CT: New Techniques for Attack Detection, Prevention and Immunization

在过去的几年里，软件漏洞一直是网络攻击背后的罪魁祸首。缓冲区溢出、格式字符串、SQL注入、命令注入、跨站脚本和目录遍历等少数漏洞已经占据主导地位，占过去两年报告的CVE漏洞的70%左右。尽管这些漏洞已经被很好地理解和记录，但它们的数量每年都在不断增加。在最近发布的软件和已建立的软件中，新的漏洞不断被发现。这将开发新的技术来保护应用程序免受已知和未知的攻击，并使应用程序免受未来攻击实例的影响。因此，所提出的方法可以保护的完整性以及易受攻击的应用程序的可用性。所提出的方法的一个核心组成部分是一个有效的细粒度动态污点分析，跟踪不可信的信息流通过avulnerable程序。基于规范和基于异常的攻击检测技术都可以通过使用细粒度污点来实现高度通用和准确，并且可以阻止上面提到的各种攻击。污点分析还将成为免疫技术的基础，该技术基于学习识别攻击输入的输入过滤器，并有选择地丢弃这些输入。拟议的工作可以解决由于网络攻击而遭受的数十亿美元损失，因为它可以在造成损害之前阻止大多数类型的漏洞利用。为了最大限度地扩大影响，项目中开发的技术将被应用到开放源码软件原型中。

Software vulnerabilities have been the biggest culprit behind cyberattacks in the past several years. A handful of vulnerabilities, such asbuffer overflows, format string, SQL injection, command injection,cross-site scripting, and directory traversals, have come to dominate,accounting for about 70% of the CVE vulnerabilities reported in the lasttwo years. Although that these vulnerabilities are well understood anddocumented, their number continues to escalate from one year to the next.New vulnerabilities continue to be discovered in recently releasedsoftware, as well as established software.This will develop novel techniques for defending applications from knownas well as unknown attacks, and for immunizing applications from futureattack instances. The proposed approach can thus protect the integrity aswell as the availability of vulnerable applications. A central componentof the proposed approach is an efficient fine-grained dynamic taintanalysis that tracks the flow of untrusted information through avulnerable program. Both specification-based and anomaly-based attackdetection techniques can be made highly versatile and accurate by usingfine-grained taint, and can stop the wide range of attacks mentionedabove. Taint analysis will also form the basis of an immunizationtechnique that is based on learning input filters that characterizeattack-bearing inputs, and selectively discarding such inputs.The proposed work can address multi-billion dollar losses experienced dueto cyber attacks, since it can stop most types of exploits before theycause damage. To maximize impact, the techniques developed in the projectwill be implemented into open-source software prototypes.