Introduction

My research group develops methods to secure computing systems by understanding attacks, developing defenses, and devising metrics by which we can show that our defenses work. Some projects require expertise in program analysis and transformation, some projects utilize expertise in operating systems, and some projects include elements of both.

The following exciting research projects are underway:

Secure Virtual Architecture (SVA) Projects

Defenses Against Kernel-Level Malware

Metadata Diagram

Funded by NSF Award 1618213, this project will develop new methods of defending systems against kernel-level malware. Our previous research, Virtual Ghost, protects applications from a compromised operating system kernel. However, it still permits attackers to corrupt key kernel data structures and to interfere with correct operating system kernel operation. Our goal in this project is to develop run-time checks that a compiler can insert into kernel code that will restrict which fields of each data structure each kernel module can read and write. Furthermore, we are investigating methods of creating these policies automatically by analyzing the behavior of trusted kernel modules. To support this work, we have developed and are evaluating new methods for attaching metadata to memory objects; this metadata will hold policy information needed by run-time checks.

Software Defenses for Security-Critical Processor Bugs

Hardware Bug Defense Compilation Flow Diagram

We have started preliminary work on a project that leverages the fact that our research infrastructure, Secure Virtual Architecture (SVA), gives us the ability to control all native code running on a system. We believe we can employ SVA in a three-pronged approach to defeat security-critical processor bugs: generate safe instruction sequences when known instructions are buggy, detect whether the SVA native code generator has generated a program which could trigger a processor bug, and enhance SVA to add run-time checks to detect whether a security-critical processor bug is about to be exploited to bypass system security. We are currently studying existing processor bugs to see which of these defenses can thwart each bug and are developing intial designs for static analyses and run-time checks to prevent the exploitation of these bugs.

Virtual Ghost

Virtual Ghost Architecture Diagram

Virtual Ghost is a system which protects applications from a compromised operating system kernel. While Virtual Ghost has outperformed its predecessors, we want to make it even faster to make it practical for use in environments with tight resource constraints (such as mobile devices, large-scale data centers, and cloud computing systems). We also want to enhance Virtual Ghost to provide formally sound defenses against implicit information flow attacks; these attacks allow the operating system kernel to infer information from application system call behaviors and to indirectly affect application behavior via Iago attacks.

Program Analysis for Security Projects

CRAFTED

Diagram of CRAFTED Architecture

Funded by NSF Award 1463870, the CRAFTED project aims to create a compiler-based tool for measuring the efficacy of defenses against code reuse attacks. A code reuse attack corrupts data within a program and executes instructions (potentially in an order not allowed by the programming language's original semantics) that use those corrupted memory values. We are building a program analysis infrastructure that will locate all instructions that an attacker may want to use, determine via data flow analysis which instructions can be strung together to perform computation, and determine whether a security policy (such as control flow integrity) allows the instructions to be used in the order needed by the attacker.

Stealthy Return-Oriented Programming Parasite

Return-oriented programming (ROP) is a technique in which the data flow and control flow of a program is corrupted to start an unauthorized computation within an existing program without injecting new code into the victim process. Normally, ROP is used in buffer overflow attacks. However, an attacker who has already gained access to the root account may want to hide a backdoor in the system to allow himself/herself to log into the machine remotely without supplying a password. Normally, such an attack adds or modifies the code within executable files and processes; this can be detected using digital signatures. My students and I have built a remote login backdoor using ROP that does not add or modify code on the system; instead, it only modifies the control-flow of the OpenSSH (sshd) remote login server. The backdoor also mimics the system call behavior of the parent server process it infects using a mimicry attack, further reducing its detectability.