TC: Medium: Collaborative Research: Securing Web Advertisements: Fixing the Short-term Crisis and Addressing Long-term Challenges

恶意和可利用的网络广告（广告）被广泛认为是在线攻击和侵犯隐私的主要新兴来源。 流氓广告通常可以逃脱广告网络和网站现有的薄弱防御，对最终用户造成很大伤害。这种广告安全危机因以下几个因素而加剧：网络广告制作、分发和部署的复杂机制;广告网络的过滤策略薄弱;网站无法控制广告网络提供的内容;和穷人浏览器级原语的广告隔离和限制。这个项目通过开发一个综合框架，集成和扩展最近的研究，浏览器，级别脚本沙盒、字节码内联引用监控、信息流分析和二进制代码认证。一个关键的优先事项是透明地保留重要的Web广告技术，如广告计费、Flash-JavaScript互操作性、跨站点脚本和广告网络上下文定位。这两个PI的优势互补，形成了一种自然的协同效应，使其成为一个优雅且易于采用的框架，用于保护用户免受恶意广告带来的严重在线安全和隐私风险。据估计，2010年网络广告行业的规模将达到500亿美元，该项目开发的技术为该行业的活力做出了贡献。 为了最大限度地发挥影响力，PI正在将这项研究的结果转移到从事广告开发及其传播的工业部门。

Malicious and exploitable web advertisements (ads) are widely recognized as a major emerging source of online attacks and privacy violations. Rogue ads can often escape existing weak defenses employed by ad networks and websites, inflicting much harm on end-users. This ad security crisis is exacerbated by several factors: complex mechanisms by which web ads are produced, distributed and deployed; weak filtering strategies of ad networks; web sites' inability to control content supplied by ad networks; and poor browser-level primitives for ad isolation and confinement.This project tackles the ad crisis by developing a comprehensive framework that integrates and extends recent research on browser-level script sandboxing, bytecode in-lined reference monitoring, information flow analysis, and binary code certification. A key priority is to transparently preserve important web ad technologies, such as ad-billing, Flash-JavaScript interoperability, cross-site scripting, and ad network contextual targeting. The complementary strengths of the two PIs forms a natural synergy that lends itself to an elegant and easily adoptable framework for protecting users from the severe online security and privacy risks currently posed by malicious ads.With the web advertisement industry estimated to be at a USD $50 billion mark in 2010, the techniques developed by this project are contributing to the vitality of this industry. To maximize impact, the PIs are transitioning results from this research to the industrial sector engaged in the development of ads as well as their dissemination.