CAREER: Binary and Virtualization Centric Malware Defense

恶意软件（malware）已经成为计算机安全的主要威胁，并将在未来几十年内继续成为计算机安全研究的中心主题。该项目采用以二进制和虚拟化为中心的方法，使用在线和离线分析来有效地击败恶意软件。离线恶意软件分析旨在提取有关新发现的恶意软件实例或软件漏洞的内部工作原理的知识，以建立针对类似攻击的适当防御。在线恶意软件防御旨在建立高效的安全机制，有效地限制恶意行为，并为后续的安全调查收集足够的证据。对于离线恶意软件分析，使用了一种新的基于虚拟化的恶意软件分析平台，在此基础上，将新型推理技术应用于恶意软件分解和漏洞诊断。对于在线恶意软件防御，使用虚拟化的模块级沙箱和执行重放的新技术被协作地用于击败恶意软件。这项研究的结果将通过同行评审的出版物和软件发布来传播。基于这项研究，将开发新的课程材料，模块化实践项目和专业培训教程，以帮助未来的计算机工程师和安全研究人员深入了解恶意软件防御。

Malicious software (malware) has become a major threat to computer security and will continue to be a central theme for computer security research for decades. This project takes a binary and virtualization centric approach to effectively and efficiently defeat malware using both online and offline analysis. Offline malware analysis aims to extract knowledge about the inner-workings for a newly discovered malware instance or software exploit, for the purpose of building up proper defense against similar attacks. Online malware defense aims to build efficient security mechanisms to effectively confine malicious behavior and collect enough evidence for subsequent security investigation. For offline malware analysis, a novel virtualization-based malware analysis platform is used, on top of which new type inference techniques are applied to malware decomposition and vulnerability diagnosis. For online malware defense, new techniques for module-level sandbox and execution replay using virtualization are cooperatively used to defeat malware. The results from this research will be disseminated through both peer-reviewed publications and software release. Based on this research, new course materials, modular hands-on projects, and professional training tutorials will be developed, to help future computer engineers and security researchers gain in-depth knowledge about malware defense.