Citation Context

..., and manual processes. Techniques for automatically detecting software flaws include intrusion detection [8], model checking and lightweight static analyses [9], [10], and software diversity methods =-=[11]-=-, [12]. However, detecting a defect is only half of the story: Once identified, a bug must still be repaired. As the scale of software deployments and the frequency of defect reports increase [13], so...

Citation Context

...en widely instantiated in existing works, such as ASLR [9, 10, 45], instruction set randomization (ISR) [5], data randomization [8, 14, 21], OS interface randomization [19], and multi-variant systems =-=[11, 22, 47]-=-. Address Space Layout Randomization: ASLR is a practical technique that has been adopted by many modern OSes such as Windows and Linux. The goal of ASLR is to obscure the location of code and data ob...

Citation Context

...6-bits of randomness in some memory regions, can be defeated relatively quickly using guessing attacks [35]. As mentioned earlier, they are also susceptible to information leakage attacks. Cox et al. =-=[19]-=- and Bruschi et al. [11] have shown how process replication can be used to address these deficiencies, and hence provide deterministic (rather than probabilistic) defense against certain classes of me...

Citation Context

... layout rerandomization. Finally, randomization as a general form of diversification [26] has been proposed to execute multiple program variants in parallel and detect attacks from divergent behavior =-=[20, 62, 63]-=-. Operating system defenses. Prior work on OS defenses against memory exploits focuses on control-flow attacks. SecVisor [65] is a hypervisor-based solution which uses memory virtualization to enforce...

Citation Context

...ioning as well as another instance of the approach for defeating code injection by tagging instructions in different variants with different values and checking and removing the tags before execution =-=[16]-=-. Other researchers have developed other variations within similar frameworks: Bruschi et al. created a variation to thwart partial memory overwrites [9], and Franz created a variation using reverse s...

Citation Context

...nst code-reuse attacks. For example, ROPdefender [32] uses a shadow stack together with binary rewriting to validate each return target. DynIMA [10] instead leverages the characteristics of return-oriented programming of using short code sequences before “ret” to detect possible attacks. Return-less kernel instead using compiler-rewriting However, these approaches are ad-hoc in defending only a special class of code-reuse attack and most of them require rewrite either source code or binaries. Security Through Diversity: Security through running several diverse copies and comparing the results [33], [34] has been a useful technique to defend against a variant of attacks, by increasing the attacking difficulty in requiring understanding and attacking several copies simultaneously. When implementing purely in software, this usually means that the resource consumption will be increased by approximately the number of diverse copies. Hence, recent researchers exploit the architectural support and multicore hardware [35] to reduce the resource consumption and increase performance. Security Through Randomization: Randomizing the execution environments such as instruction sets [36], [37], and a...

Citation Context

...ted in previous sections. Diversity has also been explored for detecting specific malicious behavior. TightLip [36] runs a shadow process to detect the use of sensitive information. N-Variant Systems =-=[20]-=- aim to create general, deterministic variants with disjoint exploitation sets. The authors showed address space partitioning that detects attacks using absolute addresses and instruction set tagging....

Citation Context

...ndependently-designed replicas does not prevent an adversary from learning the different vulnerabilities of these replicas and compromising them one by one over time. Recent work on N-variant systems =-=[12]-=- uses multiple different copies of a program to vote on output. The diverse variants of the program are generated using obfuscators, but all are run by a trusted monitor (a potential high-leverage tar...