SaTC: CORE: Medium: Collaborative: Threat-Aware Defense: Evaluating Threats for Continuous Improvement

在寻找程序漏洞的竞赛中，对手的速度超过了开发人员。程序员必须找到他们程序中的所有潜在软件缺陷，并确定它们是否可在所有部署中利用以防止漏洞，而对手只需找到一个软件缺陷，使他们能够在任何一个部署中实现他们的目标。由于现代软件及其部署的复杂性，目前消除程序漏洞的技术无法找到所有此类缺陷。最近的漏洞检测研究并没有证明没有漏洞，而是在探索更强大的技术来自动生成漏洞。然而，这种利用生成往往缺乏现代和新兴防御的系统模型，这可能有助于评估防御的效用。此外，一旦生成漏洞利用，必须手动将防止该漏洞利用的防御措施添加到程序中。因此，漏洞检测还没有对防御措施给予足够的重视，以评估其有效性，也没有在必要时生成额外的防御措施。本项目提出了一种不断迭代改进防御措施的理论和技术，以应对导致漏洞的威胁。开发了一种方法，该方法搜索程序是否违反安全策略，并扩展现有防御以自动防止检测到的违规行为。主要的见解是将每个程序的威胁和防御链接到一个连贯的模型中，称为程序威胁图(PTG)，以主动评估威胁是否使对手能够在现有防御条件下违反程序安全策略，并自动改进防御以防止此类违规行为。该项目探讨了如何在考虑到项目的内部和环境防御的情况下找到违反安全规定的情况。安全违规被用来生成有针对性的防御和/或系统防御，以有效地阻止此漏洞，并阻止可能在给定性能约束下利用其他漏洞的潜在未知漏洞。这项研究的目标是不断提高对漏洞的防御能力。该方法在给定当前和即将到来的防御的规范的情况下发现安全违规行为，自动加强它们，并在不中断程序功能的情况下从未遂攻击中恢复。在该项目期间开发的所有工具、基准和分析都是以开源形式发布的。在外展方面，重点放在夺旗比赛和暑期软件安全课程上。这一奖项反映了NSF的法定使命，并通过使用基金会的智力优势和更广泛的影响审查标准进行评估，被认为值得支持。

Adversaries are outpacing developers in the race to find program vulnerabilities. Where programmers have to find all potential software flaws in their programs and determine whether they are exploitable across all deployments to prevent vulnerabilities, adversaries need only find one software flaw that enables them to achieve their goals in any one deployment. Current techniques to rid programs of vulnerabilities cannot find all such flaws due to the complexity of modern software and their deployments. Rather than proving the absence of flaws, recent vulnerability detection research is exploring more powerful techniques to automate exploit generation. However, such exploit generation often lacks a systematic model of modern and emerging defenses, which may be useful in assessing the utility of defenses. In addition, once an exploit is generated, defenses to prevent that exploit must be added manually to the program. As a result, vulnerability detection does not yet pay enough attention to defenses to assess their effectiveness nor generate additional defenses when necessary.This project proposes a theory and techniques to improve defenses continuously and iteratively to counter threats that cause vulnerabilities. A method is developed that searches programs for security policy violations and extends existing defenses to prevent detected violations automatically. The main insight is to link the threats and defenses of each program into one coherent model, called the Program Threat Graph (PTG), to evaluate proactively whether threats enable adversaries to violate program security policies given current defenses and automate the improvement of defenses to prevent such violations. The project explores how to find security violations given a program's internal and environmental defenses. Security violations are used to generate both targeted defenses and/or systematic defenses to block this exploit efficiently and block potentially unknown exploits that may leverage other flaws under given performance constraints. The goal of this research is to continuously improve defenses against vulnerabilities. The approach discovers security violations given a specification for both current and upcoming defenses, tightening them automatically and recovering from attempted attacks without disrupting program functionality. All tools, benchmarks, and analyses developed during this project are released as open-source. For outreach, the focus is on capture-the-flag competitions and summer software security courses.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.