TY - GEN
T1 - MazeRunner
T2 - 20th IEEE International Conference on Trust, Security and Privacy in Computing and Communications, TrustCom 2021
AU - Zeng, Dongrui
AU - Niu, Ben
AU - Tan, Gang
N1 - Publisher Copyright:
© 2021 IEEE.
PY - 2021
Y1 - 2021
N2 - Control-Flow Integrity (CFI) enforces a control-flow graph (CFG) to limit attackers' ability to manipulate runtime control flow. CFI variations, enforcing different CFGs, achieve different degrees of attack surface reduction. To compare the security strength of different CFI policies, measuring the remaining attack surface is critical but challenging. Therefore, we propose MazeRunner, a framework that quantitatively estimates the attack surface of a CFI-hardened program. Methodology-wise, it takes a program's CFG, an attack model, and a security-violation policy as input to discover risky program points by an attack-aware data dependency tracking algorithm. Risky program points and the CFG are used to compute a metric for the remaining attack surface. We evaluate MazeRunner with 3 CFG types, 3 attack models, and 4 security-violation policies against 13 realistic benchmarks, and demonstrate that the new metric achieves higher precision than traditional metrics while maintaining completeness.
AB - Control-Flow Integrity (CFI) enforces a control-flow graph (CFG) to limit attackers' ability to manipulate runtime control flow. CFI variations, enforcing different CFGs, achieve different degrees of attack surface reduction. To compare the security strength of different CFI policies, measuring the remaining attack surface is critical but challenging. Therefore, we propose MazeRunner, a framework that quantitatively estimates the attack surface of a CFI-hardened program. Methodology-wise, it takes a program's CFG, an attack model, and a security-violation policy as input to discover risky program points by an attack-aware data dependency tracking algorithm. Risky program points and the CFG are used to compute a metric for the remaining attack surface. We evaluate MazeRunner with 3 CFG types, 3 attack models, and 4 security-violation policies against 13 realistic benchmarks, and demonstrate that the new metric achieves higher precision than traditional metrics while maintaining completeness.
UR - http://www.scopus.com/inward/record.url?scp=85127445197&partnerID=8YFLogxK
UR - http://www.scopus.com/inward/citedby.url?scp=85127445197&partnerID=8YFLogxK
U2 - 10.1109/TrustCom53373.2021.00116
DO - 10.1109/TrustCom53373.2021.00116
M3 - Conference contribution
AN - SCOPUS:85127445197
T3 - Proceedings - 2021 IEEE 20th International Conference on Trust, Security and Privacy in Computing and Communications, TrustCom 2021
SP - 810
EP - 821
BT - Proceedings - 2021 IEEE 20th International Conference on Trust, Security and Privacy in Computing and Communications, TrustCom 2021
A2 - Zhao, Liang
A2 - Kumar, Neeraj
A2 - Hsu, Robert C.
A2 - Zou, Deqing
PB - Institute of Electrical and Electronics Engineers Inc.
Y2 - 20 October 2021 through 22 October 2021
ER -