Software Engineering and Information Assurance
Measurable means to achieve quality, security, and affordability
Software-intensive systems should perform as intended and be free from vulnerabilities. They should also be affordable, a term that implies cost control and timely deployment of needed software capabilities. System designers struggle to make software secure and affordable amid technology gaps for resilient software architecture, automated software analysis, development process agility, and cost control.
We focus on forming solutions to building correct, secure, and affordable systems. We develop measurable means to reduce risk for new systems or legacy system sustainment efforts by building in data and information security and wringing out software defects. We seek root causes in software acquisition of affordability issues that result in wasted effort and delays. In response to those issues, we create and prototype tooling that can shorten development time and increase software quality.
Featured Work
Managing Technical Debt with Data-Driven Analysis
Most software projects carry technical debt. We develop tools and techniques that identify it and provide a complete view of the debt that you need to manage.
Converting a Navy Weapon System from a 32- to a 64-Bit Architecture
The SEI provided an independent assessment of the risks of migrating a weapons control system deployed by the U.S. Navy from one architecture to another.
Automating Vulnerability Discovery in Critical Applications
CERT researchers develop automated tools that discover and mitigate software vulnerabilities and transfer them to researchers, procurement specialists, and software vendors.
Supporting the U.S. Army's Joint Multi-Role Technology Demonstrator Effort
We build and analyze virtual software systems to find problems early in development, before a system is built. Early discovery reduces cost and certification time.
Design Pattern Recovery from Malware Binaries
The DoD and industry face many malware problems. CERT researchers automate malware analysis capabilities, including those focused on malware family evolution and similarity.
Automated Code Repair
Finding security flaws in source code is daunting; fixing them is an even greater challenge. Our researchers are creating automated tools that can repair bugs automatically or by prompting developers for more information to make effective repairs.
QUELCE: Quantifying Uncertainty in Early Lifecycle Cost Estimation
Costs for large new systems are hard to estimate. We developed a method to quantify uncertainty and increase confidence in a program's cost estimate.
Featured Publications
Cyber Security Engineering: A Practical Approach for Systems and Software Assurance
November 15, 2016 • Book
Carol Woody, PhDNancy R. Mead
Pioneering software assurance experts Dr. Nancy R. Mead and Dr. Carol C. Woody present the latest practical knowledge and case studies.
Download
Definition and Measurement of Complexity in the Context of Safety Assurance
October 27, 2016 • Technical Report
William NicholsCharles B. WeinstockSarah Sheard
This report describes research to define complexity measures for avionics systems to help the FAA identify when systems are too complex to assure their safety.
Download
A Requirement Specification Language for AADL
June 22, 2016 • Technical Report
Peter H. FeilerJulien DelangeLutz Wrage
This report describes a textual requirement specification language, called ReqSpec, for the Architecture Analysis & Design Language (AADL) and demonstrates its use.
Download
On Board Diagnostics: Risks and Vulnerabilities of the Connected Vehicle
April 13, 2016 • White Paper
Dan J. KlinedinstChristopher King
This report describes cybersecurity risks and vulnerabilities in modern connected vehicles.
Download
Evaluating and Mitigating the Impact of Complexity in Software Models
December 03, 2015 • Technical Report
Julien DelangeJim McHaleJohn J. Hudak
This report defines software complexity, metrics for complexity, and the effects of complexity on cost and presents an analysis tool to measure complexity in models.
Download