CAREER: Combating Malicious Behavior in Commodity Software

职业：打击商品软件中的恶意行为

• 批准号: 0448476
• 负责人: Somesh Jha
• 金额: $ 40万
• 依托单位: University of Wisconsin-Madison
• 依托单位国家: 美国
• 项目类别: Continuing Grant
• 财政年份: 2005
• 资助国家: 美国
• 起止时间: 2005-01-15 至 2011-12-31
• 项目状态: 已结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=0448476&HistoricalAwards=false
• 关键词: CAREER; Combating; Malicious; Behavior; Commodity

Infrastructures in critical domains such as medical, power, telecommunications, and finance depend on information systems. Therefore, attacks can have devastating affects on these critical infrastructures. Moreover, an increasing number of organizations are relying on commodity software. This trend can be attributed to increasing reliance on out-sourcing and commercial off-the-shelf (COTS) components. However, deploying commodity software poses significant risks because they can contain exploitable vulnerabilities and hidden malicious behavior. Combating malicious behavior in commodity software is especially challenging because its user only has access to the executable for the software. This proposal addresses the problem of combating malicious behavior in commodity software. The proposed tasks are applicable in the context of model-based intrusion detection systems (MIDS) which are a type of host-based intrusion detection system (HIDS) that monitor program execution using a model. There are three major areas in MIDS: model construction, enforcement, and model analysis. This proposal addresses model construction and model analysis. In the context of MIDS, the proposed research will improve precision of existing model-construction algorithms, tackle privacy violations, and develop techniques for analyzing and refining models.

医疗、电力、电信和金融等关键领域的基础设施依赖于信息系统。因此，攻击会对这些关键的基础设施造成毁灭性的影响。此外，越来越多的组织依赖于商品软件。这种趋势可以归因于对外包和商用现货（COTS）组件的日益依赖。然而，部署商用软件会带来巨大的风险，因为它们可能包含可利用的漏洞和隐藏的恶意行为。打击商品软件中的恶意行为尤其具有挑战性，因为它的用户只能访问软件的可执行文件。该建议解决了在商用软件中打击恶意行为的问题。所提出的任务适用于基于模型的入侵检测系统（MIDS），它是一种基于主机的入侵检测系统（HIDS），使用模型来监视程序的执行。在MIDS中有三个主要领域：模型构建、执行和模型分析。本建议涉及模型构建和模型分析。在MIDS的背景下，提出的研究将提高现有模型构建算法的精度，解决隐私侵犯问题，并开发分析和精炼模型的技术。