SaTC: CORE: Medium: Collaborative: Threat-Aware Defense: Evaluating Threats for Continuous Improvement

在寻找程序漏洞的竞赛中，攻击者的速度超过了开发人员。程序员必须找到程序中所有潜在的软件缺陷，并确定是否可以在所有部署中利用它们来防止漏洞，而攻击者只需要找到一个软件缺陷，就可以在任何一个部署中实现他们的目标。由于现代软件及其部署的复杂性，当前消除程序漏洞的技术无法发现所有此类缺陷。最近的漏洞检测研究不是证明不存在缺陷，而是探索更强大的技术来自动生成漏洞。然而，这种漏洞生成往往缺乏现代和新兴防御的系统模型，这可能有助于评估防御的效用。此外，一旦一个漏洞被生成，必须手动将防御措施添加到程序中以防止该漏洞。因此，漏洞检测尚未对防御给予足够的重视，以评估其有效性，也没有在必要时生成额外的防御。该项目提出了一种理论和技术，以不断迭代地改进防御，以对抗导致漏洞的威胁。开发了一种搜索违反安全策略的程序并扩展现有防御的方法，以自动阻止检测到的违规行为。主要的见解是将每个项目的威胁和防御连接到一个连贯的模型中，称为项目威胁图（PTG），以主动评估威胁是否使对手能够违反给定当前防御的项目安全策略，并自动改进防御以防止此类违反。该项目探讨了如何在给定程序内部和环境防御的情况下发现安全违规行为。安全违规用于生成目标防御和/或系统防御，以有效地阻止此漏洞，并阻止可能在给定性能约束下利用其他缺陷的潜在未知漏洞。这项研究的目标是不断改进对漏洞的防御。该方法在给定当前和即将到来的防御规范的情况下发现安全违规，自动收紧它们，并在不中断程序功能的情况下从尝试的攻击中恢复。在这个项目中开发的所有工具、基准测试和分析都作为开源发布。在拓展方面，重点是夺旗比赛和夏季软件安全课程。该奖项反映了美国国家科学基金会的法定使命，并通过使用基金会的知识价值和更广泛的影响审查标准进行评估，被认为值得支持。

Adversaries are outpacing developers in the race to find program vulnerabilities. Where programmers have to find all potential software flaws in their programs and determine whether they are exploitable across all deployments to prevent vulnerabilities, adversaries need only find one software flaw that enables them to achieve their goals in any one deployment. Current techniques to rid programs of vulnerabilities cannot find all such flaws due to the complexity of modern software and their deployments. Rather than proving the absence of flaws, recent vulnerability detection research is exploring more powerful techniques to automate exploit generation. However, such exploit generation often lacks a systematic model of modern and emerging defenses, which may be useful in assessing the utility of defenses. In addition, once an exploit is generated, defenses to prevent that exploit must be added manually to the program. As a result, vulnerability detection does not yet pay enough attention to defenses to assess their effectiveness nor generate additional defenses when necessary.This project proposes a theory and techniques to improve defenses continuously and iteratively to counter threats that cause vulnerabilities. A method is developed that searches programs for security policy violations and extends existing defenses to prevent detected violations automatically. The main insight is to link the threats and defenses of each program into one coherent model, called the Program Threat Graph (PTG), to evaluate proactively whether threats enable adversaries to violate program security policies given current defenses and automate the improvement of defenses to prevent such violations. The project explores how to find security violations given a program's internal and environmental defenses. Security violations are used to generate both targeted defenses and/or systematic defenses to block this exploit efficiently and block potentially unknown exploits that may leverage other flaws under given performance constraints. The goal of this research is to continuously improve defenses against vulnerabilities. The approach discovers security violations given a specification for both current and upcoming defenses, tightening them automatically and recovering from attempted attacks without disrupting program functionality. All tools, benchmarks, and analyses developed during this project are released as open-source. For outreach, the focus is on capture-the-flag competitions and summer software security courses.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.