I-Corps: Hardening Programs Against Cyber Attacks

I-Corps：针对网络攻击的强化计划

• 批准号: 1439439
• 负责人: Michael Franz
• 金额: $ 5万
• 依托单位: University of California-Irvine
• 依托单位国家: 美国
• 项目类别: Standard Grant
• 财政年份: 2014
• 资助国家: 美国
• 起止时间: 2014-06-01 至 2015-11-30
• 项目状态: 已结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=1439439&HistoricalAwards=false
• 关键词: Corps; Hardening; Programs; Against; Cyber

This project addresses cyber security from a programming language perspective. Of the five most used programming languages today, three (including the most used language C) lead to programs that are highly susceptible to cyber-attacks. The goal is to establish software diversity as a viable cyber defense approach, to be used in concert with other defenses. Commercializing this team's research may have the effect of changing both the way that software is distributed as well as many of the assumptions and models underlying current threats to deployed software. This team?s 'multi-compiler approach' may provide solutions for many security problems. The multi-compiler approach provides automatic hardening of binaries before they are distributed to end users. The use of hardened binaries does not remove the need to fix security vulnerabilities by patching the source code and distributing software. However, it makes it substantially harder for attackers to exploit vulnerabilities. This solution may appeal to a broad spectrum of customers: software vendors as well as large institutions such as the US government. This team's project aims to commercialize automated software diversification mechanisms, providing a solution that can scale both to potentially millions of users (i.e., millions of distinctly different software versions) as well as very large programs, including even operating systems. To this end, they plan to provide the variation mechanism through a "cloud computing" service in which subsequent requesters download different unique variants of the same software, rather than identical binaries. In addition, this team is also working on making their solution almost completely transparent to developers by "normalizing" error reports that flow back from users. .

该项目从编程语言的角度解决网络安全问题。 在当今最常用的五种编程语言中，其中三种（包括最常用的 C 语言）导致的程序极易受到网络攻击。 目标是将软件多样性建立为一种可行的网络防御方法，与其他防御措施配合使用。该团队的研究商业化可能会改变软件的分发方式以及当前对已部署软件构成威胁的许多假设和模型。 该团队的“多编译器方法”可以为许多安全问题提供解决方案。多编译器方法可以在将二进制文件分发给最终用户之前自动对其进行强化。使用强化的二进制文件并不能消除通过修补源代码和分发软件来修复安全漏洞的需要。然而，这使得攻击者更难利用漏洞。该解决方案可能会吸引广泛的客户：软件供应商以及美国政府等大型机构。该团队的项目旨在将自动化软件多样化机制商业化，提供一种解决方案，既可以扩展到潜在的数百万用户（即数百万个明显不同的软件版本），也可以扩展到非常大的程序，甚至包括操作系统。为此，他们计划通过“云计算”服务提供变体机制，其中后续请求者下载同一软件的不同独特变体，而不是相同的二进制文件。此外，该团队还致力于通过“规范化”从用户返回的错误报告，使他们的解决方案对开发人员几乎完全透明。 。