Abstract:In the wake of the research community gaining deep understanding about control-hijacking attacks, data-oriented attacks have emerged. Among data-oriented attacks, data structure manipulation attack (DSMA) is a major category. Pioneering research was conducted and shows that DSMA is able to circumvent the most effective defenses against control-hijacking attacks - DEP, ASLR and CFI. Up to this day, only two defense techniques have demonstrated their effectiveness: Data Flow Integrity (DFI) and Data Structure Layout Randomization (DSLR). However, DFI has high performance overhead, and dynamic DSLR has two main limitations. L-1: Randomizing a large set of data structures will significantly affect the performance. L-2: To be practical, only a fixed sub-set of data structures are randomized. In the case that the data structures targeted by an attack are not covered, dynamic DSLR is essentially noneffective.To address these two limitations, we propose a novel technique, feedback-control-based adaptive DSLR and build a system named SALADSPlus. SALADSPlus seeks to optimize the trade-off between security and cost through feedback control. Using a novel feedback-control-based adaptive algorithm extended from the Upper Confidence Bound (UCB) algorithm, the defender (controller) uses the feedbacks (cost-effectiveness) from previous randomization cycles to adaptively choose the set of data structures to randomize (the next action). Different from dynamic DSLR, the set of randomized data structures are adaptively changed based on the feedbacks. To obtain the feedbacks, SALADSPlus inserts canary in each data structure at the time of compilation. We have implemented SALADSPlus based on gcc-4.5.0. Experimental results show that the runtime overheads are 1.8%, 3.7%, and 5.3% when the randomization cycles are selected as 10s, 5s, and 1s respectively.

A Co-Design Adaptive Defense Scheme with Bounded Security Damages Against Heartbleed-Like Attacks.

Towards a Science for Adaptive Defense: Revisit Server Protection

Security Protection and Checking in Embedded System Integration Against Buffer Overflow Attacks

Data Guardian: A Data Protection Scheme for Industrial Monitoring Systems

Optimal Defense Resource Allocation Considering Nonlinear Attack Cost in Power Systems

SecretSafe: A Lightweight Approach against Heap Buffer Over-Read Attack

Security protection and checking for embedded system integration against buffer overflow attacks via hardware/software

Adaptive Side-Channel Analysis Model and Its Applications to White-Box Block Cipher Implementations.

Distributed Adaptive Consensus Control for Nonlinear Systems with Active-Defense Mechanism Against Denial-of-Service Attacks

Optimized Lightweight Hardware Trojan-Based Fault Attack on DES

HeapTherapy: An Efficient End-to-End Solution against Heap Buffer Overflows

Feedback Control Can Make Data Structure Layout Randomization More Cost-Effective under Zero-Day Attacks

AES software and hardware system co‐design for resisting side channel attacks

Defensive Design of Saturating Counters Based on Differential Privacy

Design a Hybrid Flooding Attack Defense Scheme under the Cloud Computing Environment

Watermark-based Proactive Defense Strategy Design For Cyber-Physical Systems With Unknown-but-bounded Noises

DHRCA: A Design of Security Architecture Based on Dynamic Heterogeneous Redundant for System on Wafer

Defense Buffer Overflow in Code Writing

Influence of Attacker's Target Recognition Ability on Defense Strategy in Homogeneous Parallel Systems

Key-area Cyberspace Mimic Defense Against Data-Oriented Attacks

Defending a Cyber System with Early Warning Mechanism