Mechanisms for protecting software integrity in networked systems

摘要: Protecting software integrity is a key to successfully maintain its own credibility and reduce the financial technical risks caused from lack of integrity. Although researchers have been putting effort on improving development techniques preventing human errors during process, it still daunting task make non-vulnerable in practice. For example, national vulnerability database shows that set new vulnerabilities are discovered every day. Since developing hardly achievable, this research, we look for way achieve while they used. In particular, dissertation investigates three mechanisms protect at runtime. Firstly, presents protection mechanism can thwart attacks try exploit memory corruption software. The provided by randomizing program's runtime address layout objects. As result, hinders an attacker being able easily predict their target addresses. implemented novel binary rewriting tool randomly place code data segments programs perform fine-grained permutation function bodies segment as well global variables segment. Our evaluation results show minimal performance overhead with orders magnitude improvement randomness. Secondly, identification named CBones discover how unknown C exploited verifying program structural constraints. automatically extracts constraints via analysis compiled executable. CBone then verifies these monitors execution detect isolate security bugs. real-world applications known all no false alarms, pinpoint corrupting instructions, provide information facilitate understanding attack exploits bug. Lastly, identifies need dynamic attestation overcome limitations existing remote approaches. To best our knowledge, first introduce notion propose use system properties proof running system. validate idea, develop application-level ReDAS (Remote Dynamic Attestation System) verify provides evidence checking properties: These collected each application, representing application's unique behavior must be satisfied also uses hardware support TPM potential attacks. effective capturing violations zero demonstrates incurs 8% average performing measurements.