Probabilistically Correct Execution: Hardening Applications Against Error and Attack

当今绝大多数软件应用程序都是用C和c++编写的，这两种语言都不安全。这些语言使应用程序无法抵御程序员的大量错误。这些错误不仅会导致程序出错或崩溃，还会使它们容易受到攻击。概率正确执行（PCE）透明地增强了这些应用程序免受错误或攻击的能力。PCE首先随机化应用程序的内存映像，增加错误不会产生影响的几率，并保证任何错误只会影响一小部分用户。通过在不同的处理器上运行相同程序的多个不同随机副本，并对它们的输出进行投票，PCE可以确保程序以更高的概率正确执行。当前的硬件趋势是廉价和充足的系统内存，以及多核处理器的到来使这项工作尤其及时。PCE可以利用这些额外的硬件资源来显著提高现有软件的可靠性。PCE的原型实现已经开发出来，它为用C或c++编写的现成应用程序提供了保护。这个原型叫做《虎胆龙威》，对大多数应用程序来说，它的运行时开销很小。当虎胆龙威的性能扩展到大量的多个处理器和处理核心时，额外的副本增加了保护。虎胆龙威允许程序以高概率正确执行，可以证明保护它们免受各种错误和攻击。这个项目探索了PCE的各种扩展，包括容忍竞争条件、面对内存泄漏时继续执行、将其扩展到更广泛的应用程序类别，以及使用PCE进行错误检测。

The vast majority of today's software applications are written in C and C++, two unsafe languages. These languages leave applications defenseless against a wide range of programmer errors. These errors not only cause programs to misbehave or crash, but also leave them susceptible to attack.Probabilistically correct execution (PCE) transparently hardens these applications against error or attack. PCE first randomizes the memory image of an application, increasing the odds that errors will have no effect, and guaranteeing that any bug will only affect a small percentage of users. By running multiple, differently-randomized replicas of the same program on different processors and voting on their outputs, PCE can ensure correct program execution with even higher probability.Current hardware trends inexpensive and plentiful system memory, and the arrival of multicore processors make this work especially timely. PCE can harness these additional hardware resources to dramatically increase the reliability of existing software.A prototype implementation of PCE has been developed that offers protection for off-the-shelf applications written in C or C++. This prototype, called DieHard, imposes little runtime overhead for most applications. Additional replicas add protection while DieHard's performance scales to large numbers of multiple processors and processing cores. DieHard allows programs to execute correctly with high probability, provably protecting them against a broad range of errors and attacks.This project explores various extensions to PCE, including tolerating race conditions, continuing execution in the face of memory leaks, extending it to a broader class of applications, and using PCE for bug detection.