Computational tools for analyzing and detecting software supply chain attacks

用于分析和检测软件供应链攻击的计算工具

• 批准号: 474601-2014
• 负责人: Lie, David
• 金额: $ 5.1万
• 依托单位: University of Toronto
• 依托单位国家: 加拿大
• 项目类别: Collaborative Research and Development Grants
• 财政年份: 2016
• 资助国家: 加拿大
• 起止时间: 2016-01-01 至 2017-12-31
• 项目状态: 已结题
• 来源: https://www.nserc-crsng.gc.ca/ase-oro/Details-Detailles_eng.asp?id=598906
• 关键词: Computational; tools; analyzing; detecting; software

Software supply chain attacks -- attacks where malware is covertly inserted into reputable and otherwise benign software somewhere in the chain between development and final use by the customer have become a growing concern. With the potential to affect enterprises, public organizations and individual users, supply chain attacks are a threat to users of every kind. Traditional defenses, such as anti-virus scanners are largely ineffective as the malware deposited by these attacks are often custom crafted and can be stealthily embedded in code that is normally highly trusted by the end user.

软件供应链攻击--恶意软件被秘密插入到客户开发和最终使用之间的链中某个地方的信誉良好的软件中的攻击，已经成为一个越来越令人担忧的问题。供应链攻击有可能影响企业、公共组织和个人用户，对各种用户都构成威胁。传统的防御措施，如防病毒扫描程序，在很大程度上是无效的，因为这些攻击所存放的恶意软件通常是定制的，并且可以悄悄地嵌入到最终用户通常高度信任的代码中。