CNS Core: Medium: Automated IoT Safety and Security Analysis and Synthesis

CNS 核心：中：自动化物联网安全分析与综合

• 批准号: 2320882
• 负责人: Patrick McDaniel
• 金额: $ 119.99万
• 依托单位: University of Wisconsin-Madison
• 依托单位国家: 美国
• 项目类别: Continuing Grant
• 财政年份: 2022
• 资助国家: 美国
• 起止时间: 2022-10-01 至 2024-06-30
• 项目状态: 已结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=2320882&HistoricalAwards=false
• 关键词: CNS; Core; Medium; Automated; IoT

This project focuses on advancing a science that enables practitioners to validate the safety of homes, workplaces, and public spaces that have been augmented with digital devices such as sensors, smart-devices, and autonomous infrastructure. Specifically, the objective of this research is the creation of software analysis and verification techniques to evaluate the safety and security of Internet of Things (IoT) programs and environments in a range of domains. This project will study how to model IoT programming platforms to validate safety, security and functional properties at scale as well as how to create IoT-specific languages for secure-by-design IoT implementations.This project will develop systems that extract models (called transition systems) from IoT source code and apply scalable software verification techniques to provide proofs of correctness with the desired properties. At the same time, this project furthers the creation of IoT-specific languages to automatically generate IoT programs that preserve functional, safety and security properties at run-time. This project will develop tools and datasets, as well as evaluate the efficacy of verification and generation techniques in diverse IoT domains.The expected results of this project are a set of online IoT analysis and synthesis tools and a curriculum for IoT software safety and security analysis for the public and technical communities. Such tools will enable the ongoing transition to smart environments in ways that will be safer and more secure. This project will also help foster the engagement of scientific and industrial communities in IoT safety and security through the development of workshop, outreach and tutorial events.All software, data, papers, and tutorials will be maintained on project website for the entirety of the project and maintained thereafter as future work progresses. For public distribution, all development and experimental artifacts for this project will be linked to the project website (https://github.com/IoTBench/) and maintained over the project duration.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.

该项目致力于推进一门科学，该科学使从业人员能够验证已通过数字设备（例如传感器，智能设备和自动基础架构）增强的房屋，工作场所和公共场所的安全性。 具体而言，这项研究的目的是创建软件分析和验证技术，以评估一系列领域中物联网（IoT）程序和环境的安全性和安全性。该项目将研究如何对物联网编程平台进行建模，以规模验证安全，安全性和功能性属性，以及如何为Secure-by-designesign Iot实施创建IoT特异性语言。本项目将开发从IoT源代码中提取模型（称为过渡系统）的系统，并从IoT源代码中提取模型（称为过渡系统），并应用可扩展的软件验证技术，以提供所需的属性的正确性。同时，该项目进一步创建了特定于IoT的语言，以自动生成在运行时保留功能，安全和安全属性的IoT程序。该项目将开发工具和数据集，并评估验证和发电技术在不同的物联网域中的功效。该项目的预期结果是一套在线物联网分析和合成工具，以及用于公共和技术社区的物联网软件安全和安全性分析的课程。这样的工具将以更安全，更安全的方式使持续过渡到智能环境。 该项目还将通过开发研讨会，外展和教程活动来帮助促进科学和工业社区在物联网安全和保障中的参与。所有软件，数据，论文和教程都将在项目网站上为整个项目进行维护，并在此后随后将未来的工作继续进行。 对于公众发行，该项目的所有开发和实验性工件将与项目网站（https://github.com/iotbench/）相关，并在项目持续时间内维持。该奖项反映了NSF的法定任务，并认为通过基金会的知识智能和更广泛的影响，可以通过评估通过评估来获得支持。

项目成果

IoTRepair: Flexible Fault Handling in Diverse IoT Deployments

• DOI: 10.1145/3532194
• 发表时间: 2022-05
• 期刊: ACM Transactions on Internet of Things
• 作者: Michael Norris;Z. Berkay Celik;P. Venkatesh;Shulin Zhao;P. Mcdaniel;A. Sivasubramaniam;Gang Tan

The CVE Wayback Machine: Measuring Coordinated Disclosure from Exploits against Two Years of Zero-Days

CVE 回溯机器：衡量针对两年零日漏洞的协调披露

• DOI: 10.1145/3618257.3624810
• 发表时间: 2023
• 期刊: ACM
• 作者: Pauley, Eric;Barford, Paul;McDaniel, Patrick
• 通讯作者: McDaniel, Patrick