ITR: Intrusion Detection and Intrusion Prevention Through Dynamic Binary Translation

恶意代码对我们的社会构成了重大威胁，我们的社会越来越依赖于网络计算机系统进行商业和通信。恶意软件，包括病毒、蠕虫和特洛伊木马，具有破坏通信和威胁整个互联网稳定的潜力。因此，本研究的目的是分析、检测和缓解恶意代码。根据利用的漏洞和效果，对多种类型的恶意代码进行了调查和分组。这使得有选择地分别针对每个漏洞利用类成为可能。以前分析恶意代码的方法依赖于静态逆向工程、受限执行（通过程序语言沙盒）或网络跟踪。这些方法通常不适用于日益复杂的恶意代码，这些恶意代码可能使用运行时加密或动态多态性进行自我修改。动态恶意代码需要动态工具进行分析、检测和缓解。因此，正在开发允许此类分析的新动态工具，以及允许检测和减轻已知恶意代码类型的安全性增强。研究方法是利用运行时二进制转换实现透明的代码监控和重写。正在开发一个基于二进制转换的软件保证和安全系统的原型实现，并正在调查该解决方案的有效性及其潜在的部署成本。

Malicious code poses a significant threat to our society, which is becoming increasingly reliant on networked computer systems for commerce and communication. Malicious software, including viruses, worms, and Trojan Horses, has the potential to disrupt communications and threaten the stability of the Internet as a whole. Therefore the objective of this research is analysis, detection, and mitigation of malicious code. The many types of malicious code are being investigated and grouped by exploited vulnerability and effect. This makes it possible selectively to target each exploit class separately. Previous approaches to the analysis of malicious code relied on static reverse engineering, confined execution (via program language sandboxing), or network traces. These approaches are often inadequate for increasingly complex malicious code that may be self-modifying, using run-time encryption or dynamic polymorphism. Dynamic malicious code requires dynamic tools for analysis, detection, and mitigation. Therefore new dynamic tools to permit such analysis are being developed, together with security enhancements to allow detection and mitigation of known malicious code types. The research approach is to use run-time binary translation to achieve transparent code monitoring and rewriting. A prototype implementation of a system for software assurance and security based on binary translation is being developed, and the effectiveness of the solution and its potential deployment cost are being investigated.