Software Supply Chain Security in the Cloud

Adoption of third-party open-source software (OSS) has increased significantly over the last few years. And for a good reason: OSS helps developers lower costs and reduce time to market by reusing existing components as building blocks for their applications. At the same time, vulnerabilities in OSS pose a significant risk to application security. Developers need to keep track of their (transitive) dependencies, known vulnerabilities (CVEs), and upgrade dependencies whenever a new CVE is found. Application Dependency Management (ADM) is an OCI-native service that helps managing dependencies in the customers software supply chain. ADM is exploring and researching the software composition analysis space to help users manage the risk associated to using 3rd parties.

Potential Topics

The goal of this project is to extend the Application Dependency Management cloud service with new capabilities in the areas of automated tuning and upgrades, patching security vulnerabilities in application dependencies and automated testing. We offer various topics depending on the skills and the interests of the candidate:

• Improve Vulnerability Curation Process: Application Dependency Management provides a knowledge base of artifacts and their known vulnerabilities (CVEs). New and updated CVEs need to be processed to identify the list of vulnerable artifact versions. This curation process currently involves different tools and scripts, but there is no single solution to optimize the time to curate the CVE itself. The objective of this internship is to evaluate the potential of Data Science and Artificial Intelligence techniques, including machine learning, to automate the manual labor involved in the CVE curation process and enhance its overall efficiency. Additionally, the internship may also encompass the development of a user-friendly application to support the entire CVE curation process, further optimizing it through increased automation.
• Build Profiles of third-party libraries: Modern applications heavily depend on open-source software components (dependencies). Developers are often not aware of what capabilities these dependencies need. For example, if the dependency makes network requests, load code at runtime, start new threads or write to the file system. Giving developers insight into the capabilities that their dependencies require could help them make more informed decisions about which dependencies to include. The goal of this internship is to develop a system to automatically detect what capabilities does an open-source dependency need based on the available test suite. Third-party libraries can suffer from vulnerabilities that are associated with a score according to the Common Vulnerability Scoring System (CVSS). This score will depend on the severity of the vulnerability, however, such score can only be determined if a vulnerability for the third-party has been found. Another objective of the internship could be to evaluate a risk score (additionally to CVSS) for third-party dependency libraries. Different paths can be explored towards this idea, such as a risk score taking into account the maturity of the project and its code repository (project still maintained, license, security policy); the usage of third parties (frequency and ways of usage); how big, how complex the library is, how much is it used in other projects.
• Evaluate impact of changing a 3rd party library: At the moment, ADM remediation runs the CI/CD pipeline of the customer’s service to confirm that updating a vulnerable dependency did not break the customer’s application. The idea behind this internship topic is to improve this verification, to also include the historical data about the application and evaluate impact of changing a 3rd party by simulating an execution based on a recorded trace of an older version and see if exercised code path is the same. High level idea is to replay the history of the service , but to replace the version of the application that was used at the time with the updated version. Once this test is run, the verify step would have a better idea of how likely the dependency upgrade is to break the application, and this can be communicated to the user through something like a “disruption score”.
• Query engine on top of Java heap dumps and compilation trace to aggregate and find 3rd party issues: Nowadays open source libraries are used in every project helping developers to not have to re-invent the wheel. These open source libraries are usually trusted by developers and do not go through code review. This opens up the possibility of pulling libraries which contain issues such as memory leaks which are very hard to debug and find. The idea of this internship topic is to find a way to collect Java heap dumps – just enough to build the data lake – making sure that this collection does not impact the performance of the respective service. The detection algorithm should work on top of this data lake and its result should be used to figure out which open source libraries contain memory leaks. The data about open source libraries should be made available to developers in an easy to query manner.

Point of Contact

In order to apply, please send an email to app-platform-jobs_ww@oracle.com including the following:

• Your CV or link to your home page containing your curriculum
• Description of your motivation and area of interest
• Your preferred internship dates & location

Graal Cloud Service

Oracle Labs is building the next generation serverless platform that provides a fully managed on-demand compute platform for Java users. It brings following benefits to the end user:

• Developer Productivity - Developers can use GCN provided APIs and tools to develop applications. GCN is an opinionated API for developing multi-cloud applications.
• Cost Efficiency - Scale to zero is supported without sacrificing cold start latency, so idle applications are not charged to customers (except for private mode).
• Simplicity - Developers don’t have to learn about containers, networking, SSL, etc. to run production grade application.

