Tools and Techniques to Perform Comprehensive Security Assessments

执行全面安全评估的工具和技术

• 批准号: 577519-2022
• 负责人: Lie, DavidDJ
• 金额: $ 1.09万
• 依托单位: University of Toronto
• 依托单位国家: 加拿大
• 项目类别: Idea to Innovation
• 财政年份: 2022
• 资助国家: 加拿大
• 起止时间: 2022-01-01 至 2023-12-31
• 项目状态: 已结题
• 来源: https://www.nserc-crsng.gc.ca/ase-oro/Details-Detailles_eng.asp?id=751709
• 关键词: Tools; Techniques; Perform; Comprehensive; Security

As the age of the Internet of Things ("IoT") dawns, we face a growing legion of embedded, intelligent, and internet-capable devices. Although these devices provide significant utility for end-users, they also come with the potential of significant security flaws, which can exploit the vulnerabilities in IoT devices. The intellectual property contained in our patent offers a solution to the potential security flaws in IoT devices. In lab tests, our tool and method can check for correspondence between source code and binaries with 75% accuracy, thus significantly limiting the threat of and risk of a security compromise resulting from a mismatched binary. Our techniques have proven to be more effective than existing tools at findings vulnerabilities. So far, our techniques have discovered several vulnerabilities during testing, including previously unknown vulnerabilities in popular web applications and Android devices. Compared to existing tools, ours require far less effort on the part of the end user. All vulnerabilities within a particular device were uncovered using our product by single graduate student. In comparison, using existing tools in the marketplace would require a large team to uncover the same vulnerabilities.

随着物联网（“IoT”）时代的到来，我们面临着越来越多的嵌入式、智能和具有互联网能力的设备。尽管这些设备为最终用户提供了重要的实用性，但它们也存在重大安全缺陷的可能性，这些缺陷可能会利用物联网设备中的漏洞。 我们专利中包含的知识产权为物联网设备中的潜在安全缺陷提供了解决方案。在实验室测试中，我们的工具和方法可以以75%的准确率检查源代码和二进制文件之间的对应关系，从而大大限制了由不匹配的二进制文件导致的安全威胁和风险。我们的技术已被证明比现有的工具更有效地发现漏洞。到目前为止，我们的技术已经在测试过程中发现了几个漏洞，包括流行的Web应用程序和Android设备中以前未知的漏洞。与现有的工具相比，我们的工具需要终端用户付出的努力要少得多。特定设备中的所有漏洞都是由一名研究生使用我们的产品发现的。相比之下，使用市场上现有的工具将需要一个庞大的团队来发现相同的漏洞。