TAG: Tagged Architecture Guide

Memory safety is instrumental to the safety and security of software systems. The Rust language stands out with a type system and underlying memory model targeting memory safety without the need for dynamic garbage collection, making Rust a viable option for embedded applications. In this paper we present an integrated tool for call-stack analysis of Rust applications. We cover both theoretical and practical challenges, their solutions and open questions. The cargo-call-stack tool is useful for analyzing Rust applications in general, and embedded Rust in particular. To the latter, we show that using the call-stack analysis we can give guarantees of total memory safety, free of assumptions on operating systems and underlying memory protection mechanisms in hardware. The feasibility of the approach is demonstrated by applying the `call-stack' tool on production code targeting a light-weight ARM Cortex-M platform.

Memory-safety violations are the primary cause of security and reliability issues in software systems written in unsafe languages. Given the limited adoption of decades-long research in software-based memory safety approaches, as an alternative, Intel released Memory Protection Extensions (MPX)---a hardware-assisted technique to achieve memory safety. In this work, we perform an exhaustive study of Intel MPX architecture along three dimensions: (a) performance overheads, (b) security guarantees, and (c) usability issues. We present the first detailed root cause analysis of problems in the Intel MPX architecture through a cross-layer dissection of the entire system stack, involving the hardware, operating system, compilers, and applications. To put our findings into perspective, we also present an in-depth comparison of Intel MPX with three prominent types of software-based memory safety approaches. Lastly, based on our investigation, we propose directions for potential changes to the Intel MPX architecture to aid the design space exploration of future hardware extensions for memory safety.

Memory safety continues to be a significant software reliability and security problem, and low overhead and low complexity hardware solutions have eluded computer designers. In this paper, we explore a pathway to deployable memory safety defenses. Our technique builds on a recent trend in software: the usage of binning memory allocators. We observe that if memory allocation sizes (e.g., malloc sizes) are made an architectural feature, then it is possible to overcome many of the thorny issues with traditional approaches to memory safety such as compatibility with unsecured software and significant performance degradation. We show that our architecture, No-FAT, incurs an overhead of 8% on SPEC CPU2017 benchmarks, and our VLSI measurements show low power and area overheads. Finally, as No-FAT's hardware is aware of the memory allocation sizes, it effectively mitigates certain speculative attacks (e.g., Spectre-V1) with no additional cost. When our solution is used for pre-deployment fuzz testing it can improve fuzz testing bandwidth by an order of magnitude compared to state-of-the-art approaches.

While automated verification of imperative programs has been studied intensively, proving termination of programs with explicit pointer arithmetic fully automatically was still an open problem. To close this gap, we introduce a novel abstract domain that can track allocated memory in detail. We use it to automatically construct a symbolic execution graph that over-approximates all possible runs of a program and that can be used to prove memory safety. This graph is then transformed into an integer transition system, whose termination can be proved by standard techniques. We implemented this approach in the automated termination prover AProVE and demonstrate its capability of analyzing C programs with pointer arithmetic that existing tools cannot handle.

We survey the notion of provably secure searchable encryption (SE) by giving a complete and comprehensive overview of the two main SE techniques: searchable symmetric encryption (SSE) and public key encryption with keyword search (PEKS). Since the pioneering work of Song, Wagner, and Perrig (IEEE S&P '00), the field of provably secure SE has expanded to the point where we felt that taking stock would provide benefit to the community.The survey has been written primarily for the nonspecialist who has a basic information security background. Thus, we sacrifice full details and proofs of individual constructions in favor of an overview of the underlying key techniques. We categorize and compare the different SE schemes in terms of their security, efficiency, and functionality. For the experienced researcher, we point out connections between the many approaches to SE and identify open research problems.Two major conclusions can be drawn from our work. While the so-called IND-CKA2 security notion becomes prevalent in the literature and efficient (sublinear) SE schemes meeting this notion exist in the symmetric setting, achieving this strong form of security efficiently in the asymmetric setting remains an open problem. We observe that in multirecipient SE schemes, regardless of their efficiency drawbacks, there is a noticeable lack of query expressiveness that hinders deployment in practice.

