Verification of concurrent control flow in distributed computer systems

An approach to verifying control flow in distributed computer systems (DCS) is presented. The approach is based on control flow checking among software components distributed over processors and cooperating among them. In this approach, control-flow behavior of DCS software is modeled and contained in special software components called verifiers. The verifiers are distributed over the processors and consulted to check the correctness of the control flow in DCS software during its execution. Algorithms for deriving the verifiers are presented. This technique can detect global errors including synchronization errors as well as local errors. It can be used for sequential or concurrent software at various levels of details. Experiments show that using this technique requires no significant overhead.<>     

基于行为轨迹的软件动态可信度量

针对软件动态可信度量方法中准确性和效率较低的问题,提出了一种以编译器插桩获取软件行为轨迹的软件动态可信SDTBT模型。通过分析包含函数调用和基本块调用的C程序控制流,在GCC编译预处理过程中设计软件插桩算法,提取软件行为轨迹;模型运行时可选择基本块或函数调用作为动态可信验证的对象,提高了软件度量的灵活性和效率,同时降低了度量资源消耗。实验分析表明,该模型能够准确提取软件行为轨迹信息,有效检测基于控制流的攻击行为,相较于已有模型有较高的准确性和较低的时间消耗。     

Detecting component changes at run time with behavior models

Modern software systems are composed of several services which may be developed and maintained by third parties and thus they can change independently and without notice during the system’s runtime execution. In such systems, changes may possibly be a threat to system functional correctness, and thus to its reliability. Hence, it is important to detect them as soon as they happen to enable proper reaction. Change detection can be done by monitoring system execution and comparing the observed execution traces against models of the services composing the application. Unfortunately, formal specifications for services are not usually provided and developers have to infer them. In this paper we propose a methodology which exactly addresses these issues by using software behavior models to monitor component execution and detect changes. In particular, we describe a technique to infer behavior model specifications with a dynamic black box approach, keep them up-to-date with run time observations and detect behavior changes. Finally, we present a case study to validate the effectiveness of the approach in component change detection for a component that implements a complex, real communication protocol.     

恶意软件动态分析云平台

传统的杀毒软件基于特征码识别的方式有效但具有一定的局限性.使用沙箱动态分析的方法能通过目标软件的行为特征对其恶意属性进行判断,可以同时达到检测恶意软件和帮助分析人员快速分析恶意软件的目的.为了提高沙箱平台分析的易用性和高效性,本文设计并实现了一个恶意软件动态分析云平台,通过分布式的沙箱控制机制,保证沙箱的分析能力以及可扩展性,并可通过对目标软件的分析结果来判断其是否属于恶意软件.实验表明,设计的云沙箱系统能够有效和高效的检测出恶意软件的恶意行为.     

Fighting Bugs: Remove, Retry, Replicate, and Rejuvenate

Even if software developers don't fully understand the faults or know their location in the code, software rejuvenation can help avoid failures in the presence of aging-related bugs. This is good news because reproducing and isolating an aging-related bug can be quite involved, similar to other Mandelbugs. Moreover, monitoring for signs of software aging can even help detect software faults that were missed during the development and testing phases. If, on the other hand, a developer can detect a specific aging-related bug in the code, fixing it and distributing a software update might be worthwhile. In the case of the Patriot missile-defense system, a modified version of the software was indeed prepared and deployed to users. It arrived at Dhahran on 26 February 1991- a day after the fatal incident     

An approach to testing commercial embedded systems

A wide range of commercial consumer devices such as mobile phones and smart televisions rely on embedded systems software to provide their functionality. Testing is one of the most commonly used methods for validating this software, and improved testing approaches could increase these devices’ dependability. In this article we present an approach for performing such testing. Our approach is composed of two techniques. The first technique involves the selection of test data; it utilizes test adequacy criteria that rely on dataflow analysis to distinguish points of interaction between specific layers in embedded systems and between individual software components within those layers, while also tracking interactions between tasks. The second technique involves the observation of failures: it utilizes a family of test oracles that rely on instrumentation to record various aspects of a system's execution behavior, and compare observed behavior to certain intended system properties that can be derived through program analysis. Empirical studies of our approach show that our adequacy criteria can be effective at guiding the creation of test cases that detect faults, and our oracles can help expose faults that cannot easily be found using typical output-based oracles. Moreover, the use of our criteria accentuates the fault-detection effectiveness of our oracles.     

Knowledge Representation of Software Component Interconnection Information for Large-Scale Software Modifications

Logic can be used to precisely express human thoughts and inferences. In this paper, an approach using first-order logic for knowledge representation of software component interconnection information to facilitate the validity and integrity checking of the interconnection among software components during software development or modification is presented. Directed graphs are first used to model the structure and behavior of a large-scale software system, and a first-order theory of directed graphs (the DG theory) is established. The interconnection behavior among software components in a large-scale software system is a directed graph which is called software component interconnection graph (CIG). The behavior of the CIG is interpreted using the DG theory and translated into logic representation. The translated logic representation is a set of logic clauses and can be considered as a set of axioms. Automated reasoning techniques based on these axioms can be used to perform the validity and integrity checking of software properties in the software development or maintenance phase.     

