基于gadget特征分析的软件多样性评估方法

谢根琳; 程国振; 王亚文; 王庆丰

doi:10.11959/j.issn.2096-109x.2023047

您当前的位置：

首页 >

文章列表页 >

基于gadget特征分析的软件多样性评估方法

学术论文 | 更新时间：2024-06-03

- 基于gadget特征分析的软件多样性评估方法
- Software diversity evaluating method based on gadget feature analysis
- 网络与信息安全学报 2023年9卷第3期页码：161-173
- 作者机构：
- 作者简介：
  
  [ "谢根琳（1999- ），男，河北辛集人，信息工程大学硕士生，主要研究方向为网络空间安全和软件多样化" ]
  [ "程国振（1986- ），男，山东菏泽人，信息工程大学副教授，主要研究方向为网络空间安全、云安全" ]
  [ "王亚文（1990- ），男，河南郑州人，信息工程大学助理研究员，主要研究方向为拟态防御和云计算" ]
  [ "王庆丰（1994- ），男，河南南阳人，信息工程大学助理研究员，主要研究方向为拟态防御和软件多样化" ]
- 基金信息：
  
  国家重点研发计划;The National Key R＆D Program of China(2021YFB1006200);国家重点研发计划;The National Key R＆D Program of China(2021YFB1006201);国家自然科学基金;The National Natural Science Foundation of China(62072467)
- DOI：10.11959/j.issn.2096-109x.2023047
  中图分类号： TP309
- 网络首发：2023-06，
  
  纸质出版：2023-06-25
- 稿件说明：
移动端阅览
谢根琳, 程国振, 王亚文, 等. 基于gadget特征分析的软件多样性评估方法[J]. 网络与信息安全学报, 2023,9(3):161-173.

Genlin XIE, Guozhen CHENG, Yawen WANG, et al. Software diversity evaluating method based on gadget feature analysis[J]. Chinese Journal of Network and Information Security, 2023, 9(3): 161-173.
谢根琳, 程国振, 王亚文, 等. 基于gadget特征分析的软件多样性评估方法[J]. 网络与信息安全学报, 2023,9(3):161-173. DOI： 10.11959/j.issn.2096-109x.2023047.

Genlin XIE, Guozhen CHENG, Yawen WANG, et al. Software diversity evaluating method based on gadget feature analysis[J]. Chinese Journal of Network and Information Security, 2023, 9(3): 161-173. DOI： 10.11959/j.issn.2096-109x.2023047.

摘要

软件多样性能够有效提升系统弹性和安全性，广泛应用于软件分发、操作系统等场景，但现有软件多样性评估方法普遍基于常规代码特征进行度量且较为单一，难以准确反映软件多样性带来的安全增益。针对此问题，以ROP（return-oriented programming）攻击视角出发，通过分析软件多样性对代码重用攻击过程中各阶段的影响，提出了一种综合 gadget 质量、实用性和分布指标的软件多样性评估方法，通过度量软件多样性对构建gadget攻击链的难度、攻击者潜在可获得的计算能力和攻击者在不同变体中搜索gadget成本的影响程度对其进行安全性评估。利用不同粒度的多样化技术进行实验，结果表明，所提方法能够准确全面地反映软件多样性带来的安全增益，细粒度的多样化技术能使软件中大量的 gadget 重定位/修改/移除，增加攻击软件变体的成本，但部分多样化技术会导致不同程度的软件膨胀等问题。最后，依据不同度量指标下得到的结果对现有软件多样化技术的优势与不足进行分析和讨论。

Abstract

Software diversity is commonly utilized in scenarios such as software distribution and operating systems to improves system resilience and security.However

existing software diversity evaluation methods are typically based on conventional code features and are relatively limited in scope

which can make it difficult to accurately reflect the security benefits of software diversity.To address this issue

a software diversity evaluation method was proposed from the perspective of ROP attack by analyzing the impact of software diversity on the difficulty of building a gadget attack chain

the attacker’s potentially available computing power

and the attacker’s cost of searching for gadgets in different variants.Metrics for the quality

practicability

and distribution of gadgets were integrated into this method.Testing was conducted using diversity technologies with different granularity.The evaluation results showed that the proposed method could accurately and comprehensively reflect the security gain brought by software diversity.It was observed that software diversity could relocate/modify/delete a large number of gadgets in the software

increasing the cost of attacking different software variants but also leading to different degrees of software expansion.Finally

an analysis and discussion of the advantages and disadvantages of existing diversity techniques were conducted based on the experimental results.

