SaTC: CORE: Medium: Collaborative: Doctor WHO: Investigation and Prevention of Online Content Management System Abuse

世界上18亿个网站中有一半以上运行在内容管理系统(CMS)上。不幸的是，CMS部署很容易成为攻击者的目标，因为它们由分层软件和解释器的混合物构建，具有不同程度的网络和系统权限，在面向Internet的Web服务器上执行。该项目开发了以程序分析为中心的技术，使正在进行的感染的调查和补救以及针对未来CMS危害的强化，目标是1)了解CMS感染的意图和策略，并跟踪其根本原因攻击向量以进行可靠的补救；2)揭示CMS感染的恶意软件样本中的动态和复杂的攻击行为；3)强化CMS部署以抵御未来的攻击。该项目通过为CMS网站及其支持的金融、政府和私营部门运营创建网络取证和漏洞检测技术，从而有利于国家安全和经济稳定。它提供服务器端脚本代码，包括恶意脚本和易受攻击的代码，以帮助培训下一代网络安全专家。这个项目开发了世界卫生组织博士，这是一个CMS分析框架，结合了快速证据收集和先进的项目分析技术，用于调查和补救感染，并加强对未来CMS的妥协。具体地说，被称为TARDIS的数据驱动预测框架的开发是为了了解真实世界网站语料库中攻击证据的时间相关性。Tardis能够自动发现漏洞的伪迹，识别攻击的传播，并快速调查针对CMS部署的网络攻击。该项目还开发了Torchwood，这是一个跨语言和跨环境的程序分析框架，可以有效地分析针对CMS的高度动态和复杂的恶意软件。Torchwood可以处理应用于恶意软件的高级混淆和反分析技术，并有效地揭示恶意软件隐藏的恶意行为和意图。最后，该项目开发了能够加强和保护CMS部署以抵御未来攻击的单位。单位通过启用CMS支持的网站的自动化动态测试来实现这一点，而不需要任何运行时环境资源。该单位通过一套新的方法来识别运行时资源的依赖关系并对其进行建模，并使用仪表化脚本解释器引擎重建丢失的资源，从而消除错误警报并提供概念验证漏洞。该奖项反映了NSF的法定使命，并通过使用基金会的智力优势和更广泛的影响审查标准进行评估，被认为值得支持。

Over half of the world's 1.8 billion websites run on Content Management Systems (CMS). Unfortunately, CMS deployments make easy targets for attackers, as they are built from an amalgam of layered software and interpreters, with varying degrees of network and system permissions, which execute on an Internet-facing web server. This project develops program-analysis-centric techniques that enable the investigation and remediation of ongoing infections as well as hardening against future CMS compromises, with the goals of 1) understanding the intent and strategy of a CMS infection and tracing their root-cause attack vector for reliable remediation, 2) revealing dynamic and sophisticated attack behaviors in malware samples in a CMS infection, 3) hardening of CMS deployments against future attacks. This project benefits national security and economic stability by creating cyber forensics and vulnerability detection techniques for CMS websites and the financial, government, and private sector operations they support. It provides server-side script code including malicious scripts and vulnerable code to help train next-generation cybersecurity experts. Students from underrepresented minority groups are involved in research activities.This project develops Doctor WHO, a CMS analysis framework which combines rapid evidence collection and advanced program analysis techniques for the investigation and remediation of infections and hardening against future CMS compromises. Specifically, the data-driven prediction framework, called TARDIS, is developed to understand the temporal correlation of attack evidence across a corpus of real-world websites. TARDIS enables the automated discovery of the artifacts of a compromise, fingerprinting of the attack's propagation, and rapid investigation of cyberattacks against CMS deployments. The project also develops Torchwood, a cross-language and cross-environment program analysis framework to effectively analyze highly dynamic and sophisticated malware targeting CMSs. Torchwood can handle advanced obfuscation and anti-analysis techniques applied to malware and reveal hidden malicious behaviors and intentions of the malware effectively. Lastly, the project develops UNIT that enables the hardening and securing of CMS deployments against future attacks. UNIT accomplishes this by enabling automated dynamic testing of CMS-backed websites without requiring any runtime environment resources. UNIT eliminates false alerts and provide proof-of-concept exploits via a set of new methods to identify and model dependencies of runtime resources and reconstruct missing resources using instrumented script interpreter engines.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.