SaTC: CORE: Medium: Collaborative: Doctor WHO: Investigation and Prevention of Online Content Management System Abuse

全球18亿个网站中有一半以上运行在内容管理系统（CMS）上。不幸的是，CMS部署很容易成为攻击者的目标，因为它们是由分层软件和解释器的混合体构建的，具有不同程度的网络和系统权限，并在面向internet的web服务器上执行。该项目开发了以程序分析为中心的技术，能够调查和修复正在进行的感染，并加强对未来CMS危害的防范，其目标是1)了解CMS感染的意图和策略，并追踪其根本原因攻击向量以进行可靠的补救，2)在CMS感染的恶意软件样本中揭示动态和复杂的攻击行为，3)加强CMS部署以应对未来的攻击。该项目通过为CMS网站及其支持的金融、政府和私营部门运营创建网络取证和漏洞检测技术，有利于国家安全和经济稳定。为培养下一代网络安全专家，提供恶意脚本和易受攻击代码等服务器端脚本代码。来自代表性不足的少数群体的学生参与了研究活动。该项目开发了“世卫组织医生”，这是一个CMS分析框架，结合了快速证据收集和先进的规划分析技术，用于调查和补救感染，并加强对CMS未来危害的防范。具体来说，数据驱动的预测框架，称为TARDIS，是为了理解跨真实世界网站语料库的攻击证据的时间相关性而开发的。TARDIS支持自动发现入侵产物、识别攻击传播，以及快速调查针对CMS部署的网络攻击。该项目还开发了Torchwood，这是一种跨语言和跨环境的程序分析框架，可有效分析针对cms的高动态和复杂恶意软件。Torchwood可以处理应用于恶意软件的高级混淆和反分析技术，并有效地揭示恶意软件隐藏的恶意行为和意图。最后，该项目开发了UNIT，使CMS部署能够针对未来的攻击进行加固和保护。UNIT通过启用cms支持的网站的自动动态测试来实现这一点，而不需要任何运行时环境资源。UNIT消除错误警报，并通过一组新方法提供概念验证漏洞，以识别和建模运行时资源的依赖关系，并使用仪器化脚本解释器引擎重建缺失的资源。该奖项反映了美国国家科学基金会的法定使命，并通过使用基金会的知识价值和更广泛的影响审查标准进行评估，被认为值得支持。

Over half of the world's 1.8 billion websites run on Content Management Systems (CMS). Unfortunately, CMS deployments make easy targets for attackers, as they are built from an amalgam of layered software and interpreters, with varying degrees of network and system permissions, which execute on an Internet-facing web server. This project develops program-analysis-centric techniques that enable the investigation and remediation of ongoing infections as well as hardening against future CMS compromises, with the goals of 1) understanding the intent and strategy of a CMS infection and tracing their root-cause attack vector for reliable remediation, 2) revealing dynamic and sophisticated attack behaviors in malware samples in a CMS infection, 3) hardening of CMS deployments against future attacks. This project benefits national security and economic stability by creating cyber forensics and vulnerability detection techniques for CMS websites and the financial, government, and private sector operations they support. It provides server-side script code including malicious scripts and vulnerable code to help train next-generation cybersecurity experts. Students from underrepresented minority groups are involved in research activities.This project develops Doctor WHO, a CMS analysis framework which combines rapid evidence collection and advanced program analysis techniques for the investigation and remediation of infections and hardening against future CMS compromises. Specifically, the data-driven prediction framework, called TARDIS, is developed to understand the temporal correlation of attack evidence across a corpus of real-world websites. TARDIS enables the automated discovery of the artifacts of a compromise, fingerprinting of the attack's propagation, and rapid investigation of cyberattacks against CMS deployments. The project also develops Torchwood, a cross-language and cross-environment program analysis framework to effectively analyze highly dynamic and sophisticated malware targeting CMSs. Torchwood can handle advanced obfuscation and anti-analysis techniques applied to malware and reveal hidden malicious behaviors and intentions of the malware effectively. Lastly, the project develops UNIT that enables the hardening and securing of CMS deployments against future attacks. UNIT accomplishes this by enabling automated dynamic testing of CMS-backed websites without requiring any runtime environment resources. UNIT eliminates false alerts and provide proof-of-concept exploits via a set of new methods to identify and model dependencies of runtime resources and reconstruct missing resources using instrumented script interpreter engines.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.