关键词

Keywords

references

BIRMAN K P , SCHNEIDER F B . The monoculture risk put into context [J ] . IEEE Security ＆ Privacy , 2009 , 7 ( 1 ): 14 - 17 .

SHACHAM H . The geometry of innocent flesh on the bone:return-into-libc without function calls (on the x86) [C ] // Proceedings of the 14th ACM Conference on Computer and Communications Security . 2007 : 552 - 561 .

CARLINI N , WAGNER D . ROP is still dangerous:breaking modern defenses [C ] // Proceedings of 23rd USENIX Security Symposium (USENIX Security 14) . 2014 : 385 - 399 .

CHECKOWAY S , DAVI L , DMITRIENKO A , et al . Return-oriented programming without returns [C ] // Proceedings of the 17th ACM Conference on Computer and Communications Security- CCS '10 . 2010 : 559 - 572 .

SNOW K Z , MONROSE F , DAVI L , et al . Just-in-time code reuse:on the effectiveness of fine-grained address space layout randomization [C ] // Proceedings of 2013 IEEE Symposium on Security and Privacy . 2013 : 574 - 588 .

LARSEN P , HOMESCU A , BRUNTHALER S , et al . SoK:automated software diversity [C ] // Proceedings of 2014 IEEE Symposium on Security and Privacy . 2014 : 276 - 291 .

BAUDRY B , MONPERRUS M . The multiple facets of software diversity [J ] . ACM Computing Surveys , 2015 , 48 ( 1 ): 1 - 26 .

PAX T . PaX address space layout randomization (ASLR) [R ] . 2003 .

CRANE S , LIEBCHEN C , HOMESCU A , et al . Readactor:practical code randomization resilient to memory disclosure [C ] // Proceedings of 2015 IEEE Symposium on Security and Privacy . 2015 : 763 - 780 .

YAO D D , SHU X K , CHENG L , et al . Anomaly detection as a service:challenges,advances,and opportunities [J ] . Synthesis Lectures on Information Security,Privacy,and Trust , 2017 , 9 ( 3 ): 1 - 173 .

GRIER C , BALLARD L , CABALLERO J , et al . Manufacturing compromise:the emergence of exploit-as-a-service [C ] // Proceedings of the 2012 ACM Conference on Computer and Communications Security . 2012 : 821 - 832 .

GEARHART A S , HAMILTON P A , COFFMAN J . An analysis of automated software diversity using unstructured text analytics [C ] // Proceedings of 2018 48th Annual IEEE/IFIP International Conference on Dependable Systems and Networks Workshops (DSN-W) . 2018 : 79 - 80 .

LE Q , MIKOLOV T . Distributed representations of sentences and documents [C ] // Proceedings of International Conference on Machine Learning . 2014 : 1188 - 1196 .

COFFMAN J , KELLY D M , WELLONS C C , et al . ROP gadget prevalence and survival under compiler-based binary diversification schemes [C ] // Proceedings of the 2016 ACM Workshop on Software PROtection . 2016 : 15 - 26 .

HOMESCU A , NEISIUS S , LARSEN P , et al . Profile-guided automated software diversity [C ] // Proceedings of the 2013 IEEE/ACM International Symposium on Code Generation and Optimization (CGO) . 2013 : 1 - 11 .

熊浩 , 晏海华 , 郭涛 , 等 . 代码相似性检测技术:研究综述 [J ] . 计算机科学 , 2010 , 37 ( 8 ): 9 - 14 , 76 .

XIONG H , YAN H H , GUO T , et al . Code similarity detection:a survey [J ] . Computer Science , 2010 , 37 ( 8 ): 9 - 14 , 76 .

KRINKE J . Identifying similar code with program dependence graphs [C ] // Proceedings of Eighth Working Conference on Reverse Engineering . 2001 : 301 - 309 .

BAKER B S . A program for identifying duplicated code [J ] . Computing Science and Statistics , 1993 : 49 - 49 .

ENGELS S , LAKSHMANAN V , CRAIG M . Plagiarism detection using feature-based neural networks [C ] // Proceedings of the 38th SIGCSE Technical Symposium on Computer Science Education . 2007 : 34 - 38 .

