Smart Information Flow Technologies - cybersecurity

Network Policy Enforcement Using Transactions: The NEUTRON Approach

dthomsen — Fri, 29 Jun 2018 20:09:40 +0000

We propose a tool to capture applications requirements with respect to the enforcement of network security policies in an object-oriented design language. Once a design captures clear, concise, easily understood network requirements new technologies become possible, including network transactions and user-driven policies to remove rarely used network permissions until needed, creating a least privilege in time policy. Existing security enforcement policies represent a model of all allowable behavior. Only modeling allowable behavior requires that any entity that may need a permission, be granted it permanently. Refining the modeling to distinguish between common behavior and rare behavior will increase security. The increased security comes with costs, such as requiring users to strongly authenticate more often. This paper discusses those costs and the complexity of increasing security enforcement models.

Citation:

Dan Thomsen and Elisa Bertino. 2018. Network Policy Enforcement Using Transactions: The NEUTRON Approach. In Proceedings of the 23nd ACM on Symposium on Access Control Models and Technologies (SACMAT '18). ACM, New York, NY, USA, 129-136.

Date Published:

Wednesday, June 13, 2018

Workflow: Editor Role:

Request Review

Workflow: Publisher Role:

Publish

Prevent Workflow Messages:

FUZZBUSTER: Towards Adaptive Immunity from Cyber Threats

admin — Fri, 20 Nov 2015 22:31:46 +0000

Today’s computer systems are under relentless at- tack from cyber attackers armed with sophisticated vulnerabil- ity search and exploit development toolkits. To protect against such threats, we are developing FUZZBUSTER , an automated system that provides adaptive immunity against a wide variety of cyber threats. FUZZBUSTER reacts to observed attacks and proactively searches for never-before-seen vulnerabilities. FUZZBUSTER uses a suite of fuzz testing and vulnerability assessment tools to find or verify the existence of vulnerabilities. Then FUZZBUSTER conducts additional tests to characterize the extent of the vulnerability, identifying ways it can be triggered. After characterizing a vulnerability, FUZZBUSTER synthesizes and applies an adaptation to prevent future exploits.

Citation:

David J. Musliner, Jeffrey M. Rye, Dan Thomsen, David D. McDonald, Mark H. Burstein, and Paul Robertson, "FUZZBUSTER: Towards Adaptive Immunity from Cyber Threats", SASO-11 Awareness Workshop, October, 2011.

Date Published:

Saturday, October 1, 2011

Publication File:

saso11.pdf

Workflow: Editor Role:

Request Review

Workflow: Publisher Role:

Publish

Prevent Workflow Messages:

HACKAR: Helpful Advice for Code Knowledge and Attack Resilience

admin — Fri, 20 Nov 2015 21:40:21 +0000

This paper describes a novel combination of Java program analysis and automated learning and planning architecture to the domain of Java vulnerability analysis. The key feature of our “HACKAR: Helpful Advice for Code Knowledge and Attack Resilience” system is its ability to analyze Java programs at development-time, identifying vulnerabilities and ways to avoid them. HACKAR uses an improved version of NASA’s Java PathFinder (JPF) to execute Java programs and identify vulnerabilities. The system features new Hierarchical Task Network (HTN) learning algorithms that (1) advance stateof- the- art HTN learners with reasoning about numeric constraints, failures, and more general cases of recursion, and (2) contribute to problem-solving by learning a hierarchical dataflow representation of the program from the inputs of the program. Empirical evaluation demonstrates that HACKAR was able to suggest fixes for all of our test program suites. It also shows that HACKAR’s can analyze programs with string inputs that original JPF implementation cannot.

Citation:

U. Kuter, M. Burstein, J. Benton, D. Bryce, J. Thayer, and S. McCoy. 2015. HACKAR: Helpful Advice for Code Knowledge and Attack Resilience. Proceedings of the AAAI/IAAI-15.

Date Published:

Tuesday, January 20, 2015

Publication File:

hackar.pdf

Workflow: Editor Role:

Request Review

Workflow: Publisher Role:

Publish

Prevent Workflow Messages:

Automatically Repairing Stripped Executables with CFG Microsurgery

sfriedman — Thu, 10 Sep 2015 19:12:35 +0000

BINSURGEON is a binary rewriting system that enhances stripped binary executables with repairs, defenses, and additional functionality. This involves making space-consuming changes to the program’s control flow graph (CFG), recomputing instruction content, and relocating instructions, all while preserving functionality in the remainder of the program’s control flow. BINSURGEON uses extendable rewrite templates that enable other systems to specify and parameterize program modifications, which allows BINSURGEON to be a fully-automatic component of a larger system. In this paper, we describe BINSURGEON in the context of the FUZZBOMB automated program analysis and repair system. We outline BINSURGEON’s general binary rewriting algorithm for modifying CFGs according to FUZZBOMB’s rewrite templates. We also review some of FUZZBOMB’s rewrite templates to demonstrate the diverse repair and defense strategies— including stack protection, heap protection, CFI, pointer-checking, and more— that are implemented by BINSURGEON to harden and repair vulnerable binaries.

