SBIR Phase I: Automatic Security Audit of Third-Party Software

本次小企业创新研究一期项目的创新之处在于第三方软件的自动安全审计。为了展示该技术的能力，该项目将构建安全审计云服务BitTurner，以自动发现漏洞并对第三方软件进行安全审计。这项云服务将完全自动化；它将适用于源代码不可用的程序，如商业二进制程序；由于它生成的每一份漏洞报告都将伴随着证明该漏洞的测试用例，因此它将不会有误报。这种属性的组合应该会彻底改变软件审计的过程，并使其速度更快、成本效益更高。这是由一种最先进的程序分析技术的新颖组合实现的。BitTurner云服务将整合使用两种不同符号执行引擎的白盒模糊，使用污点定向模糊增强的黑盒模糊，以及用于指导白盒模糊的静态漏洞分析。建议的高度并行体系结构将使我们在最小化成本的同时实现高吞吐量和低延迟。该团队还计划扩展移动应用程序安全审计的技术和基础设施。第三方软件自动安全审计的更广泛/商业影响解决了一个迫切需要创新解决方案的巨大市场。安全漏洞每年给企业造成数十亿美元的损失，大多数攻击是由于软件漏洞造成的。然而，许多障碍阻碍了采取确保软件安全所需的步骤。由于所需的时间和专业技能，手动审计的成本高得令人望而却步。基于源代码的技术不适用于二进制形式的第三方软件。基于静态分析的现有技术可能会报告如此多的误报警告，其结果会让开发人员和分析人员不知所措，并浪费大量资源来排除误报。BitTurner基于云的颠覆性安全审计技术应该会改变这种局面，因为它基于低成本的分布式计算，允许对第三方软件进行全自动审计，而不会出现误报。安全审计作为一种服务已经是一个巨大的市场，但现有的商业产品往往不能满足客户的需求。BitTurner的技术可能会以具有竞争力的价格提供更全面的结果，因此既能抓住现有客户，又能对目前不可行的软件进行审计。

The innovation of this Small Business Innovation Research Phase I project is the automatic security audit of third-party software. To demonstrate the capabilities of the technology, this project will build a security audit Cloud service, BitTurner, to automatically discover vulnerabilities and conduct security audits of third-party software. This cloud service will be fully automated; it will apply to programs for which source code is not available such as commercial binaries; and because every vulnerability report it generates will be accompanied by a test case demonstrating the vulnerability, it will have no false positives. This combination of attributes should revolutionize the process of software auditing and make it much faster and more cost effective. This is made possible by a novel combination of state-of-the-art program analysis techniques. The BitTurner Cloud service will incorporate white-box fuzzing using two different symbolic execution engines, black-box fuzzing enhanced with taint-directed fuzzing, and static vulnerability analysis to direct white-box fuzzing. The proposed highly parallel architecture will let us achieve high throughput and low latency while minimizing cost. The team also plans to extend the technology and infrastructure for security audit of mobile apps.The broader/commercial impact of automatic security audit of third-party software addresses an enormous market that has a dire and immediate need for innovative solutions. Security breaches cost businesses billions of dollars every year, and a majority of attacks are due to vulnerabilities in software. However, many barriers stand in the way of taking the steps needed to ensure software security. Manual auditing is prohibitively expensive because of the time and specialized skills required. Techniques based on source code are inapplicable to third-party software in binary form. Existing techniques based on static analysis can report so many false positive warnings that their results overwhelm developers and analysts and waste huge resources to weed out false positives. BitTurner's disruptive Cloud-based security audit technology should change this landscape by allowing fully automatic auditing of third-party software with no false positives, based on low-cost distributed computing. Security auditing as a service is already a large market, but existing commercial offerings are often an inadequate match for customer needs. BitTurner's technology may provide more comprehensive results at a competitive price point, and so both capture existing customers and make auditing available for software where it is currently infeasible.