CICI: SSC: SciTrust: Enhancing Security for Modern Software Programming Cyberinfrastructure

软件在支持科学团体方面起着至关重要的作用。现代软件编程网络基础设施（CI）由在线讨论平台（如Stack Overflow）和社交编码存储库（如Github）组成，为分布式科学社区提供了一个开源和协作环境，以加快软件开发过程。在生态系统中，研究人员和开发人员可以重用代码片段和库，或者调整现有的即用软件来解决他们自己的问题。尽管这种新的社会编码模式有明显的好处，但其潜在的安全风险在很大程度上被忽视了；不安全或恶意代码很容易嵌入和分发，这可能严重损害CI的科学可信度。因此，迫切需要开发可扩展的技术和工具来自动检测这些开源的不安全代码或恶意代码。为了解决这一问题，本拟议项目旨在探索人工智能（AI）与网络安全之间的创新联系，以增强现代软件编程CI的安全性。该研究的主要组成部分有三个方面：(1)开发了一种基于人工智能的解决方案（iTrustSO），利用社会编码属性自动识别堆栈溢出上的可疑不安全代码片段；(2)构建了一个跨平台模型来表示GitHub和Stack Overflow之间复杂的相互作用；然后利用深度学习技术构建预测模型（iTrustGH），用于自动检测GitHub上的恶意代码；(3)开发了一个用户友好的工具（SciTrust），以提高软件开发的代码安全性。这项工作的更广泛影响包括通过在不牺牲安全性的情况下提高网络软件开发的效率，从而使科学界和整个社会受益。通过该项目建立网络安全实验室，加强网络安全教育和人才培训。该项目通过新设立的网络安全学位课程的课程开发和学生指导活动，将研究与教育结合起来。预计还将增加代表性不足的群体，包括少数民族和妇女的参与。该奖项反映了美国国家科学基金会的法定使命，并通过使用基金会的知识价值和更广泛的影响审查标准进行评估，被认为值得支持。

Software plays a vital role supporting scientific communities. Modern software programming cyberinfrastructure (CI), consisting of online discussion platforms (such as Stack Overflow) and social coding repositories (such as Github), offers an open-source and collaborative environment for distributed scientific communities to expedite the process of software development. Within the ecosystem, researchers and developers can reuse code snippets and libraries, or adapt existing ready-to-use software to solve their own problems. Despite the apparent benefits of this new social coding paradigm, its potential security-related risks have been largely overlooked; insecure or malicious codes could be easily embedded and distributed, which could severely damage the scientific credibility of CI. Therefore, there is an urgent need for developing scalable techniques and tools to automatically detect these open-source insecure or malicious codes. To address this issue, this proposed project seeks to explore innovative links between Artificial Intelligence (AI) and cybersecurity to enhance the security of modern software programming CI. The key components of the proposed research are three-fold: (1) a novel AI-based solution (iTrustSO) utilizing social coding properties is developed to automatically identify suspicious insecure code snippets on Stack Overflow; (2) a cross-platform model is constructed to represent the complex interplay between GitHub and Stack Overflow; deep learning techniques are then utilized to build a predictive model (iTrustGH) for automatic detection of malicious codes on GitHub; and (3) a user-friendly tool (SciTrust) is developed to enhance code security for software development. The broader impacts of this work include benefits to scientific communities and the whole society by promoting the efficiency of cyber-enabled software development without sacrificing the security. The establishment of a Cybersecurity Lab through this project enhances the education and workforce training in cybersecurity. The project integrates research with education through curriculum development and student mentoring activities for the newly-established cybersecurity degree program. It is also expected to increase the participation of underrepresented groups including minority and women.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.