SBIR Phase I: Automatic Extraction and Enforcement of Application-Specific Security Policy

这个小型企业创新研究(SBIR)第一阶段的项目是开发一个程序语义感知的入侵检测(付费)系统，该系统从应用程序的源代码中派生安全策略，并在运行时根据生成的策略检查应用程序的系统调用。该产品不仅可以完全自动派生这些策略，而且生成的安全策略是针对各个应用程序量身定做的，因此非常准确。一些最危险的网络安全威胁是“控制劫持”攻击，这种攻击劫持受攻击应用程序的控制，并以受攻击程序的有效用户的身份执行任意系统调用。这些类型的攻击非常危险，因为具有此类漏洞的商业应用程序似乎分布广泛，最近的SQL Slammer蠕虫病毒的猖獗就表明了这一点。系统调用监控被吹捧为控制劫持攻击的有效解决方案，因为它可以防止远程攻击者对受害者系统造成损害，即使他们可以成功破坏系统上运行的应用程序。这种方法的一个缺点是如何构建能够最大限度地减少误报和漏报的准确的安全策略。虽然已经尝试了各种方法来解决这个问题，但都不是令人满意的。基于系统调用监控的基于主机的入侵检测，也被称为行为拦截系统，是一种众所周知的倾向于保守或误报的错误。该工具将自动获得与个别应用程序的系统调用模式相对应的准确安全策略，从而将误报和漏报都减少到最低限度。付费系统代表着缩小当前行为屏蔽产品与现实世界信息技术(IT)系统实际需求之间的差距的一大步。

This Small Business Innovation Research (SBIR) Phase I project is to develop a Program semantics-Aware Intrusion Detection (PAID) system that derives a security policy from an application's source code, and checks the application's system calls against the resulting policy at run time. Not only can this product derive these policies completely automatically, but also the resulting security policy is tailored to individual applications and thus is highly accurate. Some of the most dangerous cyber security threats are "control hijacking" attacks, which hijack the control of a victim application, and execute arbitrary system calls assuming the identity of the victim program's effective user. These types of attacks are highly perilous because commercial applications with such vulnerabilities appear to be wide spread, as shown in the rampancy of the recent SQL Slammer Worm. System call monitoring has been touted as an effective solution to "control hijacking" attacks because it could prevent remote attackers from inflicting damage upon a victim system even if they can successfully compromise applications running on the system. A weakness of this approach is how to construct accurate security policy that could minimize false positives and negatives. Although various approaches have been tried to solve this problem, none of them is satisfactory. Host-based intrusion detection based on system call monitoring, also referred to as behavioral blocking systems, is a well known tend to err on the conservative or false positive side. The tool will automatically derive accurate security policies corresponding to the system call patterns of individual applications, thus reducing both false positives and negatives to the minimum. The PAID system represents a big step in closing the gap between current behavioral blocking products and the actual needs of real world information technology (IT) systems.