用程序安全的影响。拟议活动产生的更广泛的影响可能是重大的；如果成功，这项研究可能会对网络服务的安全产生重大的积极影响，从长远来看，可能会对整个软件安全产生重大的积极影响。

The world-wide web has become one of computing's great success stories,changing the way that people around the world communicate, compute,and conduct their business. Unfortunately, security problems on the webare prevalent, and these problems increase costs for website operatorsand for Internet users. This project aims to develop new methods forsecuring the web, providing website developers and operators with newand improved tools to protect their site and their users.The research involves several technical directions. First, to helpprotect existing websites, this project will investigate ways of hardeninglegacy web application code to defend it against the most common attacks.Second, to provide a solid foundation for web systems of the future,this project will study how to provide robust protection for newlydeveloped code. The project will also study web development frameworksthat are safe by construction. Third, this project will develop toolsand techniques to incrementally migrate existing web applications tonext-generation safe-by-construction web frameworks. Fourth, this projectwill devise and carry out user studies to measure rigorously the effectof different programming languages, frameworks, and programming practicesupon the security of web applications. The broader impacts resulting fromthe proposed activity are potentially significant; if it is successful,this research could have a significant positive impact on the securityof web services and, in the longer term, on software security in general.