SBIR Phase II: Making the Internet Safer One Website at a Time

这个小型企业创新研究第二阶段项目将开发一种新的安全能力，通过提供预防和早期诊断服务来保护网站免受黑客攻击。对黑客来说，破坏网站是一项新兴的有利可图的业务，由于这种攻击，会产生破坏性的影响：（a）直接损害受危害的网站，例如窃取存储的信用卡信息，（B）损害网站访问者，他们通过代码注入受到病毒感染或身份盗窃，这将合法网站变成恶意软件的分发者，以及（c）损害代码注入网站的声誉，不可避免地会被搜索引擎列入黑名单该项目将开发技术，以便：（a）评估网站的脆弱程度;（B）检测注入代码形式的安全漏洞;（c）加快恢复受损网站。 拟议的工作集中在三个关键目标：（a）通过最大限度地减少人工干预实现大规模可扩展性，（B）通过精心设计的软件-硬件架构实现鲁棒性和可扩展性，以及（c）持续的自我改进和性能评估过程。如果成功，拟议项目的影响可能是直接和直接的：它承诺使网站安全更实惠，而不是奢侈品或事后的想法。 网站安全是一个紧迫而昂贵的问题：（a）据估计，大多数网站（超过60%）都是脆弱的，（B）基于网络的恶意软件传播正在采取流行病的规模，（c）所有报告的74 M活跃网站都可能成为目标：从银行到本地cookie存储，最终，（d）根据政府的说法，网络犯罪是国家安全的头号威胁。 拟议的解决方案有可能在这四个领域中的每一个领域作出重大贡献。

This Small Business Innovation Research Phase II project will develop a novel security capability for protecting websites against hackers by providing preventive and early diagnosis services. Compromising websites is an emerging and profitable business for hackers, with devastating effects since such attacks: (a) hurt the compromised site directly, e.g. stealing stored credit card information, (b) hurt the website visitors, who are subjected to viruses infections or identity theft via code injection, which turns a legitimate website into a distributor of malware, and (c) hurt the reputation of the code-injected website, which is inevitably blacklisted by search engines. The project will develop the technology to: (a) assess the vulnerability level of a website, (b) detect security breaches in the form of code injection, and (c) expedite the recovery of a compromised website. the proposed work focuses on three key goals: (a) massive scalability through the minimization of manual intervention, (b) robustness and manageability by a carefully designed software-hardware architecture, and (c) continuous process of self-improvement and assessment of performance.If successful, the impact of the proposed project has the potential to be immediate and direct: it promises to make website security more affordable, and not a luxury or an afterthought. Website security is an immediate and expensive problem: (a) it is estimate that most websites (over 60%) are vulnerable, (b) web-based malware spreading is taking the dimensions of a pandemic, (c) all of the reported 74M active websites are likely targets: from banks, to the local cookie store, and ultimately, (d) cyber-crime is a top national security threat according to the government. The proposed solution has the potential to make significant contributions in each of these four areas.