Browsing by Author "Laurie Williams, Committee Member"
Now showing 1 - 10 of 10
- Results Per Page
- Sort Options
- Address Space Layout Permutation: Increasing Resistance to Memory Corruption Attacks(2005-10-18) Bookholt, Christopher Glen; Jun Xu, Committee Chair; Peng Ning, Committee Member; Laurie Williams, Committee MemberA key problem with current address obfuscation techniques is their use of randomly sized pads to shift the location of critical memory regions. Padding limits the potential of existing techniques because pads are unused space. To increase protection, the pad size need be increased, thereby wasting additional address space. The relationship between protection and pad size forces system designers to choose between security and conservation of address space. This thesis improves upon existing address randomization techniques by proposing and implementing a novel approach to increase the probabilistic protection provided by address obfuscation with performance overhead comparable to contemporary techniques and without the use of large pads. Our approach is to randomly permute the user stack, heap, and mmap allocations throughout the entire 3 gigabyte user address space. The approach improves upon the protection of the best existing technique by an order of magnitude and with no more than 8 kilobytes lost to padding. Further, the technique incurs a performance overhead of 7-13% during process startup and less than 1% overhead thereafter. We also present a validation of address space randomization by showing that randomization limits the propagation speed of worms reliant on memory corruption attack vectors. Our analysis shows that an average time of more than 57 minutes is needed to complete a brute-force attack on the protection provided by our technique. The increased time needed for worms to exploit individual targets using the absolute location of either the user stack, heap, or an mmap allocation means that the fastest time needed to infect nearly 100% of a vulnerable population is on the order of hours, not minutes. Our analysis provides an in depth discussion of the probabilistic protection provided by our technique. The results offer detailed information regarding the expected performance impact in three critical computing environments: scientific, desktop, and network server. We conclude that our address obfuscation technique is capable of providing greater probabilistic protection than existing techniques at a comparable performance cost.
- Automating and Simplifying Memory Corruption Attack Response Using Failure-Aware Computing(2006-07-21) Gauriar, Prachi; Jun Xu, Committee Chair; Laurie Williams, Committee Member; Frank Mueller, Committee MemberOver the last two decades, advances in software engineering have produced new ways of creating robust, reliable software. Unfortunately, the dream of bug-free software still eludes us. When bugs are discovered in deployed software, software failures and service disruption can lead to significant losses, both monetary and otherwise. The typical failure response process is composed of three phases: failure detection, cause analysis, and solution formulation. To minimize the impact of software failures, it is critical that each of these phases be completed as quickly as possible. This thesis is separated into two parts. In the first part, we propose a general conceptual approach called emph{failure-aware computing} that aims to automate as much of the failure response process as possible. We describe the architecture of this proposed framework, some possible applications, and challenges if it were implemented. We then describe how this framework can be applied to responding to memory corruption errors. In the second part, we describe and evaluate an implementation of part of this framework for diagnosing memory corruption failures. In particular, we discuss a root cause analysis tool we have created that analyzes a program's source code to determine which memory-related program events potentially lead to a memory corruption error. Our tool then monitors the afflicted program's execution and outputs useful information to aid the developer in understanding the root cause of the failure. We finally evaluate our tool's effectiveness in identifying the root cause of memory access errors in both self-written and open-source code.
