TC: Small: Reducing Virus Propagation in Mobile Devices

由于其编码中的漏洞，移动计算机系统和软件日益受到大量安全威胁和恶意软件(恶意软件)的攻击。由于缺乏经验的用户的普遍存在以及对第三方软件集成的日益依赖，使诸如网络浏览器和搜索引擎等用户应用程序的软件模块插件能够实现，进一步加剧了实现安全系统的困难。传统方法试图通过修补软件漏洞或检测和阻止恶意软件来提供对特定恶意软件攻击的绝对防御。用于小型移动平台的这些方法的一个困难是，这些设备上的设计限制通常倾向于低功耗以最大化电池寿命，而不是增强对安全协议的支持。目前的情况也代表了修补现有漏洞和利用新应用程序代码中的漏洞之间的程序性军备竞赛。该研究开发了一种基于当前移动技术的新的安全移动计算环境，该环境作为消费者终端产品广泛使用，寻求在存在软件漏洞时利用程序差异化来降低恶意软件的传播速度。这不是直接消除安全漏洞，而是大幅缩小了任何利用安全漏洞感染大量系统的范围。通过将疫情仅限于少数几个系统，可以在造成重大经济损失之前采取应对措施。通过修改应用程序的执行方面，可以将应用程序可执行文件置换为每个分布式实例的唯一版本。使用硬件和/或系统软件修改来实现差异化。不同的领域包括函数调用/返回和系统调用语义，以及硬件支持的指令寄存器堆访问和入侵检测监控的建议。对可执行文件的区分阻碍了对漏洞的分析，并防止利用单个分布式版本中的漏洞传播到该应用程序的其他实例。除了传统的绝对防御外，我们还着眼于防止恶意软件的传播，以使恶意软件的经济变得昂贵和不可行。这种方法比一些传统的安全方法更可行，因为它可以很容易地应用于移动系统有限的性能和加密技术出口的法律限制。有关该项目的更多信息和软件分发，请访问：http://www.cs.fsu.edu/~tyson/differentiation.。

Mobile computer systems and software are increasingly subject to a host of security threats and malicious software (malware) attacks due to vulnerabilities in their coding. The difficulty in achieving secure systems is further compounded by prevalence of unsophisticated users and the increasing reliance on third party software integration by enabling software module plugins for such user applications as web browsers and search engines. Traditional approaches have sought to provide an absolute defense to specific malware attacks by patching software vulnerabilities or detecting and blocking malware. One difficulty with these approaches for small mobile platforms is that the design constraints on these devices often favor low power to maximize battery life over enhancements to support security protocols. The current situation also represents a programmatic arms race between patching existing vulnerabilities and exploiting vulnerabilities in new application code. This research develops a new secure mobile computing environment based on current mobile technology widely available as consumer end products that seeks to use program differentiation to reduce the propagation rate of malware when a software vulnerability exists. This results not in the direct elimination of security vulnerabilities, but in the dramatic reduction in scope of any security exploit to infect large numbers of systems. By constraining the outbreak to only a few systems, counter measures can be employed before significant economic damage can result. By modifying aspects of the execution of the application, application executables can be permuted into unique versions for each distributed instance. Differentiation is achieved using hardware and/or systems software modifications. Areas of differentiation include function call/return and system call semantics, as well as a proposal for hardware-supported Instruction Register File access and intrusion detection monitoring. Differentiation of executables hinders analysis for vulnerabilities as well as prevents the exploitation of a vulnerability in a single distributed version from propagating to other instances of that application. By focusing on prevention of malware propagation in addition to traditional absolute defenses, we target the economics of malware in order to make attacks prohibitively expensive and infeasible.This approach can be more feasible than some conventional security approaches since it can be readily applied to the restricted performance capabilities of mobile systems and the legal constraints on the export of encryption technology. Further information and software distribution related to this project can be accessed at: http://www.cs.fsu.edu/~tyson/differentiation.