Runtime Monitoring: From Theory to Usable Security

点击翻译按钮获取中文摘要

According to the 2013 Norton Report, cyber-crime has cost Canadian upwards of 3 Bilion US$ in 2013 alone. Globally, the costs are estimated to reach 113 Billion US$. As a consequence, both government and industry have taken a keen interest in developing tools to protect sensitive systems and data. Runtime monitoring is an approach to enforcing security policies that seeks to allow untrusted code to run safely by observing its execution and reacting as needed to prevent a violation of a user-supplied security policy. This method of ensuring the safety of code is rapidly gaining acceptance in practice and several implementations exist. This proliferation has prompted interest from the academic community, and many interesting and innovative ideas have been proposed in the scientific literature to make monitors an attractive and powerful security policy enforcement option. A few examples of such ideas include monitors with zero overhead in memory usage, monitor certification-a technique to provide a user-checkable proof of the monitor's correct enforcement, and the monitoring of information flow, a particular class of policies that relates to privacy.******However, practical implementations of monitors do not draw upon the vast body of scholarly research that relates to monitoring. Indeed, most remain limited to the enforcement of a narrow subset of security policies and rely upon only one of the multiple mechanisms at their disposal to avert a potential violation of the security policy, namely aborting the execution. Conversely, theoretical research in monitoring abstracts away many aspects of a real-life monitor that would make implementation more laborious. For example, research-paper monitors are often tested on short execution traces of a few hundred events and do not scale up to the many millions of events of real execution traces.******This research program seeks to bridge the divide between theoretical research and practical implementations of monitors. On the one hand, we will develop software that exploit the full potential of monitors highlighted in the scientific literature and issue them as ready-to-use security tools. We are particularly interested in developing a usable monitor certification framework, and diversity-based HIDS. On the other hand, our work will also push theoretical research forward through our study of the pitfalls encountered when implementing monitors and provide the scientific community with real tools and test data to use in monitor research.******The upshot of this research will be the development of monitors that are more powerful, in the sense that can enforce a larger set of security policies, more precise, meaning that they can detect violations with less risk of a false positive, and with a lower footprint of resource consumption. This research will also allow us to refine the theoretical models used to reason about the capacities of monitors.