short-paper

Practical implications and requirements of diversifying interpreted languages

Authors:

Joni Uitto,

Sampsa Rauti,

Ville LeppänenAuthors Info & Claims

CISRC '16: Proceedings of the 11th Annual Cyber and Information Security Research Conference

Article No.: 14, Pages 1 - 4

https://doi.org/10.1145/2897795.2897796

Published: 05 April 2016 Publication History

Get Access

Abstract

Instruction set randomization (ISR) provides a strong defense against all types of injection attacks, especially in interpreted environments. However, fully enabling a system to benefit from language interpreters that support programs diversified with ISR requires several alterations and considerations. In this paper we identify core challenges related to enabling system-wide interpreter diversification. We also propose possible solutions to each challenge and expand upon the existing diversification schemes for interpreted languages.

References

[1]

Linux From Scratch. http://www.linuxfromscratch.org/lfs/. Version 7.8 Accessed: 2016-01-21.

Google Scholar

[2]

Vulnerability summary for cve-2014-6271. https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-6271. Initial CVE of Shellshock vulnerability Accessed: 2016-01-21.

Google Scholar

[3]

Elias Athanasopoulos, Antonis Krithinakis, and Evangelos P Markatos. An Architecture for Enforcing JavaScript Randomization in Web 2.0 Applications. In Information Security, pages 203--209. Springer, 2011.

Digital Library

Google Scholar

[4]

S.W. Boyd, G.S. Kc, M.E. Locasto, and A.D. Keromytis. On the General Applicability of Instruction-Set Randomization. IEEE Transactions on Dependable and Secure Computing, 7(3), 2008.

Digital Library

Google Scholar

[5]

G. Portokalidis and A.D. Keromytis. Global ISR: Toward a Comprehensive Defense Against Unauthorized Code Execution. In Moving Target Defense, Creating Asymmetric Uncertainty for Cyber Threats, Advances in Information Security 54, pages 469--480. Springer, 2014.

Google Scholar

[6]

Joni Uitto, Sampsa Rauti, Jari-Matti Mäkelä, and Ville Leppänen. Preventing Malicious Attacks by Diversifying Linux Shell Commands. In Proceedings of the 14th Symposium on Programming Languages and Software Tools (SPLST), pages 206--220, 2015.

Google Scholar

Cited By

View all

Frotan NYazıcı R(2024)ARAYÜZ ÇEŞİTLENDİRMESİNİN KÖTÜ AMAÇLI YAZILIMLARDA KULLANIM DURUMUİstanbul Ticaret Üniversitesi Teknoloji ve Uygulamalı Bilimler Dergisi10.56809/icujtas.1410198Online publication date: 9-May-2024
https://doi.org/10.56809/icujtas.1410198
Rauti SLaurén SMäki PUitto JLaato SLeppänen V(2020)Internal interface diversification as a method against malwareJournal of Cyber Security Technology10.1080/23742917.2020.1813397(1-26)Online publication date: 31-Aug-2020
https://doi.org/10.1080/23742917.2020.1813397
Rauti SKoivunen LMäki PHosseinzadeh SLaurén SHolvitie JLeppänen V(2018)Internal Interface Diversification as a Security Measure in Sensor NetworksJournal of Sensor and Actuator Networks10.3390/jsan70100127:1(12)Online publication date: 6-Mar-2018
https://doi.org/10.3390/jsan7010012
Show More Cited By

Recommendations

Prototyping symbolic execution engines for interpreted languages
ASPLOS '14: Proceedings of the 19th international conference on Architectural support for programming languages and operating systems

Symbolic execution is being successfully used to automatically test statically compiled code. However, increasingly more systems and applications are written in dynamic interpreted languages like Python. Building a new symbolic execution engine is a ...
Prototyping symbolic execution engines for interpreted languages
ASPLOS '14

Symbolic execution is being successfully used to automatically test statically compiled code. However, increasingly more systems and applications are written in dynamic interpreted languages like Python. Building a new symbolic execution engine is a ...
Managing jobs with an interpreted language for dynamic adaptation
MGC '05: Proceedings of the 3rd international workshop on Middleware for grid computing

In this paper we explore the advantages of using interpreted languages for building submitting engines for the grid. In particular, we discuss an example engine, developed using ALua, for submitting jobs in a cluster, which can be extended to a grid ...