- A Framework for Performance Analysis of Virtual Collaborative Environments.(2010-07-29) Gavaskar, Nilesh; Mihail Devetsikiotis, Committee Chair; Do Eun, Committee Member; Laurie Williams, Committee Member
- Improving Software Productivity and Quality via Mining Source Code.(2010-11-23) Thummalapenta, Suresh; Tao Xie, Committee Chair; Mladen Vouk, Committee Member; Laurie Williams, Committee Member; Yan Solihin, Committee Member
- Improving Structure Testing via Integrating Evolutionary Testing and Symbolic Execution(2008-04-22) Inkumsah, Kobina Kweenu; Kemafor Anyanwu, Committee Member; Laurie Williams, Committee Member; Tao Xie, Committee Chair
- Multiagent Referral Systems: Maintaining and Applying Trust and Expertise Mode(2007-08-28) Ranjit, Narendran; Laurie Williams, Committee Member; Dr.Edward Gehringer, Committee Member; Dr.Munindar Singh, Committee Chair
- PaRaM: Path-Sensitive Monitoring of Web Applications against SQL Injection Attacks.(2010-07-07) Marri, Madhuri; Tao Xie, Committee Chair; Ting Yu, Committee Member; Laurie Williams, Committee Member
- Requirements-Based Access Control Analysis and Policy Specification(2005-08-15) He, Qingfeng; Ting Yu, Committee Member; Laurie Williams, Committee Member; Julie Earp, Committee Member; Annie I. Anton, Committee ChairAccess control is a mechanism for achieving confidentiality and integrity in software systems. Access control policies (ACPs) define how access is managed and the high-level rules of who can access what information under certain conditions. Traditionally, access control policies have been specified in an ad-hoc manner, leaving systems vulnerable to security breaches. ACP specification is often isolated from requirements analysis, resulting in policies that are not in compliance with system requirements. This dissertation introduces the Requirements-based Access Control Analysis and Policy Specification (ReCAPS) method for deriving access control policies from various sources, including software requirements specifications (SRS), software designs, and high-level security/privacy policies. The ReCAPS method is essentially an analysis method supported by a set of heuristics and a software tool: the Security and Privacy Requirements Analysis Tool (SPRAT). The method was developed in two formative case studies and validated in two summative case studies. All four case studies involved operational systems, and ReCAPS evolved as a result of the lessons learned from applying the method to these case studies. Further validation of the method was performed via an empirical study to evaluate the usefulness and effectiveness of the approach. Results from these evaluations indicate that the process and heuristics provided by the ReCAPS method are useful for specifying database-level and application-level ACPs. Additionally, ReCAPS integrates policy specification into software development, thus providing a basic framework for ensuring compliance between different levels of policies, system requirements and software design. The method also improves the quality of requirements specifications and system designs by clarifying ambiguities and resolving conflicts across these artifacts.
- Structural and Dialogue Act Modeling in Task-Oriented Tutorial Dialogue.(2010-07-28) Boyer, Kristy; Mladen Vouk, Committee Chair; James Lester II, Committee Chair; Tiffany Barnes, Committee Member; Laurie Williams, Committee Member
- Verifying Commitment Based Business Protocols and their Compositions: Model Checking using Promela and Spin(2006-08-22) Cheng, Zhengang; Laurie Williams, Committee Member; Peter R. Wurman, Committee Member; Munindar P. Singh, Committee Co-Chair; Mladen A. Vouk, Committee Co-ChairA protocol-oriented approach of modeling and enacting business processes and workflows has been developed recently that offers advantages in terms of supporting the autonomy and heterogeneity of business partners and the reconfigurability of their process. Importantly, protocols are described using commitments, map to the individual computation of the participating roles, and can be composed to yield more complex protocols. However, verifying that the protocols, especially composed protocols, fully satisfy appropriate correctness properties remains an open problem. This dissertation presents a novel way to model business protocols in terms of commitments involved and the constraints for protocol composition. The correct composition of a business process can be expressed via individual protocol definitions and their composition constraints,thereby enabling the verification of large processes. Importantly, as part of the verification process, protocols are translated into the language Promela, which makes them amenable to analysis and verification using the model checker Spin. As a result many important properties of business protocols and their compositions into partial and full workflows can be verified, and improved protocols can be produced. The contribution of this dissertation is in providing a generalized mechanism for modeling commitments, formulating and verifying properties related to commitments. In fact, the results are applicable to a wide range of processes and related protocols, such as scientific discovery processes and workflows.
