SaTC: CORE: Medium: Collaborative: Taming Web Content Through Automated Reduction in Browser Functionality

经由web浏览器执行的基于web的应用在日常生活中无处不在。 它们是我们的银行业务、通信、购物、社交网络、纳税、保险交易和医疗保健互动的基础。不幸的是，恶意行为者可以利用Web浏览器中的漏洞来利用用户的计算机。 Web浏览器攻击的后果可能很严重：Web内容可以在受害者的机器上执行任意代码。本研究项目研究Web应用程序如何使用Web浏览器提供的功能，以及如何通过限制不必要的浏览器功能来保护用户系统。本项目通过减少浏览器功能占用来解决Web浏览器安全问题，从而减少浏览器攻击面并减轻多种攻击。研究人员正在构建一个功能仪表化的浏览器，报告Web应用程序使用的功能。然后，他们利用这些信息自动识别Web应用程序何时偏离其预期行为并攻击用户的浏览器。为了使用户能够使用最新的浏览器，同时保护他们免受不必要和危险的浏览器功能的影响，研究团队正在构建一个系统来将功能与浏览器分离。

Web-based applications executed via web browsers are ubiquitous in everyday life. They underlie our banking, communications, shopping, social networking, tax payments, insurance transactions, and health care interactions. Unfortunately, malicious actors can take advantage of vulnerabilities in web browsers to exploit the user's computer. The consequences of a web browser attack can be severe: web content can execute arbitrary code on the victim's machine. This research project studies how web applications use the features provided by web browsers and how user systems can be protected by restricting unnecessary browser features.This project addresses web browser security by reducing the browser feature footprint, thereby reducing the browser attack surface and mitigating many classes of attacks. The researchers are building a feature-instrumented browser that reports what functionality is used by a web application. Then, they leverage that information to automatically identify when web applications diverge from their expected behavior and attack the user's browser. To enable users to use the most up-to-date browsers, while protecting them from unnecessary and risky browser features, the research team is building a system to decouple features from the browser.