检索结果-内蒙古大学图书馆

40th Annual IEEE Computer Software and Applications Conference Symposium (COMPSAC) / Symposium on Software Engineering Technology and Applications (SETA)

作者： Jiang, Yufei Wu, Dinghao Liu, Peng Penn State Univ University Pk PA 16802 USA

ISBN: (纸本)9781467388450

Modern software engineering practice increasingly brings redundant code into software products, which has caused a phenomenon called bloatware, leading to software system maintenance, performance and reliability issues as well as security problems. With the rapid advances of smart devices and a more connected world, it is never more important to trim bloatware to improve the leanness, agility, reliability, performance, and security of the interconnected software and network systems. Previous methods have limited scopes and are usually not fully automated. In this paper, we propose a new static-analysis-enabled approach to trimming unused code from both Java applications and Java Runtime Environment (JRE) automatically. We have built a tool called JRed on top of the Soot framework. We have conducted a fairly comprehensive evaluation of JRed based on a set of criteria: code size, code complexity, memory footprint, execution and garbage collection time, and security. Our experimental results show that, Java application size can be reduced by 44.5% on average and the JRE code can be reduced by more than 82.5% on average. The code complexity is significantly reduced according to a set of well-known metrics. Furthermore, we report that by trimming redundant code, 48.6% of the known security vulnerabilities in the Java Runtime Environment JRE 6 update 45 has been removed.

关键词： Bloatware Java Runtime Environment program customization Software Analysis Static Analysis

来源：评论

学校读者我要写书评

暂无评论

Generic feature modules: Two-staged program customization

Generic feature modules: Two-staged program customization

引用

1st International Conference on Software and Data Technologies

作者： Apel, Sven Kuhlemann, Martin Leich, Thomas Otto Von Guericke Univ Magdeburg Germany

ISBN: (纸本)9728865694

With feature-oriented programming (FOP) and generics programmers have proper means for structuring software so that its elements can be reused and extended. This paper addresses the issue whether both approaches are equivalent. While FOP targets at large-scale building blocks and compositional programming, generics provide fine-grained customization at type-level. We contribute an analysis that reveals the individual capabilities of both approaches with respect to program customization. There from, we extract guidelines for programmers in what situations which approach suffices. Furthermore, we present a fully implemented language proposal that integrates FOP and generics in order to combine their strengths. Our approach facilitates two-staged program customization: (1) selecting sets of features;(2) parameterizing features subsequently. This allows a broader spectrum of code reuse to be covered-reflected by proper language level mechanisms. We underpin our proposal by means of a case study.

关键词： feature-oriented programming generics program customization software reuse software product lines

来源：评论

学校读者我要写书评

暂无评论

Hecate: Automated customization of program and Communication Features to Reduce Attack Surfaces 15th

Hecate: Automated Customization of Program and Communication...

引用

15th EAI International Conference on Security and Privacy in Communication Networks (SecureComm)

作者： Xue, Hongfa Chen, Yurong Venkataramani, Guru Lan, Tian George Washington Univ Washington DC 20052 USA

ISBN: (纸本)9783030372316;9783030372309

Customizing program and communication features is a commonly adopted strategy to counter security threats that arise from rapid inflation of software features. In this paper, we propose Hecate, a novel framework that leverages dynamic execution and trace to create customized, self-contained programs, in order to minimize potential attack surface. It automatically identifies program features (i.e., independent, well-contained operations, utilities, or capabilities) relating to application binaries and their communication functions, tailors and eliminates the features to create customized program binaries in accordance with user needs, in a fully unsupervised fashion. Hecate makes novel use of deep learning to identify program features and their constituent functions by mapping dynamic instruction trace to functions in the binaries. It enables us to modularize program features and efficiently create customized program binaries at large scale. We implement a prototype of Hecate using a number of open source tools such as DynInst and TensorFlow. Evaluation using real-world executables including OpenSSL and LibreOffice demonstrates that Hecate can create a wide range of customized binaries for diverse feature requirements, with the highest accuracy up to 96.28% for feature/function identification and up to 67% reduction of program attack surface.

关键词： program customization Deep learning Binary analysis

来源：评论

学校读者我要写书评

暂无评论

Implementing heap-object behavior prediction efficiently and effectively

引用

SOFTWARE-PRACTICE & EXPERIENCE 2001年第9期31卷 869-892页

作者： Seidl, ML Zorn, BG Univ Colorado Dept Comp Sci Boulder CO 80309 USA Microsoft Corp Redmond WA 98052 USA

Heap-allocated objects play an important role in many modern programs. Various results have shown the overall performance of these programs can be improved by increasing the reference locality of heap-allocated objects. In this paper we describe an approach that improves the virtual memory performance of allocation-intensive C programs by predicting the reference behavior and lifetime of heap objects as they are allocated, We further describe an implementation of our prediction algorithm and evaluate its performance on real programs. As part of our implementation, we present a low-overhead algorithm to minimize the cost of gathering run-time stack information, Finally, we show that an implementation of these algorithms has little overhead and can improve the virtual memory and TLB performance of programs substantially. Copyright (C) 2001 John Wiley & Sons, Ltd.

