CAREER: Tools and Techniques for Preserving Integrity on the Web

网络是互联网最成功和最知名的应用，已经成为人们日常生活的一部分，数十亿用户依赖于它来获取新闻、娱乐、通信和工作。这种依赖性不断被攻击者利用，他们似乎拥有针对流行Web服务和最终用户的各种攻击的无穷无尽的集合。该项目将大量看似无关的攻击视为违反完整性问题的实例。由于缺乏完整性检查和保证，Web应用程序无法衡量用户在点击远程链接或加载远程资源时今天将收到的内容是否与他们过去链接的内容相同。该项目的重点是更好地了解网络上的内容完整性问题，收集有关攻击者如何滥用它的数据，并开发针对完整性侵犯的防御措施。该项目建议设计，实施，并评估通过使Web开发人员能够发现其Web应用程序所依赖的远程资源并通过新的政策体系除了开发人员编写的策略之外，该项目还将使用异常检测，通过提取属性并将其组合到完整性签名中，自动发现远程资源何时以不典型的方式运行。为了量化流行的网络应用程序对远程资源的依赖程度，并评估不同类型的网站对不同政策的反应，该项目包括纵向收集链接数据，并使用这些数据来模拟拟议系统的效果。最后，该项目提出了协作，客户端-服务器资源完整性计划，以进一步保护Web用户和加强现有服务的安全性。这项研究工作的成果有望提高研究界对网络内容完整性的理解，并在保护网站和用户免受网络上违反完整性的攻击方面产生实质性的实际影响。该奖项反映了NSF的法定使命，并被认为值得通过使用基金会的智力价值和更广泛的影响审查标准进行评估来支持。

The web, the Internet's most successful and recognizable application, has become part of peoples' daily lives and is relied upon by billions of users for news, entertainment, communications, and work. This reliance is constantly taken advantage of by attackers who appear to have an inexhaustible collection of diverse attacks targeting popular web services and end users. This project views a large number of seemingly unrelated attacks as mere instances of the problem of integrity violation. Due to the absence of integrity checks and guarantees, web applications have no way of gauging whether the content that their users will receive today when clicking on a remote link or loading a remote resource, is the same content that they linked to in the past. This project focuses on better understanding this issue of content integrity on the web, gathering data about how attackers abuse it, and developing defenses against integrity violations.The project proposes to design, implement, and evaluate tools and techniques for preserving integrity on the web by enabling web developers to discover the remote resources on which their web applications rely and make explicit statements about these resources through new policy systems. Next to developer-authored policies, this project will use anomaly detection to automatically discover when remote resources behave in an uncharacteristic fashion by extracting attributes and combining them in integrity signatures. To quantify how popular web applications depend on remote resources and to evaluate how different types of websites would react to different policies, the project includes the longitudinal collection of linking data and the use of this data to simulate the effects of the proposed systems. Finally, the project proposes collaborative, client-server resource-integrity schemes to further protect web users and strengthen the security of existing services. The outcomes of this research effort are expected to improve the research community's understanding of content integrity on the web and to achieve substantial practical impact in protecting websites and users against integrity-violating attacks on the web.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.