DMCA
Profile-guided Automated Software Diversity
| Citations: | 13 - 3 self |
BibTeX
@MISC{Homescu_profile-guidedautomated,
author = {Andrei Homescu and Steven Neisius and Per Larsen and Stefan Brunthaler and Michael Franz},
title = {Profile-guided Automated Software Diversity},
year = {}
}
Share
 |
 |
 |
 |
||
OpenURL
Abstract
Code-reuse attacks are notoriously hard to defeat, and most current solutions to the problem focus on automated software diversity. This is a promising area of research, as diversity attacks the common denominator enabling code-reuse attacks—the software monoculture. Recent research in this area provides security, but at an unfortunate price: performance overhead. Leveraging previously collected profiling information, compilers can substantially improve subsequent code generation. Traditionally, profile-guided optimization focuses on hot program code, where a program spends most of its execution time. Optimizing rarely executed code does not significantly impact performance, so few optimizations focus on this code. We use profile-guided optimization to reduce the performance overhead of software diversity. The primary insight is that we are free to diversify cold code, but restrict our diversification efforts in hot code. Our work investigates the impact of profiling on an expensive diversification technique: NOP insertion. By differentiating between hot cold and cold code, we optimize NOP insertion overheads from a maximum of 25 % down to a negligible 1%, while preserving the security properties of the original defense. Consequently, using our profile-guided diversification technique, even randomization techniques having a high performance overhead become practical.
Keyphrases
profile-guided automated software diversity code-reuse attack profile-guided optimization cold code performance overhead hot program code promising area recent research impact performance automated software diversity common denominator software diversity current solution diversification effort unfortunate price profile-guided diversification technique nop insertion overhead nop insertion hot cold subsequent code generation software monoculture high performance security property expensive diversification technique original defense problem focus execution time primary insight hot code randomization technique
