CICI: TCR: Improving the Robustness of Cyberinfrastructure via Scalable Vulnerability Discovery and Mitigation on "Big Binaries"

关键科学领域的研究人员和科学家使用软件进行地球物理成像，测序DNA，监测空气质量，以及发现新分子以寻找新药。甚至更多的软件支持科学家必须执行的日常和例行活动，例如建立和更新学术网站，共享和传输研究数据，撰写和撰写科学手稿，审查学术论文，与同事进行视频会议，浏览科学网站和数据集，阅读和发送科学通信等等。不幸的是，在研究原型软件中缺乏软件工程最佳实践，加上科学界广泛使用遗留软件（通常由于研究人员毕业和漂移而无法维护），使得科学家和研究人员极易受到网络攻击。这种网络攻击直接威胁到开放科学。这个项目探索了应用二进制分析技术的方法，它可以在理论上发现和减轻遗留软件中的漏洞，以分析和改进科学软件。首先，它追求二进制软件的综合语料库的创建，在这个语料库中，项目将发现并减轻漏洞，并且可以在其上度量所取得的改进。考虑到这个软件，下一个重点将集成和增强二进制分析技术，以解决当前二进制分析缺乏可扩展性的问题（使它们能够扩展到，例如，大型模拟软件）。最后，这将结合到一个自动化的水平，目前还没有在实践中存在，以便研究语料库中必须分析的科学软件的绝对数量。由此产生的以科学软件为中心的网络推理系统不仅将为识别和改进遗留的、不安全的科学软件提供经济和平稳的过渡路径，而且将为创建和部署下一代二进制分析技术铺平道路。该奖项反映了美国国家科学基金会的法定使命，并通过使用基金会的知识价值和更广泛的影响审查标准进行评估，被认为值得支持。

Researchers and scientists in critical scientific domains use software to conduct geophysical imaging, sequence DNA, monitor air quality, and discover new molecules for finding new drugs. Even more software powers daily and routine activities that scientists must perform, such as building and updating academic websites, sharing and transferring research data, writing and composing scientific manuscripts, reviewing academic papers, video conferencing with colleagues, browsing scientific websites and datasets, reading and sending scientific correspondence, and so on. Unfortunately, a lack of software engineering best-practices in research prototype software combined with the wide-spread use of legacy software (often unmaintained due to researcher graduation and drift) in scientific communities make scientists and researchers extremely vulnerable to cyber attacks. Such cyber attacks directly threaten open science.This project explores ways to apply binary analysis techniques, which can theoretically find and mitigate vulnerabilities in legacy software, to the analysis and improvement of scientific software. First, it pursues the creation of a comprehensive corpus of binary software in which the project will find and mitigate vulnerabilities and on which achieved improvements can be measured. With this software in mind, the next thrust will integrate and augment binary analysis techniques to address a lack of scalability of current binary analyses (enabling them to scale to, for example, large simulation software). Finally, this will be combined to a level of automation that does not currently exist in practice so that the sheer amount of scientific software in the research corpus that must be analyzed. The resulting scientific software-focused Cyber Reasoning System will not only provide economical and smooth transition paths for the identification and improvement of legacy, insecure scientific software, but will pave the way for the creation and deployment of next-generation binary analysis technologies.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.