TC: Small: Reducing Virus Propagation in Mobile Devices

TC：小：减少移动设备中的病毒传播

• 批准号: 0915926
• 负责人: Gary Tyson
• 金额: $ 50万
• 依托单位: Florida State University
• 依托单位国家: 美国
• 项目类别: Continuing Grant
• 财政年份: 2009
• 资助国家: 美国
• 起止时间: 2009-09-15 至 2013-08-31
• 项目状态: 已结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=0915926&HistoricalAwards=false
• 关键词: TC; Small; Reducing; Virus; Propagation

Mobile computer systems and software are increasingly subject to a host of security threats and malicious software (malware) attacks due to vulnerabilities in their coding. The difficulty in achieving secure systems is further compounded by prevalence of unsophisticated users and the increasing reliance on third party software integration by enabling software module plugins for such user applications as web browsers and search engines. Traditional approaches have sought to provide an absolute defense to specific malware attacks by patching software vulnerabilities or detecting and blocking malware. One difficulty with these approaches for small mobile platforms is that the design constraints on these devices often favor low power to maximize battery life over enhancements to support security protocols. The current situation also represents a programmatic arms race between patching existing vulnerabilities and exploiting vulnerabilities in new application code. This research develops a new secure mobile computing environment based on current mobile technology widely available as consumer end products that seeks to use program differentiation to reduce the propagation rate of malware when a software vulnerability exists. This results not in the direct elimination of security vulnerabilities, but in the dramatic reduction in scope of any security exploit to infect large numbers of systems. By constraining the outbreak to only a few systems, counter measures can be employed before significant economic damage can result. By modifying aspects of the execution of the application, application executables can be permuted into unique versions for each distributed instance. Differentiation is achieved using hardware and/or systems software modifications. Areas of differentiation include function call/return and system call semantics, as well as a proposal for hardware-supported Instruction Register File access and intrusion detection monitoring. Differentiation of executables hinders analysis for vulnerabilities as well as prevents the exploitation of a vulnerability in a single distributed version from propagating to other instances of that application. By focusing on prevention of malware propagation in addition to traditional absolute defenses, we target the economics of malware in order to make attacks prohibitively expensive and infeasible.This approach can be more feasible than some conventional security approaches since it can be readily applied to the restricted performance capabilities of mobile systems and the legal constraints on the export of encryption technology. Further information and software distribution related to this project can be accessed at: http://www.cs.fsu.edu/~tyson/differentiation.

移动的计算机系统和软件由于其编码中的漏洞而越来越多地受到大量安全威胁和恶意软件（恶意软件）攻击。实现安全系统的难度由于不熟练的用户的普遍存在以及通过为诸如web浏览器和搜索引擎之类的用户应用启用软件模块插件而对第三方软件集成的日益依赖而进一步加剧。传统方法试图通过修补软件漏洞或检测和阻止恶意软件来对特定恶意软件攻击提供绝对防御。对于小型移动的平台，这些方法的一个困难在于，这些设备上的设计约束通常倾向于低功率以最大化电池寿命，而不是支持安全协议的增强。目前的情况也代表了修补现有漏洞和利用新应用程序代码中的漏洞之间的编程军备竞赛。这项研究开发了一个新的安全的移动的计算环境的基础上，目前广泛使用的移动的技术作为消费者终端产品，寻求使用程序差异化，以减少恶意软件的传播速度时，软件漏洞存在。这不会直接消除安全漏洞，但会显著减少任何安全漏洞感染大量系统的范围。通过将疫情限制在少数系统内，可以在造成重大经济损失之前采取应对措施。通过修改应用程序的执行的方面，应用程序可执行文件可以被置换为每个分布式实例的唯一版本。通过硬件和/或系统软件修改实现差异化。差异领域包括函数调用/返回和系统调用语义，以及硬件支持的指令寄存器文件访问和入侵检测监控的建议。可执行文件的区分会阻碍对漏洞的分析，并防止对单个分布式版本中漏洞的利用传播到该应用程序的其他实例。除了传统的绝对防御之外，我们还专注于防止恶意软件的传播，从而使攻击变得过于昂贵和不可行。这种方法比一些传统的安全方法更可行，因为它可以很容易地应用于移动的系统的有限性能和加密技术出口的法律的限制。有关此项目的更多信息和软件分发，请访问：http://www.cs.fsu.edu/~tyson/differentiation。