Building and Monitoring Security in Emerging Softwarized Systems

点击翻译按钮获取中文摘要

The security of softwarized systems (i.e., software-centric or software-controlled systems) is critical to ensure that evolving digital environments remain both safe and effective. The growing complexity of softwarized systems (that is, transitioning from hardware-driven to software-driven systems) and their constantly changing runtime environments require a significant increase in the capability of security analysts and software engineers to monitor their security. To timely deliver software capabilities for emerging domains (e.g., cloud) or applications (e.g., connected vehicles), software providers prioritize functionality over security, resulting in a system vulnerable to attacks. The proposed research will innovate a variety of automated techniques for secure softwarization by addressing security issues in different stages of a development life cycle and subsequent monitoring at runtime. This research will develop methods and tools for intrusion scenario description and automatic signature generation from the scenarios. A monitoring system will be developed to detect intrusions into software systems by comparing their operational behavior with the generated signatures. Commonly recurring security problems can be addressed using security patterns. Such patterns will be used to realize security requirements in software design, with security violation detected by automatic runtime analysis of the patterns. Motivated by an increased recognition of the importance of prioritizing both security and functionality, softwarized systems are turning to cloud for Software as a Service (SaaS) to instantly access or update various software capabilities via the internet. This research will provide a novel comprehensive platform to incorporate security activities and services at different phases of the SaaS development lifecycle. The platform will provide end to end information protection and harden SaaS applications against prevalent security threats. Vehicles are being softwarized very rapidly, inevitably making connected and autonomous vehicles (CAVs) soft targets of cyber-attacks. Existing software development methodologies do not address the range of security challenges encountered in developing software for modern softwarized vehicles. This research will apply the above-mentioned software development and monitoring tools and techniques to improve CAV software security. The proposed research program will play a vital role in advancing the state of the art of security in emerging complex softwarized systems. The program is in alignment with the Government of Canada's immediate need for cybersecurity experts to protect Canadians from cyberattacks. The program will consider and promote equity, diversity and inclusion (EDI) and facilitate a unique training environment for five graduate students per year by incorporating both software engineering and security engineering principles and collaborating closely with our various Canadian industry connections.