CT-T: Proactive Techniques for Preserving System Integrity: A Basis for Robust Defense Against Malware

网络威胁在过去十年中迅速升级。“零日攻击”已经变得非常重要，越来越多地通过网页、图像和文档等看似无害的手段进行。恶意软件非常猖獗，通过垃圾邮件、网络钓鱼、恶意共享软件和免费软件的组合被秘密安装在世界各地数百万台计算机上。今天的防御使用诸如基于签名的扫描和文件完整性监控等技术来检测恶意软件的存在，然后将其删除。不幸的是，聪明的对手可以迅速开发出隐藏自己的恶意软件，从而击败这些反应式防御。相比之下，这个项目将开发一种方法，大大提高对恶意软件的防御能力，并使计算机所有者重新控制攻击者。这种方法，基于综合和执行低层次的信息流属性从通用的高层次的政策，将被用来识别组件的计算机系统是至关重要的，其可信度，并保持其完整性。在这样做的过程中，该方法将使用户能够继续使用流行的操作系统、应用程序和附加软件，同时仍然确保系统安全。具体而言，该项目将开发技术来保护（a）操作系统和关键应用程序免受不可信代码或数据的影响，（B）关键应用程序免受模块和扩展（例如，浏览器插件和媒体播放器编解码器）在同一地址空间内运行，以及（c）操作系统内核免受损坏，由于不可信的内核扩展，如设备驱动程序。在更广泛的影响方面，这个项目将培训几个研究生，研究将被整合到PI的教学活动，最后，开发的解决方案将作为开源软件和/或工具分发。

Cyber threats have escalated rapidly over the past decade. "Zero-dayattacks" have become significant, delivered increasingly throughseemingly innocuous means such as web pages, images, and documents.Malware is rampant, being installed surreptitiously on millions ofcomputers around the world using a combination of spam, phishing,malicious shareware and freeware. Today's defenses use techniques such as signature-based scanning andfile integrity monitoring to detect the presence of malware, and thenremove them. Unfortunately, clever adversaries can quickly developmalware that conceals itself from these detection mechanisms, andhence defeat such reactive defenses. In contrast, this project willdevelop an approach that dramatically improves defenses againstmalware, and put a computer owner back in control over theattackers. This approach, based on synthesizing and enforcinglow-level information flow properties from generic high levelpolicies, will be used to identify components of a computer systemthat are critical for its trustworthiness, and preserve theirintegrity. In doing so, the approach will enable users to continue touse popular operating systems, applications, and add-on software, while stillassuring system security.Specifically, this project will develop techniques to protect (a) the OSand critical applications from untrusted code or data, (b) criticalapplications from modules and extensions (e.g., browser plug-ins and mediaplayer codecs) that run within the same address space, and (c) the OS kernelfrom damage due to untrusted kernel extensions such as device drivers.In terms of broader impact, this project will train several graduatestudents, the research will be integrated into the teaching activities ofthe PIs, and finally, the solutions developed will be distributed asopen-source software and/or tools.