Architectural Enhancement and System Software Support for Program Code Integrity Monitoring in Application-Specific Instruction-Set Processors

Program code in a computer system can be altered either by malicious security attacks or by various faults in microprocessors. At the instruction level, all code modifications are manifested as bit flips. In this work, we present a generalized methodology for monitoring code integrity at run-time in application-specific instruction set processors (ASIPs), where both the instruction set architecture (ISA) and the underlying micro architecture can be customized for a particular application domain. We embed monitoring microoperations in machine instructions, thus the processor is augmented with a hardware monitor automatically. The monitor observes the processor's execution trace of basic blocks at run-time, checks whether the execution trace aligns with the expected program behavior, and signals any mismatches. Since microoperations are at a lower software architecture level than processor instructions, the microarchitectural support for program code integrity monitoring is transparent to upper software levels and no recompilation or modification is needed for the program. Experimental results show that our microarchitectural support can detect program code integrity compromises with small area overhead and little performance degradation

This paper describes the creation of custom floating point units (FPUs) for application specific instruction set processors (ASIPs). ASIPs allow the customization of processors for use in embedded systems by extending the instruction set, which enhances the performance of an application or a class of applications. These extended instructions are manifested as separate hardware blocks, making the creation of any necessary floating point instructions quite unwieldy. On the other hand, using a predefined FPU includes a large monolithic hardware block with considerable number of unused instructions. A customized FPU will overcome these drawbacks, yet the manual creation of one is a time consuming, error prone process. This paper presents a methodology for automatically generating floating-point units (FPUs) that are customized for specific applications at the instruction level. Generated FPUs comply with the IEEE754 standard, which is an advantage over FP format customization. Custom FPUs were generated for several Mediabench applications. Area savings over a fully-featured FPU without resource sharing of 26%-80% without resource sharing and 33%-87% with resource sharing, were obtained. Clock period increased in some cases by up to 9.5% due to resource sharing

In the block ciphers, though the operation is quite complex, there are a lot of similar characteristics including arithmetic unit, operation width, parallel data and ordinal implement. It is very suitable for designing ASIP (application specific instruction set processor) targeted at block ciphers. In this thesis, a reconfigurable processor architecture is proposed, At the mean time, in order to improve instruction level parallelism. This thesis put forward the instruction bundle structure based on VLIW architecture, which supports word and sub-word parallel processing. As to the design of cipher arithmetic units, we adopt a specific design which is reconfigurable, so as to make the architecture have instruction level reconfigurable function. Besides, In order to solve the bottleneck of storage and access, this thesis adopt clustered technology to design two separated register files to storage data and subkey. Furthermore, this scheme reduces energy and clock cycles. A number of algorithms were implemented successfully on the processor. The prototype is realized using Alterapsilas FPGA. Synthesis, placement and routing of processor have accomplished under 0.18 mum CMOS technology through design complier tool. Compared with other ASIP targeted at block cipher, the results prove that processor can achieve relatively high performance in block cipher algorithms processing.

For remote malicious code injection attacks, the analysis of injected code behavior has always been the difficulty of malicious code dynamic analysis. In this paper, a remote code injection behavior analysis method based on code refactoring was proposed. By analyzing the behavior of remote code injection attack, extracting the injection behavior pattern rules, analyzing the malicious code by using the dynamic binary analysis platform, identifying the remote injection behavior in the execution process, obtaining the remote injected malicious data, then refactoring and executing the injected code, and finally triggering the hidden behavior of injected code, this method improves the integrity of malicious code behavior analysis. A series of malicious code samples were also used for experimental analysis. And the results showed that this method can obtain more comprehensive behavior information for malicious code with remote injection, and effectively improve the integrity of malicious code analysis.

Mobile Cloud Computing is a combination of Mobile Computing, Cloud Computing and wireless networks to convey rich computational resources to mobile users, network operators, as well as cloud computing providers. Nowadays, the market of mobile devices and its applications are growing at an alarming speed. In general, single application for a specific purpose is not compatible to different operating systems. So the developer has to develop various versions of application which is compatible to different platforms. In order to overcome the drawback of compatibility and interoperability issues, HTML5-based mobile applications are built by using standard web technologies. HTML5-based mobile applications support same version of application in different platforms, but these applications are vulnerable to attacks because of the data and code being fused together. A new form of Code Injection Attack found in this type of mobile applications inherits the property of XSS attack and also uses many channels to inject malicious code such as Contact, SMS, WIFI, NFC, Barcode etc. This allows the attacker to inject malicious code to exhaust all the resources of the victim. Therefore, security is the major issue which impedes the development of Mobile Cloud Computing. This paper surveys the malicious code injection attacks in Mobile Cloud Computing environment and the possible solutions.

