CICI: SSC: SciTrust: Enhancing Security for Modern Software Programming Cyberinfrastructure

CICI：SSC：SciTrust：增强现代软件编程网络基础设施的安全性

• 批准号: 2218762
• 负责人: Yanfang Ye
• 金额: $ 63.37万
• 依托单位: University of Notre Dame
• 依托单位国家: 美国
• 项目类别: Standard Grant
• 财政年份: 2021
• 资助国家: 美国
• 起止时间: 2021-11-01 至 2023-09-30
• 项目状态: 已结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=2218762&HistoricalAwards=false
• 关键词: CICI; SSC; SciTrust; Enhancing; Security

Software plays a vital role supporting scientific communities. Modern software programming cyberinfrastructure (CI), consisting of online discussion platforms (such as Stack Overflow) and social coding repositories (such as Github), offers an open-source and collaborative environment for distributed scientific communities to expedite the process of software development. Within the ecosystem, researchers and developers can reuse code snippets and libraries, or adapt existing ready-to-use software to solve their own problems. Despite the apparent benefits of this new social coding paradigm, its potential security-related risks have been largely overlooked; insecure or malicious codes could be easily embedded and distributed, which could severely damage the scientific credibility of CI. Therefore, there is an urgent need for developing scalable techniques and tools to automatically detect these open-source insecure or malicious codes. To address this issue, this proposed project seeks to explore innovative links between Artificial Intelligence (AI) and cybersecurity to enhance the security of modern software programming CI. The key components of the proposed research are three-fold: (1) a novel AI-based solution (iTrustSO) utilizing social coding properties is developed to automatically identify suspicious insecure code snippets on Stack Overflow; (2) a cross-platform model is constructed to represent the complex interplay between GitHub and Stack Overflow; deep learning techniques are then utilized to build a predictive model (iTrustGH) for automatic detection of malicious codes on GitHub; and (3) a user-friendly tool (SciTrust) is developed to enhance code security for software development. The broader impacts of this work include benefits to scientific communities and the whole society by promoting the efficiency of cyber-enabled software development without sacrificing the security. The establishment of a Cybersecurity Lab through this project enhances the education and workforce training in cybersecurity. The project integrates research with education through curriculum development and student mentoring activities for the newly-established cybersecurity degree program. It is also expected to increase the participation of underrepresented groups including minority and women.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.

软件在支持科学社区方面起着至关重要的作用。现代软件编程网络基础架构（CI），包括在线讨论平台（例如堆栈溢出）和社交编码存储库（例如GitHub），为分布式科学社区提供了开源和协作环境，以加快软件开发过程。在生态系统中，研究人员和开发人员可以重复使用代码片段和库，或者调整现有的现成软件来解决自己的问题。尽管这种新的社会编码范式显然带来了好处，但其潜在的与安全有关的风险在很大程度上被忽略了。不安全或恶意代码可以很容易地嵌入和分发，这可能会严重损害CI的科学信誉。因此，迫切需要开发可扩展技术和工具来自动检测这些开源不安全或恶意代码。为了解决这个问题，该提议的项目旨在探索人工智能（AI）和网络安全之间的创新联系，以增强现代软件编程CI的安全性。拟议的研究的关键组成部分是三个方面：（1）开发了一种基于AI的新解决方案（ITRUSTSO），利用社交编码属性开发出来自动识别堆栈溢出上的可疑不安全代码段； （2）构建了一个跨平台模型，以表示GitHub和堆栈溢出之间的复杂相互作用；然后，将深度学习技术用于构建一个预测模型（ITRUSTGH），以自动检测GitHub上的恶意代码。 （3）开发了一种用户友好的工具（Scitrust），以增强软件开发的代码安全性。这项工作的更广泛影响包括通过促进网络支持软件开发的效率而不牺牲安全性来促进科学社区和整个社会的好处。通过该项目建立网络安全实验室可以增强网络安全方面的教育和劳动力培训。该项目通过课程开发和学生指导活动将研究与新建立的网络安全学位课程相结合。预计它将增加包括少数族裔和妇女在内的代表性不足的团体的参与。该奖项反映了NSF的法定任务，并使用基金会的知识分子优点和更广泛的影响标准，被认为值得通过评估来获得支持。

项目成果

Rep2Vec: Repository Embedding via Heterogeneous Graph Adversarial Contrastive Learning

• DOI: 10.1145/3534678.3539324
• 发表时间: 2022-08
• 期刊: Proceedings of the 28th ACM SIGKDD Conference on Knowledge Discovery and Data Mining
• 作者: Y. Qian;Yiming Zhang;Qianlong Wen;Yanfang Ye;Chuxu Zhang

Back-Propagating System Dependency Impact for Attack Investigation

攻击调查的反向传播系统依赖性影响

• 发表时间: 2022
• 期刊: USENIX Security Symposium
• 作者: Fang, Pengcheng;Gao, Peng;Liu, Changlin;Ayday, Erman;Jee, Kangkook;Wang, Ting;Ye, Yanfang;Liu, Zhuotao;Xiao, Xusheng
• 通讯作者: Xiao, Xusheng

Grape: Knowledge Graph Enhanced Passage Reader for Open-domain Question Answering

• DOI: 10.48550/arxiv.2210.02933
• 发表时间: 2022-10
• 作者: Mingxuan Ju;W. Yu;Tong Zhao;Chuxu Zhang;Yanfang Ye

Multi-view Self-supervised Heterogeneous Graph Embedding

• DOI: 10.1007/978-3-030-86520-7_20
• 发表时间: 2021
• 作者: Jianan Zhao;Qian Wen;Shiyu Sun;Yanfang Ye;Chuxu Zhang

Adversarial Reprogramming of Pretrained Neural Networks for Fraud Detection

用于欺诈检测的预训练神经网络的对抗性重编程

• DOI: 10.1145/3459637.3482053
• 发表时间: 2021
• 期刊: International Conference on Information and Knowledge Management (CIKM
• 作者: Chen, Lingwei;Fan, Yujie;Ye, Yanfang
• 通讯作者: Ye, Yanfang