Adaptive Just-In-Time Code Diversification

Abstract

We present a method to regenerate diversified code dynamically in a Java bytecode JIT compiler, and to update the diversification frequently during the execution of the program. This way, we can significantly reduce the time frame in which attackers can let a program leak useful address space information and subsequently use the leaked information in memory exploits. A proof of concept implementation is evaluated, showing that even though code is recompiled frequently, we can achieved smaller overheads than the previous state of the art, which generated diversity only once during the whole execution of a program.

Moving target defense: state of the art and characteristics

“…In adaptive just-in-time (JIT) code diversification (Jangda et al, 2015), the code is recompiled frequently by a Java bytecode JIT compiler during the execution of the program to generate multiple diversified variants for the target program. Its goal is to reduce the time frame between the two critical timestamps: time of leakage of useful address space information and time of use of the leaked information in an exploit.…”

“…As mentioned in Section 3, attack surface can be viewed as a set of all the properties of the system that can be used for attack. Attack surface reduction means reducing some of the properties, and the usual way to achieve attack surface reduction is to repair some vulnera- (Azab et al, 2011), end-to-end software randomly chosen to replace the current candidate) diversity (Christodorescu et al, 2011), practical software diversification (Pappas et al, 2013), SEM (Cui and Stolfo, 2011), proactive obfuscation (Roeder and Schneider, 2010), HMS (le Goues et al, 2013), NOMAD (Vikram et al, 2013), adaptive JIT code diversification (Jangda et al, 2015), OF-RHM (Jafarian et al, 2012), spatio-temporal address mutation (Jafarian et al, 2014), and MOTAG (Jia et al, 2013) Choosing by rotation (the next candidate is chosen SCIT (Bangalore and Sood, 2009), MAS (Huang and Ghosh, by turns) 2011), and MORE (Thompson et al, 2014) Choosing according to function (the next MT6D (Dunlop et al, 2011), RHM (Al-Shaer et al, 2013), candidate is calculated by a function) MTD-MANETs (Albanese et al, 2013), the SDN shuffle approach (MacFarland and Shue, 2015), the SDN-based frequency-minimal MTD approach (Debroy et al, 2016), and RPAH (Luo et al, 2015) Choosing according to game theory (this method Manadhata (2013), Zhu and Başar (2013), is used to provide a general method for attack and Carter et al (2014) surface shifting, and there can be multiple specific strategies under the guidance of this method) Choosing according to the attack behavior observed Spatio-temporal address mutation (Jafarian et al, 2014), and or perceived (the next candidate is chosen to TALENT (Okhravi et al, 2011b) meet some specific security requirements) * (The next candidate is chosen based on an MTD MTD strategy for cloud-based services (Peng et al, 2014) service deployment strategy proposed by authors) * (The selection probability for each candidate OF-RHM (Jafarian et al, 2012) directly relates to the weight that is associated with each candidate based on a certain criterion) * (The next candidate (new configuration) is chosen…”

“…JIT code diversification (Jangda et al, 2015), MTD strategy for cloud-based services (Peng et al, 2014), MTD-MANETs (Albanese et al, 2013), MT6D (Dunlop et al, 2011), and RHM (Al-Shaer et al, 2013) Triggering by anomalous events (the mechanism ChameleonSoft (Azab et al, 2011), TALENT (Okhravi et al, 2011a), changes its candidate when there is an attack MAS (Huang and Ghosh, 2011), and MOTAG (Jia et al, 2013) or when the security level is decreased) * (Limited timeliness is triggered by user request) NOMAD (Vikram et al, 2013) * (Limited timeliness is achieved by the SDNA (Yackoski et al, 2011) occurrence of address rewriting when packets enter or exit the OS) * (Limited timeliness is achieved by setting the SDN shuffle approach (MacFarland and Shue, 2015) TTL value) * (Limited timeliness is achieved based on the SDN-based frequency-minimal MTD approach statistical attack pattern and probability) (Debroy et al, 2016) * Belonging to some other ways ment, while in le Goues et al (2013) it is the time when attack attempts are thwarted and detected. The third aspect is the vulnerabilities repaired by them respectively.…”

libmask: Protecting browser JIT engines from the devil in the constants

“…These techniques are implemented by [3], [6], [7] in compiler. [9], [8] and [29] implements these techniques in virtual machines and JIT. [10], [11] uses static binary re-writing to implement above techniques.…”

“…These implementations show that diversification has a positive impact on software security with negligible performance overhead. [8] relies on static NOP insertion techniques while [29] has shown that even less performance overhead could be achieved using dynamic adaptive NOP insertion.…”