SaTC: CORE: Medium: Augmenting Automated Vulnerability Analysis with Human Activity

传统上，人类分析师在检查软件程序的漏洞时执行核心分析任务，同时使用自动化技术作为辅助。在这种情况下，人类是分析过程的协调者，他们将特定的任务委托给特定的工具（如反汇编程序或符号执行系统），负责组合和合成多个工具的结果。 由于二进制程序的自动化分析已经发展到可以扩展到大量真实世界二进制程序的复杂技术，因此现在建议我们转向一种新的范式，其中自动化工具编排过程，并在适当的时候将任务委托给人类。该研究调查了这种新方法，在这种方法中，当自动化技术无法处理应用程序的语义丰富的特定于应用程序的方面时，会利用人类的行为，这些方面是人类可以毫不费力地执行的任务。总体目标是提高自动化漏洞分析和修补的能力。 该研究将开发一个定义良好的框架，其中子任务建模并以原则性的方式分配给演员。例如，模糊是自动漏洞分析中常用的技术。这种方法需要一组测试用例或种子作为输入，这些测试用例或种子执行目标二进制文件的功能。然后这些种子会发生变异，以探索越来越多的代码库，并增加触发bug的机会。 种子质量，就它们如何很好地执行目标程序而言，对模糊器的有效性具有缩放效应：这些测试用例提供的覆盖范围越大，通过变异它们来探索的代码就越多。不幸的是，创建高质量的测试用例种子是一个复杂的问题，这通常被视为人类提供给系统的输入，因为人类对软件的语义有很好的理解，他们在创建高质量的测试用例方面非常有效。 所提出的框架开始分析，然后生成定义良好的“播种小任务”，以系统的方式整合人类的努力，不需要专家级别的人类分析师。这些简单的任务表示与应用程序的阶段性交互，不熟练的人可以执行（例如，因此，这些任务可以通过各种渠道进行众包（如亚马逊的土耳其机器人），他们的结果自动合并到整个漏洞分析过程中。定义良好的框架支持发现自动化和由具有不同技能水平的人执行的动作的意外组合。通过改善二进制分析技术可以更全面地分析大量的二进制文件。因此，在部署之前可以识别更多的漏洞，从而有助于软件应用程序的整体安全性，包括那些关键基础设施的一部分。

Traditionally, human analysts have carried out the core analysis tasks when checking software programs for vulnerabilities, while using automated techniques as an aid. In this case, the humans are the orchestrators of the analysis process, and they delegate specific tasks to specific tools (such as a disassembler or a symbolic execution system), taking care of combining and composing the results of multiple tools. Because the automated analysis of binary programs has advanced to sophisticated techniques that scale to large sets of real-world binary programs, it is now proposed that we move to a new paradigm in which automated tools orchestrate the process, with tasks being delegated to humans when appropriate. The research investigates this new approach, in which human actions are leveraged when automated techniques are unable to deal with the semantically rich, application-specific aspects of applications, which are tasks that humans can carry out with little effort. The overall goal is to improve the capabilities of automated vulnerability analysis and patching. The research will develop a well-defined framework in which subtasks are modeled and assigned to actors in a principled way. For example, fuzzing is a technique commonly used in automated vulnerability analysis. This approach requires, as input, a set of test cases, or seeds, that exercise the functionality of the target binary. These seeds are then mutated to explore more and more of the code base and increase the chance of triggering bugs. The seed quality, in terms of how well they exercise the target program, has a scaling effect on the effectiveness of a fuzzer: the more coverage these test cases provide, the more code will be explored by mutating them. Unfortunately, the creation of high-quality test case seeds is a complicated problem, and this is generally seen as a human-provided input into a system.Because humans have an excellent understanding of the semantics of software, they are very effective at creating high-quality test cases. The proposed framework starts the analysis and then generates well-defined "seeding tasklet" to integrate human efforts in a systematic way that does not require expert-level human analysts.These simple tasks represent staged interactions with an application that an unskilled human can carry out (e.g., by executing a transaction or filling a form).Therefore, these tasks can be crowdsourced through various channels (such as Amazon's Mechanical Turk), and their results automatically merged into the overall vulnerability analysis process.The reliance on a formal, well-defined framework supports the discovery of unanticipated combinations of automation and actions performed by humans with different skill levels.By improving the state-of-the-art in binary analysis it is possible to analyze a larger number of binaries in a more complete way.As a result, more vulnerabilities are identified before deployment, contributing to the overall security of software applications, including those that are part of the critical infrastructure.