CT-T: Proactive Techniques for Preserving System Integrity: A Basis for Robust Defense Against Malware

CT-T：保护系统完整性的主动技术：强大防御恶意软件的基础

• 批准号: 0831298
• 负责人: Ramasubramanian Sekar
• 金额: $ 100万
• 依托单位: SUNY at Stony Brook
• 依托单位国家: 美国
• 项目类别: Continuing Grant
• 财政年份: 2008
• 资助国家: 美国
• 起止时间: 2008-09-01 至 2015-08-31
• 项目状态: 已结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=0831298&HistoricalAwards=false
• 关键词: CT; Proactive; Techniques; Preserving; System

Cyber threats have escalated rapidly over the past decade. "Zero-dayattacks" have become significant, delivered increasingly throughseemingly innocuous means such as web pages, images, and documents.Malware is rampant, being installed surreptitiously on millions ofcomputers around the world using a combination of spam, phishing,malicious shareware and freeware. Today's defenses use techniques such as signature-based scanning andfile integrity monitoring to detect the presence of malware, and thenremove them. Unfortunately, clever adversaries can quickly developmalware that conceals itself from these detection mechanisms, andhence defeat such reactive defenses. In contrast, this project willdevelop an approach that dramatically improves defenses againstmalware, and put a computer owner back in control over theattackers. This approach, based on synthesizing and enforcinglow-level information flow properties from generic high levelpolicies, will be used to identify components of a computer systemthat are critical for its trustworthiness, and preserve theirintegrity. In doing so, the approach will enable users to continue touse popular operating systems, applications, and add-on software, while stillassuring system security.Specifically, this project will develop techniques to protect (a) the OSand critical applications from untrusted code or data, (b) criticalapplications from modules and extensions (e.g., browser plug-ins and mediaplayer codecs) that run within the same address space, and (c) the OS kernelfrom damage due to untrusted kernel extensions such as device drivers.In terms of broader impact, this project will train several graduatestudents, the research will be integrated into the teaching activities ofthe PIs, and finally, the solutions developed will be distributed asopen-source software and/or tools.

过去十年来，网络威胁迅速升级。 “零日攻击”变得越来越严重，越来越多地通过网页、图像和文档等看似无害的方式进行。恶意软件猖獗，通过垃圾邮件、网络钓鱼、恶意共享软件和免费软件的组合，秘密安装在世界各地数百万台计算机上。当今的防御使用基于签名的扫描和文件完整性监控等技术来检测恶意软件的存在，然后将其删除。不幸的是，聪明的对手可以快速开发出隐藏在这些检测机制之外的恶意软件，从而击败这种反应性防御。相比之下，该项目将开发一种方法，显着提高对恶意软件的防御能力，并使计算机所有者重新控制攻击者。这种方法基于从通用高级策略中综合和执行低级信息流属性，将用于识别对其可信度至关重要的计算机系统组件，并保持其完整性。在此过程中，该方法将使用户能够继续使用流行的操作系统、应用程序和附加软件，同时仍然确保系统安全。具体来说，该项目将开发技术来保护 (a) 操作系统和关键应用程序免受不受信任的代码或数据的影响，(b) 来自在同一地址空间内运行的模块和扩展（例如浏览器插件和媒体播放器编解码器）的关键应用程序，以及 (c) 操作系统内核免受由于不受信任的内核扩展（例如设备）造成的损坏就更广泛的影响而言，该项目将培训几名研究生，研究将融入PI的教学活动中，最后，开发的解决方案将作为开源软件和/或工具分发。