TC: Medium: Collaborative Research: Multi-Perspective Bayesian Learning for Automated Diagnosis of Advanced Malware

当代互联网恶意软件正在不断演变，使反病毒和入侵检测系统日益过时。简单地依靠二进制签名来识别恶意软件不再是可以接受的。当前和未来一代的恶意软件都需要全新的检测策略，能够容忍二进制结构和有效负载传递机制中的快速扰动。实现这一目标的一个有希望的方向是使用多角度、面向行为的范例来识别恶意软件。在这个项目中，我们提出了一种新的方法，1)基于多角度、面向行为的观点自动提取感染知识，2)快速应用所获得的知识来诊断主机系统中是否存在恶意软件。对于每个恶意软件系列，将自动提取概率配置文件，该配置文件捕获其成员的不变行为特征。这个设想的知识提取过程应该在其不变行为描述中提供足够的抽象性，以便可以识别未来的恶意软件变体。我们还提出了一个贝叶斯框架，用于诊断现场计算机系统上的实时恶意软件感染。如果成功，这项研究将引入一种新的补充策略，用于诊断恶意软件感染，其方式是当前的一套反病毒对策无法击败的。

Contemporary Internet malware is constantly evolving and making antivirus and intrusion detection systems increasingly obsolete. It is no longer acceptable to simply rely on binary signatures for malware identification. Both current and future generations of malware will require entirely new detection strategies that can tolerate the rapid perturbations in binary structure and payload delivery mechanisms. A promising direction to this end is the use of multi-perspective, behavioral-oriented paradigms for malware identification. In this project, we propose a new approach to 1) automatically extract infection knowledge, based on a multi-perspective, behavior-oriented view, and 2) rapidly apply this gained knowledge to diagnose the presence of malware in host computer systems. For each malware family, a probabilistic profile will be automatically extracted, which captures the invariant behavioral features of its members. This envisioned knowledge-extraction process should provide sufficient abstraction in its invariant behavior characterization such that future malware variants can be recognized. We also propose a Bayesian framework for diagnosing live malware infections on fielded computer systems. If successful, this research will introduce a new complementary strategy for diagnosing malware infections in ways that cannot be defeated through the current suite of antivirus countermeasures.