Toward Software Diversity in Heterogeneous Networked Systems
Toward Software Diversity in Heterogeneous Networked Systems
复制标题
DOI：
10.1007/978-3-662-43936-4_8
复制
发表时间：
2014-07
期刊：
影响因子：
--
通讯作者：
Chu Huang;Sencun Zhu;R. Erbacher
中科院分区：
文献类型：
--
作者：
Chu Huang;Sencun Zhu;R. Erbacher
当存在设计或实现缺陷时，同构架构很可能被利用其漏洞的单一攻击（例如蠕虫）完全破坏。基于异构的生存性理论，提出了一种利用软件多样性技术提高网络系统生存性的新方法。具体来说，我们设计了一种高效的算法，将一套现成的软件选择并部署到网络系统中的主机上，使得一台主机上的漏洞数量和类型与其相邻节点上的漏洞数量和类型不同。通过这种方式，我们能够将蠕虫控制在一个孤立的“岛屿”上。该算法通过考虑实际约束来解决更复杂场景下的软件分配问题，例如，基于不同的系统先决条件，主机可能有不同的需求。我们通过简单和复杂系统模型的仿真来评估算法的性能。实验结果证实了该算法的有效性和可扩展性。
When there are either design or implementation flaws, a homogeneous architecture is likely to be disrupted entirely by a single attack (e.g., a worm) that exploits its vulnerability. Following the survivability through heterogeneity philosophy, we present a novel approach to improving survivability of networked systems by adopting the technique of software diversity. Specifically, we design an efficient algorithm to select and deploy a set of off-the-shelf software to hosts in a networked system, such that the number and types of vulnerabilities presented on one host would be different from that on its neighboring nodes. In this way, we are able to contain a worm in an isolated “island”. This algorithm addresses software assignment problem in more complex scenarios by taking into consideration practical constraints, e.g., hosts may have diverse requirements based on different system prerequisites. We evaluate the performance of our algorithm through simulations on both simple and complex system models. The results confirm the effectiveness and scalability of our algorithm.