TWC: Small: Understanding Anti-Analysis Defenses in Malicious Code

网络安全问题涉及各种规模的计算机系统，几乎影响到我们日常生活的各个方面。这使得准确检测并快速响应网络威胁变得至关重要。该项目旨在开发技术和工具，以加快理解和应对新的网络威胁的过程。 恶意软件（malware）的作者通常试图使恶意软件隐身，以避免检测。在许多情况下，这涉及到各种旨在阻碍安全分析师分析工作的技术;我们将这些技术称为反分析防御。当遇到这种防御时，安全分析人员必须识别并禁用它们，以便观察和了解其真实的行为，从而制定对策。目前这样做的方法是缓慢和繁琐的。该项目旨在开发高度通用、高效和强大的自动化技术，以加快识别和理解恶意软件中的反分析防御措施的过程，目标是为安全分析人员提供工具，帮助他们快速响应新的网络威胁。恶意软件（malware）通常采用各种反分析和反篡改防御措施来阻碍分析和逆向工程。目前，消除这种防御需要大量的人工干预，因此是繁琐和耗时的。该项目开发基于语义的技术，以自动化大部分或所有这些工作，从而加快识别和中和此类防御的过程。 该项目的重点是分析采用各种反分析和反篡改防御的程序。特别是，该项目将集中在以下研究问题：* 检测。环境观测的特征如何转化为反分析防御的检测算法？如何使检测算法通用化？*精度哪些因素会影响这种检测算法的精度？如何提高精度？*性能对低级代码进行复杂的分析可能代价高昂。与此同时，遇到的大量新恶意软件使分析变得非常重要。如何才能使这种检测算法足够有效以实用？*隐形防御如何使环境检查在静态和动态上都是隐蔽的？反分析检测算法的含义是什么？为了使这种反反分析技术具有寿命，重要的是它们是通用的，即，尽可能少地假设可能已经应用的防御的性质或形式。为此，该项目将明确阐述其开发的技术基础的假设。这可以通过指出假设可能被削弱或删除的地方来为研究提出新的方向。这项研究的潜在贡献是技术和社会。更轻松地中和恶意软件部署的反分析防御的能力将使安全研究人员能够快速响应新出现的恶意软件威胁。这将限制此类恶意软件造成的损害范围，并提高我们网络基础设施的安全性和可靠性。此外，该项目将涉及研究生和本科生在研究的各个方面，从而有助于高技能劳动力的发展。最后，作为该项目一部分开发的软件将提供给更广泛的研究界，从而协助和支持这一领域的其他研究项目。

The problem of cyber-security encompasses computer systems of all sizes and affects almost all aspects of our day-to-day lives. This makes it fundamentally important to detect accurately and respond quickly to cyber-threats as they develop. This project aims to develop techniques and tools that can accelerate the process of understanding and responding to new cyber-threats as they develop. The authors of malicious software (malware) usually try to make the malware stealthy in order to avoid detection. In many cases, this involves a variety of techniques aimed at hindering analysis efforts by security analysts; we refer to such techniques as anti-analysis defenses. When confronted by such defenses, security analysts have to identify and disable them in order to observe and understand its real behaviors and thereby develop countermeasures. Current approaches for doing this are slow and cumbersome. This project aims to develop highly general, efficient, and robust automated techniques for speeding up the process of identifying and understanding anti-analysis defenses in malware, with the goal of providing security analysts with tools that can help them respond quickly to new cyber-threats as they develop.Malicious software (malware) usually employs a variety of anti-analysis and anti-tampering defenses to hinder analysis and reverse engineering. Currently, neutralizing such defenses requires a lot of manual intervention and is therefore tedious and time-consuming. This project develops semantics-based techniques to automate most or all of this effort and so accelerate the process of identifying and neutralizing such defenses. The project focusses on analyzing programs that employ a variety of anti-analysis and anti-tampering defenses. In particular, the project will focus on the following research questions:* Detection. How do characterizations of environmental observations translate to detection algorithms for anti-analysis defenses? How can the detection algorithms be made general?* Precision. What factors affect the precision of such detection algorithms? How can the precision be improved?* Performance. Sophisticated analysis of low-level code can be expensive. At the same time, the high volumes of new malware that are encountered make it important for analyses to be efficient. How can such detection algorithms be made efficient enough to be practical?*Stealthy Defenses. How can environment checks be made statically and dynamically stealthy? What are the implications for anti-analysis detection algorithms?In order for such anti-anti-analysis techniques to have longevity, it is important that they be general, i.e., make as few assumptions as possible about the nature or form of the defenses that may have been applied. To this end, the project will articulate explicitly the assumptions underlying the techniques it develops. This can be expected to suggest new directions for research by indicating where assumptions may be weakened or removed. The potential contributions of this research are both technical and societal. The ability to more easily neutralize anti-analysis defenses deployed by malware will allow security researchers to respond to new and emerging malware threats quickly. This will have the effect of limiting the scope of the damage caused by such malware, and improve the security and reliability of our cyber-infrastructure. Additionally, the project will involve graduate and undergraduate students in all aspects of the research and thereby contribute to the development of a highly skilled workforce. Finally, software developed as part of the project will be made available to the broader research community, thereby assisting and supporting other research projects in this area.