Runtime Monitoring: From Theory to Usable Security

点击翻译按钮获取中文摘要

According to the 2013 Norton Report, cyber-crime has cost Canadian upwards of 3 Bilion US$ in 2013 alone. Globally, the costs are estimated to reach 113 Billion US$. As a consequence, both government and industry have taken a keen interest in developing tools to protect sensitive systems and data. Runtime monitoring is an approach to enforcing security policies that seeks to allow untrusted code to run safely by observing its execution and reacting as needed to prevent a violation of a user-supplied security policy. This method of ensuring the safety of code is rapidly gaining acceptance in practice and several implementations exist. This proliferation has prompted interest from the academic community, and many interesting and innovative ideas have been proposed in the scientific literature to make monitors an attractive and powerful security policy enforcement option. A few examples of such ideas include monitors with zero overhead in memory usage, monitor certification—a technique to provide a user-checkable proof of the monitor’s correct enforcement, and the monitoring of information flow, a particular class of policies that relates to privacy.