SGER: Malware Immunization through Deterrence and Diversion

提案编号：0650386PI：卓青莫利毛研究所：密歇根大学标题：SGER：通过威慑和转移进行恶意软件免疫摘要该提案解决了应对越来越智能的蠕虫的重要问题，这些蠕虫正开始由攻击者发起，并可能在不久的将来变得更加流行。这项研究将设计和实施一类基于欺骗的方案，以阻止恶意软件感染，并使主机免受试图躲避检测的智能蠕虫的攻击；这种蠕虫被称为“潜行”。该提案认为，基于指纹的轻量级欺骗是将常规宿主伪装成蜜罐系统的一种方式，而这种系统是蠕虫试图避免的。该提案还解决了创建假指纹的问题，使主机运行在操作系统上，其服务并不是恶意软件的诱人目标。威慑是将探索的另一种密切相关的技术，例如，以资源限制和反定性的形式，使蠕虫对本应具有吸引力的目标失去兴趣。这项工作将专注于多态和躲避蠕虫，这类蠕虫很可能很快就会出现。关键思想是欺骗这些躲避蠕虫，让他们认为它们正在被它们想要避免的检测算法主动检查。通过考虑模拟隐形蠕虫想要逃避的环境，所提出的蠕虫防御系统将防止许多隐形蠕虫感染重要主机，这是第一项旨在利用隐形蠕虫的躲避性质使其自我中和的工作。

Proposal Number: 0650386PI: Zhuoqing Morley Mao Institution: University of Michigan Title: SGER: Malware Immunization through Deterrence and Diversion AbstractThis proposal addresses the important problem of coping with the ever more intelligent worms that are beginning to be launched by attackers and that are likely to become much more prevalent in the near future. The research will design and implement a class of deception-based schemes to deter malware infection and immunize hosts against smart worms that attempt to avoid detection; such worms are called "stealthy." The proposal identifies light-weight fingerprinting-based deception as a way to disguise regular hosts as honeypot systems, the kind of systems that worms attempt to avoid. The proposal also addresses the creation of fake fingerprints to make hosts run on OSes with services that are not attractive targets for malware. Deterrence is another closely related technique that will be explored, for example in the form of resource restriction and counter-characterization to make what should be attractive targets uninteresting to worms. The work will focus on polymorphic and evasive worms, the kind that are likely to appear soon.The key idea is to trick those evasive worms into thinking they are being actively checked by detection algorithms they want to avoid. By deliberating imitating the environments that stealthy worms want to evade, the proposed worm defense system will prevent many stealthy worms from infecting important hosts.This is the first work aimed at exploiting the evasive nature of stealthy worms so that such worms will neutralize themselves.