Collaborative Research: CT-T: A Vertical Systems Framework for Effective Defense against Memory-Based Attacks

利用系统软件漏洞的恶意攻击不断破坏国家信息基础设施的安全。大多数现有的攻击利用基于内存的缺陷，如堆栈或堆溢出，以及格式字符串漏洞。当前的防御机制，无论是基于网络还是基于主机，都不足以抵御许多高级攻击，如多态或变形蠕虫攻击。该项目旨在为检测、分析和消灭此类攻击提供一个全面的框架。pi采用跨学科的方法，结合他们在计算机体系结构、计算机和网络安全、编程语言、编译器和软件工程方面的专业知识来解决这个难题。特别是，pi提出了一个分层防御和分析框架，该框架包括：(1)用于检测和从未知攻击中恢复的体系结构层；(2)分析层，用于诊断攻击并生成攻击特征；(3)用于发现和修复未知软件漏洞的测试层。这个项目的智力价值将在于该项目开发的先进技术，以防御未知的、大规模的基于内存的攻击。这个跨学科的项目将允许一个有效的方法来解决这个问题，并通过系统概念和先进的编程语言和分析技术来推进每个必要学科的知识。这个项目更广泛的影响是有可能建立一个更可靠和安全的信息系统基础设施。由于我们越来越依赖信息技术，这将对社会产生巨大的经济影响。该项目的研究成果（如系统、模拟器和工具）将广泛传播，以便进一步评估、加强和采用，以使其他研究人员和业界受益。

The security of national information infrastructures is undermined by constant malicious attacks exploiting vulnerabilities in systems software. Most existing attacks exploit memory-based flaws, such as stack or heap overflows, and format string vulnerabilities. Current defense mechanisms, either network- or host-based, are not sufficient against many advanced attacks such as polymorphic or metamorphic worm exploits. This project is to provide a comprehensive framework for detecting, analyzing, and exterminating such attacks. The PIs take an interdisciplinary approach, combining their expertise in computer architecture, computer and network security, programming languages, compilers, and software engineering to tackle this difficult problem. In particular, the PIs propose a layered defense and analysis framework that consists of: (1) an architecture layer for detecting and recovering from unknown attacks; (2) an analysis layer for diagnosing attacks and generating attack signatures; and (3) a testing layer for discovering and fixing unknown software vulnerabilities. The intellectual merit of this project will lie in the advanced techniques developed in this project to defend against unknown, large-scale memory-based attacks. This interdisciplinary project will allow an effective approach to tackle this problem and advance knowledge in each of the requisite disciplines with both systems concepts and advanced programming language and analysis techniques. The broader impact of this project is the potential for a more reliable and secure information systems infrastructure. This will have tremendous economical impact on society because of our growing reliance on information technologies. Research results from this project (such as systems, simulators, and tools) will be widely disseminated so that they can be further evaluated, enhanced, and adopted to benefit other researchers and the industry.