Scalpel-Debloat

In this effort, we propose to transition, improve, and evaluate a set of software transformation tools for use in DevSecOps pipelines for an identified Navy customer. Software transformation tools have proven their potential to enhance the performance and security of software that is produced and deployed in the Navy and throughout the Department of Defense. One example of such improvements comes from debloating. Software bloat, i.e., unnecessary functionality, is an acknowledged problem, as bloated applications incur excessive storage and network transmission costs, which are particularly undesirable for on-ship deployment. In addition, every excessive line of software increases the application’s cyber-attack surface and exposes the application – and potentially the platform on which it runs – to the consequences of a security breach. Debloating tools are available today which remove bloat at the source code, binary, and file level, and which have empirically been shown to produce significant size reductions on applications, with no loss of functionality. In addition to debloaters, tools exist for hardening software against cyber vulnerabilities, for patching it when a defect is found, for obfuscating it, and for performing other beneficial transformations. Building on our SCALPEL Phase 1 and Phase 2 SBIR which developed a tool for patching of embedded firmware and broadening our scope to tools developed under additional contracts, we will pursue the following technical objectives. First, we will transition a set of software debloating, hardening, and other transformation tools into our customer’s environment. Second, we will improve these tools in targeted ways, with a focus on usability, to boost their adoption at the customer’s site. Finally, we will carry out an extended case study on these tools’ performance and effectiveness in a real-world environment and quantify their mission impact to motivate broader adoption within the Navy and DoD. Our approach for achieving these objectives is as follows. We will work closely with the customer on two fronts: first, we will provide training on both tool use and tool integration, to allow engineers at the customer’s site to gradually gain expertise and confidence in using the tools themselves, and even to conduct further in-house training. Second, we will improve the tools’ usability and other aspects in targeted ways as requested by the customer. In addition, we will define metrics and implement telemetry to gather data on the performance and effectiveness of the tools in the customer’s environment. We will collate this data and produce an assessment of the impact of those tools, as well as identifying areas where gaps remain. As feasible within the scope of this effort, we will fill these gaps with targeted improvements.