CT-T: Proactive Techniques for Preserving System Integrity: A Basis for Robust Defense Against Malware

CT-T：保护系统完整性的主动技术：强大防御恶意软件的基础

• 批准号: 0831298
• 负责人: Ramasubramanian Sekar
• 金额: $ 100万
• 依托单位: SUNY at Stony Brook
• 依托单位国家: 美国
• 项目类别: Continuing Grant
• 财政年份: 2008
• 资助国家: 美国
• 起止时间: 2008-09-01 至 2015-08-31
• 项目状态: 已结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=0831298&HistoricalAwards=false
• 关键词: CT; Proactive; Techniques; Preserving; System

Cyber threats have escalated rapidly over the past decade. "Zero-dayattacks" have become significant, delivered increasingly throughseemingly innocuous means such as web pages, images, and documents.Malware is rampant, being installed surreptitiously on millions ofcomputers around the world using a combination of spam, phishing,malicious shareware and freeware. Today's defenses use techniques such as signature-based scanning andfile integrity monitoring to detect the presence of malware, and thenremove them. Unfortunately, clever adversaries can quickly developmalware that conceals itself from these detection mechanisms, andhence defeat such reactive defenses. In contrast, this project willdevelop an approach that dramatically improves defenses againstmalware, and put a computer owner back in control over theattackers. This approach, based on synthesizing and enforcinglow-level information flow properties from generic high levelpolicies, will be used to identify components of a computer systemthat are critical for its trustworthiness, and preserve theirintegrity. In doing so, the approach will enable users to continue touse popular operating systems, applications, and add-on software, while stillassuring system security.Specifically, this project will develop techniques to protect (a) the OSand critical applications from untrusted code or data, (b) criticalapplications from modules and extensions (e.g., browser plug-ins and mediaplayer codecs) that run within the same address space, and (c) the OS kernelfrom damage due to untrusted kernel extensions such as device drivers.In terms of broader impact, this project will train several graduatestudents, the research will be integrated into the teaching activities ofthe PIs, and finally, the solutions developed will be distributed asopen-source software and/or tools.

网络威胁在过去十年中迅速升级。“零日攻击”已经变得越来越重要，越来越多地通过看似无害的手段（如网页、图像和文档）进行攻击。恶意软件猖獗，通过垃圾邮件、网络钓鱼、恶意共享软件和免费软件的组合，被秘密地安装在世界各地数以百万计的计算机上。今天的防御使用诸如基于签名的扫描和文件完整性监控等技术来检测恶意软件的存在，然后将其删除。不幸的是，聪明的对手可以很快开发出隐藏在这些检测机制之外的恶意软件，从而击败这种反应性防御。相比之下，这个项目将开发一种方法，大大提高对恶意软件的防御能力，并使计算机所有者重新控制攻击者。该方法基于综合和执行来自通用高层策略的低级信息流属性，将用于识别计算机系统中对其可信度至关重要的组件，并保持其完整性。这样，该方法将使用户能够继续使用流行的操作系统、应用程序和附加软件，同时仍然确保系统安全性。具体来说，该项目将开发技术来保护(a) OS和关键应用程序免受不受信任的代码或数据的影响，(b)运行在同一地址空间内的模块和扩展（例如浏览器插件和媒体播放器编解码器）的关键应用程序，以及(c) OS内核免受不受信任的内核扩展（如设备驱动程序）的损害。就更广泛的影响而言，该项目将培养几名研究生，研究将整合到pi的教学活动中，最后，开发的解决方案将作为开源软件和/或工具分发。