Engineering Papers⌕ Search

Engineering topics

Southam, Philip

Publications and source records attributed to Southam, Philip.

5 records
All sourcesNASA NTRSDOE OSTI
NASA NTRS2022

Research Report: Progress on Building a File Observatory for Secure Parser Development

Parsing untrusted data is notoriously challenging.Failure to handle maliciously crafted data correctly can (anddoes) lead to a wide range of vulnerabilities. The Languagetheoretic security (LangSec) philosophy seeks to obviate the needfor developers to apply ad hoc solutions by, instead, offeringformally correct and verifiable input handling throughout thesoftware development lifecycle. One of the key components indeveloping secure parsers is a broad coverage corpus that enablesdevelopers to understand the problem space for a given formatand to use, potentially, as seeds for fuzzing and other automatedtesting. In this paper, we offer an update on work reportedat the LangSec 2021 conference on the development of a fileobservatory to gather and enable analysis on a diverse collectionof files at scale. The initial focus of the observatory is on PortableDocument Format (PDF) files and file formats typically embeddedin PDFs. In this paper, we report on refactoring the ingestprocess, applying new analytic methods, and improving the User Interface.

Stonebraker, Ryan↗
NASA NTRS2021

Research Report: Building a File Observatory for Secure Parser Development

"Parsing untrusted data is notoriously challenging.Failure to handle maliciously crafted data correctly can (anddoes) lead to a wide range of vulnerabilities. The Languagetheoretic security (LangSec) philosophy seeks to obviate the needfor developers to apply ad hoc solutions by, instead, offeringformally correct and verifiable input handling throughout thesoftware development lifecycle. One of the key components indeveloping secure parsers is a broad coverage corpus that enablesdevelopers to understand the problem space for a given formatand to use, potentially, as seeds for fuzzing and other automatedtesting. In this paper, we offer an update on the developmentof a file observatory to gather and enable analysis on a diversecollection of files at scale. Specifically, we report on the additionof a bug tracker corpus and new analytic methods on our existingcorpus."

Stonebraker, Ryan↗
NASA NTRS2020

Names Don't Fly: Smart Filters for Profanity Detection and Classification in User-Generated Content

Generally, names associate with a person’s identity. But what if in the pretext of a legitimate name and given the opportunity, users of software provide names to online web forms that carry along offensive language, slurs, and other profanity that is then sent to Mars ? The answer is simple: they don’t fly. In this paper,we perform model explorations to detect and classify inappropriate content in the names submitted from people across the world to ‘Send Your Names to MARS’ public engagement campaign.We propose a novel pipeline approach, that can effectively overcome the issues of lack of negative samples, noisy labels by gathering expert knowledge over time with human(s) in the loop and data augmentation, and achieve high accuracy in classifying inappropriate names with very little or no context. We describe cloud-based infrastructure to deploy our application and run predictions on large-scale data through our pipeline and achieve significant speedup over offline processes, with enhanced reliability and security.

Soderstrom, Tomas↗
NASA NTRS2020

Research Report: Building a Wide Reach Corpus for Secure Parser Development

Whether developing from a specification or deriving parsers from samples, LangSec parser developers require widereach corpora of their target file format in order to identify key edge cases or common deviations from the format’s specification. In this work-in-progress paper, we report the details of several methods we’ve used to gather 30 million files, extract features and make these features amenable to search and other analytics. This paper documents opportunities and limitations of some popular open source data and tools and this paper will benefit researchers who need to efficiently gather a large file corpus.

Timmaraju, Virisha↗