Automated security analysis of hardware systems

该研究项目建议从硬件和软件两个角度研究和创建机器学习(ML)支持的工具，以执行嵌入式和物联网设备的自动化安全分析。分析嵌入式系统的主要挑战来自硬件和软件的多样性和紧密耦合。另一个非常真实的安全威胁来自生产这些物联网设备的供应链。组成这些系统的组件是由许多公司制造的，它们都有不同的安全标准和保障。ML系统也有类似的问题，因为模型是基于来自不同作者的无数不同的软件包。这种外包构成了安全风险。硬件/软件的自动化安全分析系统可以通过使制造商更容易地测试其产品，并允许使用这些供应商的公司测试达到必要安全标准的单个组件来缓解这一问题。我们提出使用分层强化学习结构来解决从两端发现漏洞的问题。也就是说，底层层次结构将负责发现和利用低级漏洞和错误(如缓冲区溢出或释放后使用的敏感代码块)，而顶层层次结构将试图将它们链接在一起，以创建更复杂的利用漏洞。

This research project proposes to investigate and create machine learning (ML)-backed tools to perform automatedsecurity analysis of embedded and IoT devices, from both a hardware and software perspective. The main challengesinvolved with analysing embedded systems stem from the diversity and tight coupling of hardware and software involved.Another very real security threat is caused by the supply chain involved in producing these IoT devices. The componentsthat make up these systems are made by a wide range of companies, all with different security standards andguarantees. ML systems have a similar problem due to models being based on a myriad of different software packagesfrom different authors. This outsourcing poses a security risk. An automated security analysis system forhardware/software can alleviate this problem by making it easier for manufacturers to test their products, and by allowingcompanies using these suppliers to test individual components up to a necessary security standard. We propose to usehierarchical reinforcement learning architecture to tackle the problem of vulnerability discovery from 'both ends'. Namely,the bottom-level hierarchy would be responsible for discovery and exploit of low-level vulnerabilities and bugs (such asbuffer-overflow, or use-after-free susceptible chunks of code), while the top-level hierarchy will attempt to link thesetogether to create a more complex exploit.