SBIR Phase I: Advanced Ransomware Countermeasure

这个小型企业创新研究（SBIR）项目的更广泛的影响/商业潜力是提供勒索软件对策。 商用防病毒解决方案不足以应对关键的关键基础设施，也无法科普网络犯罪分子为逃避检测而开发的新技术。拟议的项目使私营和公共组织能够加强对敏感数据的保护，降低数据赎金成本，并减少对运营能力的破坏。SBIR第一阶段项目旨在探索一种新方法的可行性，用于连续的攻击前观察和环境和网络的表征。算法验证来自网络的传入交互，并通过观察和描述软件代码中的内置命令来评估其威胁风险。同时，他们验证传出的交互，评估恶意数据泄露的风险。任务包括在开发所需功能之前开发用于部署和测试技术的沙箱环境。该系统将与最新的攻击向量进行广泛的测试。该奖项反映了NSF的法定使命，并已被认为是值得通过使用基金会的智力价值和更广泛的影响审查标准进行评估的支持。

The broader impact/commercial potential of this Small Business Innovation Research (SBIR) project is to provide ransomware countermeasures. Commercially available antivirus solutions are not adequate for key critical infrastructures and do not cope with new techniques developed by cybercriminals to evade detection. The proposed project enables private and public organizations to increase protection of sensitive data, reduce data ransom costs, and decrease disruption to operational capabilities. This SBIR Phase I project proposes to explore the feasibility of a new method for continuous pre-attack observation and characterization of the environment and the network. Algorithms validate incoming interactions from the network and evaluate their threat risk by observing and characterizing the built-in commands in the software code. Simultaneously, they validate outgoing interactions assessing the risk for malicious data exfiltration. Tasks include developing a sandbox environment for the deployment and testing of the technology prior to developing needed functionalities. The system will be extensively tested with the most recent attack vectors.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.