Recent cyberattacks targeting Supervisory Control and Data Acquisition (SCADA)/Industrial Control System(ICS) exploit weaknesses of host system software environment and take over the control of host processes in the host of the station network. We analyze the attack path of these attacks, which features how the attack hijacks the host in the network and compromises the operations of field device controllers. The paper proposes a host-based protection method, which can prevent malware penetration into the process memory by code injection attacks. The method consists of two protection schemes. One is to prevent file-based code injection such as DLL injection. The other is to prevent fileless code injection. The method traces changes in memory regions and determine whether the newly allocated memory is written with malicious codes. For this method, we show how a machine learning method can be adopted.

In highly scaled nano-CMOS devices, soft errors and aging defects are a design concern. Online detection of errors is necessary to address such errors. For online error detection in microprocessors, redundant execution of the entire pipeline has been studied. Software solutions for such re-execution impose significant performance penalty due to competition for execution resources between the main and the redundant threads, while hardware implementations incur large area overhead. Previously, researchers have proposed alternative low-cost mechanisms targeting only the execution stage of the processor pipeline. Earlier work, however, (i) neglects the effect of such redundant execution in simultaneous multi-threaded processors, (ii) neglects the energy overhead of such redundant execution and (iii) only focus on soft error detection, while neglecting detection of hard errors. In this paper, we extend the earlier work by addressing these shortcomings. Our studies indicate that prior solutions are either energy or performance efficient, but not both. Towards this end, we explore a hybrid scheme based on earlier work that is both energy and performance efficient. Results indicate that such a hybrid scheme may result in performance and energy improvement of 5% when compared to earlier solutions. This is a significant improvement since unlike previous schemes, the proposed scheme enables detection of both soft and hard errors.

Subsequently to the wall of performance and power consumption, the dependability of computing, caused by soft errors, has become a growing design concern. Since Register Files (RFs) are very frequently accessed and available protecting techniques usually provoke significant power penalty and performance degradation, soft errors occurred in RFs are among the top reasons for affecting system reliability. Based on our previous analytical method, which is able to estimate the living probability of target registers, we propose a compiler optimization approach that can enhance the reliability of programs without extra costs. Under the constraints of instruction dependencies, we describe the concrete algorithm for basic block scheduling in a dynamic programming fashion, whose basic idea is to decrease the total live intervals that are vulnerable to soft errors during the execution process. We also present a register renaming method for improving the capability of scheduling. Experimental results from the MiBench benchmarks indicate that the average reliability of programs have been improved for 4.41% without palpable overhead.

The automatic detection of divergences from a desired process behavior is a common research topic in the business process management community. An established technique to analyze processes is called conformance checking. Given a definition of a process in form of a process model, conformance checking can be used to test whether the executions of a process contained in a so-called event log data structure are conforming with the process as it was defined. The result is a comparison of the execution traces and their respective correct execution, according to the process model. This technique provides insights into where the divergence has occurred and how the execution must be altered to conform to the process model. However, a problem is that it requires a process model to be available. Process models in the correct format are not always available. Contrary to conformance checking, process anomaly detection aims to find anomalous executions without relying on a predefined process model. A process anomaly detection algorithm derives the process logic from the event log itself and exploits the patterns found within the event log to distinguish normal from anomalous process executions. Though process anomaly detection provides the benefit of not relying on a process model, it typically does not provide the level of detail that conformance checking does. A process execution can either be normal or it can be anomalous. This dissertation proposes process anomaly correction, a novel approach that combines the benefits of conformance checking and process anomaly detection. Given only an event log, process anomaly correction detects anomalous executions, clearly indicates where the anomaly has occurred during the execution and suggests possible corrective measures. The solution presented in this work is based on a new concept to the field of process anomaly detection: Process learning. In process learning, the task of understanding the process based on the example data is transformed into a learning problem in which a neural network is trained to predict the very next activity in a running process execution. The resulting machine learning model thus represents an approximation of the real process that created the data. This cumulative dissertation consists of five contributions to the field of business process management that demonstrate how, starting from a process anomaly detection, process anomaly correction is achieved in a series of four steps. (1) Process learning is employed to generate an approximated model of the process logic. (2) The limitation of only distinguishing between normal and anomalous process executions is overcome by employing the process learning model which processes the process executions on a finer level of detail than existing approaches. (3) The necessity of providing manual threshold settings, as it is typical for process anomaly detection algorithms, is replaced by an automatic parameterization utilizing the process learning model. (4) The predictive capabilities of the process learning model are exploited to generate possible corrections of detected anomalies. The resulting process anomaly correction approach can be employed in scenarios where classic conformance checking would be infeasible, due to the restriction of relying on a process model. Furthermore, it can be employed alongside classical conformance checking, for it incorporates more information coming from the event log than classical conformance checking (such as employees executing a process step, in which country the process is executed, etc.), and thus provides a new perspective for the process analyst.

