Lightweight Virtualization to Detect, React, and Adapt to Cyber Attacks

Many software defenses against reverse engineering, piracy, and tampering rely on disabling the software when such attacks are detected. The proposed research makes innovative use of proces-level software virtualization on a per-application basis to defeat such attacks without disabling the software. The virtualization technology keeps normal operational run time overhead low, invoking more expensive graded responses only after an attack is initially detected and defeated. The graded responses will be powerful enough to cope with determined nation-state attackers possessing powerful attack resources. The defenses can be thought of as a control system, in which sensors detect attacks and actuators provide graded responses to attacks. The architecture of the defensive system is extensible, permitting further research and development to add new sensors for additional attack classes of concern to the defense community (e.g. back doors and implanted Trojan horses).