Collaborative Research: SaTC: CORE: Medium: Audacity of Exploration: Toward Automated Discovery of Security Flaws in Networked Systems through Intelligent Documentation Analysis

协作研究：SaTC：核心：中：大胆探索：通过智能文档分析自动发现网络系统中的安全缺陷

• 批准号: 2409269
• 负责人: Feng Qian
• 金额: $ 30万
• 依托单位: University of Southern California
• 依托单位国家: 美国
• 项目类别: Standard Grant
• 财政年份: 2023
• 资助国家: 美国
• 起止时间: 2023-10-01 至 2026-06-30
• 项目状态: 未结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=2409269&HistoricalAwards=false
• 关键词: Collaborative; Research; SaTC; CORE; Medium

Specifications, developer guides and other documentations of networked systems (e.g., Internet applications, carrier networks) describe how these systems are designed, used and operate. These documentations are important sources for understanding security weaknesses in these systems and have not been fully leveraged due to the difficulty in analyzing their imprecise, convoluted and ambiguous content. Project Audacity (AUtomated Documentation Analysis for seCurITY) aims at addressing the challenge for security weakness discovery and remedy. Its novelties are the development of innovative technologies to enable automated document analysis for security protection. The project’s broader significance and importance include transferring the technologies to industry, involving members from under-represented groups in the project and disseminating outcomes through K9-12 outreach and community services. The project focuses on mitigating security risks of both design flaws and implementation vulnerabilities in networked systems, through automatically recovering security-related information (e.g., models, security properties) and confusing descriptions (e.g., inconsistent statements) from documentations to evaluate their security implications (e.g., verification of system designs, validation of predicted weaknesses on system implementations). This purpose is served by novel techniques based upon machine learning and natural language processing for analyzing different types of documentations, such as those for payment, single-sign-on, and for the 3rd Generation Partnership Project or 3GPP. Examples of such techniques include sentiment analysis for finding the statements related to security requirements and a similarity and differential analysis that compares different statements about similar security-critical operations to capture inconsistency. Furthermore, the project studies emerging techniques such as service syndication through comparing the documentations of different services and the 3GPP ecosystem from analyzing its public text data for risk measurement, identification and mitigation. This work complements program analysis to help enhance the security quality of networked systems, contributing to a better procedure and ecosystem that make security-critical documentations more precise, more consistent and less error-prone.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.

规格，开发人员指南和其他网络系统的文档（例如，互联网应用程序，运营商网络）的设计，使用和操作是理解这些系统中安全弱点的重要来源，并且由于扩散性而没有完全利用在分析不精确的内容时，请参阅“ Audacity IMS”，以解决安全性和补救措施。社区服务。尽管自动推荐信息（例如，模型，安全属性），例如，不一致的陈述以评估其安全性（例如，验证系统设计，对系统实施的验证）根据学习和自然语言处理的新技术，例如分析以下付款，单签名和第三基因项目或3GPP的情感分析。通过构成不同服务的文档和3GPP生态系统的限制性操作，以分析其公共文本数据，以提高风险测量，识别和缓解。制作关键安全文件的生态系统M. Ore精确，更加一致，更容易出错。这一奖项反映了NSF的Beend Demed值得支持Thentel thentel宗教优点和更广泛的影响审查标准。