Academic Commons

Articles

The MINESTRONE Architecture Combining Static and Dynamic Analysis Techniques for Software Security

Keromytis, Angelos D.; Stolfo, Salvatore; Yang, Junfeng; Stavrou, Angelos; Ghosh, Anup; Engler, Dawson; Dacier, Marc; Elder, Matthew; Kienzle, Darrell

We present MINESTRONE, a novel architecture that integrates static analysis, dynamic confinement, and code diversification techniques to enable the identification, mitigation and containment of a large class of software vulnerabilities in third-party software. Our initial focus is on software written in C and C++; however, many of our techniques are equally applicable to binary-only environments (but are not always as efficient or as effective) and for vulnerabilities that are not specific to these languages. Our system seeks to enable the immediate deployment of new software {e.g., a new release of an open-source project) and the protection of already deployed (legacy) software by transparently inserting extensive security instrumentation, while leveraging concurrent program analysis, potentially aided by runtime data gleaned from profiling actual use of the software, to gradually reduce the performance cost of the instrumentation by allowing selective removal or refinement. Artificial diversification techniques are used both as confinement mechanisms and for fault-tolerance purposes. To minimize the performance impact, we are leveraging multi-core hardware or (when unavailable) remote servers that enable quick identification of likely compromise. To cover the widest possible range of systems, we require no specific hardware or operating system features, although we intend to take advantage of such features where available to improve both runtime performance and vulnerability coverage.

Subjects

Files

More Information

Published In
Proceedings: First SysSec Workshop: Amsterdam, The Netherlands, 6 July 2011
Publisher DOI
https://doi.org/10.1109/SysSec.2011.33
Pages
53 - 56
Publisher
IEEE
Publication Origin
Piscataway, N.J.
Academic Units
Computer Science
Academic Commons provides global access to research and scholarship produced at Columbia University, Barnard College, Teachers College, Union Theological Seminary and Jewish Theological Seminary. Academic Commons is managed by the Columbia University Libraries.