Coding Success
Creating a prototype to improve computer source code security and reduce cyber threat.
A potential spin-out driven by AMBS and the computer science department at The University of Manchester has received backing from the Innovation Factory.
There are major challenges in the coding sector around security, quality, and plagiarism. For instance, it is estimated that small UK businesses are targeted by 65,000 cyber attacks daily, costing the average small business thousands of pounds.
At the same time, studies have shown that the average computer developer spends almost half their time dealing with maintenance issues and debugging bad or poor-quality code.
In response the FuSeBMC-AI tool was created by Dr Lucas Cordeiro, Reader in Program Analysis and Cyber-Security at The University of Manchester, and Dr Kaled Alshmrany from Computer Sciences with support from Richard Allmendinger, Professor of Applied Artificial Intelligence at AMBS. The tool specifically aims to improve computer source code security and reduce cyber security threats.
The project has now received £30,000 funding from the Innovation Factory, the organisation which drives the commercialisation of the University of Manchester's innovations and intellectual property, and the money will now be used to create a prototype of the FuSeBMC-AI tool.
Spin-out
Professor Allmendinger said the idea for the spin-out came on the back of the university's ongoing project with Cheshire Software Escrow and cyber security specialist SES Secure, with whom it collaborated to produce a proof of concept that allows an AI programme to evaluate source code and discover weaknesses that could lead to security vulnerabilities.
He said: "The computer science department has been looking at identifying security vulnerabilities in computer code for many years. On the back of our work with SES, we realised that the FuSeBMC-AI tool was a strong product in its own right, so we reached out to Innovation Factory.
"We know that this tool can spot vulnerabilities really well, so the next step is all about how it can then be used to repair code as well. At the end of the day anyone creating code wants to ensure it is safe before operationalising it. We are also using AI to get the most out of the algorithm by allowing it to calibrate itself to the code at hand, making it more adaptable."
Verification
Dr Cordeiro said the University’s systems and software security research group has been developing automated logic-based verification engines for various industrial programming languages, including C/C++, Java, Kotlin, Python, and Solidity.
He added: "We have also made considerable progress in tackling scalability and usability aspects so that our framework can handle larger software systems and different types of run-time errors that are of interest to prevent vulnerabilities in modern software architectures. We also have industrial partners that deploy our research in production to safeguard software systems against vulnerabilities in this increasingly digital and interconnected world.
Our partnership with Innovation Factory marks an exciting opportunity to extend our research further so that we can empower organisations to construct trustworthy software and AI systems, ensuring reliability, availability, safety, resilience, and security.
Data and AI for Leaders
Build confidence in your understanding of data and AI and use emerging technologies to your advantage.
Proof of concept
If the proof of concept is successful, the team will seek external investment. Being based in Manchester also brings considerable benefits as the University of Manchester has been at the forefront of the cyber security agenda for several years through its investment in the Centre for Digital Trust and Society. Manchester also has grand ambitions to be a leading global centre for business data security through its GM Digital Strategy.
Rachel Pooley, Invention Discovery Manager at The Innovation Factory, added: "The Innovation Factory is proud to support this innovative proof of concept project that addresses emerging cybersecurity threats head-on.
"The FuSeBMC-AI tool has great potential to protect organisations and foster a more secure digital landscape. We are excited to support the team in their journey to commercialisation of their cutting-edge research."
Further research
Tom Sweet, Head of Technology, Escrow and Cyber Security, at SES Secure, added that the company was also keen to pursue this area of research in partnership with the University of Manchester.
"I can see a future that utilises this solution to evaluate code at rest and prevent exploits being created that could otherwise cause significant harm if discovered by malicious actors. This type of machine learning will be especially useful within our industry, where millions of lines of code are held securely on behalf of businesses and developers as part of their risk mitigation strategies.
"The benefit of discovering weaknesses and potential vulnerabilities in advance could save large organisations significant sums of money when you account for the amount of damage a cyber security incident can have and will provide an additional layer of protection against cyber criminals and nation state hackers.”
