TY - GEN
T1 - Return value predictability profiles for self-healing
AU - Locasto, Michael E.
AU - Stavrou, Angelos
AU - Cretu, Gabriela F.
AU - Keromytis, Angelos D.
AU - Stolfo, Salvatore J.
PY - 2008
Y1 - 2008
N2 - Current embryonic attempts at software self-healing produce mechanisms that are often oblivious to the semantics of the code they supervise. We believe that, in order to help inform runtime repair strategies, such systems require a more detailed analysis of dynamic application behavior. We describe how to profile an application by analyzing all function calls (including library and system) made by a process. We create predictability profiles of the return values of those function calls. Self-healing mechanisms that rely on a transactional approach to repair (that is, rolling back execution to a known safe point in control flow or slicing off the current function sequence) can benefit from these return value predictability profiles. Profiles built for the applications we tested can predict behavior with 97% accuracy given a context window of 15 functions. We also present a survey of the distribution of actual return values for real software as well as a novel way of visualizing both the macro and micro structure of the return value distributions. Our system helps demonstrate the feasibility of combining binary-level behavior profiling with self-healing repairs.
AB - Current embryonic attempts at software self-healing produce mechanisms that are often oblivious to the semantics of the code they supervise. We believe that, in order to help inform runtime repair strategies, such systems require a more detailed analysis of dynamic application behavior. We describe how to profile an application by analyzing all function calls (including library and system) made by a process. We create predictability profiles of the return values of those function calls. Self-healing mechanisms that rely on a transactional approach to repair (that is, rolling back execution to a known safe point in control flow or slicing off the current function sequence) can benefit from these return value predictability profiles. Profiles built for the applications we tested can predict behavior with 97% accuracy given a context window of 15 functions. We also present a survey of the distribution of actual return values for real software as well as a novel way of visualizing both the macro and micro structure of the return value distributions. Our system helps demonstrate the feasibility of combining binary-level behavior profiling with self-healing repairs.
KW - Anonamly detection
KW - Behavior profiling
KW - Self-healing
UR - https://www.scopus.com/pages/publications/58049084388
UR - https://www.scopus.com/pages/publications/58049084388#tab=citedBy
U2 - 10.1007/978-3-540-89598-5_10
DO - 10.1007/978-3-540-89598-5_10
M3 - Conference contribution
AN - SCOPUS:58049084388
SN - 3540895973
SN - 9783540895978
T3 - Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)
SP - 152
EP - 166
BT - Advances in Information and Computer Security - Third International Workshop on Security, IWSEC 2008, Proceedings
T2 - 3rd International Workshop on Security, IWSEC 2008
Y2 - 25 November 2008 through 27 November 2008
ER -