CICI: TCR: Prompt, Reliable, and Safe Security Update for Cyberinfrastructure

CICI：TCR：网络基础设施的及时、可靠和安全的安全更新

• 批准号: 2319880
• 负责人: Jun Xu
• 金额: $ 119.81万
• 依托单位: University of Utah
• 依托单位国家: 美国
• 项目类别: Standard Grant
• 财政年份: 2023
• 资助国家: 美国
• 起止时间: 2023-09-01 至 2026-08-31
• 项目状态: 未结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=2319880&HistoricalAwards=false
• 关键词: CICI; TCR; Prompt; Reliable; Safe

Cyberinfrastructure plays a crucial role in the nation's critical infrastructures, driving advancements in science, engineering, education, and collaboration. However, cyberinfrastructure also becomes a perfect target for cyber attackers, due to its high-value data (e.g., nuclear test results) and massive computing resources (e.g., supercomputers). As shown by data, cyber attacks are happening to cyberinfrastructure more frequently, causing remarkable damage to the economy, environment, public health, and even national security. This project aims to transition recent cybersecurity advancements and techniques for enhancing cyberinfrastructure resilience under cyber threats. In particular, this project ensures that security updates, or patches, for software systems running on cyberinfrastructure are adopted in a timely, reliable, and safe way, which can help eliminate up to 85 percent of targeted attacks, according to US-CERT. The research outcomes advance the scientific study of software patching under challenging conditions such as limited monetary resources, insufficient admin expertise, and highly diverse environments. The research outcomes are also projected to deploy to large-scale cyberinfrastructure platforms, including Utah CHPC (a 5,600-user platform) and many similar platforms (e.g., PNNL, ORNL, and the Rutgers Office of Advanced Research Computing).Technically, this project develops three innovations to offer security updates desired by cyberinfrastructure. First, it adapts recent open-source frameworks to provide affordable patch management for cyberinfrastructure and explores research advancements in patch presence detection and automated exploit generation to detect unadopted patches and assess their urgency. Second, it introduces directed fuzz testing and regression fuzz testing as methods to evaluate patch quality for cyberinfrastructure and tailors differential program analysis to analyze the testing outcomes and measure the reliability of available patches. Third, it develops a system-wide dependency analysis to understand the components impacted by a target patch and informed by the analysis result, assembles a low-cost testbed on the fly to assess the safety of the patch to the entire system.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.

网络基础设施在国家的关键基础设施中起着至关重要的作用，推动了科学，工程，教育和协作方面的进步。但是，由于其高价值数据（例如，核试验结果）和大量的计算资源（例如，超级计算机），网络基础设施也成为网络攻击者的理想目标。如数据所示，网络攻击正在更频繁地发生在网络基础设施上，从而对经济，环境，公共卫生甚至国家安全造成显着损害。该项目的目的是过渡最近的网络安全进步和技术，以增强网络构造在网络威胁下的弹性。尤其是，该项目可确保以及时，可靠且安全的方式采用在网络基础结构上运行的软件系统的安全更新或补丁程序，这可以帮助消除多达85％的目标攻击。该研究结果推进了在有限的条件下（例如货币资源，管理不足和高度多样化的环境）在挑战性条件下进行软件修补的科学研究。研究结果还预计将部署到大规模的网络基础设施平台上，包括犹他州CHPC（一个5,600个用户平台）和许多类似的平台（例如，PNNL，ORNL和RUTGERS的高级研究计算办公室）。技术上，该项目在此项目上为安全提供了三个创新，可以通过安全地构建cyberinfras cyberinfras cyberinfras。首先，它适应了最近的开源框架，以为网络基础设施提供负担得起的补丁管理，并探讨了斑块存在检测和自动化利用生成中的研究进步，以检测未经补充的补丁并评估其紧迫性。其次，它引入了定向模糊测试和回归绒毛测试，作为评估网络基础设施的补丁质量的方法，并量身定制差异程序分析，以分析测试结果并测量可用补丁的可靠性。 第三，它开发了全系统的依赖性分析，以了解受目标贴片影响并通过分析结果告知的组件，并随时组装了低成本测试床，以评估整个系统的贴剂安全性。这项奖项反映了NSF的法定任务，并通过评估该基金会的知识绩效和广泛的影响来评估NSF的法定任务，并被视为值得的支持。