SBIR Phase I: Rendering Malware Benign

小型企业创新研究(SBIR)第1阶段项目将产生更广泛的影响，因为它将为组织和软件开发人员提供最好的保护，使其在完全独立和完全隔绝的环境中抵御有害的恶意软件和应用程序缺陷。在网络安全领域，应用程序现在是新的边界，并已成为恶意软件防护的最后前沿，目前所有终端安全产品都会被攻击者例行公事地关闭或以其他方式绕过。第一阶段项目专注于阻止和/或检测隐藏的恶意软件，无论它如何进入应用程序或如何改变其在应用程序中的行为。第一阶段项目的结果克服了当前解决方案中的基本技术缺陷-尝试从外部应用程序强制实施最低权限机制-提供了一个在应用程序内运行的解决方案，在该解决方案中，它可以看到恶意代码并对其执行操作。该解决方案将保护所有类型组织中的个人数据和企业资产，包括运行易受网络攻击的运营技术的组织。广泛采用将提高应用程序和终端的安全性，显著减少成功的恶意软件攻击持续增加带来的全球问题。该小型企业创新研究(SBIR)第一阶段项目旨在解决与开发实施引擎相关的核心技术挑战，以在应用程序内部的各种操作系统上实施所有当前的最低特权机制。挑战在于构建算法和引擎，以识别和防范滥用应用程序的动态代码权限的现代恶意软件。作为需要这种保护的证据，最近所有成功的恶意软件攻击几乎100%都是为了利用当前反病毒软件的这一特定漏洞而设计的。作为第一阶段项目的主题，这项新技术的第一个也是最直接的应用是将每个应用程序中动态代码的使用定义为一种特权，了解应用程序是否以及在其代码中的何处使用这种特权，并在了解到行为后强制实施该特权。第一阶段的成果将产生一种软件解决方案，该解决方案可以实时生成任何健康程序如何使用动态代码的地图，并阻止恶意软件破坏该过程的任何企图。该奖项反映了NSF的法定使命，并已通过使用基金会的智力优势和更广泛的影响审查标准进行评估，被认为值得支持。

The broader impact of this Small Business Innovation Research (SBIR) Phase 1 project will result from providing organizations and software developers the best available protection against harmful malware and application flaws in completely standalone and air-gapped environments. In cybersecurity, applications are now the new perimeter and have become the last frontier in malware protection, which is where all current endpoint security products are routinely turned off or otherwise bypassed by attackers. The Phase 1 project focuses on stopping and/or detecting hidden malware regardless of how it gets into an application or how it changes its behavior inside an application. The Phase 1 project result overcomes the fundamental technical flaw in current solutions – attempting to enforce least privilege mechanisms from outside applications – by delivering a solution that operates within the application where it can see and act upon malicious code. The solution will protect individual data and corporate assets in all types of organizations, including organizations running operational technology vulnerable to cyberattacks. Wide adoption will boost application and endpoint security, significantly reducing the worldwide problem posed by the continuing rise in successful malware attacks.This Small Business Innovation Research (SBIR) Phase I project seeks to address the core technical challenge associated with the development of an enforcement engine for implementing all current least privilege mechanisms on various operating systems inside applications. The challenge is to construct both the algorithms and the engine to recognize and protect against modern malware misusing the dynamic code privileges of applications. As proof that this protection is needed is the near 100% incidence of all recent, successful malware attacks that were all designed to take advantage of this specific vulnerability of current antivirus software. The first and most immediate application of this new technology, which is the subject of the phase I project, is to define the use of dynamic code in each application as a privilege, learn if and where within its code an application uses this privilege, and enforce it once the behavior has been learned. The outcomes from Phase 1 will result in a software solution that can produce in real time a map of how any healthy program uses dynamic code and stop any attempt by malware to subvert that process.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.