关键词： dynamic storage allocation profile-based optimization memory management program customization reference locality

来源：评论

学校读者我要写书评

暂无评论

AN APPROACH TO GENUINE DYNAMIC LINKING

引用

SOFTWARE-PRACTICE & EXPERIENCE 1991年第4期21卷 375-390页

作者： HO, WW OLSSON, RA Division of Computer Science University of California Davis CA 95616 U.S.A.

This paper describes a new approach to dynamic link/unlink editing. The basis of this approach is a library of link editing functions that can add compiled object code to or remove such code from a process any time during its execution. Loading modules, searching libraries, resolving external references, and allocating storage for global and static data structures are all performed at run time. This approach provides the efficiency of native machine code execution along with the flexibility to modify a program during its execution, thereby making many new applications possible. This paper also describes three sample applications of these dynamic link editing functions: program customization, incremental program development, and support for debugging and testing. A prototype of this approach is implemented under UNIX as a library package called did for the C programming language and is available for VAX, Sun 3 and SPARCstation machines.

关键词： DYNAMIC LINKING INCREMENTAL program DEVELOPMENT program customization DEBUGGING AND TESTING UNIX

来源：评论

学校读者我要写书评

暂无评论

CUSTOMALLOC - EFFICIENT SYNTHESIZED MEMORY ALLOCATORS

引用

SOFTWARE-PRACTICE & EXPERIENCE 1993年第8期23卷 851-869页

作者： GRUNWALD, D ZORN, B Department of Computer Science Campus Box 430 University of Colorado Boulder 80309-0430 U.S.A.

The allocation and disposal of memory is a ubiquitous operation in most programs. Rarely do programmers concern themselves with details of memory allocators;most assume that memory allocators provided by the system perform well. Yet, in some applications, programmers use domain-specific knowledge in an attempt to improve the speed or memory utilization of memory allocators. In this paper, we describe a program (CustoMalloc) that synthesizes a memory allocator customized for a specific application. Our experiments show that the synthesized allocators are uniformly faster and more space efficient than the Berkeley UNIX allocator. Constructing a custom allocator requires little programmer effort, usually taking only a few minutes. Experience has shown that the synthesized allocators are not overly sensitive to properties of input sets and the resulting allocators are superior even to domain-specific allocators designed by programmers. Measurements show that synthesized allocators are from two to ten times faster than widely-used allocators.

关键词： DYNAMIC STORAGE ALLOCATION PROFILE-BASED OPTIMIZATION MEMORY MANAGEMENT PERFORMANCE EVALUATION program customization

来源：评论

学校读者我要写书评

暂无评论

CustomPro: Network Protocol customization Through Cross-Host Feature Analysis 15th

CustomPro: Network Protocol Customization Through Cross-Host...

引用

15th EAI International Conference on Security and Privacy in Communication Networks (SecureComm)

作者： Chen, Yurong Lan, Tian Venkataramani, Guru George Washington Univ Washington DC 20052 USA

ISBN: (纸本)9783030372316;9783030372309

The implementations of network protocols are often "bloated" due to various users' needs and complex environment for deployment. The continual expansion of program features contribute to not only growing complexity but also increased the attack surface, making the maintenance of network protocol security very challenging. Existing works try to mitigate program bloat by source-code level static analysis (such as tainting and slicing) or dynamic techniques such as binary reuse. While source code is not always available for the former technique, the latter suffers from limited code coverage because of the incomplete input space. In this paper, we propose CustomPro, a new approach for automated customization of network protocols. We adopt whole system emulation, dynamic tainting and symbolic execution to identify desired code from the original program binaries, then leverage binary rewriting techniques to create a customized program binary that only contains the desired functionalities. We implement a prototype of CustomPro and evaluate its feasibility using OpenSSL (a widely used SSL implementation) and Mosquitto (an IoT messaging protocol implementation). The results show that CustomPro is able to create functional program binaries with only desired features and significantly reduce the potential attack surface by targeting and eliminating unwanted protocol features.

关键词： program customization Binary rewriting Cross-host tainting

来源：评论

学校读者我要写书评

暂无评论

Verify-Pro: A Framework for Server Authentication using Communication Protocol Dialects

Verify-Pro: A Framework for Server Authentication using Comm...