<p>Malicious code threatens the safety of computer systems. Researching malicious code design techniques and mastering code behavior patterns are the basic work of network security prevention. With the game of network offense and defense, malicious code shows the characteristics of invisibility, polymorphism, and multi-dismutation. How to correctly and effectively understand malicious code and extract the key malicious features is the main goal of malicious code detection technology. As an important method of program understanding, program slicing is used to analyze the program code by using the idea of “decomposition”, and then extract the code fragments that the analyst is interested in. In recent years, data mining and machine learning techniques have been applied to the field of malicious code detection. The reason why it has become the focus of research is that it can use data mining to dig out meaningful patterns from a large amount of existing code data. Machine learning can It helps to summarize the identification knowledge of known malicious code, so as to conduct similarity search and help find unknown malicious code. The machine learning heuristic malicious code detection method firstly needs to automatically or manually extract the structure, function and behavior characteristics of the malicious code, so we can first slice the malicious code and then perform the detection. Through the improvement of the classic program slicing algorithm, this paper effectively improves the slicing problem between binary code processes. At the same time, it implements a malicious code detection system. The machine code byte sequence variable-length N-gram is used as the feature extraction method to further prove that the efficiency and accuracy of malicious code detection technology based on data mining and machine learning. </p> <p> </p>

As the high performance computing (HPC) community continues to push towards exascale computing, HPC applications of today are only affected by soft errors to a small degree but we expect that this will become a more serious issue as HPC systems grow. We propose F-SEFI, a Fine-grained Soft Error Fault Injector, as a tool for profiling software robustness against soft errors. We utilize soft error injection to mimic the impact of errors on logic circuit behavior. Leveraging the open source virtual machine hypervisor QEMU, F-SEFI enables users to modify emulated machine instructions to introduce soft errors. F-SEFI can control what application, which sub-function, when and how to inject soft errors with different granularities, without interference to other applications that share the same environment. We demonstrate use cases of F-SEFI on several benchmark applications with different characteristics to show how data corruption can propagate to incorrect results. The findings from the fault injection campaign can be used for designing robust software and power-efficient hardware.

Authors of obfuscated malicious code generally use the code obfuscation counter technology to improve the difficulty of being reversely analyzed for programming and hide critical code, data and program logic. The detection for malicious code of code obfuscation has become one of the popular topics being researched both domestically and abroad. In this study, a method for detecting the obfuscated malicious code with behavior connection is proposed. In this method, malicious acts are described based on the extended control flow graph to improve the descriptive power of self-modifying and obfuscated code. Furthermore, interference from malicious code brought by shell adding and obfuscation is eliminated by combining the method of stain diffusion and symbolic execution. Then malicious codes are extracted and detected based on behavior connection feature. As a result, accuracy of detecting the obfuscated malicious code is enhanced.

Network communication protocol reverse-engineering is important for malicious software analysis. Security analysts need to rewrite messages sent and received by malicious software according to the protocol to control the malware's malicious behaviors. To enable such rewriting, we need detailed information about the sent message by the malware program in target host in the network dialog. However, recent works on sent message extraction have limitations and the source code of malware program is usually not obtained. This paper proposes an analysis method to extract sent message format by processing executables. This paper obtains the reliable execution trace of malware program firstly, then gets the syntax structure of the send buffer of sent function combining the binary code analysis technique with the binary dynamic backward program slicing technique. Finally we exploit the dynamic taint analysis to extract the semantic information of different syntax fields. The experimental results show that our analysis framework can effectively analyze format information of malware's sent message.

The goal of white-box cryptography is to implement cryptographic algorithms securely in software in the presence of an adversary that has complete access to the software’s program code and execution environment. In particular, white-box cryptography needs to protect the embedded secret key from being extracted. Bos et al. (CHES 2016) introduced differential computational analysis (DCA), the first automated attack on white-box cryptography. The DCA attack performs a statistical analysis on execution traces. These traces contain information such as memory addresses or register values, that is collected via binary instrumentation tooling during the encryption process. The white-box implementations that were attacked by Bos et al., as well as white-box implementations that have been described in the literature, protect the embedded key by using internal encodings techniques introduced by Chow et al. (SAC 2002). Thereby, a combination of linear and non-liner nibble encodings is used to protect the secret key. In this paper we analyse the use of such internal encodings and prove rigorously that they are too weak to protect against DCA. We prove that the use of non-linear nibble encodings does not hide key dependent correlations, such that a DCA attack succeeds with high probability.

In modern processor based systems, techniques of evaluating the soft error effect on register files (RF) is very important because it makes fine grained protection viable. This paper describes GBMW (Graph Based Mask Window analysis), a framework that can capture soft error masking effects accurately in register files at instruction level. Comparing with previous studies, GBMW not only considers logical masking effects, but also takes error propagation effects and error post-masking effects into account. We verify our method by using fault inject (FI) as a baseline and comparing our method with traditional ones. The results show that GBMW decreases the average error rate to 1/3 of those using traditional methods when predicting soft error masking effects. Furthermore, GBMW still has comparable running time.