SBIR Phase I: Automatic Security Audit of Third-Party Software

本次小企业创新研究一期项目的创新之处在于第三方软件的自动安全审计。 为了展示该技术的能力，该项目将构建一个安全审计云服务BitTurner，以自动发现漏洞并对第三方软件进行安全审计。该云服务将完全自动化;它将适用于源代码不可用的程序，例如商业二进制文件;并且由于它生成的每个漏洞报告都将附带一个演示漏洞的测试用例，因此不会出现误报。这种属性的组合应该彻底改变软件审计的过程，使其更快，更具成本效益。这是可能的一个新的组合国家的最先进的程序分析技术。BitTurner云服务将使用两种不同的符号执行引擎进行白盒模糊检测，通过污染导向模糊检测增强黑盒模糊检测，并通过静态漏洞分析直接进行白盒模糊检测。所提出的高度并行架构将使我们实现高吞吐量和低延迟，同时最大限度地降低成本。该团队还计划扩展移动的应用程序安全审计的技术和基础设施。第三方软件自动安全审计的广泛/商业影响解决了对创新解决方案迫切需求的巨大市场。安全漏洞每年给企业造成数十亿美元的损失，大多数攻击都是由于软件漏洞造成的。然而，许多障碍阻碍了采取确保软件安全所需的步骤。人工审计由于需要时间和专业技能而成本高昂。基于源代码的技术不适用于二进制形式的第三方软件。基于静态分析的现有技术可能会报告如此多的误报警告，以至于其结果使开发人员和分析人员不堪重负，并浪费大量资源来消除误报。BitTurner颠覆性的基于云的安全审计技术应该会改变这一局面，它允许基于低成本分布式计算的第三方软件的全自动审计，而不会出现误报。安全审计作为一种服务已经是一个巨大的市场，但现有的商业产品往往不足以满足客户的需求。BitTurner的技术可能会以具有竞争力的价格提供更全面的结果，因此既可以吸引现有客户，又可以为目前不可行的软件提供审计。

The innovation of this Small Business Innovation Research Phase I project is the automatic security audit of third-party software. To demonstrate the capabilities of the technology, this project will build a security audit Cloud service, BitTurner, to automatically discover vulnerabilities and conduct security audits of third-party software. This cloud service will be fully automated; it will apply to programs for which source code is not available such as commercial binaries; and because every vulnerability report it generates will be accompanied by a test case demonstrating the vulnerability, it will have no false positives. This combination of attributes should revolutionize the process of software auditing and make it much faster and more cost effective. This is made possible by a novel combination of state-of-the-art program analysis techniques. The BitTurner Cloud service will incorporate white-box fuzzing using two different symbolic execution engines, black-box fuzzing enhanced with taint-directed fuzzing, and static vulnerability analysis to direct white-box fuzzing. The proposed highly parallel architecture will let us achieve high throughput and low latency while minimizing cost. The team also plans to extend the technology and infrastructure for security audit of mobile apps.The broader/commercial impact of automatic security audit of third-party software addresses an enormous market that has a dire and immediate need for innovative solutions. Security breaches cost businesses billions of dollars every year, and a majority of attacks are due to vulnerabilities in software. However, many barriers stand in the way of taking the steps needed to ensure software security. Manual auditing is prohibitively expensive because of the time and specialized skills required. Techniques based on source code are inapplicable to third-party software in binary form. Existing techniques based on static analysis can report so many false positive warnings that their results overwhelm developers and analysts and waste huge resources to weed out false positives. BitTurner's disruptive Cloud-based security audit technology should change this landscape by allowing fully automatic auditing of third-party software with no false positives, based on low-cost distributed computing. Security auditing as a service is already a large market, but existing commercial offerings are often an inadequate match for customer needs. BitTurner's technology may provide more comprehensive results at a competitive price point, and so both capture existing customers and make auditing available for software where it is currently infeasible.