CAREER: Combating Malicious Behavior in Commodity Software

医疗、电力、电信和金融等关键领域的基础设施依赖于信息系统。因此，攻击可能对这些关键基础设施造成破坏性影响。此外，越来越多的组织依赖于商品软件。这一趋势可归因于越来越依赖外包和商业现货（COTS）组件。但是，部署商用软件会带来重大风险，因为它们可能包含可利用的漏洞和隐藏的恶意行为。打击商业软件中的恶意行为尤其具有挑战性，因为其用户只能访问软件的可执行文件。该提案解决了打击商品软件中恶意行为的问题。 所提出的任务是适用于基于模型的入侵检测系统（MIDS）的上下文中，这是一种基于主机的入侵检测系统（HIDS），使用模型监视程序执行。 在MIDS中有三个主要领域：模型构建、执行和模型分析。该提案涉及模型构建和模型分析。在MIDS的背景下，所提出的研究将提高现有模型构建算法的精度，解决隐私侵犯问题，并开发分析和改进模型的技术。

Infrastructures in critical domains such as medical, power, telecommunications, and finance depend on information systems. Therefore, attacks can have devastating affects on these critical infrastructures. Moreover, an increasing number of organizations are relying on commodity software. This trend can be attributed to increasing reliance on out-sourcing and commercial off-the-shelf (COTS) components. However, deploying commodity software poses significant risks because they can contain exploitable vulnerabilities and hidden malicious behavior. Combating malicious behavior in commodity software is especially challenging because its user only has access to the executable for the software. This proposal addresses the problem of combating malicious behavior in commodity software. The proposed tasks are applicable in the context of model-based intrusion detection systems (MIDS) which are a type of host-based intrusion detection system (HIDS) that monitor program execution using a model. There are three major areas in MIDS: model construction, enforcement, and model analysis. This proposal addresses model construction and model analysis. In the context of MIDS, the proposed research will improve precision of existing model-construction algorithms, tackle privacy violations, and develop techniques for analyzing and refining models.