SaTC: CORE: Medium: Collaborative: Taming Web Content Through Automated Reduction in Browser Functionality

SaTC：核心：媒介：协作：通过自动减少浏览器功能来驯服 Web 内容

• 批准号: 1703454
• 负责人: Engin Kirda
• 金额: $ 38.71万
• 依托单位: Northeastern University
• 依托单位国家: 美国
• 项目类别: Standard Grant
• 财政年份: 2017
• 资助国家: 美国
• 起止时间: 2017-09-01 至 2022-02-28
• 项目状态: 已结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=1703454&HistoricalAwards=false
• 关键词: SaTC; CORE; Medium; Collaborative; Taming

Web-based applications executed via web browsers are ubiquitous in everyday life. They underlie our banking, communications, shopping, social networking, tax payments, insurance transactions, and health care interactions. Unfortunately, malicious actors can take advantage of vulnerabilities in web browsers to exploit the user's computer. The consequences of a web browser attack can be severe: web content can execute arbitrary code on the victim's machine. This research project studies how web applications use the features provided by web browsers and how user systems can be protected by restricting unnecessary browser features.This project addresses web browser security by reducing the browser feature footprint, thereby reducing the browser attack surface and mitigating many classes of attacks. The researchers are building a feature-instrumented browser that reports what functionality is used by a web application. Then, they leverage that information to automatically identify when web applications diverge from their expected behavior and attack the user's browser. To enable users to use the most up-to-date browsers, while protecting them from unnecessary and risky browser features, the research team is building a system to decouple features from the browser.

通过网络浏览器执行的基于网络的应用程序在日常生活中无处不在。 它们是我们银行、通信、购物、社交网络、纳税、保险交易和医疗保健互动的基础。不幸的是，恶意行为者可以利用网络浏览器中的漏洞来攻击用户的计算机。 Web 浏览器攻击的后果可能很严重：Web 内容可以在受害者的计算机上执行任意代码。该研究项目研究 Web 应用程序如何使用 Web 浏览器提供的功能，以及如何通过限制不必要的浏览器功能来保护用户系统。该项目通过减少浏览器功能占用空间来解决 Web 浏览器安全问题，从而减少浏览器攻击面并缓解许多类别的攻击的攻击。研究人员正在构建一个功能仪表化的浏览器，用于报告 Web 应用程序使用了哪些功能。然后，他们利用该信息自动识别 Web 应用程序何时偏离其预期行为并攻击用户的浏览器。为了使用户能够使用最新的浏览器，同时保护他们免受不必要和有风险的浏览器功能的影响，研究团队正在构建一个系统，将功能与浏览器分离。