As the cost of human full genome sequencing continues to fall, we will soon witness a prodigious amount of human genomic data in the public cloud. To protect the confidentiality of the genetic information of individuals, the data has to be encrypted at rest. On the other hand, encryption severely hinders the use of this valuable information, such as Genome-wide Range Query (GRQ), in medical/genomic research. While the problem of secure range query on outsourced encrypted data has been extensively studied, the current schemes are far from practical deployment in terms of efficiency and scalability due to the data volume in human genome sequencing. In this paper, we investigate the problem of secure GRQ over human raw aligned genomic data in a third-party outsourcing model. Our solution contains a novel secure range query scheme based on multi-keyword symmetric searchable encryption (MSSE). The proposed scheme incurs minimal ciphertext expansion and computation overhead. We also present a hierarchical GRQ-oriented secure index structure tailored for efficient and large-scale genomic data lookup in the cloud while preserving the query privacy. Our experiment on real human genomic data shows that a secure GRQ request with range size 100,000 over more than 300 million encrypted short reads takes less than 3 minutes, which is orders of magnitude faster than existing solutions.

The Noise protocol framework defines a succinct notation and execution framework for a large class of 59+ secure channel protocols, some of which are used in popular applications such as WhatsApp and WireGuard. We present a verified implementation of a Noise protocol compiler that takes any Noise protocol, and produces an optimized C implementation with extensive correctness and security guarantees. To this end, we formalize the complete Noise stack in F <sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">*</sup> , from the low-level cryptographic library to a high-level API. We write our compiler also in F <sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">*</sup> , prove that it meets our formal specification once and for all, and then specialize it on-demand for any given Noise protocol, relying on a novel technique called hybrid embedding. We thus establish functional correctness, memory safety and a form of side-channel resistance for the generated C code for each Noise protocol. We propagate these guarantees to the high-level API, using defensive dynamic checks to prevent incorrect uses of the protocol. Finally, we formally state and prove the security of our Noise code, by building on a symbolic model of cryptography in F <sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">*</sup> , and formally link high-level API security goals stated in terms of security levels to low-level cryptographic guarantees. Ours are the first comprehensive verification results for a protocol compiler that targets C code and the first verified implementations of any Noise protocol. We evaluate our framework by generating implementations for all 59 Noise protocols and by comparing the size, performance, and security of our verified code against other (unverified) implementations and prior security analyses of Noise.

The Internet is a primary breeding ground for various network attacks, presenting a persistent challenge to cybersecurity. Machine learning has emerged as a powerful tool for automating the detection of cyber attacks and threats. Unlike traditional algorithms that rely on predefined signatures or rules, machine learning excels at uncovering complex patterns within vast volumes of Internet data. This capability enables the development of more intelligent and effective security solutions. The integration of machine learning into security systems has become a critical focus in both academia and industry. Nevertheless, the integration of machine learning and cybersecurity remains in its infancy. A significant gap exists between theory and practice: while machine learning may perform well in controlled or simulated environments, it may not work as expected in complex and dynamic real-world scenarios. Currently, machine learning security solutions are often evaluated using publicly available datasets in controlled laboratory settings. These lab-based evaluations introduce uncertainty about their practical effectiveness, which may hinder their adoption by security practitioners in real-world contexts. Proactive security measures aim to prevent threats before they cause harm, offering greater efficiency and effectiveness compared to reactive security, which relies on responsive strategies. Machine learning can enhance proactive security by automatically identifying potential vulnerabilities and predicting emerging threats, thereby strengthening the protection of Internet infrastructures. This dissertation aims to facilitate the application of machine learning in real-world cybersecurity settings, with a focus on addressing five core research questions: 1) What general challenges and limitations arise in the design, development, and deployment of practical ML-based security applications? 2) How can ML-based security solutions be effectively implemented in real-world scenarios? 3) What specific challenges and limitations are encountered when implementing such solutions in practical environments? 4) What current technologies, approaches, or solutions can be used to address these challenges and limitations, thereby facilitating the implementation of practical ML-based security systems? 5) What future research directions hold promise for advancing the practical application of machine learning in the cybersecurity field? We begin with a comprehensive literature review, identifying potential challenges and limitations in the practical application of machine learning (ML) within the field of cybersecurity. Building on these insights, we develop two practical tools designed to enhance existing proactive security mechanisms, directly addressing specific real-world challenges. Subsequently, we offer key recommendations regarding methodologies and solutions to mitigate obstacles in the development and deployment of realistic ML-based security systems. Finally, we propose future research directions, highlighting promising technologies and concepts with the potential to advance the field of practical ML applications in cybersecurity. This dissertation represents the first comprehensive investigation into the application of machine learning in realistic cybersecurity scenarios, with significant implications for the field of ML-based cybersecurity. It provides security researchers and practitioners with a deeper understanding of practical challenges and obstacles in this field. The development of two practical tools not only advances state-of-the-art proactive security mechanisms but also delivers actionable recommendations to assist researchers in addressing these challenges. Finally, the proposed future research directions highlight the potential of emerging technologies to enable more effective ML-driven security solutions in real-world environments. Overall, the insights presented in this dissertation help bridge the gap between theory and practice in ML-based cybersecurity, promoting the practical implementation of ML security systems that can replace or complement traditional approaches.

