1 / 16

Supporting A Dynamic Program Signature: An Intrusion Detection Framework for Microprocessors

Supporting A Dynamic Program Signature: An Intrusion Detection Framework for Microprocessors. Koji Inoue Department of Informatics, Kyushu University Japan Science and Technology Agency. Trusted Program. Malicious Program. Branch Prediction. Selective Activation. Pipelining.

graham
Download Presentation

Supporting A Dynamic Program Signature: An Intrusion Detection Framework for Microprocessors

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. Supporting A Dynamic Program Signature:An Intrusion Detection Framework for Microprocessors Koji Inoue Department of Informatics, Kyushu University Japan Science and Technology Agency ICECS'06

  2. Trusted Program Malicious Program Branch Prediction Selective Activation Pipelining SuperScalar Signal Gating Clock Gating ILP TLP DVS OOO Exe. Value Prediction Resizing Drowsy Operation On-chip Cache MLP Background High Performance Low Power/Energy ICECS'06

  3. Architectural Support for Branch Prediction Selective Activation Pipelining SuperScalar Signal Gating Clock Gating ILP TLP DVS OOO Exe. Value Prediction Resizing Drowsy Operation On-chip Cache MLP The Goal of This Research Security Run-Time Program Authentication High Performance Low Power/Energy ICECS'06

  4. Outline • Introduction • Processor Level Intrusion Detection (Conventional) • Supporting A Dynamic Signature • Evaluation • Security Strength • Performance and Cost Overhead • Conclusions ICECS'06

  5. Search Malicious Programs Allow to Execute Only Authenticated Programs Static Static Dynamic Dynamic Certificate (w/ Key) Virus Scan （Pattern Matching） Virus Scan （Rule Matching） • Problems • Require Virus Lists • Impossible to Detect Unkonwn Virus • Problems • Corruption of key check programs • Hijack of the program execution control of authenticated programs What Is The Problem of Current Intrusion Detection? (1/2) ICECS'06

  6. Dynamic Program Authentication[Wanger’01] Extract a Rule (or Behavior) From the Program Code Check the Rule at Run Time Program object code compile Behavior Model static analysis CPU Execution What Is The Problem of Current Intrusion Detection? (2/2) • Problems • Limits of The Extracted Rule • Can NOT Detect Viruses Which Have The Same Rule ICECS'06 D. Wagner and D. Dean, "Intrusion Detection via Static Analysis," IEEE Symposium on Security and Privacy, May 2001

  7. Outline • Introduction • Processor Level Intrusion Detection (Conventional) • Supporting A Dynamic Signature • Evaluation • Security Strength • Performance and Cost Overhead • Conclusions ICECS'06

  8. Program CPU Concept of Dynamic Program Signature • Determine an execution behavior for the program authentication from a secret key • E.g., Memory-Access Pattern • Control the execution behavior at compile time • Monitor the execution behavior at run time • E.g., Hardware Profiler object code compile Secret Key Behavior Model Behavior Model ? ICECS'06

  9. Attack Code Program HW Profiler Dynamic Execution Behavior for Program Authentication Address X is Accessed in Every N Instructions! HW Profiler End of Execution Hijacking of Execution Control N Instructions ICECS'06

  10. A special instruction to generate a dynamic signature Unified Basic Block Basic Block original How Can We Control The Execution Behavior At Compile Time? • Branches • Unify the size of basic blocks • Speculative/OOO Execution • Monitor the sequence of committed instructions ICECS'06

  11. Outline • Introduction • Processor Level Intrusion Detection (Conventional) • Supporting A Dynamic Signature • Evaluation • Security Strength • Performance and Cost Overhead • Conclusions ICECS'06

  12. Security Strength We can NOT detect malicious attacks if • The attacker knows the secret key information and algorithm how to determine the pre-defined behavior • The attack codes are inserted at the compile time • The attacker can predict the pre-defined behavior • Provability: 1/(2ADDRbit-width+2N) where N is the candidate of the unified basic-block size • The size of malicious code is smaller than that of unified basic-block • E.g., less than 5 or 30 instructions ICECS'06

  13. Performance/Cost Overhead (1/2) • Evaluation • Code size (Cost) • Execution time (Performance) • Experimental Environment • ARMSimplescalar • StrongARM model • Support the dynamic signature • Benchmark programs • SPECint95（129.compress） • Dynamic Signature • Unified basic-block size：from 5 to 25 instructions • #of key-load instructions in each basic block: 1 ICECS'06

  14. Load for Key Nop Original Performance/Cost Overhead (2/2) • Code size • x5 in maximum, and x1.7 in minimum • Execution time overhead • 50% in max. and 10% in min. ICECS'06

  15. Outline • Introduction • Processor Level Intrusion Detection (Conventional) • Supporting A Dynamic Signature • Evaluation • Security Strength • Performance and Cost Overhead • Conclusions ICECS'06

  16. Conclusions • Summary • Supporting Dynamic Program Signature • Run-time execution authentication • Detect the execution of malicious programs • Overhead Evaluation (unified BB size = 5 inst.) • Code size: about x1.7 • Execution Time: about x1.1 • Future Work • Support secure compilation • Explore the tradeoff between security and cost, performance, and also energy consumption ICECS'06

More Related