TC: Small: Mining Operating System Semantics: Techniques and Applications

操作系统语义知识是许多安全应用的基础，包括虚拟机自省、恶意软件检测和分析、计算机取证等。然而，现有的操作系统语义提取技术还不够完善。它们对操作系统源代码执行静态分析，因此不能应用于封闭源代码操作系统。源代码分析还存在WYSINWYX(即，您看到的不是您执行的内容)问题。此外，所获得的语义知识很容易被各种核攻击所破坏。在这种不健全的基础上，这些安全应用的功能和可信性变得值得怀疑。为了巩固这一基础，PI旨在构建一个以二进制为中心的、用于提取操作系统语义的健壮分析框架。它是以二进制为中心的，因为它可以从操作系统内核的二进制代码中提取语义信息。从而解决了WYSINWYX问题，克服了封闭源代码操作系统的语义障碍。它是健壮的，因为它可以捕获操作系统级语义中的不变量。因此，可以从这些不变量中获取可信的语义知识，从而可以检测到各种伪造攻击。然后，在这个框架下，将进一步研究如何增强各种安全应用的功能和健壮性。拟议的任务将导致发布原型系统，并为本科生和研究生课程以及专业培训班编写教材。

The knowledge about operating system semantics is the foundation for many security applications, including virtual machine introspection, malware detection and analysis, computer forensics, etc. However, the existing techniques for extracting operating system semantics fall short. They perform static analysis on the OS source code, and thus cannot be applied to the closed-source operating systems. The source-code analysis also suffers from the WYSINWYX (i.e., What You See Is Not What You eXecute) problem. Furthermore, the obtained semantics knowledge can be easily compromised by various kernel attacks. With such an unsound foundation, the functionality and trustworthiness of these security applications become questionable.To fortify this foundation, the PI aims to build a binary-centric and robust analysis framework for extracting operating system semantics. It is binary-centric, because it can extract semantics information from the binary code of an OS kernel. Consequently, the WYSINWYX problem can be solved and the semantics barrier of closed-source operating systems can be overcome. It is robust, because it can capture the invariants in OS-level semantics. So trustworthy semantics knowledge can be derived from these invariants, and various forgery attacks can be detected. Then with this framework, further research will be conducted to investigate how the functionality and robustness of various security applications can be strengthen. The proposed tasks will lead to the release of prototype systems and the development of education materials for undergraduate and graduate courses and for professional training sessions.