Home

The MINESTRONE Architecture Combining Static and Dynamic Analysis Techniques for Software Security

Angelos D. Keromytis; Salvatore Stolfo; Junfeng Yang; Angelos Stavrou; Anup Ghosh; Dawson Engler; Marc Dacier; Matthew Elder; Darrell Kienzle

Title:
The MINESTRONE Architecture Combining Static and Dynamic Analysis Techniques for Software Security
Author(s):
Keromytis, Angelos D.
Stolfo, Salvatore
Yang, Junfeng
Stavrou, Angelos
Ghosh, Anup
Engler, Dawson
Dacier, Marc
Elder, Matthew
Kienzle, Darrell
Date:
Type:
Articles
Department:
Computer Science
Permanent URL:
Book/Journal Title:
Proceedings: First SysSec Workshop: Amsterdam, The Netherlands, 6 July 2011
Publisher:
IEEE
Publisher Location:
Piscataway, N.J.
Abstract:
We present MINESTRONE, a novel architecture that integrates static analysis, dynamic confinement, and code diversification techniques to enable the identification, mitigation and containment of a large class of software vulnerabilities in third-party software. Our initial focus is on software written in C and C++; however, many of our techniques are equally applicable to binary-only environments (but are not always as efficient or as effective) and for vulnerabilities that are not specific to these languages. Our system seeks to enable the immediate deployment of new software {e.g., a new release of an open-source project) and the protection of already deployed (legacy) software by transparently inserting extensive security instrumentation, while leveraging concurrent program analysis, potentially aided by runtime data gleaned from profiling actual use of the software, to gradually reduce the performance cost of the instrumentation by allowing selective removal or refinement. Artificial diversification techniques are used both as confinement mechanisms and for fault-tolerance purposes. To minimize the performance impact, we are leveraging multi-core hardware or (when unavailable) remote servers that enable quick identification of likely compromise. To cover the widest possible range of systems, we require no specific hardware or operating system features, although we intend to take advantage of such features where available to improve both runtime performance and vulnerability coverage.
Subject(s):
Computer science
Publisher DOI:
http://dx.doi.org/10.1109/SysSec.2011.33
Item views:
80
Metadata:
View

In Partnership with the Center for Digital Research and Scholarship at Columbia University Libraries/Information Services.