Collaborative Research: CT-T: A Vertical Systems Framework for Effective Defense against Memory-Based Attacks

利用系统软件漏洞的恶意攻击不断，损害了国家信息基础设施的安全。大多数现有攻击都会利用基于内存的缺陷，例如堆栈或堆溢出以及格式字符串漏洞。当前的防御机制，无论是基于网络还是基于主机，都不足以抵御许多高级攻击，例如多态或变态蠕虫攻击。该项目旨在提供一个全面的框架来检测、分析和消除此类攻击。 PI 采用跨学科方法，结合计算机体系结构、计算机和网络安全、编程语言、编译器和软件工程方面的专业知识来解决这一难题。特别是，PI提出了一个分层防御和分析框架，其中包括：（1）用于检测未知攻击并从中恢复的架构层； (2)分析层，用于诊断攻击并生成攻击特征码； (3)测试层，用于发现和修复未知的软件漏洞。该项目的智力优势在于该项目开发的先进技术，用于防御未知的大规模基于内存的攻击。这个跨学科项目将提供一种有效的方法来解决这个问题，并通过系统概念和先进的编程语言和分析技术来推进每个必要学科的知识。该项目更广泛的影响是有可能建立更可靠、更安全的信息系统基础设施。由于我们对信息技术的依赖日益增加，这将对社会产生巨大的经济影响。该项目的研究成果（例如系统、模拟器和工具）将被广泛传播，以便进一步评估、增强和采用，以使其他研究人员和行业受益。

The security of national information infrastructures is undermined by constant malicious attacks exploiting vulnerabilities in systems software. Most existing attacks exploit memory-based flaws, such as stack or heap overflows, and format string vulnerabilities. Current defense mechanisms, either network- or host-based, are not sufficient against many advanced attacks such as polymorphic or metamorphic worm exploits. This project is to provide a comprehensive framework for detecting, analyzing, and exterminating such attacks. The PIs take an interdisciplinary approach, combining their expertise in computer architecture, computer and network security, programming languages, compilers, and software engineering to tackle this difficult problem. In particular, the PIs propose a layered defense and analysis framework that consists of: (1) an architecture layer for detecting and recovering from unknown attacks; (2) an analysis layer for diagnosing attacks and generating attack signatures; and (3) a testing layer for discovering and fixing unknown software vulnerabilities. The intellectual merit of this project will lie in the advanced techniques developed in this project to defend against unknown, large-scale memory-based attacks. This interdisciplinary project will allow an effective approach to tackle this problem and advance knowledge in each of the requisite disciplines with both systems concepts and advanced programming language and analysis techniques. The broader impact of this project is the potential for a more reliable and secure information systems infrastructure. This will have tremendous economical impact on society because of our growing reliance on information technologies. Research results from this project (such as systems, simulators, and tools) will be widely disseminated so that they can be further evaluated, enhanced, and adopted to benefit other researchers and the industry.