NDLI: E unibus pluram: massive-scale software diversity as a defense mechanism

Please wait, while we are loading the content...

Why is there no science in cyber science?: a panel discussion at NSPW 2010

E unibus pluram: massive-scale software diversity as a defense mechanism

A stealth approach to usable security: helping IT security managers to identify workable security solutions

A billion keys, but few locks: the crisis of web single sign-on

Would a 'cyber warrior' protect us: exploring trade-offs between attack and defense of information systems

Ontological semantic technology for detecting insider threat and social engineering

This is your data on drugs: lessons computer security can learn from the drug war

On information flow for intrusion detection: what if accurate full-system dynamic information flow tracking was possible?

VM-based security overkill: a lament for applied systems security research

To boldly go where invention isn't secure: applying security entrepreneurship to secure systems design

On-line privacy and consent: a dialogue, not a monologue

The pervasive trust foundation for security in next generation networks

Relationships and data sanitization: a study in scarlet

A risk management process for consumers: the next step in information security

E unibus pluram: massive-scale software diversity as a defense mechanism

Content Provider	ACM Digital Library
Author	Franz, Michael
Abstract	We contend that the time has come to revisit the idea of software diversity for defense purposes. Four fundamental paradigm shifts that have occurred in the past decade now make it viable to distribute a unique version of every program to every user. We outline a practical approach for providing compiler-generated software diversity on a massive scale. It is based on an "App Store" containing a diversification engine (a "multicompiler") that automatically generates a unique, but functionally identical version of every program each time that a downloader requests it. All the different versions of the same program behave in exactly the same way from the perspective of the end-user, but they implement their functionality in subtly different ways. As a result, any specific attack will succeed only on a small fraction of targets. An attacker would require a large number of different attacks and would have no way of knowing a priori which specific attack will succeed on which specific target. Hence, the cost to the attacker is raised dramatically. Equally importantly, our approach makes it much more difficult for an attacker to generate attack vectors by way of reverse engineering of security patches. An attacker requires two pieces of information to extract a vulnerability from a bug fix: the version of the program that is vulnerable and the specific patch that fixes the vulnerability. In an environment in which software is diversified and every instance of every program is unique, we can set things up so that the attacker never obtains a matching pair of vulnerable program and its corresponding bug fix that could be used to identify the vulnerability. We propose a mechanism for incremental updating of diversified software that has this property.
Starting Page	7
Ending Page	16
Page Count	10
File Format	PDF
ISBN	9781450304153
DOI	10.1145/1900546.1900550
Language	English
Publisher	Association for Computing Machinery (ACM)
Publisher Date	2010-09-21
Publisher Place	New York
Access Restriction	Subscribed
Subject Keyword	Dynamic patching of software vulnerabilities Service computing architectures Reverse engineering of security patches Compiler-generated software diversity Software vulnerabilities
Content Type	Text
Resource Type	Article

Central Library (ISO-9001:2015 Certified)
Indian Institute of Technology Kharagpur
Kharagpur, West Bengal, India | PIN - 721302

See location in the Map
03222 282435
Mail: support@ndl.gov.in

Sl.	Authority	Responsibilities	Communication Details
1	Ministry of Education (GoI), Department of Higher Education	Sanctioning Authority	https://www.education.gov.in/ict-initiatives
2	Indian Institute of Technology Kharagpur	Host Institute of the Project: The host institute of the project is responsible for providing infrastructure support and hosting the project	https://www.iitkgp.ac.in
3	National Digital Library of India Office, Indian Institute of Technology Kharagpur	The administrative and infrastructural headquarters of the project	Dr. B. Sutradhar bsutra@ndl.gov.in
4	Project PI / Joint PI	Principal Investigator and Joint Principal Investigators of the project	Dr. B. Sutradhar bsutra@ndl.gov.in Prof. Saswat Chakrabarti will be added soon
5	Website/Portal (Helpdesk)	Queries regarding NDLI and its services	support@ndl.gov.in
6	Contents and Copyright Issues	Queries related to content curation and copyright issues	content@ndl.gov.in
7	National Digital Library of India Club (NDLI Club)	Queries related to NDLI Club formation, support, user awareness program, seminar/symposium, collaboration, social media, promotion, and outreach	clubsupport@ndl.gov.in
8	Digital Preservation Centre (DPC)	Assistance with digitizing and archiving copyright-free printed books	dpc@ndl.gov.in
9	IDR Setup or Support	Queries related to establishment and support of Institutional Digital Repository (IDR) and IDR workshops	idr@ndl.gov.in