Citation:

Scott E. Friedman, David J. Musliner. (2015). Automatically Repairing Stripped Executables with CFG Microsurgery. Fourth annual SASO workshop on Adaptive Host and Network Security. Boston, MA.

Date Published:

Thursday, September 10, 2015

Publication File:

main.pdf

Workflow: Editor Role:

Request Review

Workflow: Publisher Role:

Publish

Prevent Workflow Messages:

Self-Adaptation Metrics for Active Cybersecurity

sfriedman — Thu, 10 Sep 2015 19:05:11 +0000

FUZZBUSTER is a host-based adaptive security system that automatically discovers, refines, and repairs vulnerabilities in hosted applications in order to prevent cyberattacks. FUZZBUSTER must decide when to adapt its applications, when to revoke its previous adaptations, and when to sacrifice functionality to improve security. This requires an adaptation quality metric that captures (1) an application’s susceptibility to cyberattacks and (2) an application’s functionality, since adapting an application affects both of these factors. FUZZBUSTER uses different types of test cases to measure security and functionality. In this paper, we describe FUZZBUSTER’s adaptation metrics and we present two different policies for balancing security and functionality. We provide empirical results comparing these policies, and we also demonstrate how FUZZBUSTER can temporarily sacrifice the functionality of hosted applications to increase host security, and then restore functionality when more favorable adaptations are found.

Citation:

David J. Musliner, Scott E. Friedman, Tom Marble, Jeffrey M. Rye, Michael W. Boldt, Michael Pelican. (2013). Self-Adaptation Metrics for Active Cybersecurity. Second annual SASO workshop on Adaptive Host and Network Security. Philadelphia, PA.

Date Published:

Thursday, September 5, 2013

Publication File:

ahans13.pdf

Workflow: Editor Role:

Request Review

Workflow: Publisher Role:

Publish

Prevent Workflow Messages:

Meta-control for Adaptative Cybersecurity in FUZZBUSTER

sfriedman — Thu, 10 Sep 2015 18:54:08 +0000

Modern cyber attackers use sophisticated, highly-automated vulnerability search and exploit development tools to find new ways to break into target computers. To protect against such threats, we are developing FUZZBUSTER, a host-based adaptive security system that automatically discovers faults in hosted applications and incrementally refines and repairs the underlying vulnerabilities. To perform this self-adaptation, FUZZBUSTER uses meta-control to coordinate a diverse and growing set of custom and off-the-shelf fuzz-testing tools. FUZZBUSTER's greedy meta-control strategy considers adaptation deadlines, the exploit potential of vulnerabilities, the usage schedule of vulnerable applications, and the expected performance of its various fuzz-testing and adaptation tools. In this paper, we demonstrate how FUZZBUSTER's meta-control reasons efficiently about these factors, managing task selection to maximize the system's safety and effectiveness.

Citation:

David J. Musliner, Scott E. Friedman, Jeffrey M. Rye, Tom Marble. (2013). Meta-control for Adaptative Cybersecurity in FUZZBUSTER. Proceedings of SASO 2013. Philadelphia, PA.

Date Published:

Thursday, September 12, 2013

Publication File:

saso13.pdf

Workflow: Editor Role:

Request Review

Workflow: Publisher Role:

Publish

Prevent Workflow Messages:

Automated Fault Analysis and Filter Generation for Adaptive Cybersecurity

sfriedman — Thu, 10 Sep 2015 18:51:18 +0000

We are developing the FUZZBUSTER system to automatically identify software vulnerabilities and create adaptations that shield or repair those vulnerabilities before attackers can exploit them. Adaptive cybersecurity involves efficiently improv- ing software security to minimize the window of attack, and also preserving software functionality as much as possible. This paper presents new tools that have been integrated into FUZZBUSTER adaptive cybersecurity. These tools produce more general, accurate adaptations, increase the efficiency of FUZZBUSTER’s diagnoses and adaptation operations, and preserve the software’s functionality. We report the results of FUZZBUSTER’s analysis of 16 fault-injected command-line binaries and six previously known bugs in the Apache web server. We compare results over different configurations of FUZZBUSTER to characterize the benefits of the new fuzz-testing tools.