ZHANG L , ZHUANG Y T , YUAN Z M . A program plagiarism detection model based on information distance and clustering [C ] // Proceedings of 2007 International Conference on Intelligent Pervasive Computing (IPC 2007) . 2007 : 431 - 436 .

PRIYADARSHAN S , NGUYEN H , SEKAR R . Practical fine-grained binary code randomization [C ] // Proceedings of Annual Computer Security Applications Conference , 2020 : 401 - 414 .

刘镇武 , 隋然 , 张铮 , 等 . 基于信息熵与软件复杂度的软件多样性评估方法 [J ] . 信息工程大学学报 , 2020 , 21 ( 2 ): 207 - 213 .

LIU Z W , SUI R , ZHANG Z , et al . Software diversity evaluation method based on information entropy and software complexity [J ] . Journal of Information Engineering University , 2020 , 21 ( 2 ): 207 - 213 .

BALACHANDRAN V , EMMANUEL S . Software protection with obfuscation and encryption [C ] // Proceedings of Information Security Practice and Experience . 2013 : 309 - 320 .

BANESCU S , COLLBERG C , GANESH V , et al . Code obfuscation against symbolic execution attacks [C ] // Proceedings of the 32nd Annual Conference on Computer Security Applications . 2016 : 189 - 200 .

KELLY D M , WELLONS C C , COFFMAN J , et al . Automatically validating the effectiveness of software diversity schemes [C ] // Proceedings of 2019 49th Annual IEEE/IFIP International Conference on Dependable Systems and Networks–Supplemental Volume (DSN-S) . 2019 : 1 - 2 .

AHMED S , XIAO Y , SNOW K Z , et al . Methodologies for quantifying (Re-) randomization security and timing under JIT-ROP [C ] // Proceedings of the 2020 ACM SIGSAC Conference on Computer and Communications Security . 2020 : 1803 - 1820 .

FOLLNER A , BARTEL A , BODDEN E . Analyzing the gadgets [C ] // Proceedings of International Symposium on Engineering Secure Software and Systems . 2016 : 155 - 172 .

ROEMER R , BUCHANAN E , SHACHAM H , et al . Return-oriented programming:systems,languages,and applications [J ] . ACM Transactions on Information and System Security , 2012 , 15 ( 1 ): 1 - 34 .

DAI Z D . Practical return-oriented programming [J ] . Source Boston , 2010 .

HOMESCU A , STEWART M , LARSEN P , et al . Microgadgets:size does matter in turing-complete return-oriented programming [J ] . WOOT , 2012 , 12 : 64 - 76 .

DOLAN S . MOV is turing-complete (2013) [EB ] .

HAWKINS W H , HISER J D , CO M , et al . Zipr:efficient static binary rewriting for security [C ] // Proceedings of 2017 47th Annual IEEE/IFIP International Conference on Dependable Systems and Networks (DSN) . 2017 : 559 - 566 .

KOO H , CHEN Y H , LU L , et al . Compiler-assisted code randomization [C ] // Proceedings of 2018 IEEE Symposium on Security and Privacy . 2018 : 461 - 477 .

CONTI M , CRANE S , FRASSETTO T , et al . Selfrando:securing the tor browser against de-anonymization exploits [J ] . Proc Priv Enhancing Technol , 2016 ( 4 ): 454 - 469 .

JUNOD P , RINALDINI J , WEHRLI J , et al . Obfuscator-LLVM:software protection for the masses [C ] // Proceedings of 2015 IEEE/ACM 1st International Workshop on Software Protection . 2015 : 3 - 9 .

PORTER C , MURURU G , BARUA P , et al . BlankIt library debloating:getting what You want instead of cutting what you don’t [C ] // Proceedings of PLDI 2020:Proceedings of the 41st ACM SIGPLAN Conference on Programming Language Design and Implementation . 2020 : 164 - 180 .

MISHRA S , POLYCHRONAKIS M . Saffire:context-sensitive function specialization against code reuse attacks [C ] // Proceedings of 2020 IEEE European Symposium on Security and Privacy (EuroS＆P) . 2020 : 17 - 33 .

浏览量

111

下载量

CSCD

文章被引用时，请邮件提醒。

提交

工具集

关联资源

暂无数据