SBIR Phase I: ReleaseChecker: Lastline Software Supply Chain Security via GPU-accelerated Binary Diffing

The broader impact of this Small Business Innovation Research (SBIR) Phase I project is to introduce unique AI-powered code diffing capabilities to defend against software supply chain attacks, capabilities that are not yet available in other software supply chain security solutions. This innovation offers several benefits. Firstly, by reducing cybersecurity operation costs, it improves the competitiveness of U.S. companies, allowing them to allocate resources more efficiently.

Secondly, it bolsters software supply chain security, significantly reducing the risk of cyberattacks and protecting sensitive data for governments, enterprises, critical infrastructures, and individuals. Additionally, this innovation will extend our understanding of how to apply AI to program analysis for cybersecurity, including binary code disassembling, function feature extraction and embedding, model training, and optimization.

It establishes a new program analysis pipeline based on the latest AI technology, which can be extended to many other cybersecurity applications.

This Small Business Innovation Research (SBIR) Phase I project addresses the critical need for enhancing software supply chain security and compliance. Unlike other solutions that monitor each stage of the software supply chain, this project aims to leverage AI-powered code diffing technology to precisely and efficiently find the differences between two released versions of the same software.

It further combines software composition analysis and large language models (LLMs) to understand the risks associated with these differences. This solution acts as the final check before the software is released or deployed. The anticipated results include improved accuracy and efficiency in diffing analysis and comprehension, as well as a prototype for testing and commercialization.

This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.