Software Profiling Options and Their Effects on Security Based Diversification

Abstract

Imparting diversity to binaries by inserting garbage instructions is an e↵ective defense against code-reuse attacks. Relocating and breaking up code gadgets removes an attacker's ability to craft attacks by merely studying the existing code on their own computer. Unfortunately, inserting garbage instructions also slows down program execution. The use of profiling enables optimizations that alleviate much of this overhead, while still maintaining the high level of security needed to deter attacks. These optimizations are performed by varying the probability for the insertion of a garbage instruction at any particular location in the binary. The hottest regions of code get the smallest amount of diversification, while the coldest regions get the most diversification.We show that static and dynamic profiling methods both reduce run-time overhead to under 2.5% while preventing over 95% of original gadgets from appearing in any diversified binary. We compare static and dynamic profiling and find that dynamic profiling has a slight performance advantage in a best-case scenario. But we also show that dynamic profiling results can su↵er greatly from bad training input. Additionally, we find that static profiling creates smaller binary files than dynamic profiling, and that the two methods o↵er nearly identical security characteristics.

Moving target defense: state of the art and characteristics

“…However, it slows down the program execution simultaneously. Murphy et al (2014) proposed the use of software profiling methods to reduce the runtime overhead through optimizations, which were performed by varying the probability for the insertion of a garbage instruction at any particular location in the binary code.…”

Economics of Resilient Cloud Services

“…The SCIT rotation approach makes a weaker form of N-Version programming more effective. We recommend a weaker form of N-Version Programming suggested by Murphy et al [6], where software is compiled with multiple compilers and varying compilation flags. The approach can be generalized to varying runtimes as well.…”

Research of Register Pressure Aware Loop Unrolling Optimizations for Compiler

“…They are transformations who result in instruction movement like scalar replacement, loop invariant motion, Common sub-expression elimination and so on, and transformations that result in code redundancy, like inliner, loop unrolling, modulo scheduling [3] and so on. Meanwhile, some fine-grained randomizations [4,5], implemented during the compilation process, such as Atomic Instruction substitution, instruction reordering, register reassignment [6], random NOP insertion and so on, are adopted to defend ROP attacks. However, they are very likely to increase register pressure because they use instruction movement and code redundancy technologies a lot.…”