CSR:Small:Preventing the Exploitation of Software Vulnerabilities and Execution of Malicious Software on Embedded Systems

该奖项是根据2009年美国复苏和再投资法案（公法111-5）资助的。软件安全攻击预防，解决软件漏洞和恶意软件造成的威胁，对现代计算，特别是嵌入式系统非常重要。尽管进行了广泛的研究，但软件的复杂性和软件攻击的复杂性和独创性不断增加，导致了对创新的不断需求。传统技术的一些缺点是检测准确性不足（误报/漏报）和高性能惩罚。在本项目中，将研究一种新的方法来检测和防止恶意代码执行和软件漏洞利用，具有比现有技术显著提高准确性和效率的潜力。 它将利用相关领域的最新进展，例如虚拟化和动态二进制插装，这些技术可以有效地创建隔离的执行环境，并对程序执行进行动态监控和分析。 该项目的关键方面是安全的执行后分析，以检测违反特定的安全策略，推导出一个混合模型，表示在正则表达式和数据不变量方面的程序/数据流的动态控制，恶意行为的运行时预防，几个软件/硬件增强，以便在嵌入式系统上有效地部署防御框架。这些方法将通过研究文章传播，开发的软件工具将放在万维网上。 将鼓励本科生就这一主题开展独立的研究项目。 普林斯顿大学鼓励女性和少数民族学生通过特殊奖学金申请，这将是杠杆作用。还计划开展其他几项外联活动，以促进代表性不足的高中生的教育。

This award is funded under the American Recovery and Reinvestment Act of 2009 (Public Law 111-5).Software security attack prevention, which addresses threats posed by software vulnerabilities and malicious software, is important for modern computing, especially for embedded systems. Despite widespread research efforts, the increasing complexity of software and sophistication and ingenuity of software attacks have led to a constant need for innovation. Some of the shortcomings of conventional techniques are insufficient detection accuracy (false positives/negatives) and high performance penalties.In this project, a new methodology will be investigated for detecting and preventing malicious code execution and software vulnerability exploits, with the potential to significantly improve the accuracy and efficiency beyond current techniques. It will leverage recent advances in related areas, such as virtualization and dynamic binary instrumentation, which enable efficient creation of isolated execution environments and dynamic monitoring and analysis of program execution. The key aspects of the project are safe post-execution analysis to detect violation of specific security policies, derivation of a hybrid model that represents a dynamic control of the program/data flow in terms of regular expressions and data invariants, run-time prevention of malicious behavior, and several software/hardware enhancements for efficiently deploying the defense framework on embedded systems.The methodologies will be disseminated through research articles, and software tools developed will be placed on the world-wide web. Undergraduates will be encouraged to carry out independent research projects on this topic. Princeton encourages applications from female and minority students through special fellowships, which will be leveraged. Several other outreach activities are also planned for promoting education among underrepresented high school students.