CAREER: Exo-Core: An Architecture to Detect Malware as Computational Anomalies

点击翻译按钮获取中文摘要

Applications that run on billions of mobile devices backed by enormousdatacenters hold the promise of personal, always-on healthcare; of intelligentvehicles and homes; and thus of a healthier, more efficient society. It isimperative to make such applications secure by protecting their integrity andkeeping their data confidential. However, malicious programs (``malware'')today can subvert the best software-level defenses by impersonating benignprocesses on mobile devices or by attacking victim processes through thehardware on shared datacenter servers. Grappling with such intelligent malwarerequires fundamental advances in the hardware-software organization of computersystems.The key observation behind the research project here is that, while seeminglydisparate, intelligent malware relies on hiding its hardware-level behaviorsfrom operating system-level monitors. By exposing instruction-level andmicro-architectural behaviors to software analysis, the proposed Exo-corearchitecture enables a new class of malware detectors. In addition, Exo-coreintroduces programmable hardware accelerators to synthesize run-time programtraces into robust models of benign programs. The project will alsointegrate research in hardware-software foundations of computer securityinto a new two-semester research course for undergraduate students.