...
  • 主题
高级搜索  >
历史搜索 清空历史
首页> 外文期刊>Dependable and Secure Computing, IEEE Transactions on >Runtime Defense against Code Injection Attacks Using Replicated Execution
【24h】

Runtime Defense against Code Injection Attacks Using Replicated Execution

机译：使用复制执行的代码注入攻击的运行时防御

获取原文
获取原文并翻译 | 示例
           
页面导航
  • 摘要
  • 著录项
  • 相似文献
  • 相关主题

摘要

The number and complexity of attacks on computer systems are increasing. This growth necessitates proper defense mechanisms. Intrusion detection systems play an important role in detecting and disrupting attacks before they can compromise software. Multivariant execution is an intrusion detection mechanism that executes several slightly different versions, called variants, of the same program in lockstep. The variants are built to have identical behavior under normal execution conditions. However, when the variants are under attack, there are detectable differences in their execution behavior. At runtime, a monitor compares the behavior of the variants at certain synchronization points and raises an alarm when a discrepancy is detected. We present a monitoring mechanism that does not need any kernel privileges to supervise the variants. Many sources of inconsistencies, including asynchronous signals and scheduling of multithreaded or multiprocess applications, can cause divergence in behavior of variants. These divergences cause false alarms. We provide solutions to remove these false alarms. Our experiments show that the multivariant execution technique is effective in detecting and preventing code injection attacks. The empirical results demonstrate that dual-variant execution has on average 17 percent performance overhead when deployed on multicore processors.
机译：对计算机系统的攻击的数量和复杂性正在增加。这种增长需要适当的防御机制。入侵检测系统在破坏软件之前，在检测和破坏攻击方面起着重要作用。多变量执行是一种入侵检测机制，可以按步执行同一程序的几个略有不同的版本（称为变体）。这些变体被构建为在正常执行条件下具有相同的行为。但是，当变体受到攻击时，它们的执行行为存在可检测到的差异。在运行时，监视器会比较某些同步点上变量的行为，并在检测到差异时发出警报。我们提出了一种监视机制，该机制不需要任何内核特权即可监督变体。许多不一致的来源，包括异步信号和多线程或多进程应用程序的调度，都可能导致变量行为的差异。这些差异会导致错误警报。我们提供消除这些错误警报的解决方案。我们的实验表明，多变量执行技术可有效检测和防止代码注入攻击。实证结果表明，在多核处理器上部署时，双变量执行平均具有17％的性能开销。

著录项

相似文献

  • 外文文献
  • 中文文献
  • 专利
获取原文

客服邮箱：kefu@zhangqiaokeyan.com

京公网安备：11010802029741号 ICP备案号：京ICP备15016152号-6 六维联合信息科技 (北京) 有限公司©版权所有

  • 客服微信

  • 服务号