Comments

Information & Contributors

Information

Published In

CISRC '16: Proceedings of the 11th Annual Cyber and Information Security Research Conference

April 2016

150 pages

ISBN:9781450337526

DOI:10.1145/2897795

General Chairs:
Joseph P. Trien
Oak Ridge National Laboratory
,
Stacy J. Prowell
Oak Ridge National Laboratory
,
John R. Goodall
Oak Ridge National Laboratory
,
Program Chair:
Robert A. Bridges
Oak Ridge National Laboratory

Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. Copyrights for components of this work owned by others than ACM must be honored. Abstracting with credit is permitted. To copy otherwise, or republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. Request permissions from [email protected]

In-Cooperation

Oak Ridge National Laboratory

Publisher

Association for Computing Machinery

New York, NY, United States

Publication History

Published: 05 April 2016

Permissions

Request permissions for this article.

Request Permissions

Check for updates

Author Tags

Qualifiers

Short-paper
Research
Refereed limited

Conference

CISRC '16

CISRC '16: 11th Annual Cyber and Information Security Research

April 5 - 7, 2016

TN, Oak Ridge, USA

Acceptance Rates

CISRC '16 Paper Acceptance Rate 11 of 28 submissions, 39%;

Overall Acceptance Rate 69 of 136 submissions, 51%

Other Metrics

View Article Metrics

Bibliometrics & Citations

Bibliometrics

Article Metrics

5
Total Citations
View Citations
72
Total Downloads

Downloads (Last 12 months)0
Downloads (Last 6 weeks)0

Reflects downloads up to 08 Mar 2025

Other Metrics

View Author Metrics

Citations

Cited By

View all

Frotan NYazıcı R(2024)ARAYÜZ ÇEŞİTLENDİRMESİNİN KÖTÜ AMAÇLI YAZILIMLARDA KULLANIM DURUMUİstanbul Ticaret Üniversitesi Teknoloji ve Uygulamalı Bilimler Dergisi10.56809/icujtas.1410198Online publication date: 9-May-2024
https://doi.org/10.56809/icujtas.1410198
Rauti SLaurén SMäki PUitto JLaato SLeppänen V(2020)Internal interface diversification as a method against malwareJournal of Cyber Security Technology10.1080/23742917.2020.1813397(1-26)Online publication date: 31-Aug-2020
https://doi.org/10.1080/23742917.2020.1813397
Rauti SKoivunen LMäki PHosseinzadeh SLaurén SHolvitie JLeppänen V(2018)Internal Interface Diversification as a Security Measure in Sensor NetworksJournal of Sensor and Actuator Networks10.3390/jsan70100127:1(12)Online publication date: 6-Mar-2018
https://doi.org/10.3390/jsan7010012
Laurén SRauti SLeppänen VBahsoon RWeinreich R(2016)An interface diversified honeypot for malware analysisProccedings of the 10th European Conference on Software Architecture Workshops10.1145/2993412.2993417(1-6)Online publication date: 28-Nov-2016
https://dl.acm.org/doi/10.1145/2993412.2993417
Koivunen LRauti SLeppanen V(2016)Applying Internal Interface Diversification to IoT Operating Systems2016 International Conference on Software Security and Assurance (ICSSA)10.1109/ICSSA.2016.7(1-5)Online publication date: Aug-2016
https://doi.org/10.1109/ICSSA.2016.7

View Options

Login options

Check if you have access through your login credentials or your institution to get full access on this article.

Full Access

Get this Publication

View options

PDF

View or Download as a PDF file.

PDF

eReader

View online with eReader.

eReader

Abstract

References

Cited By

Recommendations

Prototyping symbolic execution engines for interpreted languages

Prototyping symbolic execution engines for interpreted languages

Managing jobs with an interpreted language for dynamic adaptation

Comments

Information

Published In

In-Cooperation

Publisher

Publication History

Permissions

Check for updates

Author Tags

Qualifiers

Conference

Acceptance Rates

Contributors

Other Metrics

Bibliometrics

Article Metrics

Other Metrics

Citations

Cited By

Login options

Full Access

View options

PDF

eReader

Share

Share this Publication link

Share on social media

Affiliations