TWC: Medium: Collaborative Proposal: Safety in Numbers: Crowdsourcing for Global Software Integrity

最近恶意软件的激增带来了财务、隐私和安全风险。这个项目探索了一种全新的恶意软件检测方法，它有望比现有的工具更快、更有效、更便宜。恶意软件或恶意软件的演变，已经看到了恶意软件的能力和绝对数量的增加。最近的恶意软件利用了许多复杂的技术，包括多态性、公钥加密和点对点架构。这些进步是由犯罪企业和国家在恶意软件开发上投入的大量资源推动的。传统的恶意软件检测工具依赖于缓慢的手动过程，而恶意软件的最新进展已经超出了现有工具的应对能力。该项目采用了一种新的方法来解决恶意软件危机，该方法以建设性地使用众包为中心。关键的见解是，互联网上的机器集合包含可用于自动将软件分类为合法或恶意的信息。这些信息不仅包括单个机器上恶意软件的行为，还包括总体群体的行为。例如，软件如何在网络上传播的汇总统计数据可以提供对软件是否恶意的洞察。提出的工作的一个关键组成部分是基于二进制翻译的动态签名。传统的恶意软件检测工具使用静态签名，但多态技术使这种方法变得更加困难。该项目使用二进制翻译来有效地收集代码执行和行为事件（如网络通信）的动态跟踪，然后为这些跟踪生成签名。该项目显著减少了恶意软件对社会的威胁，特别是因为通过该项目开发的软件是免费的。该项目正在指导未被充分代表的少数民族成员，并将其理念融入课程。

The recent explosion in malware poses financial, privacy, and safety risks. This project explores a fundamentally new approach to malware detection that promises to be faster, more effective, and cheaper than current tools.The evolution of malicious software, or malware, has seen increases in both malware's capabilities and sheer volume. Recent malware makes use of a number of sophisticated technologies including polymorphism, public key encryption, and peer-to-peer architectures. These advances are driven by significant resources put into malware development by both criminal enterprises and countries. Traditional malware detection tools rely on slow manual processes and the recent advances in malware have outrun the ability of existing tools to cope.This project uses a new approach to the malware crisis that centers around constructive use of crowd-sourcing. The key insight is that the collection of machines on the Internet contains information that can be used to automatically classify software as either legitimate or malicious. This information includes not only the behavior of malware on individual machines but also the behavior of the aggregate population. For example, the aggregate statistics of how software propagates across the network can provide insight into whether the software is malicious.A key component of the proposed work is binary translation-based dynamic signatures. Traditional malware detection tools have used static signatures, but polymorphic techniques have made this approach significantly more difficult. The project employs binary translation to efficiently collect dynamic traces for both code execution and behavioral events such as network communication and then generate signatures for these traces.The project significantly reduces the threats of malware to society, especially since software developed through the project is freely available. The project is mentoring members of underrepresented minorities, and is infusing its ideas into the curriculum.