新兴技术：软件行为计算在安全性与正确性中的应用.pdf

1、The Emerging Technology of Software Behavior Computation for Security and CorrectnessRick LingerAssuranceLabs Inc.1Copyright 2024 AssuranceLabsrick.lingerassurancelabs.tech202-701-6257SEI 2024 Secure Software By Design ConferenceSoftware Can Dwarf Hardware in Complex Systems2Cost allocation Since th

2、e 1980s,HW/SW cost ratio has shifted from 10:1 to 1:2Parts countF-35:8M SW parts(instructions),300K HW parts:Ratio 27/1NASA:“We are no longer building hardware into which we install enabling software,we are building software systems which we wrap up in enabling hardware.”*Dr.Patricia Sanders,Chair,A

3、erospace Safety Advisory Panel,testifying at House hearing“Keeping Our Sights on Mars,”May 8,2019.Copyright 2024 AssuranceLabsHard Work and Mega-Failures Every effort is made to ensure correctness and security But failures continue to occur,with serious consequences:Boeing:Starliner spacecraft failu

4、re to achieve orbit:Multiple$100M CrowdStrike:Global IT meltdown:May be multiple$100BConsortium for Information and Software Quality:2022 cost of poor software in US:$2.41T*Copyright 2024 AssuranceLabs*Krasner,H.,“The Cost of Poor Software Quality in the US:A 2022 Report,”Dec.2022,https:/www.it-cisq

5、.org/the-cost-of-poor-quality-software-in-the-us-a-2022-report/Limitations of Todays MethodsTestingPrincipal means of software assurance.Can show the presence of errors not their absence.Can exercise only a small fraction of possible executions.Static AnalysisMust unroll loops,cannot determine full

6、loop functionality.Reviews Subject to human fallibility.Copyright 2024 AssuranceLabsFormal MethodsEffective,but slow and costly.All vital and useful,but can we do better?A New Approach:Computing the Behavior of Software5Function Extraction(FX)Technology An emerging mathematics-based technology Compu