NDLI: CloudER: a framework for automatic software vulnerability location and patching in the cloud

Please wait, while we are loading the content...

Protection, usability and improvements in reflected XSS filters

Ciphertext policy attribute-based encryption from lattices

Forgery-resilience for digital signature schemes

Adding query privacy to robust DHTs

Private and oblivious set and multiset operations

CARMA: a hardware tamper-resistant isolated execution environment on commodity x86 platforms

User-level secure deletion on log-structured file systems

AdDroid: privilege separation for applications and advertisers in Android

Towards efficient proofs of retrievability

A closer look at keyboard acoustic emanations: random passwords, typing styles and decoding techniques

An independent validation of vulnerability discovery models

Expressive CP-ABE with partially hidden access structures

Verifier-local revocation group signatures with time-bound keys

On sampling, anonymization, and differential privacy or, k-anonymization meets differential privacy

Practical client puzzles in the standard model

CloudER: a framework for automatic software vulnerability location and patching in the cloud

ClusterFA: a memory-efficient DFA structure for network intrusion detection

Constraint-enhanced role engineering via answer set programming

Boosting efficiency and security in proof of ownership for deduplication

Letting applications operate through attacks launched from compromised drivers

Virtual browser: a virtualized browser to sandbox third-party JavaScripts with enhanced security

New time-memory-data trade-off attack on the estream finalists and modes of operation of block ciphers

An identity authentication protocol in online social networks

Privacy-preserving alibi systems

Towards the attacker's view of protocol narrations (or, how to compile security protocols)

Monetizing spambot activity and understanding its relation with spambot traffic features

Discovering records of private VoIP calls without wiretapping

Integrity walls: finding attack surfaces from mandatory access control policies

Secure cloud maintenance: protecting workloads against insider attacks

Software decoys for insider threat

Memoirs of a browser: a cross-browser detection model for privacy-breaching extensions

An efficient broadcast attack against NTRU

On the mixing time of directed social graphs and security implications

Verifiable private equality test: enabling unbiased 2-party reconciliation on ordered sets in the malicious model

Carving secure wi-fi zones with defensive jamming

Adaptive semi-private email aliases

The specification and compilation of obligation policies for program monitoring

Outsourced private set intersection using homomorphic encryption

Coercion resistance in authentication responsibility shifting

FlashOver: automated discovery of cross-site scripting vulnerabilities in rich internet applications

Recursive partitioning and summarization: a practical framework for differentially private data publishing

Keeping identity secret in online social networks

CL-PRE: a certificateless proxy re-encryption scheme for secure data sharing with public cloud

PassMap: a map based graphical-password authentication system

Key-insulated symmetric key cryptography and mitigating attacks against cryptographic cloud software

Security implications in Kerberos by the introduction of smart cards

KoNKS: konsensus-style network koordinate system

CloudER: a framework for automatic software vulnerability location and patching in the cloud

Content Provider	ACM Digital Library
Author	Xu, Dongyan Mao, Bing Chen, Ping
Abstract	In a virtualization-based cloud infrastructure, customers of the cloud deploy virtual machines (VMs) with their own applications and customized runtime environments. The cloud provider supports the execution of these VMs without detailed knowledge of the guest applications and operating systems in the VMs. In addition to elastic resource provisioning for the VMs, a desirable "value-added" service the cloud provider can provide is the emergency response to runtime incidences of software bugs and vulnerabilities. The challenge is to facilitate the automatic runtime detection, location, and patching of the software vulnerability -- outside the VMs and without the source code. In this paper, we present CloudER, a cloud "emergency room" architecture that automatically detect, locate, and patch software vulnerabilities in cloud application binaries at runtime. CloudER leverages an existing taint-based system (Demand Emulation) for runtime anomaly detection, employs new algorithms for software vulnerability location and patch generation, and adapts a virtual machine introspection system (XenAccess) for dynamic patching. Our preliminary evaluation experiments with a number of real-world server applications show that CloudER achieves timely response to runtime software faults or attacks from outside the VMs. The main contributions of this paper are highlighted as follows: (1) CloudER is an integrated architecture that improves the runtime reliability of cloud applications. It covers the full life cycle of exploit detection, culprit instruction location, patch generation and application, and execution state recording and reset -- all performed from outside the protected VM and without the source code of the applications. (2) While leveraging existing techniques for taint-based exploit detection, CloudER involves new methods for culprit instruction location and binary patch generation. The methods cover some of the most common types of software vulnerabilities and the patches generated are of small size (tens of bytes). (3) CloudER incurs reasonable performance overhead to the application in comparison with running the application in an unprotected VM. The interruption to the production VM's execution (for culprit instruction location and patch generation) is less than half a minute in our experiments with real-world applications.
Starting Page	50
Ending Page	50
Page Count	1
File Format	PDF
ISBN	9781450316484
DOI	10.1145/2414456.2414485
Language	English
Publisher	Association for Computing Machinery (ACM)
Publisher Date	2012-05-02
Publisher Place	New York
Access Restriction	Subscribed
Content Type	Text
Resource Type	Article

