SGER: Malware Immunization through Deterrence and Diversion

方案编号：0650386 PI：Zhuoqing莫利Mao 院校：密歇根大学 职务名称： SGER：通过威慑和转移恶意软件免疫 AbstractThis建议解决了一个重要的问题，即如何应对越来越智能的蠕虫，这些蠕虫开始由攻击者发起，并且在不久的将来可能会变得更加普遍。 该研究将设计和实现一类基于欺骗的方案，以阻止恶意软件感染，并使主机对试图避免检测的智能蠕虫免疫;这种蠕虫被称为“隐身”。“该提案将轻量级的基于指纹的欺骗识别为将常规主机伪装成蜜罐系统的一种方式，这种系统是蠕虫试图避免的。 该提案还解决了创建假指纹的问题，以使主机在操作系统上运行的服务对恶意软件来说不是有吸引力的目标。 威慑是另一个密切相关的技术，将探讨，例如，在资源限制和反定性的形式，使什么应该是有吸引力的目标不感兴趣的蠕虫。 这项工作将集中在多态和逃避蠕虫，这类蠕虫可能很快就会出现。关键的想法是欺骗那些逃避蠕虫，让它们认为它们正在被它们想要避免的检测算法主动检查。该蠕虫防御系统通过刻意模仿隐身蠕虫想要躲避的环境，阻止隐身蠕虫感染重要主机，这是首次利用隐身蠕虫的躲避特性，使隐身蠕虫自我中和。

Proposal Number: 0650386PI: Zhuoqing Morley Mao Institution: University of Michigan Title: SGER: Malware Immunization through Deterrence and Diversion AbstractThis proposal addresses the important problem of coping with the ever more intelligent worms that are beginning to be launched by attackers and that are likely to become much more prevalent in the near future. The research will design and implement a class of deception-based schemes to deter malware infection and immunize hosts against smart worms that attempt to avoid detection; such worms are called "stealthy." The proposal identifies light-weight fingerprinting-based deception as a way to disguise regular hosts as honeypot systems, the kind of systems that worms attempt to avoid. The proposal also addresses the creation of fake fingerprints to make hosts run on OSes with services that are not attractive targets for malware. Deterrence is another closely related technique that will be explored, for example in the form of resource restriction and counter-characterization to make what should be attractive targets uninteresting to worms. The work will focus on polymorphic and evasive worms, the kind that are likely to appear soon.The key idea is to trick those evasive worms into thinking they are being actively checked by detection algorithms they want to avoid. By deliberating imitating the environments that stealthy worms want to evade, the proposed worm defense system will prevent many stealthy worms from infecting important hosts.This is the first work aimed at exploiting the evasive nature of stealthy worms so that such worms will neutralize themselves.