基于约束的软件多样性对代码重用攻击的有效抑制
Constraint-Based Software Diversification for Efficient Mitigation of Code-Reuse Attacks
摘要：
现代软件部署过程产生的软件是统一的，因此容易受到大规模代码重用攻击。基于编译器的多样化通过自动生成给定程序的不同汇编代码版本来提高软件系统的弹性和安全性。现有的技术是有效的，但不具有对生成的代码变体的质量的精确控制。本文介绍了多样性的建设（DivCon），基于约束的编译方法，软件多样化。与以前的方法不同，DivCon允许用户控制和调整多样性和代码质量的冲突目标。一个关键的推动因素是使用大型邻近搜索（LNS）来高效地生成高度多样化的汇编代码。使用两个流行的编译器基准测试套件的实验证实，有一个权衡每个汇编代码版本的质量和整个版本池的多样性。我们的研究结果表明，DivCon允许用户在这两个属性之间进行交易，生成不同的汇编代码的质量范围。特别是，实验表明，DivCon能够有效地减轻代码重用攻击，同时提供接近最优的代码（< 10%的最优性差距）。对于约束编程的研究人员和从业者，本文表明，LNS是一个有价值的技术，寻找不同的解决方案。对于安全研究人员和软件工程师，DivCon将基于编译器的多样化扩展到性能关键和资源受限的应用程序。
英文摘要：
Modern software deployment process produces software that is uniform, and hence vulnerable to large-scale code-reuse attacks. Compiler-based diversification improves the resilience and security of software systems by automatically generating different assembly code versions of a given program. Existing techniques are efficient but do not have a precise control over the quality of the generated code variants. This paper introduces Diversity by Construction (DivCon), a constraint-based compiler approach to software diversification. Unlike previous approaches, DivCon allows users to control and adjust the conflicting goals of diversity and code quality. A key enabler is the use of Large Neighborhood Search (LNS) to generate highly diverse assembly code efficiently. Experiments using two popular compiler benchmark suites confirm that there is a trade-off between quality of each assembly code version and diversity of the entire pool of versions. Our results show that DivCon allows users to trade between these two properties by generating diverse assembly code for a range of quality bounds. In particular, the experiments show that DivCon is able to mitigate code-reuse attacks effectively while delivering near-optimal code (< 10% optimality gap). For constraint programming researchers and practitioners, this paper demonstrates that LNS is a valuable technique for finding diverse solutions. For security researchers and software engineers, DivCon extends the scope of compiler-based diversification to performance-critical and resource-constrained applications.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