Graal Cloud Service (GCS) uses GraalVM native image, a technology to ahead-of-time compile Java code to a standalone executable. Additionally, the service leverages GraalOS, a new virtualization technology built on top of modern hardware features, such as control flow integrity and in-process memory protection features, compilation techniques to isolate untrusted code execution.

Potential Topics

The goal of this project is to extend GCS with new capabilities. We offer various topics depending on the skills and the interests of the candidate:

• Detect and mitigate metastable failures for applications running on GCS: Metastable failures1 are a class of failures in distributed systems in which a “sustaining effect” prevents the system’s quick recovery after a temporary “trigger”. These failures can be sustained by so-called “Workload Amplification” or “Capacity Degradation Amplification” effects. Examples of sustaining effects include retries, garbage collection, look-aside cache. The GCS platform, acting as a cloud orchestrator managing all/parts of the distributed components of the application and with its virtualization layer, offers the opportunity to detect those issues with a better overview of the states of the components. It can also offer the possibility to correct those issues with or without the aid of the application framework.
• Secure and optimized cross-isolate communication for GraalOS: The BlackBox paper describes a technique to improve container isolation. Traditionally, container isolation is guaranteed by the operating system. However, operating systems are big code bases that occasionally have vulnerability. Instead, BlackBox runs a container security monitor (CSM) between the container and operating system. The CSM creates protected physical address spaces (PPASes) for each container such that there is no direct information flow from container to operating system or other container PPASes. The authors make clever use of the hardware’s virtualization support to run the CSM at the level of a hypervisor, i.e. a higher privilege than the kernel and user space. However, the CSM is not a hypervisor itself: it still delegates memory management and task scheduling to the OS. Containers are prohibited from accessing each other’s memory and communication between the container and OS is encrypted. In the context of GraalOS, one internship topic would be to investigate the current techniques by which Native Image Isolates are isolated, and whether the techniques from BlackBox can be used to improve this isolation.
• Platform to analyze application usage to optimize Graal VM Native Image creation: GraalVM Native Image compiles Java code ahead-of-time to a standalone executable. It has the benefit of significantly improving startup time as well as memory footprint. However, peak performance of native image is lower than peak performance running on a traditional JVM that does just-in-time compilation. GraalVM can apply profile-guided optimizations (PGO) for additional performance gain and higher throughput of native images. With PGO, one collects the profiling data in advance and then feeds it to the native image builder, which will use this information to optimize the performance of the resulting binary. The goal of this internship is to extend the Graal Cloud Service to automatically generate and apply profiling data for applications that are running on the platform, effectively simplifying the generation of optimized native images.
• Tailored security policy generation: parameters refinement: he least privilege principle states that an application should run with the least amount of privileges possible. Today, this principle can be enforced by creating a tailored security policy for mechanisms such as Seccomp, AppArmor & SELinux. However, manually creating such a security policy (i.e., defining the smallest set of privileges that is necessary for the application) is a tedious, error-prone task and one that needs to be revisited every time the application changes. Previous works have shown that it is instead possible to discover, with good accuracy, the smallest set of necessary privileges using static analysis of the source code and thus automatically generate the security policy. Our proposal is to extend this previous approach with symbolic execution to further restrict the privileges of an application. For example detecting that an application is only meant to connect to one specific IP address and thus generates a security policy that forbids connection to other IP addresses, or detecting the set of actual parameters used for a system call and forbids calls to this system call with other parameters.
• Automatically derive OCI IAM policies: In this internship, we will explore automatically generating OCI IAM policies for a given native image application. First, we will use static analysis to understand the application’s usage of the OCI SDK. Second, analyzing OpenAPI specification (and source code) of OCI cloud services, we will build a database of the permissions for each REST operation. Putting the two information together will enable generating policies, optimizing for giving the least privilege possible to the application

Point of Contact

In order to apply, please send an email to app-platform-jobs_ww@oracle.com including the following:

• Your CV or link to your home page containing your curriculum
• Description of your motivation and area of interest
• Your preferred internship dates & location

Graal Cloud Native

Graal Cloud Native (GCN) is an Open Source developer-centered platform built on the Java ecosystem to dramatically improve developer productivity when building applications and microservices leveraging Oracle Cloud. GCN accomplishes that by providing automation in writing applications, managing configurations, and allowing developers to rapidly build/test/deploy/debug their application from their IDE (Visual Studio Code). GCN contains GraalVM Native Image, the Micronaut framework, GraalVM Tools for Java and Micronaut VS Code IDE Extensions, documentation, hands-on tutorials, and Luna Labs based hands-on experience.

