CAREER: Automated Forensic-in-the-Loop Cyber Defense Infrastructure

网络攻击正变得越来越先进和复杂。高级攻击者对目标进行长时间的监视，以发现其漏洞和保护策略。由于其复杂先进的战术和资源，以及以意想不到/被忽视的方式渗透系统的策略，此类高级攻击的预防和调查极具挑战性。更糟糕的是，攻击者使用复杂的策略，如混淆和规避技术，来阻止或延迟取证调查。攻击者还会破坏大量的系统组件和资源，使恢复和加固系统变得极其困难。由于法医分析的延迟或不完整，很难及时妥善保护受害者的组织，从而导致重大损害和损失。为此，该项目开发了新的技术来(1)彻底防止各种攻击，(2)进行快速和全面的法医分析，以及(3)严格保护受害者的系统。该项目还包括教育活动，通过组织指导研讨会和指导弗吉尼亚大学的大学网络防御竞赛团队（其中包括许多女学生），扩大计算机领域的参与。该项目旨在开发一种自动取证在环网络防御基础设施，该基础设施将新型防御、取证分析和强化方法连贯地集成在一起。首先，研究者通过干扰输入和运行时环境（攻击的最薄弱环节）来开发攻击向量不可知的保护和检测方法。其次，研究者开发了新的自动化技术来检测和消除应用于恶意软件的反取证技术。此外，为了处理规避型恶意软件，研究者引入了自适应反事实执行技术来进化运行时环境和执行上下文。最后，研究人员开发了一种自动化的根本原因分析技术，用于诊断漏洞并识别潜在的修复方法（例如，安全配置）。该奖项反映了美国国家科学基金会的法定使命，并通过使用基金会的知识价值和更广泛的影响审查标准进行评估，被认为值得支持。

Cyber-attacks are becoming increasingly advanced and sophisticated. Advanced attackers monitor their targets for a long time to find out about their vulnerabilities and protective strategies. Such advanced attacks are extremely challenging to prevent and investigate due to their sophisticated and advanced tactics and resources and by their strategy to penetrate the system in unexpected/overlooked ways. Worse, attackers use sophisticated tactics, such as obfuscation and evasive techniques, to thwart or delay forensics investigations. Attackers also compromise a wide range of system components and resources, making it extremely difficult to restore and harden the system. Delayed or incomplete forensic analysis makes it difficult to properly secure the victim’s organization on time, leading to significant damages and losses. To this end, this project develops novel techniques to (1) prevent diverse attacks thoroughly, (2) conduct rapid and comprehensive forensic analysis, and (3) protect the victim’s system rigorously. This project also involves educational activities that broadens participation in computing, by organizing mentoring workshops and coaching the University of Virginia’s Collegiate Cyber Defense Competition team, which includes many female students. This project aims to develop an automated forensic-in-the-loop cyber defense infrastructure that coherently integrates novel defenses, forensic analysis, and hardening approaches. First, the investigator develops attack vector agnostic protection and detection approaches by perturbing inputs and runtime environments that are the weakest links of the attacks. Second, the investigator develops novel automated techniques to detect and eliminate anti-forensic techniques applied to malware. Furthermore, to handle evasive malware, the investigator introduces the adaptive counterfactual execution technique to evolve the runtime environment and execution context. Finally, the investigator develops an automated root cause analysis technique that diagnoses loopholes and identifies potential fixes (e.g., secure configurations).This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.