CAREER: Language-based Security for Polymorphic Malware Protection

病毒、蠕虫和其他自我传播的恶意软件仍然是对美国几乎所有网络基础设施部门的持续重大安全威胁，包括政府、企业和家庭消费者。新恶意软件出现的不断升级的速度越来越有可能超过防御社区维护有效检测系统的能力。这在一定程度上是因为许多恶意软件检测算法根据语法特征识别恶意软件。多态恶意软件在其传播过程中不断演变新的语法，每天引入数百或数千个实现相同恶意行为的新语法。因此，发现实用的、可扩展的技术来可靠地检测新的多态恶意软件变体是当前计算机安全行业面临的最重要的挑战之一。该项目开发了基于语义而不是纯粹的语法代码特征来检测恶意软件的静态和动态混合技术。因此，恶意软件是基于其恶意编程的含义而不是其实现该恶意编程的语法来识别的。通过将传统的静态代码分析应用于在运行时动态拦截的解密内存页来识别恶意有效负载。该项目的一个主要目标是开发可扩展和适用于标准计算机硬件和操作系统的技术。这将允许大规模部署结果，并有助于保护国家免受分布式攻击，这些攻击危及大量低优先级目标，从而攻击优先级较高的目标。研究结果将带来强大的新战略、概念和实用工具，使防御者在病毒-反病毒军备竞赛中获得显著的新优势，并提高国家网络基础设施对网络攻击的弹性。

Viruses, worms, and other self-propagating malware remain significant ongoing security threats to almost all sectors of the nation's cyber-infrastructure, including government, business, and home consumers. The escalating rate of new malware appearances increasingly threatens to outpace the defense community's ability to maintain effective detection systems. This is in part because many malware detection algorithms identify malicious software based on syntactic features. Polymorphic malware continually evolves new syntaxes at it propagates, introducing hundreds or thousands of new syntaxes per day that implement the same malicious behavior. Discovering practical, scalable techniques for reliably detecting new polymorphic malware variants is therefore one of the most significant challenges currently facing the computer security industry.This project develops hybrid static-dynamic technologies that detect malware based on semantic rather than purely syntactic code features. Thus, malware is identified based on the meaning of its malicious programming rather than the syntax with which it implements it. Malicious payloads are identified by applying traditionally static code analyses to decrypted memory pages intercepted dynamically at runtime. A major goal of the project is to develop technologies that are scalable and practical for standard computer hardware and operating systems. This will allow wide-scale deployment of results, and help to protect the nation from distributed attacks that compromise large numbers of low-priority targets to attack higher-priority targets. Results from the research will lead to powerful new strategies, concepts, and practical tools that give defenders a significant new advantage in the virus-antivirus arms race, and improving the national cyber-infrastructure's resilience against cyber-attacks.