CT-T: The Detection and Prevention of Spyware

间谍软件的检测和预防这个项目正在为理解间谍软件奠定基础，并正在推进检测和预防间谍软件感染的最新技术。我们的研究包括四个主要活动：测量：结合被动网络监控和主动网络爬行，我们正在收集有关间谍软件性质及其生命周期的定量证据。早期检测：我们正在探索在新的间谍软件威胁有机会引起广泛感染之前检测它们的方案。例如，我们正在开发技术，用于检查在网络爬行时发现的软件，以自动识别“类似间谍软件”的行为，或者静态分析软件以查找与先前检测到的间谍软件相同的代码片段。预防：为了防止间谍软件到达计算机，我们正在增强防火墙和代理系统，以便在间谍软件到达受害者之前检测和阻止它。同样，为了防止新代码在PC上站稳脚跟，我们正在探索“锁定”允许执行的代码的方法。基础设施开发：为了进行我们的研究，我们正在开发新的间谍软件测试基础设施和工作负载存储库；我们的虚拟“间谍软件实验室”使用集群和虚拟机监视器来实现高吞吐量，可扩展的沙箱和恶意代码的观察。此外，我们正在收集大量已知的间谍软件程序，以便进行额外的分析。

Steve GribbleUniversity of Washington0626367Panel: P060975The detection and prevention of spywareThis project is building a foundation for understanding spyware, andis advancing the state of the art in detecting and preventing spywareinfections. Our research consists of four broad activities:Measurement: Using a combination of passive network monitoringand active Web crawling, we are gathering quantitative evidenceabout the nature of spyware and its lifecycle.Early detection: We are exploring schemes to detect new spywarethreats before they have had the opportunity to cause widespreadinfection. For example, we are developing techniques for examiningsoftware found while Web crawling to automatically identify"spyware-like" behavior, or to statically analyze software to look forcode fragments in common with previously detected spyware.Prevention: To prevent spyware from reaching a computer, we areaugmenting firewall and proxy systems to detect and block spywarebefore it reaches its victims. As well, to prevent new code fromgaining a foothold on a PC, we are exploring ways of "locking down"what code is permitted to execute.Infrastructure development: To conduct our research, we are developingnew spyware testing infrastructure and workload repositories; our virtual"spyware laboratory" uses clusters and virtual machine monitors toenable high-throughput, scalable sandboxing and observation ofmalicious code. As well, we are amassing a large collection ofknown spyware programs to enable additional analysis.