CICI: TCR: Prompt, Reliable, and Safe Security Update for Cyberinfrastructure

CICI：TCR：网络基础设施的及时、可靠和安全的安全更新

• 批准号: 2319880
• 负责人: Jun Xu
• 金额: $ 119.81万
• 依托单位: University of Utah
• 依托单位国家: 美国
• 项目类别: Standard Grant
• 财政年份: 2023
• 资助国家: 美国
• 起止时间: 2023-09-01 至 2026-08-31
• 项目状态: 未结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=2319880&HistoricalAwards=false
• 关键词: CICI; TCR; Prompt; Reliable; Safe

Cyberinfrastructure plays a crucial role in the nation's critical infrastructures, driving advancements in science, engineering, education, and collaboration. However, cyberinfrastructure also becomes a perfect target for cyber attackers, due to its high-value data (e.g., nuclear test results) and massive computing resources (e.g., supercomputers). As shown by data, cyber attacks are happening to cyberinfrastructure more frequently, causing remarkable damage to the economy, environment, public health, and even national security. This project aims to transition recent cybersecurity advancements and techniques for enhancing cyberinfrastructure resilience under cyber threats. In particular, this project ensures that security updates, or patches, for software systems running on cyberinfrastructure are adopted in a timely, reliable, and safe way, which can help eliminate up to 85 percent of targeted attacks, according to US-CERT. The research outcomes advance the scientific study of software patching under challenging conditions such as limited monetary resources, insufficient admin expertise, and highly diverse environments. The research outcomes are also projected to deploy to large-scale cyberinfrastructure platforms, including Utah CHPC (a 5,600-user platform) and many similar platforms (e.g., PNNL, ORNL, and the Rutgers Office of Advanced Research Computing).Technically, this project develops three innovations to offer security updates desired by cyberinfrastructure. First, it adapts recent open-source frameworks to provide affordable patch management for cyberinfrastructure and explores research advancements in patch presence detection and automated exploit generation to detect unadopted patches and assess their urgency. Second, it introduces directed fuzz testing and regression fuzz testing as methods to evaluate patch quality for cyberinfrastructure and tailors differential program analysis to analyze the testing outcomes and measure the reliability of available patches. Third, it develops a system-wide dependency analysis to understand the components impacted by a target patch and informed by the analysis result, assembles a low-cost testbed on the fly to assess the safety of the patch to the entire system.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.

网络基础设施在国家的关键基础设施中发挥着至关重要的作用，推动了科学，工程，教育和协作的进步。然而，网络基础设施也成为网络攻击者的完美目标，由于其高价值数据（例如，核试验结果）和大量计算资源（例如，超级计算机）。数据显示，网络攻击越来越频繁地发生在网络基础设施上，对经济，环境，公共健康甚至国家安全造成了显着的损害。该项目旨在将最近的网络安全进步和技术转变为增强网络基础设施在网络威胁下的复原力。特别是，该项目确保以及时、可靠和安全的方式采用在网络基础设施上运行的软件系统的安全更新或补丁，这可以帮助消除高达85%的有针对性的攻击。研究成果推进了在具有挑战性的条件下对软件修补的科学研究，例如有限的货币资源，管理专业知识不足和高度多样化的环境。研究成果还预计将部署到大规模的网络基础设施平台，包括犹他州CHPC（一个5,600用户的平台）和许多类似的平台（例如，从技术上讲，该项目开发了三项创新，以提供网络基础设施所需的安全更新。首先，它适应了最近的开源框架，为网络基础设施提供负担得起的补丁管理，并探索了补丁存在检测和自动漏洞生成的研究进展，以检测未采用的补丁并评估其紧迫性。其次，介绍了有向模糊测试和回归模糊测试作为评估网络基础设施补丁质量的方法，并定制了差分程序分析来分析测试结果并衡量可用补丁的可靠性。 第三，它开发了一个系统范围的依赖性分析，以了解受目标补丁影响的组件，并根据分析结果提供信息，在运行中组装一个低成本的测试平台，以评估补丁对整个系统的安全性。该奖项反映了NSF的法定使命，并通过使用基金会的知识价值和更广泛的影响审查标准进行评估，被认为值得支持。