Jari-Matti Mäkelä

Diversification of System Calls in Linux Binaries

This paper studies the idea of using large-scale diversification to protect operating systems and make malware ineffective. The idea is to first diversify the system call interface on a specific computer so that it becomes very challenging for a piece of malware to access resources, and to combine this with the recursive diversification of system library routines indirectly invoking system calls. Because of this unique diversification i.e. a unique mapping of system call numbers, a large group of computers would have the same functionality but differently diversified software layers and user applications. A malicious program now becomes incompatible with its environment. The basic flaw of operating system monoculture --- the vulnerability of all software to the same attacks --- would be fixed this way. Specifically, we analyze the presence of system calls in the ELF binaries. We study the locations of system calls in the software layers of Linux and examine how many binaries in the whole system use system calls. Additionally, we discuss the different ways system calls are coded in ELF binaries and the challenges this causes for the diversification process. Also, we present a diversification tool and suggest several solutions to overcome the difficulties faced in system call diversification. The amount of problematic system calls is small, and our diversification tool manages to diversify the clear majority of system calls present in standard-like Linux configurations. For diversifying all the remaining system calls, we consider several possible approaches.

Outline of RISC-based core for multiprocessor on chip architecture supporting moving threads

Programming multicore systems is currently considered very difficult. One reason is that those are mostly constructed from the hardware point of view. Many of the processor core design solutions in contemporary constructions emphasize execution speed of a single thread. Since the memory access delay is the real bottleneck, such techniques often aim at maximizing cache hits by programmer guided locality of memory references and prefetching memory locations, etc. In this paper, we consider constructing processor core solutions that support easy-to-use programming approach based on the PRAM model. Specifically, we consider a processor core design of a multicore system, where the aim is to amortize the memory access delays by having multiple simultaneous executable software threads per each processor core. The core switches the executed extremely light-weight thread at each step, and thus the core can wait for pending memory requests to complete without any penalty (as long as it has non-blocked threads). Moreover, we consider the core to support moving threads paradigm instead of traditional moving data paradigm. We present an outline of such a processor core architecture, where we change the traditional pipelined execution model of RISC.

Design of the Language Replica for Hybrid PRAM-NUMA Many-core Architectures

Parallel programming is widely considered very demanding for an average programmer due to inherent asynchrony of underlying parallel architectures. In this paper we describe the main design principles and core features of Replica -- a parallel language aimed for high-level programming of a new paradigm of reconfigurable, scalable and powerful synchronous shared memory architectures that promise to make parallel programming radically easier with the help of strict memory consistency and deterministic synchronous execution of hardware threads and multi-operations.

A Survey on Aims and Environments of Diversification and Obfuscation in Software Security

Diversification and obfuscation methods are promising approaches used to secure software and prevent malware from functioning. Diversification makes each software instance unique so that malware attacks cannot rely on the knowledge of the programs execution environment and/or internal structure anymore. We present a systematic literature review on the state of-the-art of diversification and obfuscation research aiming to improve software security between 1993 and 2014. As the result of systematic search, in the final phase, 209 related papers were included in this study. In this study we focus on two specific research questions: what are the aims of diversification and obfuscation techniques and what are the environments they are applied to. The former question includes the languages and the execution environments that can benefit from these two techniques, while the second question presents the goals of the techniques and also the type of attacks they mitigate.

Towards a parallel debugging framework for the massively multi-threaded, step-synchronous REPLICA architecture

Modern chip-multiprocessors pack an increasing amount of computational cores with each generation. Along with new computational power comes a problem of managing a large pool of active threads. Traditional debuggers often deal with concurrency style multi-threading with emphasis on a single thread. The problem of thread management when debugging parallel programs is analyzed and solutions are suggested. A related debugging framework for the massively multi-threaded, synchronous REPLICA architecture is proposed.

Towards programming on the moving threads architecture

We have proposed a RISC-based multi-core architecture for the moving threads approach. A simulator is implemented for it, and in this paper we consider the toolchain for implementing parallel programs to be executed on the proposed architecture by our simulator. We give special emphasis for thread creation and management issues as well as for the synchronous execution model, and discuss programming constructs as well as compiling issues.

