Subverting adversarial attribution

当恶意软件攻击的威胁成为你的首要任务时，一切都变了。最近的网络攻击对医疗、金融和国防等关键部门造成了严重后果。恶意软件已经成为这些攻击的终极工具。2016年，恶意软件导致了乌克兰的电网停电。2017年，英国多家医院遭到勒索软件攻击，要求支付解锁医院IT系统的费用。自适应的、破坏性的、不断进化的恶意软件避开了我们的传统防御。攻击者比以往任何时候都更多地使用混淆技术来伪装自己的身份，并使用恶意代码使其难以检测、分析或理解。我们研究的长期目标是设计和开发用于识别、理解、评估和中和软件中的混淆防御的有效和有弹性的技术。这不仅会给我们提供更有效的软件保护工具，而且还会极大地增强我们对对抗行为的理解。

Everything changes when a threat of malware attack becomes your number one priority. Recent cyberattacks have caused severe consequences in critical sectors including healthcare, the financial industry, and national defense. Malicious software, or malware, has become an ultimate tool in these attacks. In 2016, malware was responsible for Ukraine's power grid blackout. In 2017, hospitals across UK were hit with a ransomware attack demanding payment for unlocking the hospital's IT systems. Adaptive, destructive, and constantly evolving, malware evades our traditional defenses. More than ever adversaries use obfuscation techniques to disguise their identity, and their malicious code to make it hard to detect, analyze or understand. The long-term goal of our research is to design and develop efficient and resilient techniques for identifying, understanding, evaluating and neutralizing obfuscation defenses in software. This will not only give us more effective software protection tools, but will also greatly enhance our understanding of adversarial behavior.