Security researchers believe that identifying software vulnerabilities is extremely important, and classifying vulnerabilities is a crucial part of software security analysis. This study on Software Vulnerability Assessment aims to make vulnerability risk assessments more objective. Errors in software design can negatively impact the security and reliability of the systems they run on. Researchers have proposed some methodologies when specifying threats, but some methods are not as scalable and flexible as required. We are taking this problem on to attack detection and mitigation during the design time of the software architecture. The proposed method minimizes the threat of software vulnerabilities by embracing an integrated security software vulnerability framework. This paper presents a framework for increasing software security called the secure software Vul-IAA (Identification, Analysis and Assessment) framework. The findings provide an improved understanding of software vulnerabilities and how they can be exploited and thus should help lead to more sophisticated software defenses.

It is with great pleasure that we welcome you to the 8th International Workshop on Security Measurements and Metrics (MetriSec 2012). This year's MetriSec will be a little different from previous years, and we are very excited to see how it will turn out. While we of course have a paper-presenting session and a keynote speech, we also have for the first time a panel discussion. Our mission of providing a venue where we share new ideas on how to obtain, use, deploy, and evaluate security metrics has not changed, and we wanted to try a more interactive workshop this time. Depending on the results, we might continue this style next year, so be sure to tell us what you think. The call for papers attracted nine submissions from Asia, Europe, and the United States. The program committee accepted four papers that cover a variety of topics, including vulnerability prediction, security visualisation, and attack surfaces. In addition, the programme has two other highlights. First, there will be a keynote speech by Peter Gutmann, entitled From Revenue Assurance to Assurance: The Importance of Measurement in Computer Security. Peter has been working on both software security and security software, and his book Cryptographic Security Architecture, Design and Verification (Springer Verlag 2003) should be on every developer's and every security researcher's bookshelf. The other highlight is a panel discussion on data sources for empirical work in computer security, and to what extent to trust them. Participants include Laurie Williams and Peter Gutmann; both have much experience with empirical work, so we look forward to a high-class discussion.

In the past decades, automated test case generation for detecting software vulnerabilities using the search-based algorithm has been a crucial research area for security researchers. Several proposed techniques partially achieve the automatic test case generation of detecting security issues that target specific programming languages or API types. This review paper performs a comparative analysis of research papers published during 2010–21 specific to the search-based techniques used for automatic test case generation. We have chosen five criteria for evaluating the proposed techniques. These are target vulnerability, search-based algorithms used, test case generation source, test case generation method, and target language. We focused primarily on the techniques detecting the four most dangerous vulnerabilities found in the modern distributed system, namely Denial of Service (e.g., program crash), SQL injection, Cross-Site Scripting, and XML injection. We also incorporated the fitness function comparison table for each method, including the merits and limitations. This work will assist security researchers in finding new directions in the field of search-based software security testing.KeywordsSecurity testingSearch-based software security testing (SBSST)SBSEProgram crashDoSXMLISQLIXSS

