检索结果-内蒙古大学图书馆

40th Annual IEEE Computer Software and Applications Conference Symposium (COMPSAC) / Symposium on Software Engineering Technology and Applications (SETA)

作者： Jiang, Yufei Wu, Dinghao Liu, Peng Penn State Univ University Pk PA 16802 USA

ISBN: (纸本)9781467388450

Modern software engineering practice increasingly brings redundant code into software products, which has caused a phenomenon called bloatware, leading to software system maintenance, performance and reliability issues as well as security problems. With the rapid advances of smart devices and a more connected world, it is never more important to trim bloatware to improve the leanness, agility, reliability, performance, and security of the interconnected software and network systems. Previous methods have limited scopes and are usually not fully automated. In this paper, we propose a new static-analysis-enabled approach to trimming unused code from both Java applications and Java Runtime Environment (JRE) automatically. We have built a tool called JRed on top of the Soot framework. We have conducted a fairly comprehensive evaluation of JRed based on a set of criteria: code size, code complexity, memory footprint, execution and garbage collection time, and security. Our experimental results show that, Java application size can be reduced by 44.5% on average and the JRE code can be reduced by more than 82.5% on average. The code complexity is significantly reduced according to a set of well-known metrics. Furthermore, we report that by trimming redundant code, 48.6% of the known security vulnerabilities in the Java Runtime Environment JRE 6 update 45 has been removed.

关键词： Bloatware Java Runtime Environment program customization Software Analysis Static Analysis

来源：评论

学校读者我要写书评

暂无评论

Hecate: Automated customization of program and Communication Features to Reduce Attack Surfaces 15th

Hecate: Automated Customization of Program and Communication...

引用

15th EAI International Conference on Security and Privacy in Communication Networks (SecureComm)

作者： Xue, Hongfa Chen, Yurong Venkataramani, Guru Lan, Tian George Washington Univ Washington DC 20052 USA

ISBN: (纸本)9783030372316;9783030372309

Customizing program and communication features is a commonly adopted strategy to counter security threats that arise from rapid inflation of software features. In this paper, we propose Hecate, a novel framework that leverages dynamic execution and trace to create customized, self-contained programs, in order to minimize potential attack surface. It automatically identifies program features (i.e., independent, well-contained operations, utilities, or capabilities) relating to application binaries and their communication functions, tailors and eliminates the features to create customized program binaries in accordance with user needs, in a fully unsupervised fashion. Hecate makes novel use of deep learning to identify program features and their constituent functions by mapping dynamic instruction trace to functions in the binaries. It enables us to modularize program features and efficiently create customized program binaries at large scale. We implement a prototype of Hecate using a number of open source tools such as DynInst and TensorFlow. Evaluation using real-world executables including OpenSSL and LibreOffice demonstrates that Hecate can create a wide range of customized binaries for diverse feature requirements, with the highest accuracy up to 96.28% for feature/function identification and up to 67% reduction of program attack surface.

关键词： program customization Deep learning Binary analysis

来源：评论

学校读者我要写书评

暂无评论

Verify-Pro: A Framework for Server Authentication using Communication Protocol Dialects

Verify-Pro: A Framework for Server Authentication using Comm...

引用

IEEE Military Communications Conference (MILCOM)

作者： Gogineni, Kailash Mei, Yongsheng Venkataramani, Guru Lan, Tian George Washington Univ Dept Elect & Comp Engn Washington DC 20052 USA

ISBN: (纸本)9781665485340

Customizing program binary and communication features is a commonly adopted strategy to counter network security threats like session hijacking, context confusion, and impersonation attacks. A potential attacker may have enough time to launch an attack targeting these vulnerabilities by rerouting the target request to a malicious server or hijacking the traffic. This paper presents a novel system Verify-Pro, a framework for server authentication using communication protocol dialects by customizing the communication features, enforcing continuous authentication, detecting the adversary, and preventing sensitive information leakage. Specifically, we leverage a machine learning approach (pre-trained neural network model) on both client and server machines to trigger a specific dialect that dynamically changes for each request (e.g., get filename in FTP). Then, a decision tree algorithm is developed to automatically detect the adversary and terminate the entire session if the message is from an adversary. We implement a prototype of VerifyPro and evaluate its practicality on standard communication protocol: FTP (File Transfer Protocol) and present a case study of the internet of things protocol MQTT (Message Queuing Telemetry Transport). Our experimental results show that by sending misleading information through the message packets from an attacker at the application layer, it is possible for the recipient to identify if the sender is genuine or a spoofed one, with a negligible overhead of < 1%.

关键词： program customization Protocol dialects Deep learning Authentication

来源：评论

学校读者我要写书评

暂无评论

Verify-Pro: A Framework for Server Authentication using Communication Protocol Dialects

Verify-Pro: A Framework for Server Authentication using Comm...

