東華大學圖書館 |

語系: 繁體中文

說明(常見問題)

回圖書館首頁

手機版館藏查詢

登入

回首頁

切換: 標籤 | MARC模式 | ISBD

Battling Cyber Attacks with Software...

Xu, Jun.

FindBook

Google Book

Amazon

博客來

Battling Cyber Attacks with Software Crash Diagnosis.

紀錄類型:	書目-電子資源 : Monograph/item
正題名/作者:	Battling Cyber Attacks with Software Crash Diagnosis./
作者:	Xu, Jun.
出版者:	Ann Arbor : ProQuest Dissertations & Theses, : 2018,
面頁冊數:	137 p.
附註:	Source: Dissertations Abstracts International, Volume: 80-06, Section: B.
Contained By:	Dissertations Abstracts International80-06B.
標題:	Information science. -
電子資源:	http://pqdd.sinica.edu.tw/twdaoapp/servlet/advanced?query=13804074
ISBN:	9780438717763

Battling Cyber Attacks with Software Crash Diagnosis.
Xu, Jun.

Battling Cyber Attacks with Software Crash Diagnosis. - Ann Arbor : ProQuest Dissertations & Theses, 2018 - 137 p.

Source: Dissertations Abstracts International, Volume: 80-06, Section: B.

Thesis (Ph.D.)--The Pennsylvania State University, 2018.

Software systems are expanding into every aspect of human society. Accompanying this expansion comes a substantial growth of motivated adversaries and sophisticated attacks. This pair of impulses make it imperative to secure software systems. To the security of software systems, a fundamental threat is vulnerability - a type of defect that allows adversaries to exploit for malicious intentions. The battle against software vulnerabilities started two decades ago. Recently, the security community has been developing a consistent philosophy. It starts with vulnerability discoveries during product development and in-house testing. These are augmented by re-engineering the software systems to enforce run-time protections. These two lines of technique mitigate a great number of vulnerabilities, but they cannot resolve all of them. The reason behind is that vulnerability discovery does not scale well to large software and complicated vulnerabilities while in-depth run-time protection incurs performance overhead that goes beyond practical acceptance. This results in the practice that a substantial number of vulnerabilities are shipped to end users and we have no corresponding counteractions. Among those unresolved vulnerabilities, there is an interesting observation-when those vulnerabilities are triggered either during exploit tests by attackers or normal operations by benign users, the software often runs into failure. The most common type of failure is software crash. According to Microsoft, it observes millions of crashes every day. Among the root causes of those crashes, nearly 10% are vulnerabilities. My dissertation research is inspired by this practice and explores to identify unresolved vulnerabilities with automated software crash diagnosis. After a software has crashed, it typically leaves behind a snapshot of its crashing state in the form of a core dump. I design and implement CREDAL, an automatic diagnosis tool, to combine information in the core dump and source code of the crashed program to provide informative aid in tracking down the crash causes. CREDAL is featured with the capability to analyze crashes due to a common type of vulnerability known as memory corruption. For a core dump carrying corrupted memory, CREDAL systematically analyzes the core dump and identifies the crash point and stack frames. Further, CREDAL pinpoints the objects holding corrupted data using the source code along with the stack frames. To assist in tracking down the root cause, CREDAL also performs analysis and highlights the source code fragments responsible for the memory corruption. The development of CREDAL carries two assumptions - source code is available and the crash occurred in a random exercise scenario. Because of that, CREDAL may experience usability and reliability problems. To address those shortcomings of CREDAL, I then designed POMP to locate the vulnerabilities behind software crashes, even when the source codes are unavailable and the crashed execution was under attack. POMP leverages a hardware feature on recent generations of Intel processors, Processor Tracing (PT), to trace the software execution and it includes the trace in the core dump. Along with the execution trace, POMP introduces a new reverse execution mechanism to construct the data flow prior to the crash. POMP then performs a backward taint analysis and highlights those instructions that actually pertain to the vulnerability, making the diagnosis more effective.

