Thorough static analysis of device drivers

Ball, Thomas; Bounimova, Ella; Cook, Byron; Levin, Vladimir; Lichtenberg, Jakob; McGarvey, Con; Ondrusek, Bohus; Rajamani, Sriram K.; Ustuner, Abdullah

doi:10.1145/1218063.1217943

Cited by 99 publications

(54 citation statements)

References 38 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Just as in the context of traditional desktop applications, this shift towards rich frameworks and APIs exposes ample opportunities for both runtime enforcement and bug finding [2,12,23]. Combined with runtime enforcement in the context of the browser [6,16,17,34], the use of frameworks can automatically result in significantly more secure applications without additional code annotation burden placed on the developer.…”

Section: Discussionmentioning

confidence: 99%

Using web application construction frameworks to protect against code injection attacks

Livshits

Erlingsson

2007

Proceedings of the 2007 Workshop on Programming Languages and Analysis for Security

View full text Add to dashboard Cite

In recent years, the security landscape has changed, with Web applications vulnerabilities becoming more prominent that vulnerabilities stemming from the lack of type safety, such as buffer overruns. Many reports point to code injection attacks such as cross-site scripting and RSS injection as being the most common attacks against Web applications to date. With Web 2.0 existing security problems are further exacerbated by the advent of Ajax technology that allows one to create and compose HTML content from different sources within the browser at runtime, as exemplified by customizable mashup pages like My Yahoo! or Live.com.This paper proposes a simple to support, yet a powerful scheme for eliminating a wide range of script injection vulnerabilities in applications built on top of popular Ajax development frameworks such as the Dojo Toolkit, prototype.js, and AJAX.NET. Unlike other client-side runtime enforcement proposals, the approach we are advocating requires only minor browser modifications. This is because our proposal can be viewed as a natural finer-grained extension of the same-origin policy for JavaScript already supported by the majority of mainstream browsers, in which we treat individual user interface widgets as belonging to separate domains.Fortunately, in many cases no changes to the development process need to take place: for applications that are built on top of frameworks described above, a slight framework modification will result in appropriate changes in the generated HTML, completely obviating the need for manual code annotation. In this paper we demonstrate how these changes can prevent cross-site scripting and RSS injection attacks using the Dojo Toolkit, a popular Ajax library, as an example.

show abstract

Section: Discussionmentioning

confidence: 99%

Using web application construction frameworks to protect against code injection attacks

Livshits

Erlingsson

2007

Proceedings of the 2007 Workshop on Programming Languages and Analysis for Security

View full text Add to dashboard Cite

show abstract

“…However, utilization of programming languages cannot improve reliability of legacy device drivers. SLAM [13] uses the model checking method to find API usage errors in drivers. V.Chipounov et al [21] utilize the technique of the reverse engine to monitor the interaction between devices and drivers and detect the errors.…”

Section: Related Workmentioning

confidence: 99%

“…Yet, these methods require the device drivers to be rewritten, which introduces heavy workload. Automatic verification tools are used to detect driver faults, such as SLAM [13], SATABS [14] and Blast [15], but the sizes and complexity of the device drivers that they can handle are limited.…”

Section: Introductionmentioning

confidence: 99%

Serialdriver: improving the reliability of device drivers through serialization

Zhao

2012

IEEE Trans. Consumer Electron.

View full text Add to dashboard Cite

A great number of consumer electronic devices have emerged in recent years. To support these devices, many device drivers have been developed. These device drivers usually work in operating systems. Improper concurrency management causes lots of device driver bugs and the drivers' failures often lead to operating system crashes. Various approaches have been proposed to solve this problem, some of which use serialization to avoid the concurrency faults. However, these methods need to rewrite all the device drivers. This paper proposes SerialDriver, a new architecture to solve the concurrency faults of device drivers based on serialization. The proposed SerialDriver is composed of three components: an interface adapter, a message queue and a request processing thread. With the help of the interface adapter, SerialDriver gets rid of the need for reimplementing device drivers. In SerialDriver, requests from kernel threads to a device driver are placed in a message queue. The request processing thread of SerialDriver delivers these requests to the device driver sequentially. Extensive evaluation results show that SerialDriver serializes requests for a device driver successfully and the overhead incurred by SerialDriver is acceptable 1 .

show abstract

“…Default drivers that loaded when signal acquisition device had been plugged in were Windows Driver Model (WDM) [67] on Windows NT/2000/XP, ALSA [68] on Linux, Core Audio [69] on Mac and WASAPI [70,71], on Windows Vista and Windows 7 operating systems, respectively. No driver installation was needed for full operation of the breathing frequency detection system.…”

Section: Hardware and Materials Preparationmentioning

confidence: 99%

Low latency breathing frequency detection and monitoring on a personal computer

Leskovsek

Ahlin²,

Cancer³

et al. 2011

Journal of Medical Engineering & Technology

View full text Add to dashboard Cite

We demonstrate a low latency respiratory/breathing frequency detection system that is fast (<5 ms), easy to operate, requires no batteries or external power supply and operates fully via computer-standard USB connection. Exercises in controlling ones breathing frequency, usually referred to as paced-breathing exercises, have shown positive effects in treating pulmonary diseases, cardiovascular diseases and stress/anxiety-related disorders. We developed a breathing frequency detection system which uses two pairs of microphones to detect exhalation activity, eliminate noise from the environment and stream the recording data via USB connection to a personal computer. It showed 97.1% reliability (10 subjects) when monitoring breathing activity in non-guided free breathing and 100% reliability (10 subjects) when monitoring breathing activity during interactive paced-breathing exercises. We also evaluated the breathing frequency detection systems noise elimination functionality which showed a reduction of 84.2 dB for stationary (white noise) and a reduction of 79.3 dB for non-stationary (hands clapping) noise.

show abstract

Thorough static analysis of device drivers

Cited by 99 publications

References 38 publications

Using web application construction frameworks to protect against code injection attacks

Using web application construction frameworks to protect against code injection attacks

Serialdriver: improving the reliability of device drivers through serialization

Low latency breathing frequency detection and monitoring on a personal computer

Contact Info

Product

Resources

About