Automated software vulnerability detection by leveraging open source knowledge

利用开源知识自动检测软件漏洞

• 批准号: 564717-2021
• 负责人: Shang, Weiyi
• 金额: $ 1.46万
• 依托单位: Concordia University
• 依托单位国家: 加拿大
• 项目类别: Alliance Grants
• 财政年份: 2021
• 资助国家: 加拿大
• 起止时间: 2021-01-01 至 2022-12-31
• 项目状态: 已结题
• 来源: https://www.nserc-crsng.gc.ca/ase-oro/Details-Detailles_eng.asp?id=722164
• 关键词: Automated; software; vulnerability; detection; leveraging

Wind River System is a global leader in delivering software for the intelligent edge. Although Wind River and other software engineering practitioners have spent efforts on detecting and removing the vulnerabilities from their software, the ever increasing complexity and scale of software projects makes the tasks challenging. On the other hand, the open source community often shares knowledge about the discovered vulnerabilities online. Therefore, in this proposal, we plan to leveraging knowledge from the open source community in order to assist in software vulnerability detection. in particular, we design approaches that discover the discussion of software vulnerabilities from open forums and identify the associated source code in the discussion. With the identified source code, we plan to apply code clone detection and code search approaches to detect the existence of similar vulnerabilities inside other software projects, e.g., the source code from Wind River System. The proposed research will result in reports that can be shared regularly about the known vulnerabilities and approaches that automatically detect such vulnerabilities. The reports and the approaches can benefit the practitioners in Wind River System and other software engineering practitioners in Canada and the world.

风河系统是为智能边缘提供软件的全球领导者。尽管风河和其他软件工程从业者一直致力于检测和消除软件中的漏洞，但软件项目日益增加的复杂性和规模使任务变得具有挑战性。另一方面，开源社区经常在线分享有关发现的漏洞的知识。因此，在本提案中，我们计划利用开源社区的知识来帮助软件漏洞检测。特别地，我们设计了从开放论坛发现软件漏洞的讨论并识别讨论中的相关源代码的方法。利用已识别的源代码，我们计划应用代码克隆检测和代码搜索方法来检测其他软件项目中是否存在类似漏洞，例如，风河系统的源代码。拟议的研究将产生报告，可以定期分享已知的漏洞和自动检测这些漏洞的方法。这些报告和方法可以使Wind River System的从业人员以及加拿大和世界其他软件工程从业人员受益。