SE Valley Times

In August, approximately 30,000 attendees, including cybersecurity professionals, expert programmers, and officials from top government agencies, gathered at the Las Vegas Convention Center for DEF CON, the world’s largest hacker convention.

At the convention, a team of professors, researchers, and graduate students from Arizona State University awaited the results of the semifinal round of the DARPA AI Cyber Challenge (AIxCC). The 25-person Shellphish team comprised members from ASU, the University of California, Santa Barbara, and Purdue University. They had been preparing since March for this moment.

The AIxCC is hosted by the U.S. Defense Advanced Research Projects Agency (DARPA) to develop a cybersecurity system powered by artificial intelligence. The U.S. Advanced Research Projects Agency for Health (ARPA-H) also collaborates on this competition due to its interest in protecting medical infrastructure from cyberattacks.

In the semifinals, $14 million was at stake. This effort is part of broader U.S. government initiatives to enhance national cybersecurity defenses amid a significant workforce shortage and rising cybercrime rates.

Doctoral students from computer science and engineering programs paused their work as part of Shellphish for a photo opportunity. The Federal Bureau of Investigation's Internet Crime Report highlights an alarming rise in cybercrime with financial losses expected to exceed $12.5 billion annually. There are an estimated 3.5 million unfilled cybersecurity jobs globally, with around 750,000 vacancies in the U.S.

Open-source software has heightened vulnerabilities because its source code is publicly available for inspection and modification. In March, a Microsoft engineer prevented what NPR called “the hack that almost broke the internet," identifying an attack on an open-source data compression utility.

“We want to redefine how we secure widely used critical codebases,” said Andrew Carney, DARPA program manager for AIxCC and ARPA-H's program manager for resilient systems.

The ASU AIxCC team operates under Shellphish Support Syndicate led by Adam Doupé, Fish Wang, and Yan Shoshitaishvili—associate professors at ASU’s School of Computing and Augmented Intelligence. Their project ARTIPHISHELL can automatically analyze software code to correct security vulnerabilities and retest systems.

“ARTIPHISHELL is a giant leap toward achieving our vision of humans working alongside AI to keep our software safe,” said Shoshitaishvili.

At DEF CON's announcement that they had won $2 million in funds as one of seven semifinal winners out of more than 40 entries, the Shellphish team celebrated enthusiastically.

Doupé emphasized that such AI systems are needed for enterprise software maintenance: “Today, a company might hire a team of really good cybersecurity consultants... But who tests the company’s system the next week? Or the week after that?”

Shellphish has now accumulated $3 million in total prize money from AIxCC competitions. They will compete next August in Las Vegas at the AIxCC Final Competition for an additional $4 million prize.