引用

IEEE Military Communications Conference (MILCOM)

作者： Gogineni, Kailash Mei, Yongsheng Venkataramani, Guru Lan, Tian George Washington Univ Dept Elect & Comp Engn Washington DC 20052 USA

ISBN: (纸本)9781665485340

Customizing program binary and communication features is a commonly adopted strategy to counter network security threats like session hijacking, context confusion, and impersonation attacks. A potential attacker may have enough time to launch an attack targeting these vulnerabilities by rerouting the target request to a malicious server or hijacking the traffic. This paper presents a novel system Verify-Pro, a framework for server authentication using communication protocol dialects by customizing the communication features, enforcing continuous authentication, detecting the adversary, and preventing sensitive information leakage. Specifically, we leverage a machine learning approach (pre-trained neural network model) on both client and server machines to trigger a specific dialect that dynamically changes for each request (e.g., get filename in FTP). Then, a decision tree algorithm is developed to automatically detect the adversary and terminate the entire session if the message is from an adversary. We implement a prototype of VerifyPro and evaluate its practicality on standard communication protocol: FTP (File Transfer Protocol) and present a case study of the internet of things protocol MQTT (Message Queuing Telemetry Transport). Our experimental results show that by sending misleading information through the message packets from an attacker at the application layer, it is possible for the recipient to identify if the sender is genuine or a spoofed one, with a negligible overhead of < 1%.

关键词： program customization Protocol dialects Deep learning Authentication

来源：评论

学校读者我要写书评

暂无评论

TOSS: Tailoring Online Server Systems through Binary Feature customization 25

TOSS: Tailoring Online Server Systems through Binary Feature...

引用

Workshop on Forming an Ecosystem Around Software Transformation (FEAST)

作者： Chen, Yurong Sun, Shaowen Lan, Tian Venkataramani, Guru George Washington Univ Washington DC 20052 USA

ISBN: (纸本)9781450359979

Network-based models are increasingly adopted to deliver key software service and utilities (e.g., data storage, search, and processing) to end users. The need to satisfy diverse user requirements and to fit different application environment often leads to continual expansion and addition of new (and in many cases excessive) features, known as the feature creep problem. Existing work mitigating feature bloat often either debloats programs at source code level (which may not always be available, in particular for legacy systems) or customize binary only with respect to very limited scope of inputs. In this paper, we propose a new approach, TOSS , for automated customization of online servers and software systems, which are implemented using a client-server architecture based on the underlying network protocols. Specifically, TOSS harnesses program tracing and tainting-guided symbolic execution to identify desired (feature-related) code from the original program binary, and apply static binary rewriting to remove redundant features and directly create customized program binary with only desired features. We implement a prototype of TOSS and evaluate its feasibility using real-world executables including Mosquitto, which relies on the Message Queuing Telemetry Transport (MQTT) protocol for lightweight Internet of Things (IoT) communications. The results show that TOSS is able to create a functional program binary with only desired features and significantly reduce potential attack surface by eliminating undesired protocol/program features.

关键词： program customization network protocol binary rewriting

来源：评论

学校读者我要写书评

暂无评论

Verify-Pro: A Framework for Server Authentication using Communication Protocol Dialects

Verify-Pro: A Framework for Server Authentication using Comm...

引用

IEEE Military Communications Conference (MILCOM)

ISBN: (纸本)9781665485340

Customizing program binary and communication features is a commonly adopted strategy to counter network security threats like session hijacking, context confusion, and impersonation attacks. A potential attacker may have enough time to launch an attack targeting these vulnerabilities by rerouting the target request to a malicious server or hijacking the traffic. This paper presents a novel system Verify-Pro, a framework for server authentication using communication protocol dialects, to customize the communication features, enforce continuous authentication, detect the adversary, and prevent sensitive information leakage. Specifically, we leverage a machine learning approach (pre-trained neural network model) on both client and server machines to trigger a specific dialect that dynamically changes for each request (e.g., get filename in FTP). Then, a decision tree algorithm is developed to automatically detect the adversary and terminate the entire session if the message is from an adversary. We implement a prototype of VerifyPro and evaluate its practicality on standard communication protocol: FTP (File Transfer Protocol) and present a case study of the internet of things protocol MQTT (Message Queuing Telemetry Transport). Our experimental results show that by sending misleading information through message packets from an attacker at the application layer, the recipient can identify whether the sender is genuine or spoofed, with a negligible overhead of < 1%.

关键词： program customization Protocol dialects Machine Learning Network security Authentication

来源：评论

学校读者我要写书评

暂无评论

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案：

请选择收藏分类：

通借通还

建议与咨询 留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案： 新增检索档案 确定 取消

请选择收藏分类： 新增自定义分类 确定 取消

通借通还

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

请选择保存的检索档案：

请选择收藏分类：