Proto-OKN Theme 1: Knowledge Graph Construction for Resilient, Trustworthy, and Secure Software Supply Chains

Proto-OKN 主题 1：构建弹性、可信、安全的软件供应链的知识图谱

• 批准号: 2333736
• 负责人: Tianyi Zhang
• 金额: $ 150万
• 依托单位: Purdue University
• 依托单位国家: 美国
• 项目类别: Cooperative Agreement
• 财政年份: 2023
• 资助国家: 美国
• 起止时间: 2023-10-01 至 2026-09-30
• 项目状态: 未结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=2333736&HistoricalAwards=false
• 关键词: Proto; OKN; Theme; Knowledge; Graph

This project aims to create a comprehensive knowledge graph detailing software components across diverse software ecosystems to increase their overall security. Using a neural knowledge acquisition pipeline, it will extract and continually update software data from varied sources, then consolidate this information using quality control methods. This knowledge graph will facilitate a unique multi-modal query system and risk mitigation tools that can detect and automatically fix software vulnerabilities. Collaborations with industrial partners and government agencies will ensure the real-world applicability and effectiveness of the developed knowledge graph. The project will feature activities to broaden participation in computing and initiatives to educate and involve the next generation of software programmers.The project will advance research on software supply chain management and risk mitigation by creating the first large-scale knowledge graph for software supply chains. Compared to the existing techniques, this approach will provide real-time, comprehensive data for supply chain management across diverse platforms and languages. To achieve this, the team will develop advanced Natural Language Processing methods to comprehend and extract intricate software knowledge from free-form text. While enhancing the utility of the Software Bill of Materials, the proposed effort will reduce the attack surface of software systems developed with open-source software components. The project team is dedicated to sharing their findings widely through tutorials, publications, and open-source tools.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.

该项目旨在创建一个全面的知识图，详细说明不同软件生态系统中的软件组件，以提高其整体安全性。使用神经知识获取管道，它将从不同来源提取并不断更新软件数据，然后使用质量控制方法整合这些信息。这个知识图谱将促进一个独特的多模态查询系统和风险缓解工具，可以检测和自动修复软件漏洞。与行业合作伙伴和政府机构的合作将确保开发的知识图谱在现实世界中的适用性和有效性。该项目的特点是开展活动，扩大对计算的参与，并采取举措，教育和吸引下一代软件程序员参与，该项目将通过创建第一个大规模软件供应链知识图，推动对软件供应链管理和风险缓解的研究。与现有技术相比，这种方法将为跨平台和语言的供应链管理提供实时、全面的数据。为了实现这一目标，该团队将开发先进的自然语言处理方法，以从自由形式的文本中理解和提取复杂的软件知识。在加强软件材料清单的效用的同时，拟议的努力将减少使用开放源码软件组件开发的软件系统的攻击面。该项目团队致力于通过教程、出版物和开源工具广泛分享他们的发现。该奖项反映了NSF的法定使命，并通过使用基金会的知识价值和更广泛的影响审查标准进行评估，被认为值得支持。