Temporal System Call Specialization for Attack Surface Reduction
Temporal System Call Specialization for Attack Surface Reduction
复制标题
DOI：
--
复制
发表时间：
2020
期刊：
影响因子：
--
通讯作者：
Seyedhamed Ghavamnia;Tapti Palit;Shachee Mishra;M. Polychronakis
中科院分区：
文献类型：
--
作者：
Seyedhamed Ghavamnia;Tapti Palit;Shachee Mishra;M. Polychronakis
通过删除不必要的应用功能的攻击表面是提高安全性的一种有望的技术，而无需造成任何其他软件的开销，我们提出了一种临时专业化，这是一种新的方法，可以根据其执行阶段量身定制的系统调用新颖的静态分析技术，用于提高每个执行阶段的应用程序的呼叫图的精度，然后将其用于查明每个阶段中使用的系统调用，我们表明需求在服务器的整个生命周期内发生变化，并且许多危险的系统调用（诸如Execve）可以在初始化阶段完成后禁用。 - 与现有的图书馆专业方法相比，临界系统的调用，同时提供了中和13个Linux内核脆弱性的其他好处，这些漏洞可能导致特权升级。
Attack surface reduction through the removal of unnecessary application features and code is a promising technique for improving security without incurring any additional overhead. Recent software debloating techniques consider an application’s entire lifetime when extracting its code requirements, and reduce the attack surface accordingly. In this paper, we present temporal specialization , a novel approach for limiting the set of system calls available to a process depending on its phase of execution. Our approach is tailored to server applications, which exhibit distinct initialization and serving phases with different system call requirements. We present novel static analysis techniques for improving the precision of extracting the application’s call graph for each execution phase, which is then used to pinpoint the system calls used in each phase. We show that requirements change throughout the lifetime of servers, and many dangerous system calls (such as execve ) can be disabled after the completion of the initialization phase. We have implemented a prototype of temporal specialization on top of the LLVM compiler, and evaluated its effectiveness with six popular server applications. Our results show that it disables 51% more security-critical system calls compared to existing library specialization approaches, while offering the additional benefit of neutralizing 13 more Linux kernel vulnerabilities that could lead to privilege escalation.