Bugs Framework (BF)

Title: Bugs Framework (BF)

Webpage: BF Welcome! (usnistgov.github.io/BF/)

Irena Bojanova, PI & Lead

The Bugs Framework (BF) is a structured causal classification of security bugs and related faults, featuring a formal language for unambiguous specification of security weaknesses and underlined by them vulnerabilities. It organizes bugs by the operations of orthogonal software or hardware execution phases, faults -- by their input operands, and errors -- by their output results. An error either propagates to a fault or is a final error introducing an exploit vector. Bugs and faults are the possible causes for security weaknesses; errors and final errors -- their possible consequences. 

A BF weakness class is a taxonomic category of a weakness type defined by finite sets of cause-operation→consequence relations, severity attributes, and code sites. A BF weakness is an instance of a taxonomic BF class as a (cause, operation, consequence) triple with specific attributes and sites. A BF vulnerability is a chain of weaknesses linked by causality and consequence→cause propagation enabling a failure. The BF formal language is generated by the BF Left-to-right Leftmost-derivation One-symbol-lookahead (LL(1)) attribute context-free grammar (ACFG) based on the BF bugs models, causal BF weakness and BF failure taxonomies, and BF vulnerability models. The BF bugs models define the operations for related  software or hardware execution phases and the flow between these operations. The BF taxonomies comprise structured causal, complete, orthogonal, context-free BF weakness and BF failure classes. The BF vulnerability models represent a state or a  specification view of a vulnerability as a chain of underlying weaknesses and possibly converging or chaining chaining with it vulnerabilities towards a harmful failure. The BF bugs models and their related BF taxonomies, and the BF vulnerability models define the syntax and the causal semantics rules within and between weaknesses and vulnerabilities. All together they form the basis for defining secure coding principles, such as memory safety, input/output safety, and data type safety. 

The BF formalism enables a new range of research and development efforts for creation of comprehensively labeled weaknesses and vulnerabilities datasets, and generation of formal vulnerability specifications and diverse multidimensional vulnerability classifications. The BF bug models, weakness and failure taxonomies, and vulnerability models with  backwards propagation would support the development of static and dynamic analysis, and emulation algorithms for bugs, weaknesses and vulnerabilities detection. The clear, unambiguous formal BF vulnerability specifications would support efforts to understand, prioritize, and resolve or mitigate security vulnerabilities. The comprehensively labeled datasets and vulnerability classifications would serve as a formal augmentation to the National Vulnerability Database (NVD) and support development of new Machine Learning (ML) and Artificial Intelligence (AI) enabled capabilities for securing the critical infrastructure and supply chains.

Continue to the Bugs Framework (BF) website.