Thinking Ahead: A Proactive Approach for Countering Future Internet Malware

安德烈亚斯·特兹《向前看：一种主动应对未来互联网恶意软件的方法》约翰·霍普金斯大学摘要恶意软件继续对互联网构成最严重的威胁之一。虽然现有的研究努力正在产生有希望的防御措施来对抗当今的威胁，但随着攻击者变得越来越精明，情况正在迅速变化。在这个项目中，我们不是盲目地遵循当前的做法，即防御跟踪恶意软件的进步，而是应用第一原理方法来处理互联网感染。具体地说，我们探索了广泛的网络系统，包括企业网络和新兴的无线和移动网络，并检查了针对这些网络的潜在致命攻击策略的清单。我们探索的攻击比当前的感染策略更快、更隐蔽或更致命。此外，它们都具有令人印象深刻的现有防御系统的特点。这个项目的目标是开发分析模型来捕获此类恶意软件的独特行为，并使用这些模型来更好地了解正在出现的威胁。有了这些知识，我们探索了新的防御措施，包括伪装的响应器，对躲避攻击的弹性，以及能够跟踪移动感染的分布式移动网络监控器。我们完全预计，这项研究的结果将为如何保护未来的网络体系结构免受新出现的威胁提供指导。

Andreas TerzisThinking Ahead: A Proactive approach for countering future Internet malwareJohns Hopkins University0627611 AbstractMalware continues to pose one of the gravest threats to the Internet.While existing research efforts are producing promising defenses tocounter today's threats, the landscape is rapidly changing asattackers become increasingly savvy. In this project, rather thanblindly following the current practice in which defenses trail malwareadvances, we apply a first principles approach to Internetinfection. Specifically, we explore a wide range of networked systems,including corporate networks and emerging wireless and mobilenetworks, and examine a list of potentially crippling attackstrategies against these networks. The attacks we explore are faster,stealthier, or more virulent than current infectionstrategies. Moreover, they all share the characteristic ofoverwhelming existing defenses. The goals of this project are todevelop analytical models that capture the unique behavior of suchmalware, and to use these models to gain a better understanding ofemerging threats. Armed with this knowledge, we explore novel defensesthat include camouflaged responders resilient to evasive attacks anddistributed mobile network monitors capable of tracking mobileinfections. We fully anticipate that results from this research willprovide guidelines on how to secure future network architecturesagainst emerging threats.