CT-T: The Detection and Prevention of Spyware

点击翻译按钮获取中文摘要

Steve GribbleUniversity of Washington0626367Panel: P060975The detection and prevention of spywareThis project is building a foundation for understanding spyware, andis advancing the state of the art in detecting and preventing spywareinfections. Our research consists of four broad activities:Measurement: Using a combination of passive network monitoringand active Web crawling, we are gathering quantitative evidenceabout the nature of spyware and its lifecycle.Early detection: We are exploring schemes to detect new spywarethreats before they have had the opportunity to cause widespreadinfection. For example, we are developing techniques for examiningsoftware found while Web crawling to automatically identify"spyware-like" behavior, or to statically analyze software to look forcode fragments in common with previously detected spyware.Prevention: To prevent spyware from reaching a computer, we areaugmenting firewall and proxy systems to detect and block spywarebefore it reaches its victims. As well, to prevent new code fromgaining a foothold on a PC, we are exploring ways of "locking down"what code is permitted to execute.Infrastructure development: To conduct our research, we are developingnew spyware testing infrastructure and workload repositories; our virtual"spyware laboratory" uses clusters and virtual machine monitors toenable high-throughput, scalable sandboxing and observation ofmalicious code. As well, we are amassing a large collection ofknown spyware programs to enable additional analysis.