CT-T: Proactive Techniques for Preserving System Integrity: A Basis for Robust Defense Against Malware

点击翻译按钮获取中文摘要

Cyber threats have escalated rapidly over the past decade. "Zero-dayattacks" have become significant, delivered increasingly throughseemingly innocuous means such as web pages, images, and documents.Malware is rampant, being installed surreptitiously on millions ofcomputers around the world using a combination of spam, phishing,malicious shareware and freeware. Today's defenses use techniques such as signature-based scanning andfile integrity monitoring to detect the presence of malware, and thenremove them. Unfortunately, clever adversaries can quickly developmalware that conceals itself from these detection mechanisms, andhence defeat such reactive defenses. In contrast, this project willdevelop an approach that dramatically improves defenses againstmalware, and put a computer owner back in control over theattackers. This approach, based on synthesizing and enforcinglow-level information flow properties from generic high levelpolicies, will be used to identify components of a computer systemthat are critical for its trustworthiness, and preserve theirintegrity. In doing so, the approach will enable users to continue touse popular operating systems, applications, and add-on software, while stillassuring system security.Specifically, this project will develop techniques to protect (a) the OSand critical applications from untrusted code or data, (b) criticalapplications from modules and extensions (e.g., browser plug-ins and mediaplayer codecs) that run within the same address space, and (c) the OS kernelfrom damage due to untrusted kernel extensions such as device drivers.In terms of broader impact, this project will train several graduatestudents, the research will be integrated into the teaching activities ofthe PIs, and finally, the solutions developed will be distributed asopen-source software and/or tools.