Simple and Practical Integrity Models for Binaries and Files

Abstract

Software environments typically depend on implicit sharing of binaries where binaries are created, loaded/executed and updated dynamically which we call the binary lifecycle. Windows is one example where many attacks exploit vulnerabilities in the binary lifecycle of software. In this paper, we propose a family of binary integrity models with a simple and easy to use trust model, to help protect against such attacks. We implement a prototype in Windows which protects against a variety of common binary attacks. Our models are easy to use while maintaining existing software compatibility, i.e. work with the implicit binary lifecycle requirements of the software and assumptions on binary sharing. We also propose a conservative extension to protect critical non-binary files.

HPCgnature: a hardware‐based application‐level intrusion detection system

“…Having an initially trusted binary application as input, application‐level intrusion detection systems (app‐IDSs) are specific types of HIDSs try to find anomalous behaviours of the specific application. The approach could be used as a complementary method even if the system is protected by preventive approaches such as binary access control [7], authentication [8], or attestation [9, 10].…”