基于贝叶斯网络的Android恶意行为检测方法

Android操作系统是市场占有率最高的移动操作系统,基于Android平台的恶意软件也呈现爆发式的增长,而目前仍然没有有效的手段进行Android恶意行为的检测,通过分析Android恶意行为的特点,采用基于贝叶斯网络的机器学习算法进行Android恶意行为的检测,通过静态分析的方法进行Android文件静态特征的提取,将Android恶意应用的静态分析与贝叶斯网络相结合,最后通过使用提出的方法构建贝叶斯网络模型,通过实验验证了提出的Android恶意行为检测模型的有效性。     

AnDa：恶意代码动态分析系统

近年来,移动终端崛起迅速,其功能已扩展到商务应用等领域,与用户的隐私、财产等信息关系紧密。静态监控已无法满足人们对应用软件安全使用的需求,采用动态监控沙盒分析可以实时监控应用程序,具有速度快、准确性好、安全性高、可行性强的特性。针对Android平台下恶意软件在后台获取用户隐私信息,如获取用户数据并发送到网络端、拦截和窥探用户电话和短信等问题,提出一套采用动态检测沙盒分析技术记录Android恶意软件敏感行为的方案及系统--AnDa,详细描述了该系统总体设计和关键技术,实现了对访问电话、短信、位置信息、手机SIM卡信息等行为的实时监控,并在虚拟机和实体机上测试了AnDa系统。该作品采用动态监控沙盒分析技术,实现了在Android平台下软件动态监控和行为分析,并且实现了对Android框架层API的Java Method Hook和常见的恶意软件特征的有效监控。它可以在Android 4.0以上的设备上使用,可以根据监控到的应用软件恶意行为信息,判定所属恶意软件的类型,使得更加迅速发现新型病毒和更加隐蔽的病毒模型,从而更好地保护手机以及个人重要的数据,极大地提高了安全性。     

Dynamic Bayesian approach for detecting cheats in multi-player online games

Massively multi-player games hold a huge market in the digital entertainment industry. Companies invest heavily in game developments since a successful online game can attract millions of users, and this translates to a huge investment payoff. However, multi-player online games are also subjected to various forms of “hacks” and “cheats”. Hackers can alter the graphic rendering to reveal information otherwise be hidden in a normal game, or cheaters can use software robots to play the game automatically and thus gain an unfair advantage. To overcome these problems, some popular online games release software patches constantly to block “known” hacks or incorporate anti-cheating software to detect “known” cheats. This not only creates deployment difficulty but new cheats will still be able to breach the normal game logic until software patches or updates of the anti-cheating software are available. Moreover, the anti-cheating software themselves are also vulnerable to hacks. In this paper, we propose a “scalable” and “efficient” method to detect whether a player is cheating or not. The methodology is based on the dynamic Bayesian network approach. The detection framework relies solely on the game states and runs in the game server only. Therefore, it is invulnerable to hacks and it is a much more deployable solution. To demonstrate the effectiveness of the proposed method, we have implemented a prototype multi-player game system to detect whether a player is using any “aiming robot” for cheating or not. Experiments show that the proposed method can effectively detect cheaters on a first-person shooter game with extremely low false positive rate. We believe the proposed methodology and the prototype system provide a first step toward a systematic study of cheating detection and security research in the area of online multi-player games.     

基于Android网络恶意行为检测系统的应用研究

目前,Android系统是当今网络用户最对的应用系统之一,而随着科学技术的发展,对于Android系统的恶意行为软件也逐渐增多,给当前的应用用户的财产以及私人信息安全带来了很大的威胁,严重的迟缓了当前移动通信网络技术以及相关于应用客户端的推广;为此,根据Android系统的特有机构设计出一种基于Binder信息流的自动检测恶意行为系统,以此来解决对于当前网络安全对于Android系统用户带来的负面影响;根据目前网络中的应用通信信息,检测可能存在的泄露用户信息的应用软件为目标,建立信息矢量图以此来分析当前网络中的恶意行为;通过对软件进行检测,研究可实用性和检测效果,结果显示其识别率可以达到100%,并且软件运行只占有内存的7%,结果可以达到当前的Android用户的使用范围。     

基于静态分析的安全漏洞检测技术研究

消除软件中的安全漏洞是建立安全信息系统的前提。静态分析方法可以自动地提取软件的行为信息,从而检测出软件中的安全漏洞。和其它程序分析方法相比,该方法具有自动化程度高和检测速度快的优点。在本文中,我们首先描述了静态分析的理论基础,然后说明了类型推断、数据流分析和约束分析等主要静态分析方法及其在安全漏洞检测中的应用,并比较这些方法的优缺点。最后给出了几种支持安全漏洞静态检测的编程语言。     

基于SVM的Android应用程序安全检测综述

当前基于SVM的Android应用程序安全检测技术主要是通过将SVM算法与动静态分析方法相结合,应用于Android应用程序的漏洞和恶意软件的检测中,而恶意软件的检测又可分为恶意行为的检测和恶意代码的检测。故本文按SVM算法应用到的检测领域分类,分别对其应用于Android应用程序中的恶意行为检测、恶意代码检测和漏洞检测方面的研究进行分析与讨论,并总结了当前该领域中仍然存在的一些问题,给出了SVM算法和其应用于Android安全检测中的改进之处,最后对未来的发展进行了展望。     

