TC: Small: Reducing Virus Propagation in Mobile Devices

移动计算机系统和软件由于其编码中的漏洞，越来越多地受到一系列安全威胁和恶意软件（恶意软件）攻击。由于缺乏经验的用户普遍存在，以及越来越依赖第三方软件集成（为web浏览器和搜索引擎等用户应用程序启用软件模块插件），实现安全系统的难度进一步加大。传统的方法试图通过修补软件漏洞或检测和阻止恶意软件来为特定的恶意软件攻击提供绝对的防御。这些方法在小型移动平台上的一个困难是，这些设备的设计限制通常倾向于低功耗以最大化电池寿命，而不是增强以支持安全协议。当前的情况还代表了修补现有漏洞和利用新应用程序代码中的漏洞之间的编程军备竞赛。本研究开发了一种新的安全移动计算环境，该环境基于当前广泛应用于消费者终端产品的移动技术，寻求在存在软件漏洞时使用程序差异化来降低恶意软件的传播速度。这样做的结果不是直接消除安全漏洞，而是大大减少了感染大量系统的任何安全漏洞的范围。通过将疫情限制在少数几个系统，可以在造成重大经济损失之前采取应对措施。通过修改应用程序执行的各个方面，可以将应用程序可执行文件排列为每个分布式实例的唯一版本。差异化是通过硬件和/或系统软件修改来实现的。区别的领域包括函数调用/返回和系统调用语义，以及硬件支持的指令寄存器文件访问和入侵检测监控的建议。可执行文件的区别阻碍了对漏洞的分析，也防止了对单个分布式版本中的漏洞的利用传播到该应用程序的其他实例。除了传统的绝对防御之外，我们还专注于防止恶意软件的传播，我们的目标是恶意软件的经济性，以使攻击变得昂贵和不可行的。这种方法比一些传统的安全方法更可行，因为它可以很容易地应用于移动系统的受限性能和对加密技术出口的法律限制。与此项目有关的更多信息和软件分发可以访问：http://www.cs.fsu.edu/~tyson/differentiation。

Mobile computer systems and software are increasingly subject to a host of security threats and malicious software (malware) attacks due to vulnerabilities in their coding. The difficulty in achieving secure systems is further compounded by prevalence of unsophisticated users and the increasing reliance on third party software integration by enabling software module plugins for such user applications as web browsers and search engines. Traditional approaches have sought to provide an absolute defense to specific malware attacks by patching software vulnerabilities or detecting and blocking malware. One difficulty with these approaches for small mobile platforms is that the design constraints on these devices often favor low power to maximize battery life over enhancements to support security protocols. The current situation also represents a programmatic arms race between patching existing vulnerabilities and exploiting vulnerabilities in new application code. This research develops a new secure mobile computing environment based on current mobile technology widely available as consumer end products that seeks to use program differentiation to reduce the propagation rate of malware when a software vulnerability exists. This results not in the direct elimination of security vulnerabilities, but in the dramatic reduction in scope of any security exploit to infect large numbers of systems. By constraining the outbreak to only a few systems, counter measures can be employed before significant economic damage can result. By modifying aspects of the execution of the application, application executables can be permuted into unique versions for each distributed instance. Differentiation is achieved using hardware and/or systems software modifications. Areas of differentiation include function call/return and system call semantics, as well as a proposal for hardware-supported Instruction Register File access and intrusion detection monitoring. Differentiation of executables hinders analysis for vulnerabilities as well as prevents the exploitation of a vulnerability in a single distributed version from propagating to other instances of that application. By focusing on prevention of malware propagation in addition to traditional absolute defenses, we target the economics of malware in order to make attacks prohibitively expensive and infeasible.This approach can be more feasible than some conventional security approaches since it can be readily applied to the restricted performance capabilities of mobile systems and the legal constraints on the export of encryption technology. Further information and software distribution related to this project can be accessed at: http://www.cs.fsu.edu/~tyson/differentiation.