CAREER: Exo-Core: An Architecture to Detect Malware as Computational Anomalies

职业：Exo-Core：一种将恶意软件检测为计算异常的架构

• 批准号: 1453806
• 负责人: Mohit Tiwari
• 金额: $ 52.27万
• 依托单位: University of Texas at Austin
• 依托单位国家: 美国
• 项目类别: Continuing Grant
• 财政年份: 2015
• 资助国家: 美国
• 起止时间: 2015-03-01 至 2021-02-28
• 项目状态: 已结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=1453806&HistoricalAwards=false
• 关键词: CAREER; Exo; Core; Architecture; Detect

Applications that run on billions of mobile devices backed by enormousdatacenters hold the promise of personal, always-on healthcare; of intelligentvehicles and homes; and thus of a healthier, more efficient society. It isimperative to make such applications secure by protecting their integrity andkeeping their data confidential. However, malicious programs (``malware'')today can subvert the best software-level defenses by impersonating benignprocesses on mobile devices or by attacking victim processes through thehardware on shared datacenter servers. Grappling with such intelligent malwarerequires fundamental advances in the hardware-software organization of computersystems.The key observation behind the research project here is that, while seeminglydisparate, intelligent malware relies on hiding its hardware-level behaviorsfrom operating system-level monitors. By exposing instruction-level andmicro-architectural behaviors to software analysis, the proposed Exo-corearchitecture enables a new class of malware detectors. In addition, Exo-coreintroduces programmable hardware accelerators to synthesize run-time programtraces into robust models of benign programs. The project will alsointegrate research in hardware-software foundations of computer securityinto a new two-semester research course for undergraduate students.

在数十亿台移动的设备上运行的应用程序，由众多的互联网公司提供支持，有望实现个人化的、永远在线的医疗保健;智能汽车和家庭;从而实现一个更健康、更高效的社会。 通过保护这些应用程序的完整性和数据的机密性来保证它们的安全是非常必要的。然而，今天的恶意程序（"恶意软件“）可以通过模仿移动的设备上的良性进程或通过共享数据中心服务器上的硬件攻击受害者进程来破坏最好的软件级防御。 对付这种智能恶意软件需要在计算机系统的硬件-软件组织方面取得根本性的进步。这里的研究项目背后的关键观察结果是，尽管智能恶意软件非常不同，但它们依赖于隐藏其硬件级别的行为，不让操作系统级别的监视器看到。通过将防御级别和微架构行为暴露给软件分析，所提出的Exo-core架构实现了一类新的恶意软件检测器。 此外，Exo-core引入了可编程硬件加速器，将运行时程序跟踪合成为良性程序的健壮模型。该项目还将把计算机安全的硬件-软件基础研究整合到一个新的两学期的本科生研究课程中。