引用

IEEE Military Communications Conference (MILCOM)

ISBN: (纸本)9781665485340

Customizing program binary and communication features is a commonly adopted strategy to counter network security threats like session hijacking, context confusion, and impersonation attacks. A potential attacker may have enough time to launch an attack targeting these vulnerabilities by rerouting the target request to a malicious server or hijacking the traffic. This paper presents a novel system Verify-Pro, a framework for server authentication using communication protocol dialects, to customize the communication features, enforce continuous authentication, detect the adversary, and prevent sensitive information leakage. Specifically, we leverage a machine learning approach (pre-trained neural network model) on both client and server machines to trigger a specific dialect that dynamically changes for each request (e.g., get filename in FTP). Then, a decision tree algorithm is developed to automatically detect the adversary and terminate the entire session if the message is from an adversary. We implement a prototype of VerifyPro and evaluate its practicality on standard communication protocol: FTP (File Transfer Protocol) and present a case study of the internet of things protocol MQTT (Message Queuing Telemetry Transport). Our experimental results show that by sending misleading information through message packets from an attacker at the application layer, the recipient can identify whether the sender is genuine or spoofed, with a negligible overhead of < 1%.

关键词： program customization Protocol dialects Machine Learning Network security Authentication

来源：评论

学校读者我要写书评

暂无评论

CustomPro: Network Protocol customization Through Cross-Host Feature Analysis 15th

CustomPro: Network Protocol Customization Through Cross-Host...

引用

15th EAI International Conference on Security and Privacy in Communication Networks (SecureComm)

作者： Chen, Yurong Lan, Tian Venkataramani, Guru George Washington Univ Washington DC 20052 USA

ISBN: (纸本)9783030372316;9783030372309

The implementations of network protocols are often "bloated" due to various users' needs and complex environment for deployment. The continual expansion of program features contribute to not only growing complexity but also increased the attack surface, making the maintenance of network protocol security very challenging. Existing works try to mitigate program bloat by source-code level static analysis (such as tainting and slicing) or dynamic techniques such as binary reuse. While source code is not always available for the former technique, the latter suffers from limited code coverage because of the incomplete input space. In this paper, we propose CustomPro, a new approach for automated customization of network protocols. We adopt whole system emulation, dynamic tainting and symbolic execution to identify desired code from the original program binaries, then leverage binary rewriting techniques to create a customized program binary that only contains the desired functionalities. We implement a prototype of CustomPro and evaluate its feasibility using OpenSSL (a widely used SSL implementation) and Mosquitto (an IoT messaging protocol implementation). The results show that CustomPro is able to create functional program binaries with only desired features and significantly reduce the potential attack surface by targeting and eliminating unwanted protocol features.

关键词： program customization Binary rewriting Cross-host tainting

来源：评论

学校读者我要写书评

暂无评论

TOSS: Tailoring Online Server Systems through Binary Feature customization 25

TOSS: Tailoring Online Server Systems through Binary Feature...

引用

Workshop on Forming an Ecosystem Around Software Transformation (FEAST)

作者： Chen, Yurong Sun, Shaowen Lan, Tian Venkataramani, Guru George Washington Univ Washington DC 20052 USA

ISBN: (纸本)9781450359979

Network-based models are increasingly adopted to deliver key software service and utilities (e.g., data storage, search, and processing) to end users. The need to satisfy diverse user requirements and to fit different application environment often leads to continual expansion and addition of new (and in many cases excessive) features, known as the feature creep problem. Existing work mitigating feature bloat often either debloats programs at source code level (which may not always be available, in particular for legacy systems) or customize binary only with respect to very limited scope of inputs. In this paper, we propose a new approach, TOSS , for automated customization of online servers and software systems, which are implemented using a client-server architecture based on the underlying network protocols. Specifically, TOSS harnesses program tracing and tainting-guided symbolic execution to identify desired (feature-related) code from the original program binary, and apply static binary rewriting to remove redundant features and directly create customized program binary with only desired features. We implement a prototype of TOSS and evaluate its feasibility using real-world executables including Mosquitto, which relies on the Message Queuing Telemetry Transport (MQTT) protocol for lightweight Internet of Things (IoT) communications. The results show that TOSS is able to create a functional program binary with only desired features and significantly reduce potential attack surface by eliminating undesired protocol/program features.

关键词： program customization network protocol binary rewriting

来源：评论

学校读者我要写书评

暂无评论

MORPH: Enhancing System Security through Interactive customization of Application and Communication Protocol Features 18

MORPH: Enhancing System Security through Interactive Customi...

