CAREER: Towards a Secure and Reliable Internet of Things through Automated Model Extraction and Analysis

物联网(IoT)有望在各个领域改变我们的生活质量。然而，Mirai僵尸网络和其他利用物联网设备漏洞的网络攻击暴露了当前物联网部署中的重大安全和隐私问题。这些事件表明了确保物联网生态系统安全的重要性，将其作为实现物联网变革性力量的先驱。物联网生态系统涉及各种组件，包括受限设备、边缘设备、移动设备和云。保护物联网部署需要深入了解每个组件的攻击面以及由于各种组件之间的交互而形成的攻击面。然而，为这些组件提供动力的软件的复杂性构成了一个巨大的挑战。该项目的目标是使用自动模型提取和模型引导分析来实现安全工程的整体视图。该项目将产生方法、工具和教育材料，在安全软件开发和部署实践方面增强物联网行业的能力。此外，该项目将有助于扩大女性和其他代表性不足的群体在物联网安全、正式方法和软件工程研究中的参与。该项目将调查系统软件的可扩展分析，以推断系统级别的行为。关键的见解是，软件通常是根据编程模型开发的，该模型将某些结构和语义关联强加给数据和代码。这些知识为处理代码的复杂性提供了很好的机会，因为它为如何孤立地分析组件以及如何在分析过程中有效地探索状态空间提供了指导。具体地说，该项目建立在三个研究主题的基础上：1)系统软件中使用的编程模型的形式化；2)利用正式定义的编程模型和各种程序分析技术的自动模型提取和模型指导分析；以及3)通过将自动提取的组件模型与运行时数据相集成，对物联网系统进行系统级分析。自动构建的系统级模型将经过严格的分析，并将支持对物联网部署进行有效的运行时监控，以提高可用性、可靠性、隐私和安全性。一种新颖、增量和基于模型检查的回归分析将实现物联网系统的安全可靠发展。该奖项反映了NSF的法定使命，并已通过使用基金会的智力优势和更广泛的影响审查标准进行评估，被认为值得支持。

The Internet of Things (IoT) is expected to transform the quality of our lives in various domains. However, the Mirai botnet and other cyber attacks that exploited vulnerabilities in IoT devices have revealed major security and privacy issues in the current deployments of IoT. These incidents indicate the importance of securing the IoT ecosystem as a precursor to achieving the transformative power of IoT. The IoT ecosystem involves a variety of components including constrained devices, edge devices, mobile devices, and the cloud. Securing an IoT deployment requires a deep understanding of the attack surface of each component and the attack surfaces that are formed as a result of the interactions between various components. However, the complexity of software that powers these components poses a big challenge. The goal of this project is to achieve a holistic view of security engineering using automated model extraction and model guided analysis. The project will yield methodologies, tools, and educational material that will empower the IoT industry in terms of secure software development and deployment practices. Additionally, the project will help broaden participation of women and other underrepresented groups in IoT security, formal methods, and software engineering research.This project will investigate scalable analysis of system software to reason about system-level behavior. The key insight is that software is often developed according to a programming model, which imposes certain structural and semantic associations for data and code. This knowledge provides a great opportunity to deal with the complexity of code as it provides guidance on how to analyze components in isolation and how to effectively explore the state space during analysis. Specifically, the project builds on three research thrusts: 1) Formalization of programming models that are used in system software, 2) Automated model extraction and model guided analysis that leverage formally defined programming models and the integration of a variety of program analysis techniques, and 3) System-level analysis of IoT systems through integration of automatically extracted component models with run-time data. The automatically constructed system-level model will be subjected to rigorous analysis and will support effective run-time monitoring of IoT deployments for improved usability, reliability, privacy, and security. A novel, incremental, and model checking based regression analysis will enable safe and secure evolution of IoT systems.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.