I-Corps: OSSPolice

这项技术将帮助移动应用程序开发人员进行尽职调查，轻松扫描应用程序中的任何法律和安全问题，从而不仅保护了他们的品牌，还确保了最终用户的安全和隐私。该技术还保护了开源软件生态系统，使移动应用程序开发人员能够主动扫描他们的应用程序，并识别任何无意中违反开源许可证的行为。根据报告的结果，应用程序开发者可以遵守正在使用的软件的许可条款，或者切换到更宽松的开源软件（OSS）。应用商店正迅速变得拥挤，目前有超过600万款应用。因此，应用程序开发人员往往依靠开源软件（OSS）来降低开发成本并快速将应用程序推向市场。不幸的是，不小心使用OSS会带来严重的法律和安全风险。如果忽视这些风险，不仅会危及最终用户的安全和隐私，还会给拥有此类应用的企业造成巨大的经济损失，并损害其品牌。然而，跟踪所有的OSS组件，它们的版本，以及相互依赖关系可能是乏味的并且容易出错的，特别是在导入OSS时很少甚至不知道其来源的情况下。由于开发人员可能缺乏对其使用的法律后果的认识，这些OSS的深奥许可条款加剧了这个问题。PI的研究团队已经建立了一个全自动的软件系统，可以分析移动应用程序二进制文件，以检测正在使用的所有开源软件（OSS）组件的使用情况，并报告相关的安全和法律风险。该奖项反映了美国国家科学基金会的法定使命，并通过使用基金会的知识价值和更广泛的影响审查标准进行评估，被认为值得支持。

This technology will help mobile app developers do their due diligence and easily scan their apps for any legal and security issues, thereby not only protecting their brand, but also ensuring the security and privacy of end users. The technology also preserves the open-source software ecosystem, by enabling mobile app developers to proactively scan their app and identifying any inadvertent open-source license violations. Based on the reported results, app developers can either comply with the licensing terms of the software being used or switch over to a more permissive Open-Source Software (OSS).App stores are quickly getting crowded, with currently over 6 million apps. Therefore, app developers often rely on Open-Source Software (OSS) to reduce the development cost and quickly bring their apps to market. Unfortunately, careless use of OSS can introduce severe legal and security risks. If ignored, such risks can not only jeopardize the security and privacy of end users, but also cause high financial losses to businesses owning such apps and damage their brand. However, tracking all OSS components, their versions, and inter-dependencies can be tedious and error-prone, particularly if the OSS is imported with little to no knowledge of its provenance. This problem is exacerbated by the esoteric licensing terms of these OSS, as developers may lack awareness about the legal ramifications of their use. The PI's research team has built a fully-automated software system that analyzes mobile app binaries to detect usage of all Open-Source Software (OSS) components being used, and report associated security and legal risks.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.