Multi Variant eXecution (MVX) is a security defense technique that uses software diversity to protect system from attacks. MVX improves security capability by enhancing system endogenous security compared to traditional passive defense techniques. However, the current MVX technique lacks formal theoretical analysis and cannot effectively assess the overall security of the system. To address the constraint relationship between complex attack means and dynamic defense environment, we construct a novel atomic combination attack chain model, which decomposes macro attack means into single atomic attack behaviors and provides theoretical support for analyzing the security capability of dynamic systems. Then, the defense model of the MVX system is established, and the defense model’s security capability is analyzed using the attack model. Finally, the advantages and shortcomings of the security defense capability of the MVX system are evaluated based on a typical kernel attack example, and system optimization improvement measures are proposed.
KEYWORDS: Solid state lighting, Telecommunications, Information security, Information operations, Network security, Defense and security, Prototyping, Data communications, Clouds, Binary data
Multi-variant Execution (MVX) technology can effectively resist various types of memory leak attacks. Since it was proposed in 2006, after years of development, as an active defense method, it is widely used in cyberspace security. in defense. The multi-variant execution technology distributes the program input to multiple functions through distribution agents, executes executions with different structures in parallel, sets up voting points, and detects whether it is attacked by comparing the output results of the executions of the executions by the monitor. When the multi-variant execution technology is applied to the actual scene, there will be some wrong judgments. For example, the execution body is not attacked, but because the execution bodies are isolated from each other and executed in parallel, random numbers will be generated when the execution body executes the program. These random numbers are included in the output results and are sent to the monitor for voting. Based on the consistency judgment voting, the monitor compares the output results to determine that the execution results are inconsistent, and the misjudgment system is attacked.A multi-variant system is modified by multi-variant execution technological. Such misjudgments are called misjudgment of random numbers. This paper summarizes and analyzes the voting misjudgment caused by random numbers in the multi-variant system, points out the reasons for the misjudgment of random numbers, lists common use cases, summarizes the previous solutions and ideas, and proposes a method to use the file system to synchronize random numbers. Experiments have shown that this method can effectively reduce the misjudgment of random numbers in multi-variant systems and improve the availability of multi-variant systems.
Access to the requested content is limited to institutions that have purchased or subscribe to SPIE eBooks.
You are receiving this notice because your organization may not have SPIE eBooks access.*
*Shibboleth/Open Athens users─please
sign in
to access your institution's subscriptions.
To obtain this item, you may purchase the complete book in print or electronic format on
SPIE.org.
INSTITUTIONAL Select your institution to access the SPIE Digital Library.
PERSONAL Sign in with your SPIE account to access your personal subscriptions or to use specific features such as save to my library, sign up for alerts, save searches, etc.