TWC: Small: Thwarting Kernel-Level Malware with Secure Virtual Architecture

现代计算机操作系统被设计为通过启用可以添加新功能或修复缺陷的扩展来适应新的需求。然而，攻击者可以利用这种灵活性劫持扩展机制，将恶意代码插入软件；这种恶意代码窃取机密、破坏数据并隐藏恶意活动。目前，这些攻击几乎不可能被发现和预防。如果没有方法来防止或检测这种攻击，计算机操作系统将是不可信的。这个项目正在解决操作系统内核的安全可扩展性的挑战。研究人员正在研究使用静态和动态分析来自动生成安全策略。这些策略规定了每个扩展可以读取和修改哪些数据结构字段，以限制恶意内核扩展可能造成的损害。该项目还在探索静态验证内核扩展是否遵循这些策略的方法。由于静态分析可能保守地将良性扩展标记为潜在的恶意，因此研究人员正在增强现有的操作系统内核，以防止内核扩展隐藏恶意计算。这可以通过在扩展中插入代码来实现，以便在运行时强制执行上述安全策略。为了最小化运行时开销，研究人员还在研究复杂编译器优化的使用。

Modern computer operating systems are designed to adapt to new needs by enabling extensions that can add new features or fix flaws. However, attackers can take advantage of this flexibility by hijacking extension mechanisms to insert malicious code into software; this malicious code steals secrets, corrupts data, and hides malicious activities. At present, these attacks are nearly impossible to detect and prevent. Without methods to prevent or detect such attacks, computer operating systems will be untrustworthy. This project is addressing the challenge of safe extensibility of the operating system kernel.The researcher are investigating the use of both static and dynamic analysis to automatically generate security policies. These policies dictate which data structure fields can be read and modified by each extension in order to that limit the damage that malicious kernel extensions can cause. The project is also exploring methods of statically validating that kernel extensions follow these policies. Since static analysis may, conservatively, mark benign extensions as potentially malicious, the researchers are enhancing existing operating system kernels to prevent kernel extensions from hiding malicious computations. This is accomplished by inserting code into extensions to enforce the aforementioned security policies at run-time. To minimize run-time overheads, the researchers are also investigating the use of sophisticated compiler optimizations.