DMCA
SoK: Automated Software Diversity
Cached
Download Links
| Citations: | 21 - 3 self |
BibTeX
@MISC{Larsen_sok:automated,
author = {Per Larsen and Andrei Homescu and Stefan Brunthaler and Michael Franz},
title = {SoK: Automated Software Diversity},
year = {}
}
Share
 |
 |
 |
 |
||
OpenURL
Abstract
Abstract—The idea of automatic software diversity is at least two decades old. The deficiencies of currently deployed defenses and the transition to online software distribution (the “App store ” model) for traditional and mobile computers has revived the interest in automatic software diversity. Consequently, the literature on diversity grew by more than two dozen papers since 2008. Diversity offers several unique properties. Unlike other de-fenses, it introduces uncertainty in the target. Precise knowledge of the target software provides the underpinning for a wide range of attacks. This makes diversity a broad rather than narrowly focused defense mechanism. Second, diversity offers probabilistic protection similar to cryptography—attacks may succeed by chance so implementations must offer high entropy. Finally, the design space of diversifying program transformations is large. As a result, researchers have proposed multiple approaches to software diversity that vary with respect to threat models, security, performance, and practicality. In this paper, we systematically study the state-of-the-art in software diversity and highlight fundamental trade-offs between fully automated approaches. We also point to open areas and unresolved challenges. These include “hybrid solutions”, error reporting, patching, and implementation disclosure attacks on diversified software. I.
Keyphrases
software diversity automatic software diversity diversified software implementation disclosure attack high entropy threat model wide range design space mobile computer multiple approach unresolved challenge highlight fundamental trade-off target software error reporting several unique property software distribution hybrid solution diversity offer probabilistic protection program transformation app store model dozen paper focused defense mechanism precise knowledge
