Automated risk analysis with respect to open-source dependencies (Hektor) (T03#)

开源依赖项的自动风险分析 (Hektor) (T03

• 批准号: 469074023
• 金额: --
• 依托单位: Fachgruppe Softwaretechnik
• 依托单位国家: 德国
• 项目类别: Collaborative Research Centres (Transfer Project)
• 财政年份: 2021
• 资助国家: 德国
• 起止时间: 2020-12-31 至 2023-12-31
• 项目状态: 已结题
• 来源: https://gepris.dfg.de/gepris/projekt/469074023?language=en
• 关键词: Automated; risk; analysis; respect; open

In this transfer project, we explore how techniques from the quality assurance of services in on-the- fly service markets can be applied to the pressing problem of securely managing open source dependencies in large software development ecosystems. To this end, novel techniques will be developed and evaluated to efficiently and precisely detect and mitigate the inclusion of known-to- be-vulnerable third-party dependencies within software compositions. The project aims to build an open-source tool chain called HEKTOR to support the secure development of applications and services. In principle, these developments should enable precise and efficient analysis of software artifacts on a large scale. The effectiveness of the developed techniques will be validated in a real environment at the partner company SAP SE.

在这个转移项目中，我们将探讨如何将即时服务市场中的服务质量保证技术应用于大型软件开发生态系统中安全管理开源依赖关系的紧迫问题。为此，将开发和评估新的技术，以有效和精确地检测和减轻软件组合中已知易受攻击的第三方依赖关系。该项目旨在构建一个名为HEKTOR的开源工具链，以支持应用程序和服务的安全开发。原则上，这些发展应该能够在大规模上对软件工件进行精确和有效的分析。所开发技术的有效性将在合作伙伴公司SAP SE的真实的环境中得到验证。