Citation:

David J. Musliner, Scott E. Friedman, Jeffrey M. Rye. (2014). Automated Fault Analysis and Filter Generation for Adaptive Cybersecurity. ADAPTIVE 2014 : The Sixth International Conference on Adaptive and Self-Adaptive Systems and Applications. Venice, Italy. Best Paper Award.

Date Published:

Wednesday, March 5, 2014

Publication File:

adaptive14.pdf

Workflow: Editor Role:

Request Review

Workflow: Publisher Role:

Publish

Prevent Workflow Messages:

Improving Automated Cybersecurity by Generalizing Faults and Quantifying Patch Performance

sfriedman — Thu, 10 Sep 2015 18:48:49 +0000

We are developing the FUZZBUSTER system to automatically identify software vulnerabilities and create adaptations that shield or repair those vulnerabilities before attackers can exploit them. FUZZBUSTER’s goal is to minimize the time that vulnerabilities exist, while also preserving software functionality as much as possible. This paper presents new adaptive cybersecurity tools that we have integrated into FUZZBUSTER, as well as new metrics that FUZZBUSTER uses to assess their performance. FUZZBUSTER’s new tools increase the efficiency of its diagnosis and adaptation operations, they produce more general, accurate adaptations, and they effectively preserve software functionality. We present FUZZBUSTER’s analysis of 16 fault-injected command-line binaries and six previously known bugs in the Apache web server. We compare FUZZBUSTER’s results for different adaptation strategies and tool settings, to characterize their benefits.

Citation:

Scott E. Friedman, David J. Musliner, Jeffrey M. Rye. (2014). Improving Automated Cybersecurity by Generalizing Faults and Quantifying Patch Performance. International Journal on Advances in Security, 7(3&4). pp. 121-130.

Date Published:

Monday, December 1, 2014

Workflow: Editor Role:

Request Review

Workflow: Publisher Role:

Publish

Prevent Workflow Messages:

Chronomorphic Programs: Using Runtime Diversity to Prevent Code Reuse Attacks

sfriedman — Thu, 10 Sep 2015 18:46:15 +0000

Return Oriented Programming (ROP) attacks, in which a cyber attacker crafts an exploit from instruction sequences already contained in a running binary, have become popular and practical. While previous research has investigated software diversity and dynamic binary instrumentation for defending against ROP, many of these approaches incur large performance costs or are susceptible to Blind ROP attacks. We present a new approach that automatically rewrites potentially vulnerable software binaries into chronomorphic binaries that change their in-memory instructions and layout repeatedly, at runtime. We describe our proof of concept implementation of this approach, discuss its security and safety properties, provide statistical analyses of runtime diversity and reduced ROP attack likelihood, and present empirical results that demonstrate the low performance overhead of actual chronomorphic binaries.

Citation:

Scott E. Friedman, David J. Musliner, Peter Keller. (2015). Chronomorphic Programs: Using Runtime Diversity to Prevent Code Reuse Attacks. ICDS 2015: The 9th International Conference on Digital Society.

Date Published:

Sunday, February 15, 2015

Publication File:

icds_2015_4_40_10108 (2).pdf

Workflow: Editor Role:

Request Review

Workflow: Publisher Role:

Publish

Prevent Workflow Messages:

Improving Automated Cybersecurity by Generalizing Faults and Quantifying Patch Performance

admin — Thu, 06 Aug 2015 19:46:30 +0000

Keywords: cyber defense, adaptive security, security metrics, filter generation.

Abstract: We are developing the FUZZBUSTER system to automatically identify software vulnerabilities and create adaptations that shield or repair those vulnerabilities before attackers can exploit them. FUZZBUSTER’s goal is to minimize the time that vulnerabilities exist, while also preserving software functionality as much as possible. This paper presents new adaptive cybersecurity tools that we have integrated into FUZZBUSTER, as well as new metrics that FUZZBUSTER uses to assess their performance. FUZZBUSTER’s new tools increase the efficiency of its diagnosis and adaptation operations, they produce more general, accurate adaptations, and they effectively preserve software functionality. We present FUZZBUSTER’s analysis of 16 fault-injected commandline binaries and six previously known bugs in the Apache web server. We compare FUZZBUSTER’s results for different adaptation strategies and tool settings, to characterize their benefits.

The PDF document may be downloaded from iariajournals.org

Citation:

Date Published:

Wednesday, August 6, 2014

Workflow: Editor Role:

Request Review

Workflow: Publisher Role:

Publish

Prevent Workflow Messages: