SHF: Small: Detecting the 1%: Growing the Science of Vulnerability Detection

每天，新闻报道都会披露最新的日益复杂的安全攻击，这些攻击威胁到我们的国家安全、我们的网络基础设施、我们的健康、我们的财务、我们的孩子和民主本身。然而，研究表明，发现的漏洞可能具有非常大的破坏性，但很少见，出现在大约1%-4%的软件文件中。寻找漏洞被描述为“大海捞针”。但是，保护美国人民、美国国土和美国人的生活方式意味着软件组织需要检测漏洞，以便在客户使用产品之前修复这些漏洞，从而使攻击者可以使用这些漏洞。该项目将进行研究，以了解风险最大的漏洞的特征和位置，以便花费特别的努力并开发自动化工具来检测这些漏洞。这项工作将提高软件组织生产安全软件产品的能力，使人们能够依赖计算机系统执行关键功能，并安全地处理、存储和交流敏感信息。该研究项目还涉及对博士生的指导，以及面向本科生和研究生的软件安全教学创新。对要审查和测试的代码做出明智的决定，可以提高团队发现和消除更多漏洞的能力。因此，基于漏洞的检测技术和工具以及有效的漏洞预测可能会更好地为寻求优先处理安全检查和测试工作的安全工程师提供服务。该项目的目标是通过对漏洞特征的实证研究，以及通过开发和评估预测模型，并结合人工智能的最新研究，帮助软件从业者检测可利用的漏洞。该项目将探索漏洞的特征，重点放在构成最高安全风险的漏洞上。有关漏洞基本特征的知识可用于开发以漏洞为重点的工具，以帮助团队有效和高效地检测漏洞。基本的脆弱性特征还可以用来开发新的指标和方法，以建立脆弱性预测模型，并通过人工智能的最新研究得到加强。该项目团队还将提供试验台和测试数据，以帮助其他安全研究人员。该奖项反映了NSF的法定使命，并通过使用基金会的智力优势和更广泛的影响审查标准进行评估，被认为值得支持。

Daily, news reports reveal the latest increasingly sophisticated security attacks that threaten our national security, our cyber infrastructure, our health, our finances, our children, and democracy itself. Yet, studies indicate that discovered vulnerabilities can be very damaging but are rare, appearing in about 1-4% of software files. Finding vulnerabilities has been described as "searching for a needing in a haystack." But, protecting the American people, the American homeland, and the American way of life means that software organizations need to detect vulnerabilities so that they can be fixed before the product is used by customers, which makes the vulnerabilities available to attackers. This project will perform studies to understand the characteristics and location of the most risky vulnerabilities so that special effort can be spent and automated tools can be developed to detect the vulnerabilities. The work will improve the ability of software organizations to produce secure software products so that people can rely upon computer systems to perform critical functions and to process, store, and communicate sensitive information securely. The research project also involves the mentoring of PhD students and innovation in software-security teaching for undergraduate and graduate students.Making informed decisions on what code to review and test can improve a team's ability to find and remove more vulnerabilities. Therefore, security engineers looking to prioritize security inspection and testing efforts may be better served by vulnerability-based detection techniques and tools and effective vulnerability prediction. The goal of this project is to aid software practitioners in detecting exploitable vulnerabilities through empirical study of the characteristics of vulnerabilities and through the development and evaluation of prediction models enhanced with recent research from artificial intelligence. The project will explore characteristics of vulnerabilities with a focus on those that pose the highest security risk. Knowledge about the fundamental characteristics of vulnerabilities can be used in the development of vulnerability-focused tools to aid teams in effectively and efficiently detecting vulnerabilities. The fundamental vulnerability characteristics can also be used to develop novel metrics and methods for building vulnerability prediction models enhanced with recent research from artificial intelligence. The project team will also provide a testbed and test data to help other security researchers.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.