CNS Core: Medium: Automated IoT Safety and Security Analysis and Synthesis

CNS 核心：中：自动化物联网安全分析与综合

• 批准号: 2320882
• 负责人: Patrick McDaniel
• 金额: $ 119.99万
• 依托单位: University of Wisconsin-Madison
• 依托单位国家: 美国
• 项目类别: Continuing Grant
• 财政年份: 2022
• 资助国家: 美国
• 起止时间: 2022-10-01 至 2024-06-30
• 项目状态: 已结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=2320882&HistoricalAwards=false
• 关键词: CNS; Core; Medium; Automated; IoT

This project focuses on advancing a science that enables practitioners to validate the safety of homes, workplaces, and public spaces that have been augmented with digital devices such as sensors, smart-devices, and autonomous infrastructure. Specifically, the objective of this research is the creation of software analysis and verification techniques to evaluate the safety and security of Internet of Things (IoT) programs and environments in a range of domains. This project will study how to model IoT programming platforms to validate safety, security and functional properties at scale as well as how to create IoT-specific languages for secure-by-design IoT implementations.This project will develop systems that extract models (called transition systems) from IoT source code and apply scalable software verification techniques to provide proofs of correctness with the desired properties. At the same time, this project furthers the creation of IoT-specific languages to automatically generate IoT programs that preserve functional, safety and security properties at run-time. This project will develop tools and datasets, as well as evaluate the efficacy of verification and generation techniques in diverse IoT domains.The expected results of this project are a set of online IoT analysis and synthesis tools and a curriculum for IoT software safety and security analysis for the public and technical communities. Such tools will enable the ongoing transition to smart environments in ways that will be safer and more secure. This project will also help foster the engagement of scientific and industrial communities in IoT safety and security through the development of workshop, outreach and tutorial events.All software, data, papers, and tutorials will be maintained on project website for the entirety of the project and maintained thereafter as future work progresses. For public distribution, all development and experimental artifacts for this project will be linked to the project website (https://github.com/IoTBench/) and maintained over the project duration.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.

该项目的重点是推进一门科学，使从业者能够验证通过传感器、智能设备和自主基础设施等数字设备增强的家庭、工作场所和公共空间的安全性。 具体来说，这项研究的目标是创建软件分析和验证技术，以评估一系列领域中物联网 (IoT) 程序和环境的安全性。该项目将研究如何对物联网编程平台进行建模，以大规模验证安全性、保密性和功能属性，以及如何为设计安全的物联网实现创建物联网专用语言。该项目将开发从物联网源代码中提取模型（称为转换系统）的系统，并应用可扩展的软件验证技术来提供所需属性的正确性证明。与此同时，该项目进一步创建了物联网专用语言，以自动生成物联网程序，在运行时保留功能、安全和保障属性。该项目将开发工具和数据集，并评估不同物联网领域中验证和生成技术的有效性。该项目的预期结果是一套在线物联网分析和综合工具以及面向公众和技术社区的物联网软件安全和安全分析课程。此类工具将以更安全的方式持续向智能环境过渡。 该项目还将通过举办研讨会、外展和教程活动，帮助促进科学界和工业界参与物联网安全和保障。整个项目的所有软件、数据、论文和教程都将在项目网站上维护，并随着未来工作的进展进行维护。 对于公开分发，该项目的所有开发和实验工件都将链接到项目网站 (https://github.com/IoTBench/) 并在项目期间进行维护。该奖项反映了 NSF 的法定使命，并通过使用基金会的智力价值和更广泛的影响审查标准进行评估，被认为值得支持。

项目成果

IoTRepair: Flexible Fault Handling in Diverse IoT Deployments

• DOI: 10.1145/3532194
• 发表时间: 2022-05
• 期刊: ACM Transactions on Internet of Things
• 作者: Michael Norris;Z. Berkay Celik;P. Venkatesh;Shulin Zhao;P. Mcdaniel;A. Sivasubramaniam;Gang Tan

The CVE Wayback Machine: Measuring Coordinated Disclosure from Exploits against Two Years of Zero-Days

CVE 回溯机器：衡量针对两年零日漏洞的协调披露

• DOI: 10.1145/3618257.3624810
• 发表时间: 2023
• 期刊: ACM
• 作者: Pauley, Eric;Barford, Paul;McDaniel, Patrick
• 通讯作者: McDaniel, Patrick