Hardware and Software Support for NUMA Computing on Configurable Emulated Shared Memory Architectures

The emulated shared memory (ESM) architectures are good candidates for future general purpose parallel computers due to their ability to provide easy-to-use explicitly parallel synchronous model of computation to programmers as well as avoid most performance bottlenecks present in current multicore architectures. In order to achieve full performance the applications must, however, have enough thread-level parallelism (TLP). To solve this problem, in our earlier work we have introduced a class of configurable emulated shared memory (CESM) machines that provides a special non-uniform memory access (NUMA) mode for situations where TLP is limited or for direct compatibility for legacy code sequential computing or NUMA mechanism. Unfortunately the earlier proposed CESM architecture does not integrate the different modes of the architecture well together e.g. by leaving the memories for different modes isolated and therefore the programming interface is non-integrated. In this paper we propose a number of hardware and software techniques to support NUMA computing in CESM architectures in a seamless way. The hardware techniques include three different NUMA-shared memory access mechanisms and the software ones provide a mechanism to integrate NUMA computation into the standard parallel random access machine (PRAM) operation of the CESM. The hardware techniques are evaluated on our REPLICA CESM architecture and compared to an ideal CESM machine making use of the proposed software techniques.

Towards a Language Framework for Thick Control Flows

In the recent years the search for scalability in terms of computing power has led to very complex parallel computer architectures which require greater control of the storage and computation resources to utilize all the available hardware capacity for optimal performance. New solutions in the level of programming languages/models have increased the reliance and need for threads. A system with a huge number of threads can face problems with thread micro-management, smooth scaling between data and task parallelism, portability, and consistency. We present TCF++, a new concurrent C/C++ language extension generalizing on the idea of threads with so called thick control flows. Opposed to threading, thick control flows provide a way to orchestrate computation using lower number of independent actors, dynamically adapting to problem size. The language extension approach is chosen to support mixing with legacy code. We qualitatively analyze the new languages eligibility and explain its idiomatic use with a selection of core parallel algorithm kernels.

MVTsim: software simulator for multicore on chip parallel computer architectures

Designing a parallel computer architecture for the multi-core on chip environment involves a lot of architectural design issues. Actual hardware design based on ASIC and for demonstrational purposes on FPGA is very expensive method to study the cost of various design choices. Therefore, we have developed a software based simulator MVTsim for multi-core on chip parallel computers. Due to a special theme of our research project, the simulator is oriented towards supporting a very fine-grained moving threads approach. We describe the general software architecture of the multi-core on chip simulator. In the simulator, special emphasis has been put on concisely expressing the problem domain with a general purpose language, the modular structure of the simulator and target architecture, support for flexible combining of different granularity levels of components, and modelling relevant physical delay related properties. We demonstrate our simulator by describing a RISC-based configuration supporting the moving threads approach, and give some initial results concerning running actual programs with our simulator.

Diversification and obfuscation techniques for software security: A systematic literature review

Abstract Context: Diversification and obfuscation are promising techniques for securing software and protecting computers from harmful malware. The goal of these techniques is not removing the security holes, but making it difficult for the attacker to exploit security vulnerabilities and perform successful attacks. Objective: There is an increasing body of research on the use of diversification and obfuscation techniques for improving software security; however, the overall view is scattered and the terminology is unstructured. Therefore, a coherent review gives a clear statement of state-of-the-art, normalizes the ongoing discussion and provides baselines for future research. Method: In this paper, systematic literature review is used as the method of the study to select the studies that discuss diversification/obfuscation techniques for improving software security. We present the process of data collection, analysis of data, and report the results. Results: As the result of the systematic search, we collected 357 articles relevant to the topic of our interest, published between the years 1993 and 2017. We studied the collected articles, analyzed the extracted data from them, presented classification of the data, and enlightened the research gaps. Conclusion: The two techniques have been extensively used for various security purposes and impeding various types of security attacks. There exist many different techniques to obfuscate/diversify programs, each of which targets different parts of the programs and is applied at different phases of software development life-cycle. Moreover, we pinpoint the research gaps in this field, for instance that there are still various execution environments that could benefit from these two techniques, including cloud computing, Internet of Things (IoT), and trusted computing. We also present some potential ideas on applying the techniques on the discussed environments.