引用

ACM SIGSAC Conference on Computer and Communications Security (CCS)

作者： Xue, Hongfa Chen, Yurong Venkataramani, Guru Lan, Tian Jin, Guang Li, Jason George Washington Univ Washington DC 20052 USA Intelligent Automat Inc Rockville MD USA

ISBN: (纸本)9781450356930

The ongoing expansion and addition of new features in software development bring inefficiency and vulnerabilities into programs, resulting in an increased attack surface with higher possibility of exploitation. Creating customized software systems that contain just-enough features and yet satisfy specific user needs is currently an extremely slow, build-to-order process. In this paper, we propose MORPH, an Interactive program Feature customization framework to provide broad capabilities for automated program feature identification and feature customization. Our preliminary results show that MORPH can identify program features at an average accuracy of 92.7% and swiftly generate variations of self-contained, customized programs in an unsupervised fashion.

关键词： program customization Debloating Machine learning Binary analysis

来源：评论

学校读者我要写书评

暂无评论

Generic feature modules: Two-staged program customization

Generic feature modules: Two-staged program customization

引用

1st International Conference on Software and Data Technologies

作者： Apel, Sven Kuhlemann, Martin Leich, Thomas Otto Von Guericke Univ Magdeburg Germany

ISBN: (纸本)9728865694

With feature-oriented programming (FOP) and generics programmers have proper means for structuring software so that its elements can be reused and extended. This paper addresses the issue whether both approaches are equivalent. While FOP targets at large-scale building blocks and compositional programming, generics provide fine-grained customization at type-level. We contribute an analysis that reveals the individual capabilities of both approaches with respect to program customization. There from, we extract guidelines for programmers in what situations which approach suffices. Furthermore, we present a fully implemented language proposal that integrates FOP and generics in order to combine their strengths. Our approach facilitates two-staged program customization: (1) selecting sets of features;(2) parameterizing features subsequently. This allows a broader spectrum of code reuse to be covered-reflected by proper language level mechanisms. We underpin our proposal by means of a case study.

关键词： feature-oriented programming generics program customization software reuse software product lines

来源：评论

学校读者我要写书评

暂无评论

Efficient Off-Board Deployment and customization of Virtual Machine-Based Embedded Systems

引用

ACM TRANSACTIONS ON EMBEDDED COMPUTING SYSTEMS 2010年第3期9卷 21-21页

作者： Courbot, Alexandre Grimaud, Gilles Vandewalle, Jean-Jacques Univ Lille 1 IRCICA LIFL INRIA Futurs POPS Res Grp F-59655 Villeneuve Dascq France

This article presents a new way to deploy and customize embedded virtual machine based operating systems for very restrained devices. Due to the specificity of restrained embedded devices (large usage of read-only memory, very few writable memory available, ... ), these systems are typically deployed off-board, in a process called romization. However, current romization solutions do not allow a complete deployment to take place outside of the execution device: they are capable of converting system components and applications into their executable form, but are unable to perform any operation that would require the system to be running. This results in a good part of the deployment being performed by the target device, at the cost of longer startup times, bloat with code and data that are only executed once at startup, and suboptimal memory placement of data structures. In this article, we propose a new romization scheme that allows the system to be started within a virtual execution environment, and thus to be fully deployed off-board before being transferred to its real execution support. We then take advantage of all the information provided by the deployed state in order to analyze and customize it, resulting in a very low-footprint, custom-tailored embedded system. The Java platform is used as a support to implement our romization architecture and perform our experiments. For the evaluated set of embedded applications, we were able to obtain embedded systems which memory footprint was lower than their J2ME counterpart, while being based on a full-fledged J2SE environment.

关键词： Design Performance Embedded operating systems Java deployment software analysis program customization

来源：评论

学校读者我要写书评

暂无评论

Implementing heap-object behavior prediction efficiently and effectively

引用

SOFTWARE-PRACTICE & EXPERIENCE 2001年第9期31卷 869-892页

作者： Seidl, ML Zorn, BG Univ Colorado Dept Comp Sci Boulder CO 80309 USA Microsoft Corp Redmond WA 98052 USA

Heap-allocated objects play an important role in many modern programs. Various results have shown the overall performance of these programs can be improved by increasing the reference locality of heap-allocated objects. In this paper we describe an approach that improves the virtual memory performance of allocation-intensive C programs by predicting the reference behavior and lifetime of heap objects as they are allocated, We further describe an implementation of our prediction algorithm and evaluate its performance on real programs. As part of our implementation, we present a low-overhead algorithm to minimize the cost of gathering run-time stack information, Finally, we show that an implementation of these algorithms has little overhead and can improve the virtual memory and TLB performance of programs substantially. Copyright (C) 2001 John Wiley & Sons, Ltd.

关键词： dynamic storage allocation profile-based optimization memory management program customization reference locality

来源：评论

学校读者我要写书评

暂无评论

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案：

请选择收藏分类：

通借通还

建议与咨询 留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案： 新增检索档案 确定 取消

请选择收藏分类： 新增自定义分类 确定 取消

通借通还

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

请选择保存的检索档案：

请选择收藏分类：