Proto-OKN Theme 1: Knowledge Graph Construction for Resilient, Trustworthy, and Secure Software Supply Chains

该项目旨在创建一个全面的知识图谱，详细介绍不同软件生态系统中的软件组件，以提高它们的整体安全性。使用神经知识获取管道，它将从不同的来源提取并持续更新软件数据，然后使用质量控制方法巩固这些信息。这一知识图谱将促进独特的多模式查询系统和风险缓解工具，可以检测和自动修复软件漏洞。与行业合作伙伴和政府机构的合作将确保开发的知识图谱在现实世界中的适用性和有效性。该项目将开展活动，扩大对计算机的参与，并采取主动行动，教育和吸收新一代软件程序员。该项目将通过创建第一个软件供应链的大规模知识图谱，推动软件供应链管理和风险缓解方面的研究。与现有技术相比，该方法将为跨不同平台和语言的供应链管理提供实时、全面的数据。为了实现这一目标，该团队将开发先进的自然语言处理方法，以从自由格式文本中理解和提取复杂的软件知识。在加强软件材料清单的效用的同时，拟议的努力将减少使用开放源码软件组件开发的软件系统的攻击面。该项目团队致力于通过教程、出版物和开源工具广泛分享他们的发现。这一奖项反映了NSF的法定使命，并通过使用基金会的智力优势和更广泛的影响审查标准进行评估，被认为值得支持。

This project aims to create a comprehensive knowledge graph detailing software components across diverse software ecosystems to increase their overall security. Using a neural knowledge acquisition pipeline, it will extract and continually update software data from varied sources, then consolidate this information using quality control methods. This knowledge graph will facilitate a unique multi-modal query system and risk mitigation tools that can detect and automatically fix software vulnerabilities. Collaborations with industrial partners and government agencies will ensure the real-world applicability and effectiveness of the developed knowledge graph. The project will feature activities to broaden participation in computing and initiatives to educate and involve the next generation of software programmers.The project will advance research on software supply chain management and risk mitigation by creating the first large-scale knowledge graph for software supply chains. Compared to the existing techniques, this approach will provide real-time, comprehensive data for supply chain management across diverse platforms and languages. To achieve this, the team will develop advanced Natural Language Processing methods to comprehend and extract intricate software knowledge from free-form text. While enhancing the utility of the Software Bill of Materials, the proposed effort will reduce the attack surface of software systems developed with open-source software components. The project team is dedicated to sharing their findings widely through tutorials, publications, and open-source tools.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.