A Context-Aware Framework for Adaptive Software Security

动态变化的环境和威胁环境需要能够在运行时更改和修改安全机制的自适应软件。这方面的研究有两个不同的侧重点：背景意识和自我保护。上下文感知的研究更多地关注如何对上下文信息进行建模、处理和管理，但仅限于对系统如何适应上下文信息中意外的安全变化的理解。另一方面，对自我保护的研究更多地集中在如何调整系统的结构和/或行为以响应需求和/或意外的安全变化，而较少关注如何对上下文进行建模、处理和管理。*拟议研究计划的长期目标是全面了解应用层的网络攻击。在接下来的五年中，我们的目标是调查、设计和开发一个新的框架，以综合方式支持对环境感知和自适应安全的考虑。具体目标是：(1)设计一个用于语境识别的自适应模型；(2)设计一套用于语境理解的需求和运行时模型；(3)设计一套处理语境投影和解析的算法。*文献中的现有方法缺乏获得网络防御的上下文感知所需的推理和学习能力。然而，PI最近关于将攻击者和自适应管理器之间的交互建模为马尔可夫博弈的初步工作建议在自适应安全中加入上下文来处理应用层攻击。PI将提出一套综合的模型和方法，用于监测、检测攻击类型的不确定性，并在网络空间应用现有技术无法实现的适应决策。*该研究计划将创造高质量的研究能力。它将开辟一个新的研究方向，显著降低1300多家加拿大软件公司受到的网络安全威胁的成本影响，并提高加拿大在这一关键领域的竞争力。工业界将在两个方面受益于该计划的调查结果。提供卓越的上下文感知框架将允许开发和实施复杂的机器学习算法和方法，用于运行时的自适应安全，而自适应软件安全建模技术将帮助公司在自我保护系统的演变和维护过程中使用有效的方法来保持其最新。该研究计划将培养在软件工程和自适应安全领域工作的高素质人才(HQP)。HQP将获得跨学科知识的独特混合，并将这些知识应用于提高适应性软件安全性。

Dynamically changing environments and threat landscapes require adaptive software that enables the change and modification of security mechanisms at runtime. Research has been conducted with two different emphases in this area: context-awareness and self-protection. Research focused on context-awareness is more concerned with how to model, process, and manage contextual information, but is limited in its understanding of how a system adapts itself in response to unanticipated security changes in the context information. On the other hand, research into self-protection focuses more on how to adapt the system's structure and/or behavior in response to requirements and/or unanticipated security changes, but pays less attention to how the context is modeled, processed, and managed. ******The long-term goal of the proposed research program is to gain full-awareness of cyber attacks at application-layers. In the next five years, the goal is to investigate, design, and develop a novel framework that supports consideration of context-awareness and adaptive security in an integrated manner. The specific objectives are: (1) to design an adaptive model for context recognition, (2) to design a set of requirements and runtime models for context comprehension, and (3) a set of algorithms to handle context projection and resolution. ******Existing approaches in literature lack the reasoning and learning capabilities required to gain context-awareness for cyber defense. However, the recent PI's preliminary work on modeling the interactions between the attacker and the adaptation manager as a Markov game suggests incorporating context in adaptive security to handle application-layer attacks. The PI will propose a set of integrated models and methods for monitoring, detecting attack-type uncertainty, and applying adaptation decisions in cyber space that are currently unachievable with existing techniques.******This research program will create high-quality research capabilities. It will open a new research direction that significantly reduces the cost impact of cyber security threats for more than 1,300 Canadian software companies, and improves Canada's competitiveness in this vital sector. Industry will benefit from the findings of this program in two areas. The provision of a superior context-aware framework will allow for the development and implementation of sophisticated machine learning algorithms and methods for adaptive security at runtime, and the adaptive software security modeling techniques will help companies to employ effective methods to keep self-protecting systems up-to-date during their evolution and maintenance. This research program will train High Qualified Personnel (HQP) to work in the field of software engineering and adaptive security. The HQP will acquire a unique blend of interdisciplinary knowledge and apply that knowledge to improve adaptive software security.