Collaborative Research: CT-T: A Vertical Systems Framework for Effective Defense against Memory-Based Attacks

国家信息基础设施的安全受到持续不断的利用系统软件漏洞的恶意攻击的破坏。大多数现有攻击利用基于内存的缺陷，如堆栈或堆溢出和格式字符串漏洞。当前的防御机制，无论是基于网络的还是基于主机的，都不足以抵御许多高级攻击，如多态或变形蠕虫利用。该项目旨在为检测、分析和根除此类攻击提供一个全面的框架。私人投资经理采取跨学科的方法，结合他们在计算机体系结构、计算机和网络安全、编程语言、编译器和软件工程方面的专业知识来解决这一难题。特别是，PI提出了一个分层的防御和分析框架，该框架包括：(1)用于检测和恢复未知攻击的架构层；(2)用于诊断攻击和生成攻击特征的分析层；以及(3)用于发现和修复未知软件漏洞的测试层。该项目的智力价值将在于该项目中开发的先进技术，以防御未知的、基于内存的大规模攻击。这一跨学科项目将使解决这一问题的有效方法成为可能，并通过系统概念以及高级编程语言和分析技术增进每一门必要学科的知识。该项目的更广泛影响是有可能建立更可靠和更安全的信息系统基础设施。这将对社会产生巨大的经济影响，因为我们越来越依赖信息技术。该项目的研究成果(如系统、模拟器和工具)将被广泛传播，以便进一步评估、增强和采用它们，使其他研究人员和行业受益。

The security of national information infrastructures is undermined by constant malicious attacks exploiting vulnerabilities in systems software. Most existing attacks exploit memory-based flaws, such as stack or heap overflows, and format string vulnerabilities. Current defense mechanisms, either network- or host-based, are not sufficient against many advanced attacks such as polymorphic or metamorphic worm exploits. This project is to provide a comprehensive framework for detecting, analyzing, and exterminating such attacks. The PIs take an interdisciplinary approach, combining their expertise in computer architecture, computer and network security, programming languages, compilers, and software engineering to tackle this difficult problem. In particular, the PIs propose a layered defense and analysis framework that consists of: (1) an architecture layer for detecting and recovering from unknown attacks; (2) an analysis layer for diagnosing attacks and generating attack signatures; and (3) a testing layer for discovering and fixing unknown software vulnerabilities. The intellectual merit of this project will lie in the advanced techniques developed in this project to defend against unknown, large-scale memory-based attacks. This interdisciplinary project will allow an effective approach to tackle this problem and advance knowledge in each of the requisite disciplines with both systems concepts and advanced programming language and analysis techniques. The broader impact of this project is the potential for a more reliable and secure information systems infrastructure. This will have tremendous economical impact on society because of our growing reliance on information technologies. Research results from this project (such as systems, simulators, and tools) will be widely disseminated so that they can be further evaluated, enhanced, and adopted to benefit other researchers and the industry.