MVEE: A Defence Mechanism against Code Injection Attacks

Abstract:

The growth of interconnected computer increases the amount and obscurity of attacks. Computer systems require apt security mechanism. Intrusion detection and prevention systems play an important part in detecting and preventing the attacks before they conciliate software. Multi-variant execution environment is an intrusion detection and prevention mechanism that executes several slightly different versions of a program, called variants, in concurrency. The variants are defined as more than 2 same instances. These variants contain the same operational unit of the original program. The variants are built to have indistinguishable manners under normal execution environment. If any of the variant is under attack, there are noticeable divergences in their execution behavior. A monitor compares the execution manners of the variants at specific synchronization points and raises an alarm when a variance is detected.

• Periodical: Applied Mechanics and Materials (Volume 573)
• Pages: 565-570
• DOI: https://doi.org/10.4028/www.scientific.net/AMM.573.565
• Online since: June 2014
• Authors: B. John Samuel*, M. Raja Gughan
• Keywords: False Alarms, Monitor, Multi-Variant Execution Environment (MVEE), System Calls

References

[1] C. Parampalli, R. Sekar, and R. Johnson, A Practical Mimicry Attack against Powerful System-Call Monitors, Proc. ACM Symp. Information, Computer, and Comm. Security, pp.156-167, (2008).

DOI: 10.1145/1368310.1368334

[2] Atul Singh, NishantSinha, NitinAgrawal, AVATARs for Pennies: Cheap N-version Programming for Replication", USENIX Sixth Workshop on Hot Topics in System Dependability (HotDep , 10), Oct 2010, Vancouver, BC, Canada.

[3] G. Kc, A. Keromytis, and V. Prevelakis, Countering Code-Injection Attacks with Instruction-Set Randomization, Proc. ACM Conf. Computer and Comm. Security, pp.272-280, (2003).

DOI: 10.1145/948109.948146

[4] Thomas C. Bressoud, Fred B. Schneider. Hypervisor-Based Fault-Tolerance, ACM Transactions on Computer Systems, Vol. 14, No. 1, February 1996, Pages 80-107.

DOI: 10.1145/225535.225538

[5] Jun Zhu, Wei Dong, Zhefu Jiang, Xiaogang Shi, Zhen Xiao, Xiaoming Li, Improving the Performance of Hypervisor-Based Fault-Tolerance.

[6] B. Salamat, A. Gal, T. Jackson, K. Manivannan, G. Wagner, and M. Franz, Multi-Variant Program Execution: Using Multi-Core Systems to Defuse Buffer-Overflow Vulnerabilities, " Proc. Int, l Conf. Complex, Intelligent, and Software Intensive Systems, pp.843-848, Mar. (2008).

DOI: 10.1109/cisis.2008.136

[7] Benjamin Cox, David Evans, Adrian Filipi, Jonathan Rowanhill, Wei Hu, Jack Davidson, John Knight, Anh Nguyen-Tuong, and Jason Hiser, N-Variant Systems A Secretless Framework for Security through Diversity, 15th USENIX Security Symposium, Vancouver, BC, August (2006).

DOI: 10.1145/1134760.1134764

[8] Liming CHEN, AlgirdasAVlZlENlS, N-Version Programming: A Fault-Tolerance Approach To Reliability Of Software Operation, 1996 IEEE Proceedings of FTCS-25, Volume 111.

[9] Todd Jackson, BabakSalamat, Gregor Wagner, Christian Wimmer, Michael Franz, On the Effectiveness of Multi-Variant Program Execution for Vulnerability Detection and Prevention, MetriSec2010, September 15, 2010, Bolzano-Bozen, Italy.

DOI: 10.1145/1853919.1853929

[10] A. Avizienis and L. Chen. On the implementation of n-version programming for software fault tolerance during execution,. In Proceedings of the International Computer Software and Applications Conference, pages 149–155. IEEE Computer Society, (1977).

[11] B. Salamat, T. Jackson, A. Gal, and M. Franz, Orchestra: Intrusion Detection Using Parallel Execution and Monitoring of Program Variants in User-Space, Proc. European Conf. Computer Systems, pp.33-46, (2009).

DOI: 10.1145/1519065.1519071

[12] E. Barrantes, D. Ackley, T. Palmer, D. Stefanovic, and D. Zovi. Randomized instruction set emulation to disrupt binary code injection attacks,. In Proceedings of the ACM Conference on Computer and Communications Security, pages 281–289. ACM Press, (2003).

DOI: 10.1145/948109.948147

[13] K. Birman. Replication and fault-tolerance in the ISIS system,. ACM SIGOPS Operating Systems Review, 19(5): 79–86, (1985).

DOI: 10.1145/323627.323636

[14] BabakSalamat, Todd Jackson, Gregor Wagner, Christian Wimmer, and Michel Franz, Runtime Defense against Code Injection Attacks Using Replicated Execution, Senior Member, IEEE, on IEEE Transactions On Dependable And Secure Computing, Vol. 8, No. 4, July/August2011.

DOI: 10.1109/tdsc.2011.18

[15] B. Salamat, C. Wimmer, and M. Franz, Synchronous Signal Delivery in a Multi-Variant Intrusion Detection System, technical report, School of Information and Computer Sciences, Univ. of California, (2009).

[16] Algirdas A. Avizienis, The Methodology Of N-Version Programming, Software Fault Tolerance, 1995 John Wiley & Sons Ltd.

[17] A. Avizienis. The n-version approach to fault-tolerant software". IEEE Transactions on Software Engineering, SE-11(12): 1491–1501, 1985. D. Black, C. Low, and S.K. Shrivastava, "The Voltan Application Programming Environment for Fail-Silent Processes, Distributed Systems Eng., vol. 5, pp.66-77, (1998).

DOI: 10.1109/tse.1985.231893