SBIR Phase I: SpiderWeb - Self-Healing Networks for Spyware Detection

这个小企业创新研究第一阶段项目旨在设计和开发一种解决间谍软件问题的新颖解决方案；当今增长最快的安全威胁之一。为了解决日益增长的间谍软件流行病，这项工作提出了一种解决方案，可以：(1)检测以前未见过的间谍软件，(2)自动为新检测到的间谍软件生成签名，以便同一网络（例如，公司网络）内的所有其他计算机可以自动获得新间谍软件的保护。必须解决的两个关键挑战包括：如何有效地检测间谍软件行为，以及如何自动生成简洁的间谍软件签名并将信息传播到其他计算机。最近的研究表明，反间谍软件市场预计将从2003年的1200万美元扩大到2008年的3亿美元以上，未来具有显著的增长潜力。作为商业化战略的一部分，这项工作计划利用两个现有的基于开源的产品（ClamAV和Snort）来利用拟议系统的功能。

This Small Business Innovation Research Phase I project aims to design and develop a novel solution that addresses the spyware problem; one of the fastest growing security threats today. To address the growing spyware epidemic, this effort proposes a solution that can: (1) detect previously unseen spyware, and (2) automatically generate signatures for a newly detected spyware so that all other computers within a same network (e.g., a corporate network) can automatically gain protection from the new spyware. Two key challenges that must be addressed include: how to efficiently detect spyware behavior, and how to automatically generate succinct spyware signatures and propagate the information to other computers.Recent studies have suggested that the anti-spyware market is expected to expand from $12 million in 2003 to more than $300 million in 2008 with significant growth potential in the future. As part of the commercialization strategy, this effort plans to leverage the capability of the proposed system with two existing open-source based products: ClamAV and Snort.