CMU Computer Science Projects Overview

SoS and Hard Problems Bill Scherlis scherlis@cmu.edu 27 Sep 13 School of Computer Science

CMU Projects seed done Kathleen Carley Learned Resiliency: Secure Multi-Level Systems Does evidence production provide productivity benefits -- the case of API compliance Systematic Testing of Distributed and Multi-threaded Systems at Scale Improving the usability of security requirements by software developers through empirical studies and analysis A Language and Framework for Development of Secure Mobile Applications seed done Jonathan Aldrich seed done Garth Gibson Travis Breaux Jonathan Aldrich Andre Platzer Security reasoning for distributed systems with uncertainties Anupam Datta, Limin Jia, Robert Harper Secure composition of systems and policies Learned Resiliency Kathleen Carley Jason Hong, N. Sadeh, Shahiriyar Amini, Jialiu Lin seed Crowdsourcing privacy and security information Proofs and Signatures Frank Pfenning Frameworks David Garlan, Jonathan Aldrich Lorie Cranor,Alessandro Acquisti, N. Christin, R.telang User behavior study cohort School of Computer Science 2

CMU Projects [1] Composability seed done Kathleen Carley Learned Resiliency: Secure Multi-Level Systems Does evidence production provide productivity benefits -- the case of API compliance Systematic Testing of Distributed and Multi-threaded Systems at Scale Improving the usability of security requirements by software developers through empirical studies and analysis A Language and Framework for Development of Secure Mobile Applications seed done Jonathan Aldrich seed done Garth Gibson Travis Breaux Jonathan Aldrich Andre Platzer Security reasoning for distributed systems with uncertainties Anupam Datta, Limin Jia, Robert Harper Secure composition of systems and policies Learned Resiliency Kathleen Carley Jason Hong, N. Sadeh, Shahiriyar Amini, Jialiu Lin seed Crowdsourcing privacy and security information Proofs and Signatures Frank Pfenning Frameworks David Garlan, Jonathan Aldrich Lorie Cranor,Alessandro Acquisti, N. Christin, R.telang User behavior study cohort School of Computer Science 3

CMU Projects [5] Usability seed done Kathleen Carley Learned Resiliency: Secure Multi-Level Systems Does evidence production provide productivity benefits -- the case of API compliance Systematic Testing of Distributed and Multi-threaded Systems at Scale Improving the usability of security requirements by software developers through empirical studies and analysis A Language and Framework for Development of Secure Mobile Applications seed done Jonathan Aldrich seed done Garth Gibson Travis Breaux Jonathan Aldrich Andre Platzer Security reasoning for distributed systems with uncertainties Anupam Datta, Limin Jia, Robert Harper Secure composition of systems and policies Learned Resiliency Kathleen Carley Jason Hong, N. Sadeh, Shahiriyar Amini, Jialiu Lin seed Crowdsourcing privacy and security information Proofs and Signatures Frank Pfenning Frameworks David Garlan, Jonathan Aldrich Lorie Cranor,Alessandro Acquisti, N. Christin, R.telang User behavior study cohort School of Computer Science 4

CMU Projects [2] Policy seed done Kathleen Carley Learned Resiliency: Secure Multi-Level Systems Does evidence production provide productivity benefits -- the case of API compliance Systematic Testing of Distributed and Multi-threaded Systems at Scale Improving the usability of security requirements by software developers through empirical studies and analysis A Language and Framework for Development of Secure Mobile Applications seed done Jonathan Aldrich seed done Garth Gibson Travis Breaux Jonathan Aldrich Andre Platzer Security reasoning for distributed systems with uncertainties Anupam Datta, Limin Jia, Robert Harper Secure composition of systems and policies Learned Resiliency Kathleen Carley Jason Hong, N. Sadeh, Shahiriyar Amini, Jialiu Lin seed Crowdsourcing privacy and security information Proofs and Signatures Frank Pfenning Frameworks David Garlan, Jonathan Aldrich Lorie Cranor,Alessandro Acquisti, N. Christin, R.telang User behavior study cohort School of Computer Science 5