This paper describes an original technique for the joint feature and model selection in the context of support vector machine (SVM) classification applied as a diagnosis strategy in model-based fault detection and isolation (FDI). We demonstrate that the proposed technique contributes to the solution of an open research problem: to design a robust FDI procedure, correctly functioning with different operating conditions and fault sizes, specifically settled for an electric generation system based on solid oxide fuel cells (SOFCs). By using a quantitative model of the generation system coupled to an optimized SVM classifier, a satisfactory FDI procedure is achieved, which is robust against modeling and measurement errors and is compliant with practical deployment.

The modern web ecosystem relies heavily on the inclusion of third-party scripts as they offer useful, and often necessary, functionality. This inclusion leads to the "blending" of code from different origins, which has significant ramifications. Specifically, the inability to effectively and robustly disambiguate between first-party and embedded third-party scripts can severely undermine the security and privacy guarantees of existing defenses (e.g., blocking trackers or preventing vulnerabilities such as DOM XSS), as well as the validity of web measurement studies. To address that gap we propose StyxJS, a system that is able to provide real-time attribution of third-party scripts while preventing evasive tactics that can be employed by malicious scripts. This is achieved through an automated pipeline consisting of stack walking, script rewriting, browser API overriding, and tamper-proofing mechanisms. Crucially, our system does not require any developer input or prior knowledge about the website and can, thus, be readily incorporated into any countermeasure or web measurement apparatus that requires robust script attribution. We conduct an extensive experimental evaluation of our system and demonstrate that it accurately captures more script inclusion techniques compared to prior work, while incurring a negligible performance overhead, and effectively maintains page-deployed security mechanisms (e.g., CSP). We also detail the straightforward process and benefits of retrofitting a varied set of existing defenses on top of StyxJS, as well as leveraging it to analyze the web ecosystem. We will release our system as an open source project, to allow security researchers and practitioners to benefit from StyxJS’ capabilities.

Languages such as C and C++ use unsafe manual memory management, allowing simple bugs (i.e., accesses to an object after deallocation) to become the root cause of exploitable security vulnerabilities. This paper proposes Watchdog, a hardware-based approach for ensuring safe and secure manual memory management. Inspired by prior software-only proposals, Watchdog generates a unique identifier for each memory allocation, associates these identifiers with pointers, and checks to ensure that the identifier is still valid on every memory access. This use of identifiers and checks enables Watchdog to detect errors even in the presence of reallocations. Watchdog stores these pointer identifiers in a disjoint shadow space to provide comprehensive protection and ensure compatibility with existing code. To streamline the implementation and reduce runtime overhead: Watchdog (1) uses micro-ops to access metadata and perform checks, (2) eliminates metadata copies among registers via modified register renaming, and (3) uses a dedicated metadata cache to reduce checking overhead. Furthermore, this paper extends Watchdog's mechanisms to detect bounds errors, thereby providing full hardware-enforced memory safety at low overheads.

Programming languages employ significant diversity in design philosophies and implementation of their runtimes. Languages such as Java and CPython utilize distinct virtual machine and interpreter environments that enable high-level features but require substantial runtime overhead, while others like Go, Rust, C++, and C provide offer system-level programming and are compiled to binary files, requiring smaller runtimes. This creates a gap between high-level constructs (such as garbage collection and built-in data structures) and low-level functionality, with memory safety being present at both ends of the spectrum, with Python and Java at one end and Rust and Go at the other. We propose a novel approach to designing runtimes in languages that support generic programming by transforming the D programming language's runtime library from a monolithic architecture to a template-based implementation by converting its runtime hooks from Typelnfo-based implementations to templates. We evaluated the performance of each hook with the template and non-template implementations and increased the running performance of applications by as much as 25 % at the cost of a 10-30% increase in compilation time. This work may also extend the language features available when compiling for loT devices, which, due to their low available memory, do not support the full runtime of the D language.