• 主题
高级搜索  >
历史搜索 清空历史
首页> 外文会议>IEEE International Conference on Software Maintenance and Evolution >Composite Software Diversification
【24h】

Composite Software Diversification

机译：复合软件多样化

获取原文
页面导航
  • 摘要
  • 著录项
  • 相似文献
  • 相关主题

摘要

Many techniques of software vulnerability exploitation rely on deep and comprehensive analysis of vulnerable program binaries. If a copy of the vulnerable software is available to attackers, they can compose their attack scripts and payloads by studying the sample copy and launch attacks on other copies of the same software in deployment. By transforming software into different forms before deployment, software diversification is considered as an effective mitigation of attacks originated from malicious binary analyses.Essentially, developing a software diversification transformation is nontrivial because it has to preserve the original functionality, provide strong enough unpredictability, and introduce negligible cost. Enlightened by research in other areas, we seek to apply different diversification transformations to the same program for a synergy effect such that the resulting hybrid transformations can have boosted diversification effects with modest cost. We name this approach the composite software diversification.Although the concept is straightforward, it becomes challenging when searching for satisfactory compositions of primitive transformations that maximize the synergy effect and make a balance between effectiveness and cost. In this work, we undertake an in-depth study and develop a reasonably well working selection strategy to find a transformation composition that performs better than any single transformation used in the composition. We believe our work can provide guidelines for practitioners who would like to improve the design of diversification tools in the future.
机译：软件漏洞利用的许多技术依赖于对弱势计划二进制文件的深度和全面分析。如果攻击者可以使用漏洞软件的副本，可以通过在部署中的其他软件的其他副本上进行示例副本和启动攻击来撰写攻击脚本和有效载荷。通过将软件转换为不同的形式之前，软件多样化被认为是源自恶意二元分析的攻击的有效缓解。展示软件多样化转换是不动的，因为它必须保留原始功能，提供足够的不可预测性，并介绍了足够的不可预测性，并介绍可忽略不计的成本。在其他领域的研究中启发，我们寻求对同一程序应用不同的多样化转换，以实现协同效果，使得产生的混合变换可以以适度的成本提高多样化效果。我们命名这种方法复合软件多样化。虽然该概念很简单，但在寻找最大化协同效应的原始变换的令人满意的组合时，它变得具有挑战性，并在有效性和成本之间进行平衡。在这项工作中，我们进行了深入的研究，并开发了一个合理的工作选择策略，以找到比组合物中使用的任何单一转化更好的转化组合物。我们相信我们的工作可以为希望改进未来多样化工具设计的从业者提供指导方针。

著录项

相似文献

  • 外文文献
  • 中文文献
  • 专利
获取原文

客服邮箱：kefu@zhangqiaokeyan.com

京公网安备：11010802029741号 ICP备案号：京ICP备15016152号-6 六维联合信息科技 (北京) 有限公司©版权所有

  • 客服微信

  • 服务号