Information Flow: A Unified Basis for Vulnerability Mitigation, Malware Defense and Attack Scenario Reconstruction (Keynote Presentation)
Information Flow: A Unified Basis for Vulnerability Mitigation, Malware Defense and Attack Scenario Reconstruction (Keynote Presentation)
复制标题
信息流：漏洞缓解、恶意软件防御和攻击场景重构的统一基础（主题演讲）
DOI：
10.1145/3411502.3418421
复制
发表时间：
2020
期刊：
影响因子：
--
通讯作者：
Sekar, R.
中科院分区：
文献类型：
--
作者：
Sekar, R.
访问控制和信息流是安全软件设计中的两个重要组成部分。其中，访问控制似乎无处不在，广泛应用于操作系统、数据库、防火墙、服务器、Web应用程序等，信息流的成功似乎不那么明显，其好处和潜力也未得到充分的认识。然而，当涉及到防御恶意代码时，基于访问控制的防御已被证明容易被规避，或者它们最终限制太多以至于干扰合法使用。在这次演讲中，我将认为基于信息流的防御可以更有洞察力，因为它们不仅利用了执行的操作，而且还利用了它们的上下文，例如，恶意行为者是否能够控制这些操作或其关键参数。然后，我将描述信息流的成功应用，以抵御网络攻击活动的每个阶段，包括：（a）针对各种软件漏洞的利用缓解，（B）跨不同操作系统的恶意软件遏制，包括Linux、BSD和Windows XP到Windows 10，以及（c）攻击活动重建，通过应用我们的技术，我们实现了五到六个数量级的数据减少。
Access control and information flow are the two building blocks in the design of secure software. Of the two, access control seems ubiquitous, being widely used in operating systems, databases, firewalls, servers, web applications, and so on. The successes of information flow seem less obvious, and its benefits and potential underappreciated. Yet, when it comes to defending against malicious code, access control based defenses have proved susceptible to evasion, or they end up being so restrictive as to interfere with legitimate use. In this talk, I will argue that defenses based on information flow can be more discerning, as they utilize not only the operations performed but also their context, e.g., whether malicious actors could be exerting control over these operation or their key arguments. I will then describe successful applications of information flow to defend against every stage of a cyber attack campaign, including: (a) exploit mitigation for a wide range of software vulnerabilities, (b) malware containment across diverse OSes, including Linux, BSD, and Windows XP through Windows 10, and (c) attack campaign reconstruction, where we achieve a five to six orders of magnitude data reduction by applying our techniques.