CMU Projects [3] Metrics seed done Kathleen Carley Learned Resiliency: Secure Multi-Level Systems Does evidence production provide productivity benefits -- the case of API compliance Systematic Testing of Distributed and Multi-threaded Systems at Scale Improving the usability of security requirements by software developers through empirical studies and analysis A Language and Framework for Development of Secure Mobile Applications seed done Jonathan Aldrich seed done Garth Gibson Travis Breaux Jonathan Aldrich Andre Platzer Security reasoning for distributed systems with uncertainties Anupam Datta, Limin Jia, Robert Harper Secure composition of systems and policies Learned Resiliency Kathleen Carley Jason Hong, N. Sadeh, Shahiriyar Amini, Jialiu Lin seed Crowdsourcing privacy and security information Proofs and Signatures Frank Pfenning Frameworks David Garlan, Jonathan Aldrich Lorie Cranor,Alessandro Acquisti, N. Christin, R.telang User behavior study cohort School of Computer Science 6

CMU Projects [4] Resiliency seed done Kathleen Carley Learned Resiliency: Secure Multi-Level Systems Does evidence production provide productivity benefits -- the case of API compliance Systematic Testing of Distributed and Multi-threaded Systems at Scale Improving the usability of security requirements by software developers through empirical studies and analysis A Language and Framework for Development of Secure Mobile Applications seed done Jonathan Aldrich seed done Garth Gibson Travis Breaux Jonathan Aldrich Andre Platzer Security reasoning for distributed systems with uncertainties Anupam Datta, Limin Jia, Robert Harper Secure composition of systems and policies Learned Resiliency Kathleen Carley Jason Hong, N. Sadeh, Shahiriyar Amini, Jialiu Lin seed Crowdsourcing privacy and security information Proofs and Signatures Frank Pfenning Frameworks David Garlan, Jonathan Aldrich Lorie Cranor,Alessandro Acquisti, N. Christin, R.telang User behavior study cohort School of Computer Science 7

Perspective from CMU Principal technicalthemes the Hard Problems we emphasize Composition As key to scale in complexity, capability, interlinking Incremental progress, by attributes, components, API richness, etc. What are principles of modeling to enhance potential for composition? Usability Roles System developers and evaluators Humans as constituent elements of systems Human end-users, e.g., with security as secondary focus Humans as adversaries How to study and advance usability for these categories of humans? Interactions between these Developer / evaluator usability E.g., Developers dealing with complex APIs tools vs. simplicity School of Computer Science 8

Perspective from CMU Principal technical themes the Hard Problems we emphasize Principal methodological themes Data meets models E.g., socnets, developer usability, end-user usability, API complexity Semantics-based approaches meet real engineered systems E.g., hypervisors, Web apps, framework+apps, large components Empirical science (data, people) meets mathematical reasoning E.g., language design, API design, model design, tool design School of Computer Science 9

Advancing the Science Explicating SoS Learning how to do better, more productive science Identifying and codifying patterns Experiment design, validity, scientific productivity, paths to impact Accelerate paths to more confident validity Methods of analysis and reasoning Examples of cross-cutting principles of composability [workshop] Assume-guarantee reasoning Program equivalence Game theory Families of systems School of Computer Science 10

Advancing the Science Explicating SoS Learning how to do better, more productive science Learning how to do more coherent science Progress as a community From points of light to a coherent beam Effective building on results effective reuse Commonality of perspective on open questions and their framing Evolving common elements Normative methodologies E.g., human-user experiment design for secondary tasks Conventions for commensurability scales, metrics, etc. Potential for reproducibility Framing of technical problems E.g., composition, API, model, analysis Relating technical traditions E.g., state/trace types structures Patterns of community engagement Workshops, Education, Data, etc. School of Computer Science 11

Advancing the Science Explicating SoS Kinds of directevidence in support of the SoS hypothesis Hypotheses in common E.g., interventions for security/quality can enhance productivity Development of Secure Mobile Applications [Aldrich] Ability to do a meta-analysis E.g., across password guidance studies Diversity of validation techniques for individual results E.g., mathematical proofs, field trials, developer studies E.g., direct big-data analysis, modeling and simulation Learned Resiliency [Carley] Sharing of data, reproduction of significant studies School of Computer Science 12

Advancing the Science Explicating SoS Kinds of directevidence in support of the SoS hypothesis Indirect evidence Patterns for technical publications in maturing technical areas Cf. PLDI, SOSP Technical/mathematical methods common across technical attributes Science of Secure Frameworks [Garlan, Aldrich, Malek, Abi-Antoun] Shared tooling base for experimentation Cf. Stats packages, MatLab School of Computer Science 13