CICI: TCR: Improving the Robustness of Cyberinfrastructure via Scalable Vulnerability Discovery and Mitigation on "Big Binaries"

CICI：TCR：通过“大型二进制文件”的可扩展漏洞发现和缓解来提高网络基础设施的稳健性

• 批准号: 2232915
• 负责人: Ruoyu Wang
• 金额: $ 120万
• 依托单位: Arizona State University
• 依托单位国家: 美国
• 项目类别: Standard Grant
• 财政年份: 2023
• 资助国家: 美国
• 起止时间: 2023-01-01 至 2025-12-31
• 项目状态: 未结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=2232915&HistoricalAwards=false
• 关键词: CICI; TCR; Improving; Robustness; Cyberinfrastructure

Researchers and scientists in critical scientific domains use software to conduct geophysical imaging, sequence DNA, monitor air quality, and discover new molecules for finding new drugs. Even more software powers daily and routine activities that scientists must perform, such as building and updating academic websites, sharing and transferring research data, writing and composing scientific manuscripts, reviewing academic papers, video conferencing with colleagues, browsing scientific websites and datasets, reading and sending scientific correspondence, and so on. Unfortunately, a lack of software engineering best-practices in research prototype software combined with the wide-spread use of legacy software (often unmaintained due to researcher graduation and drift) in scientific communities make scientists and researchers extremely vulnerable to cyber attacks. Such cyber attacks directly threaten open science.This project explores ways to apply binary analysis techniques, which can theoretically find and mitigate vulnerabilities in legacy software, to the analysis and improvement of scientific software. First, it pursues the creation of a comprehensive corpus of binary software in which the project will find and mitigate vulnerabilities and on which achieved improvements can be measured. With this software in mind, the next thrust will integrate and augment binary analysis techniques to address a lack of scalability of current binary analyses (enabling them to scale to, for example, large simulation software). Finally, this will be combined to a level of automation that does not currently exist in practice so that the sheer amount of scientific software in the research corpus that must be analyzed. The resulting scientific software-focused Cyber Reasoning System will not only provide economical and smooth transition paths for the identification and improvement of legacy, insecure scientific software, but will pave the way for the creation and deployment of next-generation binary analysis technologies.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.

关键科学领域的研究人员和科学家使用软件进行地球物理成像，DNA测序，监测空气质量，并发现用于寻找新药的新分子。更多的软件为科学家必须执行的日常和常规活动提供了动力，例如建立和更新学术网站、共享和传输研究数据、撰写和撰写科学手稿、审阅学术论文、与同事进行视频会议、浏览科学网站和数据集、阅读和发送科学信函等等。不幸的是，在研究原型软件中缺乏软件工程最佳做法，加上科学界广泛使用遗留软件（由于研究人员毕业和漂移，往往得不到维护），使科学家和研究人员极易受到网络攻击。这种网络攻击直接威胁到开放科学。本项目探讨如何将二进制分析技术应用于科学软件的分析和改进，该技术在理论上可以发现并减轻遗留软件中的漏洞。首先，它致力于创建一个全面的二进制软件语料库，项目将在其中发现和减轻漏洞，并在此基础上衡量所取得的改进。考虑到这个软件，下一个重点将是集成和增强二进制分析技术，以解决当前二进制分析缺乏可扩展性的问题（使它们能够扩展到例如大型模拟软件）。最后，这将被结合到一个目前在实践中不存在的自动化水平，以便必须分析研究语料库中的大量科学软件。 由此产生的以科学软件为重点的网络推理系统不仅将为识别和改进遗留的、不安全的科学软件提供经济和平稳的过渡路径，但将为下一个的创建和部署铺平道路。该奖项反映了NSF的法定使命，并被认为值得通过使用基金会的知识价值和更广泛的影响进行评估来支持审查标准。

项目成果

Greenhouse: Single-Service Rehosting of Linux-Based Firmware Binaries in User-Space Emulation

• 发表时间: 2023
• 作者: Hui Jun Tay;Kyle Zeng;J. Vadayath;A. S. Raj;A. Dutcher;T. Reddy;Wil Gibbs;Zion Leonahenahe Basque;Fangzhou Dong;Zack Smith;Adam Doupé;Tiffany Bao;Yan Shoshitaishvili;Ruoyu Wang