Title:
RADAR: compiler and architecture supported intrusion prevention, detection, analysis and recovery

Simple item page
dc.contributor.advisor Pande, Santosh
dc.contributor.author Zhang, Tao en_US
dc.contributor.committeeMember Ahamad, Mustaque
dc.contributor.committeeMember Lee, Wenke
dc.contributor.committeeMember Schwan, Karsten
dc.contributor.committeeMember Yang, Jun
dc.contributor.department Computing en_US
dc.date.accessioned 2007-03-27T18:11:36Z
dc.date.available 2007-03-27T18:11:36Z
dc.date.issued 2006-08-25 en_US
dc.description.abstract In this dissertation, we propose RADAR - compileR and micro-Architecture supported intrusion prevention, Detection, Analysis and Recovery. RADAR is an infrastructure to help prevent, detect and even recover from attacks to critical software. Our approach emphasizes collaborations between compiler and micro-architecture to avoid the problems of purely software or hardware based approaches. With hardware support for cryptographic operations, our infrastructure can achieve strong process isolation to prevent attacks from other processes and to prevent certain types of hardware attacks. Moreover, we show that an unprotected system address bus leaks critical control flow information of the protected software but has never been carefully addressed previously. To enhance intrusion prevention capability of our infrastructure further, we present a scheme with both innovative hardware modification and extensive compiler support to eliminate most of the information leakage on system address bus. However, no security system is able to prevent all attacks. In general, we have to assume that certain attacks will get through our intrusion prevention mechanisms. To protect software from those attacks, we build a second line of defense consisted of intrusion detection and intrusion recovery mechanisms. Our intrusion detection mechanisms are based on anomaly detection. In this dissertation, we propose three anomaly detection schemes. We demonstrate the effectiveness of our anomaly detection schemes thus the great potential of what compiler and micro-architecture can do for software security. The ability to recover from an attack is very important for systems providing critical services. Thus, intrusion recoverability is an important goal of our infrastructure. We focus on recovery of memory state in this dissertation, since most attacks break into a system by memory tampering. We propose two schemes for intrusion analysis. The execution logging based scheme incurs little performance overhead but has higher demand for storage and memory bandwidth. The external input points tagging based scheme is much more space and memory bandwidth efficient, but leads to significant performance degradation. After intrusion analysis is done and tampered memory state is identified, tampered memory state can be easily recovered through memory updates logging or memory state checkpointing. en_US
dc.description.degree Ph.D. en_US
dc.format.extent 1445363 bytes
dc.format.mimetype application/pdf
dc.identifier.uri http://hdl.handle.net/1853/13987
dc.language.iso en_US
dc.publisher Georgia Institute of Technology en_US
dc.subject Software protection en_US
dc.subject Compiler support en_US
dc.subject Microarchitecture support en_US
dc.subject Information leakage prevention en_US
dc.subject Anomaly detection en_US
dc.subject Intrusion recovery en_US
dc.subject.lcsh Computer networks Security measures en_US
dc.subject.lcsh Computer architecture en_US
dc.subject.lcsh Computer network protocols en_US
dc.title RADAR: compiler and architecture supported intrusion prevention, detection, analysis and recovery en_US
dc.type Text
dc.type.genre Dissertation
dspace.entity.type Publication
local.contributor.advisor Pande, Santosh
local.contributor.corporatename College of Computing
relation.isAdvisorOfPublication 6239fe5b-32c4-4067-9614-1ccca3374873
relation.isOrgUnitOfPublication c8892b3c-8db6-4b7b-a33a-1b67f7db2021
Files
Original bundle
Now showing 1 - 1 of 1
Thumbnail Image
Name:
zhang_tao_200612_phd.pdf
Size:
1.38 MB
Format:
Adobe Portable Document Format
Description:
Download
Collections
Theses and Dissertations