SBIR Phase I: Securing open source software supply chain

小企业创新研究（SBIR）第一阶段项目的更广泛影响将是改善网络安全。 据报道，在流行的语言生态系统（例如，Python），已经被下载了数百万次。 这类攻击具有很高的破坏性，因为恶意软件可能会进入应用程序，可能会危及数百万用户的隐私;此外，OSS是构建现代应用程序和服务的事实上的标准方式。该项目将开发一种新型的大规模自动化审查基础设施，以分析数百万OSS软件包并减轻OSS供应链攻击。 这将提高OSS开发人员社区在网络安全领域的生产力，包括恶意软件分析，暴露不受信任的第三方OSS代码中的不良行为，维护开发人员的信任和声誉，检测隐藏的软件漏洞，以及加强OSS生态系统的安全性。这个小型企业创新研究（SBIR）第一阶段项目将推进最先进的研究技术，并探索检测和缓解开源软件（OSS）供应链攻击的新实用方法-当采用不可信的第三方OSS代码时，开发人员和组织会面临直接的网络安全威胁。该项目将：1）为OSS项目的详尽代码和元数据分析创建新颖的自动化技术; 2）开发一套广泛的强大特征配置文件，用于有效检测恶意代码。该奖项反映了NSF的法定使命，并通过使用基金会的知识价值和更广泛的影响审查标准进行评估，被认为值得支持。

The broader impact of this Small Business Innovation Research (SBIR) Phase I project will be to improve cybersecurity. Thousands of open-source software (OSS) packages containing purposefully harmful software (malware) have been reported across popular language ecosystems (e.g., Python), which have been downloaded millions of times. Such attacks are highly damaging as the malware may find its way into apps, potentially compromising the privacy of millions of users; moreover, OSS is the de facto standard way to build modern applications and services.This project will develop a novel large-scale automated vetting infrastructure to analyze millions of OSS packages and mitigate OSS supply chain attacks. This will enhance productivity for the OSS developer community across the cybersecurity spectrum, including malware analysis, exposing undesired behavior in untrusted third-party OSS code, maintaining developer trust and reputation, detecting hidden software vulnerabilities, and enforcing security of OSS ecosystems. This Small Business Innovation Research (SBIR) Phase I project will advance state-of-the-art research techniques as well as explore novel practical approaches for detection and mitigation of Open-Source Software (OSS) supply chain attacks — a direct cybersecurity threat posed to developers and organizations when adopting untrusted third-party OSS code. This project will: 1) create novel automated techniques for exhaustive code as well as metadata analysis of OSS projects, and 2) develop an extensive set of robust characteristic profiles for effective detection of malicious code.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.