StackArmor: Comprehensive Protection From Stack-based Memory Error Vulnerabilities for Binaries
StackArmor: Comprehensive Protection From Stack-based Memory Error Vulnerabilities for Binaries
复制标题
DOI：
10.14722/ndss.2015.23248
复制
发表时间：
2015
期刊：
影响因子：
--
通讯作者：
X. Chen;Asia Slowinska;Dennis Andriesse;H. Bos;Cristiano Giuffrida
中科院分区：
文献类型：
--
作者：
X. Chen;Asia Slowinska;Dennis Andriesse;H. Bos;Cristiano Giuffrida
Stackarmor是一种用于基于堆栈的内存错误漏洞的综合保护技术。它依靠二进制分析和重写策略来大大降低传统呼叫堆栈组织的独特空间和时间内存可预测性。与先前的解决方案不同，Stackarmor可以防止基于任意堆栈的攻击，不需要访问源代码，并提供了以政策驱动的保护策略，该策略允许最终用户根据他们的需求调整安全性的权衡。我们提出了X86 64 Linux的StackArmor的实现，并对流行服务器程序和标准基准测试的原型提供了详细的实验分析（SPEC CPU2006）。我们的结果表明，STACKARMOR提供的安全性比以前的Binaryand和源级别级别的方法更好，即使完全保护，也只能支付适度的性能和内存开销。
StackArmor is a comprehensive protection technique for stack-based memory error vulnerabilities in binaries. It relies on binary analysis and rewriting strategies to drastically reduce the uniquely high spatial and temporal memory predictability of traditional call stack organizations. Unlike prior solutions, StackArmor can protect against arbitrary stack-based attacks, requires no access to the source code, and offers a policy-driven protection strategy that allows end users to tune the securityperformance tradeoff according to their needs. We present an implementation of StackArmor for x86 64 Linux and provide a detailed experimental analysis of our prototype on popular server programs and standard benchmarks (SPEC CPU2006). Our results demonstrate that StackArmor offers better security than prior binaryand source-level approaches, at the cost of only modest performance and memory overhead even with full protection.