Collaborative Research: SaTC: CORE: Medium: Audacity of Exploration: Toward Automated Discovery of Security Flaws in Networked Systems through Intelligent Documentation Analysis

联网系统(例如，互联网应用程序、运营商网络)的规范、开发人员指南和其他文档描述了这些系统是如何设计、使用和运行的。这些文件是了解这些系统安全弱点的重要来源，由于难以分析其不精确、错综复杂和模棱两可的内容，这些文件尚未得到充分利用。Audacity项目(安全自动文档分析)旨在应对安全漏洞发现和补救方面的挑战。它的创新之处在于开发了创新技术，使安全保护的文件分析自动化成为可能。该项目更广泛的意义和重要性包括将技术转移到行业，让代表人数不足的群体的成员参与该项目，并通过K9-12外联和社区服务传播成果。该项目的重点是通过从文件中自动恢复与安全相关的信息(例如，模型、安全属性)和令人困惑的描述(例如，不一致的陈述)，以评估其安全影响(例如，验证系统设计、确认系统实现的预测弱点)，从而减轻联网系统中设计缺陷和实现漏洞的安全风险。这一目的由基于机器学习和自然语言处理的用于分析不同类型的文档的新技术来服务，诸如用于支付、单点登录和用于第三代合作伙伴计划或3GPP的文档。这类技术的例子包括用于查找与安全要求相关的语句的情感分析，以及比较关于类似安全关键操作的不同语句以捕获不一致性的相似性和差异性分析。此外，该项目还通过分析3GPP生态系统的公共文本数据来比较不同服务的文档和3GPP生态系统，以进行风险度量、识别和缓解，从而研究服务聚合等新兴技术。这项工作是对项目分析的补充，有助于提高联网系统的安全质量，有助于建立更好的程序和生态系统，使安全关键文档更精确、更一致、更少出错。该奖项反映了NSF的法定使命，并通过使用基金会的智力优势和更广泛的影响审查标准进行评估，被认为值得支持。

Specifications, developer guides and other documentations of networked systems (e.g., Internet applications, carrier networks) describe how these systems are designed, used and operate. These documentations are important sources for understanding security weaknesses in these systems and have not been fully leveraged due to the difficulty in analyzing their imprecise, convoluted and ambiguous content. Project Audacity (AUtomated Documentation Analysis for seCurITY) aims at addressing the challenge for security weakness discovery and remedy. Its novelties are the development of innovative technologies to enable automated document analysis for security protection. The project’s broader significance and importance include transferring the technologies to industry, involving members from under-represented groups in the project and disseminating outcomes through K9-12 outreach and community services. The project focuses on mitigating security risks of both design flaws and implementation vulnerabilities in networked systems, through automatically recovering security-related information (e.g., models, security properties) and confusing descriptions (e.g., inconsistent statements) from documentations to evaluate their security implications (e.g., verification of system designs, validation of predicted weaknesses on system implementations). This purpose is served by novel techniques based upon machine learning and natural language processing for analyzing different types of documentations, such as those for payment, single-sign-on, and for the 3rd Generation Partnership Project or 3GPP. Examples of such techniques include sentiment analysis for finding the statements related to security requirements and a similarity and differential analysis that compares different statements about similar security-critical operations to capture inconsistency. Furthermore, the project studies emerging techniques such as service syndication through comparing the documentations of different services and the 3GPP ecosystem from analyzing its public text data for risk measurement, identification and mitigation. This work complements program analysis to help enhance the security quality of networked systems, contributing to a better procedure and ecosystem that make security-critical documentations more precise, more consistent and less error-prone.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.