Sl.	Authority	Responsibilities	Communication Details
1	Ministry of Education (GoI), Department of Higher Education	Sanctioning Authority	https://www.education.gov.in/ict-initiatives
2	Indian Institute of Technology Kharagpur	Host Institute of the Project: The host institute of the project is responsible for providing infrastructure support and hosting the project	https://www.iitkgp.ac.in
3	National Digital Library of India Office, Indian Institute of Technology Kharagpur	The administrative and infrastructural headquarters of the project	Dr. B. Sutradhar bsutra@ndl.gov.in
4	Project PI / Joint PI	Principal Investigator and Joint Principal Investigators of the project	Dr. B. Sutradhar bsutra@ndl.gov.in Prof. Saswat Chakrabarti will be added soon
5	Website/Portal (Helpdesk)	Queries regarding NDLI and its services	support@ndl.gov.in
6	Contents and Copyright Issues	Queries related to content curation and copyright issues	content@ndl.gov.in
7	National Digital Library of India Club (NDLI Club)	Queries related to NDLI Club formation, support, user awareness program, seminar/symposium, collaboration, social media, promotion, and outreach	clubsupport@ndl.gov.in
8	Digital Preservation Centre (DPC)	Assistance with digitizing and archiving copyright-free printed books	dpc@ndl.gov.in
9	IDR Setup or Support	Queries related to establishment and support of Institutional Digital Repository (IDR) and IDR workshops	idr@ndl.gov.in

Clouder: a framework for automatic software vulnerability location and patching in the cloud.

LaChouTi: kernel vulnerability responding framework for the fragmented Android devices

Automatic Patching Based on Social Computing in P2P Network

A proposed framework for proactive vulnerability assessments in cloud deployments

On the effectiveness of automatic patching

OPS: Offline Patching Scheme for the Images Management in a Secure Cloud Environment

Test as a Service: A Framework for Web Security TaaS Service in Cloud Environment

The Coming Era of AlphaHacking? A Survey of Automatic Software Vulnerability Detection, Exploitation and Patching Techniques

An empirical analysis of software vendors’ patching behavior: impact of vulnerability disclosure (2006).

CloudER: a framework for automatic software vulnerability location and patching in the cloud

Similar Documents

Clouder: a framework for automatic software vulnerability location and patching in the cloud.

LaChouTi: kernel vulnerability responding framework for the fragmented Android devices

Automatic Patching Based on Social Computing in P2P Network

A proposed framework for proactive vulnerability assessments in cloud deployments

On the effectiveness of automatic patching

OPS: Offline Patching Scheme for the Images Management in a Secure Cloud Environment

Test as a Service: A Framework for Web Security TaaS Service in Cloud Environment

The Coming Era of AlphaHacking? A Survey of Automatic Software Vulnerability Detection, Exploitation and Patching Techniques

An empirical analysis of software vendors’ patching behavior: impact of vulnerability disclosure (2006).

CloudER: a framework for automatic software vulnerability location and patching in the cloud