ISBN: 9780438717763Subjects--Topical Terms:

554358
Information science.

Battling Cyber Attacks with Software Crash Diagnosis.
LDR:04444nmm a2200301 4500 001 2207860
005 20190923114243.5
008 201008s2018 ||||||||||||||||| ||eng d
020 $a 9780438717763
035 $a (MiAaPQ)AAI13804074
035 $a AAI13804074
040 $a MiAaPQ $c MiAaPQ
100 1 $a Xu, Jun. $3 1297291
245 1 0 $a Battling Cyber Attacks with Software Crash Diagnosis.
260 1 $a Ann Arbor : $b ProQuest Dissertations & Theses, $c 2018
300 $a 137 p.
500 $a Source: Dissertations Abstracts International, Volume: 80-06, Section: B.
500 $a Publisher info.: Dissertation/Thesis.
500 $a Advisor: Liu, Peng.
502 $a Thesis (Ph.D.)--The Pennsylvania State University, 2018.
520 $a Software systems are expanding into every aspect of human society. Accompanying this expansion comes a substantial growth of motivated adversaries and sophisticated attacks. This pair of impulses make it imperative to secure software systems. To the security of software systems, a fundamental threat is vulnerability - a type of defect that allows adversaries to exploit for malicious intentions. The battle against software vulnerabilities started two decades ago. Recently, the security community has been developing a consistent philosophy. It starts with vulnerability discoveries during product development and in-house testing. These are augmented by re-engineering the software systems to enforce run-time protections. These two lines of technique mitigate a great number of vulnerabilities, but they cannot resolve all of them. The reason behind is that vulnerability discovery does not scale well to large software and complicated vulnerabilities while in-depth run-time protection incurs performance overhead that goes beyond practical acceptance. This results in the practice that a substantial number of vulnerabilities are shipped to end users and we have no corresponding counteractions. Among those unresolved vulnerabilities, there is an interesting observation-when those vulnerabilities are triggered either during exploit tests by attackers or normal operations by benign users, the software often runs into failure. The most common type of failure is software crash. According to Microsoft, it observes millions of crashes every day. Among the root causes of those crashes, nearly 10% are vulnerabilities. My dissertation research is inspired by this practice and explores to identify unresolved vulnerabilities with automated software crash diagnosis. After a software has crashed, it typically leaves behind a snapshot of its crashing state in the form of a core dump. I design and implement CREDAL, an automatic diagnosis tool, to combine information in the core dump and source code of the crashed program to provide informative aid in tracking down the crash causes. CREDAL is featured with the capability to analyze crashes due to a common type of vulnerability known as memory corruption. For a core dump carrying corrupted memory, CREDAL systematically analyzes the core dump and identifies the crash point and stack frames. Further, CREDAL pinpoints the objects holding corrupted data using the source code along with the stack frames. To assist in tracking down the root cause, CREDAL also performs analysis and highlights the source code fragments responsible for the memory corruption. The development of CREDAL carries two assumptions - source code is available and the crash occurred in a random exercise scenario. Because of that, CREDAL may experience usability and reliability problems. To address those shortcomings of CREDAL, I then designed POMP to locate the vulnerabilities behind software crashes, even when the source codes are unavailable and the crashed execution was under attack. POMP leverages a hardware feature on recent generations of Intel processors, Processor Tracing (PT), to trace the software execution and it includes the trace in the core dump. Along with the execution trace, POMP introduces a new reverse execution mechanism to construct the data flow prior to the crash. POMP then performs a backward taint analysis and highlights those instructions that actually pertain to the vulnerability, making the diagnosis more effective.
590 $a School code: 0176.
650 4 $a Information science. $3 554358
650 4 $a Computer science. $3 523869
690 $a 0723
690 $a 0984
710 2 $a The Pennsylvania State University. $b Information Sciences and Technology. $3 2095842
773 0 $t Dissertations Abstracts International $g 80-06B.
790 $a 0176
791 $a Ph.D.
792 $a 2018
793 $a English
856 4 0 $u http://pqdd.sinica.edu.tw/twdaoapp/servlet/advanced?query=13804074