Thinking Ahead: A Proactive Approach for Countering Future Internet Malware

超前思考：应对未来互联网恶意软件的主动方法

• 批准号: 0627611
• 负责人: Andreas Terzis
• 金额: $ 35万
• 依托单位: Johns Hopkins University
• 依托单位国家: 美国
• 项目类别: Continuing Grant
• 财政年份: 2006
• 资助国家: 美国
• 起止时间: 2006-08-15 至 2010-07-31
• 项目状态: 已结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=0627611&HistoricalAwards=false
• 关键词: Thinking; Ahead; Proactive; Approach; Countering

Andreas TerzisThinking Ahead: A Proactive approach for countering future Internet malwareJohns Hopkins University0627611 AbstractMalware continues to pose one of the gravest threats to the Internet.While existing research efforts are producing promising defenses tocounter today's threats, the landscape is rapidly changing asattackers become increasingly savvy. In this project, rather thanblindly following the current practice in which defenses trail malwareadvances, we apply a first principles approach to Internetinfection. Specifically, we explore a wide range of networked systems,including corporate networks and emerging wireless and mobilenetworks, and examine a list of potentially crippling attackstrategies against these networks. The attacks we explore are faster,stealthier, or more virulent than current infectionstrategies. Moreover, they all share the characteristic ofoverwhelming existing defenses. The goals of this project are todevelop analytical models that capture the unique behavior of suchmalware, and to use these models to gain a better understanding ofemerging threats. Armed with this knowledge, we explore novel defensesthat include camouflaged responders resilient to evasive attacks anddistributed mobile network monitors capable of tracking mobileinfections. We fully anticipate that results from this research willprovide guidelines on how to secure future network architecturesagainst emerging threats.

Andreas Terzis前瞻：对抗未来互联网恶意软件的主动方法约翰霍普金斯大学0627611摘要恶意软件继续对互联网构成最严重的威胁之一。虽然现有的研究工作正在产生有希望的防御措施来对抗今天的威胁，但随着攻击者变得越来越精明，情况正在迅速变化。在这个项目中，我们不是盲目地遵循当前的做法，在这种做法中，防御措施跟踪恶意软件的进展，我们应用第一原理方法来处理互联网感染。具体来说，我们探讨了广泛的网络系统，包括企业网络和新兴的无线和移动网络，并检查了对这些网络的潜在的瘫痪attackstrategies列表。我们探索的攻击比目前的感染策略更快，更隐蔽，更致命。此外，它们都有一个共同的特点，即现有的防御措施令人印象深刻。该项目的目标是开发分析模型，捕捉这种恶意软件的独特行为，并使用这些模型来更好地了解新出现的威胁。有了这些知识，我们探索了新的防御方法，包括能够抵御规避攻击的远程响应者和能够跟踪移动感染的分布式移动的网络监视器。我们完全期待这项研究的结果将为如何保护未来的网络架构免受新出现的威胁提供指导方针。