CAREER: Exo-Core: An Architecture to Detect Malware as Computational Anomalies

在巨大数据中心支持的数十亿移动设备上运行的应用程序有望实现个人的、永远在线的医疗保健、智能车辆和家庭，从而实现更健康、更高效的社会。通过保护应用程序的完整性和保密它们的数据来确保这些应用程序的安全是可行的。然而，如今的恶意程序(“恶意软件”)可以通过在移动设备上模拟有益进程或通过共享数据中心服务器上的硬件攻击受害进程来破坏最好的软件级防御。应对这种智能恶意软件需要计算机系统的硬件-软件组织方面的根本进步。这里研究项目背后的关键观察是，虽然看起来截然不同，但智能恶意软件依赖于向操作系统级别的监视器隐藏其硬件级别的行为。通过将指令级和微体系结构行为暴露给软件分析，提出的外核体系结构实现了一类新的恶意软件检测器。此外，Exo-core还引入了可编程硬件加速器，将运行时程序轨迹合成为稳健的良性程序模型。该项目还将把计算机安全硬件-软件基础的研究整合到为本科生开设的新的为期两学期的研究课程中。

Applications that run on billions of mobile devices backed by enormousdatacenters hold the promise of personal, always-on healthcare; of intelligentvehicles and homes; and thus of a healthier, more efficient society. It isimperative to make such applications secure by protecting their integrity andkeeping their data confidential. However, malicious programs (``malware'')today can subvert the best software-level defenses by impersonating benignprocesses on mobile devices or by attacking victim processes through thehardware on shared datacenter servers. Grappling with such intelligent malwarerequires fundamental advances in the hardware-software organization of computersystems.The key observation behind the research project here is that, while seeminglydisparate, intelligent malware relies on hiding its hardware-level behaviorsfrom operating system-level monitors. By exposing instruction-level andmicro-architectural behaviors to software analysis, the proposed Exo-corearchitecture enables a new class of malware detectors. In addition, Exo-coreintroduces programmable hardware accelerators to synthesize run-time programtraces into robust models of benign programs. The project will alsointegrate research in hardware-software foundations of computer securityinto a new two-semester research course for undergraduate students.