Possible Research Areas

• Deep integration with Multiple Clouds
• IDE-based tools for improving developer productivity
• Abstractions over Services available on Multiple Clouds
• Tools for dramatically improving tracing, logging, and debugging in Cloud Computing

Point of Contact

To apply, please send an email with the required information (see How to Apply above) to Labs-Hiring_ww@oracle.com.

ML for Security Applications – KeyBridge

Our mission is increasing the security posture of both Oracle cloud customers and the Oracle's teams operating the cloud infrastructure.

Our research vision is of automated detection and mitigation of security events, allowing security experts to scale their efforts to large infrastructures such as the cloud. In the process, we working on data preparation and data exploration, statistical analysis and anomaly detection, alert generation and presentation of results.

Our analytics toolbelt includes techniques from data exploration, statistical analysis and deep learning. Working with application logs means that representation learning, machine learning for code and embedding techniques are fundamental research topics for us. So is explainable machine learning. For the scalable processing of the high volumes of logs we get, we are developing a machine learning pipeline framework that operates on top of various state-of-the-art libraries and follows a modular design.

Our team is a motley crew of researchers with diverse backgrounds in data analytics, machine learning, network and system design, and software development. We share a passion to develop reliable, innovative solutions to security problems with practical relevance. We place high value on a collaboration spirit, an inquisitive mindset and a drive to deliver high quality.

If you share our interests and values, we would be happy to welcome you in the family. Some ideas of directions in which an internship can go:

• Explorative: investigation of what machine learning techniques are applicable to a particular security problem.
• Research in ML: development of machine learning solutions for log encoding, source code generation, information retrieval, anomaly detection, building behavior profiles.
• Research in HCI: investigation of approaches towards data presentation for operational teams.
• Software development: development of scalable machine learning pipelines

Point of Contact

To apply, please send an email with the required information (see How to Apply above) to olabs-keybridge-hiring_ww@oracle.com.

Intelligent Application Security

The Intelligent Application Security team at Oracle Labs works on innovative projects in the application security space spanning areas like program analysis, machine learning, software composition analysis, malware detection, and runtime protection. The team is based in Brisbane, Australia with a few remote members based in in Austria. Candidates who hold work rights Australia or Austria are welcome to apply. Internships in the IAS team offer exciting opportunities to those who are passionate about improving application security. The ideal candidate will relish the challenge of developing techniques that can be applied to cloud-scale applications.

Our internships cater to a wide variety of students studying computer science or software engineering including those who are in the final year of their undergraduate degree or are undertaking research at the master's or PhD level.

Potential Topics

• Vulnerability analysis of binary code
• Combining machine learning and program analysis to improve vulnerability detection
• Synthesis of security monitors
• Automated program repair
• Analysis of infrastructure as code including securing container orchestration frameworks and CI/CD pipelines
• Automated malware analysis and threat intelligence
• Supply chain attack detection
• Fuzzing

Point of Contact

To apply, please send an email with the required information (see How to Apply above) to ias-internships-au_au_grp@oracle.com.

Machine Learning Research Group

The mission of the Machine Learning Research Group (MLRG) is to scale Machine Learning (ML) across Oracle by evangelizing ML throughout Oracle, collaborating with product groups to develop ML-based solutions to improve their products and services, developing ML tools and systems to help them implement ML solutions on their own, and doing fundamental ML research to better understand what will be needed by product groups in the future.

The MLRG is composed of researchers, data scientists, and engineers that collaborate closely with other Oracle Labs research groups, and with product groups and business units across the entire company. These collaborations run the gamut from fundamental ML research around fairness, privacy, and robustness in ML systems, training and evaluating large-scale contextual embeddings for natural language processing, and building tools for ML.

Potential Topics

• Building more robust intent classification systems by augmenting data
• Improving the performance of multi-label image classification systems through failure analysis
• Building classifiers to segment complicated email bodies and support texts more accurately
• Exploring new techniques for building large language models with less data, faster
• Investigating the uses of differential privacy and homomorphic encryption in federated learning systems

Point of Contact

To apply, please send an email with the required information (see How to Apply above) to mlrg-internships_ww@oracle.com.