SBIR Phase I: Automated Security for the DevOps World

小型企业创新研究(SBIR)第一阶段项目的更广泛影响/商业潜力是为企业Web应用程序提供强大的自动化安全保护。随着Web应用层的攻击威胁越来越大，安全性成为Web应用程序开发人员和用户最关心的问题。同时，防御这些攻击是一个资源密集型、容易出错的过程，通常由专门的网络安全专家手动执行。该项目将使用应用感知分析和创新的信息模型，在企业服务器上自动构建和部署网络安全策略，使企业能够专注于其核心业务，并减少内部安全团队的管理费用。该项目还将使用静态/动态混合分析，利用现代网络保护机制自动制定服务器端和客户端策略，使网络应用程序的用户相信他们与网络应用程序的交互将是安全的。这种方法利用了来自程序分析和机器学习的尖端技术，并将推动自动安全策略生成的最先进水平。此小型企业创新研究(SBIR)第一阶段项目将探索自动安全策略如何对敏感资源实施有意义的保护。保护Web应用程序是一个具有挑战性的研究问题，因为自动化方法要么偏向于显著的误检率，其中良性行为被标记为恶意，要么偏向显著的漏检率，其中恶意活动没有被检测到。该项目旨在使用支持应用程序的白名单来解决这种偏见：该项目自动动态地探索应用程序的行为，并且还将静态地构建该应用程序的目的模型。该项目预计将产生两个主要组成部分：一个是服务器端保护模块，用于隔离和强化企业部署中的敏感资源；另一个是客户端保护模块，用于为企业Web应用程序的用户实施细粒度策略。该项目将涉及使用大型Web应用程序开发、分析和改进这两个组件，并将企业的经验和挑战与领先的Web应用程序相结合。

The broader impact/commercial potential of this Small Business Innovation Research (SBIR) Phase I project is to provide robust, automated security protections to enterprise web applications. With the growing threat of attacks at the web application layer, security is a top of mind concern for both the developers and users of web applications. At the same time, defending against these attacks is a resource-intensive, error-prone process that typically is performed manually by specialized web security experts. The project will use application-aware analysis and an innovative information model to automatically build and deploy web security policies on enterprise servers, freeing the enterprise to focus on their core business and reduce the overhead of internal security teams. The project will also use a hybrid static/dynamic analysis to automatically craft server-side and client-side policies using modern web protection mechanisms to give users of web applications confidence that their interactions with a web application will be secure. This approach leverages cutting-edge techniques from program analysis and machine learning, and will advance the state of the art in automated security policy generation.This Small Business Innovation Research (SBIR) Phase I project will explore ways in which automated security policies enact meaningful protection of sensitive resources. Protecting web applications is a challenging research problem in that automated approaches are either biased towards significant false positive rates, in which benign behavior is flagged as malicious, or significant false negative rates, in which malicious activity is not detected. This project aims to resolve this bias using application aware whitelists: the project automatically explores an application's behavior dynamically, and will also statically build a model of that application's purpose. The project is expected to yield two major components: a server-side protection module to isolate and harden sensitive resources on an enterprise deployment, and a client-side protection module to enforce fine-grained policies for users of the enterprise's web applications. The project will involve developing, analyzing, and improving both of these components using large-scale web applications and will integrate the experience and challenges of enterprises with leading web applications.