TWC: Phase: Small: Software Cruising for System Security

软件缺陷和漏洞是当今社会网络安全漏洞的主要原因。运行时监视是一种在程序执行时加强安全性和安全性属性的技术，它对于检测入侵和保持系统健康至关重要。在实践中采用运行时监视技术的主要障碍之一是高性能开销。内联安全监视的实施通常会延迟和阻止受保护程序的执行。由于同步问题，传统的并发运行时监视器无法利用多核架构提高性能。如果使用传统的同步原语，当监视器由于外部事件而崩溃或阻塞时，即使监视器没有监视，受保护的程序也会被阻塞。本提案的目标是开发一种创新的安全监控技术，称为软件巡航，探索使用无锁数据结构和算法进行非阻塞并发安全监控的多核架构。软件巡航消除了阻塞效应，实现了高效、可扩展的安全监控。这可以为基于云的和传统计算系统和应用程序的大规模安全监控带来改变游戏规则的能力。软件巡航应用包括但不限于堆缓冲区完整性检查、内核内存巡航、数据结构和对象不变性检查、rootkit检测、信息来源和流检查。三套相关的原型工具包？巡洋舰，巡洋舰，还有巡洋舰？将演示大规模软件巡航的有效性和实用性。Cruiser用于监视用户空间程序的无锁堆缓冲区溢出。Kruiser用于内核巡航操作系统内核堆缓冲区溢出和其他安全漏洞。iCruiser用于用户空间和核空间数据结构和对象不变巡航。本研究完成后，将使大规模安全监控在日益流行的多核架构和云环境下更加高效和可扩展，从而显著提高系统安全性。通过提出的技术转移工作，应用程序和操作系统内核将通过部署的软件巡航技术得到更好的保护。教育、外联和宣传活动也将产生更广泛的影响。这个项目的教育资源，包括软件巡航和教学实验室设计的课程模块，将被纳入在线课程，并通过一个专门的网站传播。这个项目的成果将通过出版物、软件发布和技术转让广泛传播。

Software bugs and vulnerabilities are primary causes for cyber-security breaches in today's society. Runtime monitoring, a technique to enforce safety and security properties at program execution time, is essential to detect intrusions and keep the system healthy. One of the main obstacles to adopt runtime monitoring techniques in practice is high performance overhead. Inlined security monitoring enforcement often delays and blocks the execution of protected programs. Conventional concurrent runtime monitors have not been able to leverage the multicore architectures for performance due to synchronization issues. If conventional synchronization primitives are used, when the monitor is crashed or blocked due to external events, the protected program will also be blocked even if the monitor is not monitoring. The goal of this proposal is to develop an innovative security monitoring technology, called Software Cruising, to explore multicore architectures for non-blocking concurrent security monitoring using lock-free data structures and algorithms. Software cruising eliminates the blocking effect and achieves efficient and scalable security monitoring. This can result in a game-changing capability in large-scale security monitoring for both cloud-based and traditional computing systems and applications.The software cruising applications include, but are not limited to, heap buffer integrity checking, kernel memory cruising, data structure and object invariant checking, rootkit detection, and information provenance and flow checking. Three related sets of prototypical toolkits?Cruiser, Kruiser, and iCruiser?will be developed to demonstrate the effectiveness and practicality of large-scale software cruising. Cruiser is for lock-free heap buffer overflow monitoring of user-space programs. Kruiser is for kernel cruising on OS kernel heap buffer overflows and other security vulnerabilities. iCruiser is for user- and kernel-space data structure and object invariant cruising. The proposed research, upon completion, would make large-scale security monitoring more efficient and scalable in the increasingly popular multicore architecture and cloud environment, and thus significantly enhance system security. With the proposed tech transfer effort, applications as well as OS kernels will have better protection with the deployed software cruising technology. Broader impacts will also result from the education, outreach, and dissemination initiatives. Educational resources from this project, including course modules on software cruising and teaching laboratory designs, will be incorporated into online courses and disseminated through a dedicated web site. The project outcomes of this project will be disseminated broadly through publications, software releases, and technology transfer.