复合式软件随机化安全防御方法

doi:10.3969/j.issn.1001-2400.2017.02.032

Abstract

Abstract:

The traditional software security defense approach has always been faced with the problem of being easy to conquer and hard to defend, so in order to build a software security defense system that is easy to defend and hard to conquer, based on the idea of moving target defense, a combined defense in depth method for software security is designed and implemented to resist the attacks due to software vulnerabilities. The method introduces the mechanism of randomization on the source code and binary code level, and makes those mechanisms work together comprehensively through the design of metadata database, and finally forms a defense in depth for software security protection. The experimental results of the prototype system show that the proposed method can automatically and effectively build a diversity of software, and the generated software shows the uncertainty from both static analysis and dynamic aspects, which makes it difficult to analyze and attack, thus being able to effectively resist the network attacks based on software vulnerabilities.

Key words: defense standards, software generation, random complier, software defense in depth

HAN Kun;ZHANG Hailin;WU Bo;XIN Dan;REN Zhiyuan. Combined software randomization security defense method[J].Journal of Xidian University, 2017, 44(2): 191-196.

References

［1］朱承丞, 董利达. 一种多线程软件并发漏洞检测方法［J］. 西安电子科技大学学报, 2015, 42(2): 167-173.
ZHU Chengcheng, DONG Lida. Concurrency Bug Test for a Class of Multithreaded Software［J］. Journal of Xidian University, 2015, 42(2): 167-173.
［2］ ZHUANG R, DELOACH S A, OU X. Towards a Theory of Moving Target Defense［C］//Proceedings of the ACM Conference on Computer and Communications Security. New York: ACM, 2014: 31-40.
［3］邬江兴, 张帆, 罗兴国, 等. 拟态计算与拟态安全防御［J］. 中国计算机学会通讯, 2015, 11(1): 8-14.
WU Jiangxing, ZHANG Fan, LUO Xingguo, et al. Pseudo-state Calculation and Pseudo-state Security Defense［J］. Communications of the CCF, 2015, 11(1): 8-14.
［4］ JUNOD P, RINALDINI J, WEHRLI J, et al. Obfuscator-LLVM: Software Protection for the Masses［C］//Proceedings of the 1st International Workshop on Software Protection. Piscataway: IEEE, 2015: 3-9.
［5］ PAPADOGIANNAKIS A, LOUTSIS L, PAPAEFSTATHIOU V, et al. ASIST: Architectural Support for Instruction Set Randomization［C］//Proceedings of the ACM Conference on Computer and Communications Security. New York: ACM, 2013: 981-992.
［6］ KOO H, POLYCHRONAKIS M. Juggling the Gadgets: Binary-level Code Randomization Using Instruction Displacement［C］//Proceedings of the 11th ACM on Asia Conference on Computer and Communications Security. New York: ACM, 2016: 23-34.
［7］ CADAR C, AKRITIDIS P, COSTA M, et al. Data Randomization: TR-2008-120［R］. Cambridge: Microsoft Research, 2008.
［8］ LATTNER C. LLVM and Clang: Next Generation Compiler Technology［C］//The BSD Conference. Berkeley: BSD, 2008: 1-2.
［9］ JOYNER D, CERTIK O, MEURER A, et al. Open Source Computer Algebra Systems: SymPy［J］. ACM Communications in Computer Algebra, 2012, 45(3/4): 225-234.
［10］ PANCAKES. Radare［EB/OL］. ［2016-10-08］. http://www.radare.org/.
［11］ QUYNH N A. Capstone: Next-gen Disassembly Framework［EB/OL］. ［2016-10-08］. http://wenku.it168.com/d_001563416.shtml.
［12］ QUYNH N A. KEYSTONE: the Last Missing Framework for Reverse Engineering［EB/OL］. ［2016-10-08］. http://www.keystone-engine.org/.
［13］ WATERJUICE. CryptLib［EB/OL］. ［2016-10-08］. https://github.com/WaterJuice/CryptLib.

Combined software randomization security defense method

PDF (PC)

Like

Knowledge

Abstract

Cite this article

share this article

References

Related Articles 0

Metrics

Comments

Recommended 10