CT-ISG: Automatic Generation of Vaccine Exploits to Protect Commodity Software

在生物学上，疫苗是一种被故意注射到体内以刺激抗体产生的减弱的病毒或细菌株。以这种方式产生的免疫力将在未来保护人体免受同类病毒的侵袭。受这一想法的启发，本研究旨在开发自动生成疫苗漏洞的技术，以检测和诊断商品软件中的漏洞，并通过特定漏洞的签名保护它们免受潜在漏洞的攻击。这种疫苗的一个例子是其跳转地址被扰乱的“弱化”缓冲区溢出利用：当试图劫持程序的控制流时，它会导致易受攻击的程序出现异常，法医分析可以从中发现潜在的漏洞。疫苗的想法提供了一种创新的途径，以解决软件安全漏洞构成的严重威胁，而软件安全漏洞从根本上阻碍了互联网的进步。该项目开发疫苗技术，以被动和主动的方式保护易受攻击的软件。反应性疫苗可以快速检测零日漏洞并生成签名，而不依赖源代码或二进制代码。该项目的重点是应用该技术来保护互联网服务。主动疫苗用于自动从软件补丁等来源发现软件漏洞，并创建试探性补救措施。这项技术甚至可以在攻击者发现漏洞之前及时保护易受攻击的软件。这项研究也为培养安全信息学领域的教育使命提供了一个很好的机会。

In biology, a vaccine is a weakened strain of viruses or bacteria which is intentionally injected into the body for the purpose of stimulating antibody production. The immunity generated in this way will protect the body from the same type of viruses in the future. Inspired by this idea, this research aims at developing techniques that automatically generate vaccine exploits to detect and diagnose vulnerabilities inside commodity software, and protect them from potential exploits through vulnerability-specific signatures. An example of such a vaccine is a "weakened" buffer-overflow exploit with its jump address scrambled: it causes an exception to a vulnerable program when attempting to hijack the program's control flow, from which a forensic analysis can uncover the underlying vulnerability.The idea of vaccines offers an innovative avenue to address the grave threat posed by software security flaws, which has been fundamentally hampering the progress of the Internet. This project develops vaccine techniques to protect vulnerable software in both reactive and proactive fashions. Reactive vaccines can quickly detect zero-day exploits and generate signatures without reliance on source or binary code. The project focuses on applying the technique to protect Internet services. Proactive vaccines are used for automatically discovering software vulnerabilities from the sources such as software patches and creating tentative remedies. This technique enables timely protection of vulnerable software even before the attacker can figure out an exploit. This research also provides a great opportunity to foster the education missions in the area of Security Informatics.