SDN环境下的LDoS攻击检测与防御技术

低速率拒绝服务(LDoS)攻击是一种新型的网络攻击方式,其特点是攻击成本低,隐蔽性强。作为一种新型的网络架构,软件定义网络(SDN)同样面临着LDoS攻击的威胁。但SDN网络的控制与转发分离、网络行为可编程等特点又为LDoS攻击的检测和防御提供了新的思路。提出了一种基于OpenFlow协议的LDoS攻击检测和防御方法。通过对每条OpenFlow数据流的速率单独进行统计,并利用信号检测中的双滑动窗口法实现对攻击流量的检测,一旦检测到攻击流量,控制器便可以通过下发流表的方式实现对攻击行为的实时防御。实验表明,该方法能够有效检测出LDoS攻击,并能够在较短时间内实现对攻击行为的防御。     

Conflict Detection among Multiple Norms in Multi-Agent Systems

In open multi-agent systems (MAS), norms are being used to regulate the behavior of the autonomous, heterogeneous and independently designed agents. One of the main challenges on developing normative systems is that norms may be in conflict with each other. Norms are in conflict when the fulfillment of one norm violates the other and vice-versa. In previous works, the conflict checkers consider that conflicts can be detected by simply analyzing pairs of norms. However, there may be conflicts that can only be detected when we analyze several norms together. This work presents a conflict checker capable to detect conflicts between two or more norms at the same time. A new, more expressive normative language, represented by a BNF grammar, was developed to define norms and Conflict Checker was implemented in tool format. Two validation principles were applied: software testing and formal verification. The strategy thus developed emerges as a new syntax for definition and verification of conflicts in MAS.     

基于EPMM的软件过程行为偏离诊断研究

近年来,随着对PSEE认识的深入,人们逐渐发现实际观察到的过程执行往往和实施的过程模型之间存在一定的偏离(deviation),从而导致PSEE对于实际软件开发活动失去了指导意义。针对软件过程偏离问题,以软件演化过程元模型(EPMM)为基础,在软件过程偏离发现方面,借鉴进程代数的弱互模拟思想,提出过程行为空间表达式,用以构造软件过程的行为空间来检测过程偏离;在软件过程偏离处理方面,提出过程偏离类型的划分及偏离处理策略。这种方法能够发现软件过程实施中普遍存在的过程偏离问题并加以处理来改进软件过程,最终提高软件产品质量。     

Copilot: monitoring embedded systems

Runtime verification (RV) is a natural fit for ultra-critical systems that require correct software behavior. Due to the low reliability of commodity hardware and the adversity of operational environments, it is common in ultra-critical systems to replicate processing units (and their hosted software) and incorporate fault-tolerant algorithms to compare the outputs, even if the software is considered to be fault-free. In this paper, we investigate the use of software monitoring in distributed fault-tolerant systems and the implementation of fault-tolerance mechanisms using RV techniques. We describe the Copilot language and compiler that generates monitors for distributed real-time systems, and we discuss two case-studies in which Copilot-generated monitors were used to detect onboard software and hardware faults and monitor air-ground data link messaging protocols.     

Towards automatic evaluation of multimodal user interfaces

The evaluation of the usability and the learnability of a computer system may be performed with predictive models during the design phase. It may be done on the executable code as well as by observing the user in action. In the latter case, data collected in vivo must be processed. The goal is to provide software supports for performing this difficult and time consuming task.

The paper presents an early analysis of, and experience relating to, the automatic evaluation of multimodal user interfaces. With this end in view, a generic Wizard of Oz platform has been designed to allow the observation and automatic recording of subjects' behavior while they interact with a multimodal interface. It is then shown how recorded data can be analyzed to detect behavioral patterns, and how deviations of such patterns from a data-flow-oriented task model can be exploited by a software usability critic.     

一种可检测Java程序盗版的动态胎记技术

针对Java程序易盗版的特点,提出了一种新的动态软件胎记技术。首先将Java程序进行转换得到其字节码集合U,然后利用动态程序切片技术得到U在特定输入I下的子集S,最后采用k-gram胎记提取算法得到S的一个特征值序列作为软件胎记。实验分析显示这种胎记能很好地抵抗各种程序变换攻击,具有很强的置信性和鲁棒性,并能有效地检测程序盗版行为。     

Software congestion, mobile servers, and the hyperbolic model

The phenomenon of software congestion is examined. The term refers to situations in which the performance bottleneck of a system is an element of software, rather than a hardware device. Software congestion can occur in any system which contains one or more elements of software whose services may be simultaneously desired by multiple clients, but which can service only one client at a time. It is shown that the use of models which ignore software congestion can produce results that are completely irrelevant to actual system behavior. Furthermore, software congestion is frequently invisible to conventional performance measurement tools. A notational scheme, called mobile servers representation, is introduced for describing those systems in which software congestion may be important. An approximate analytical model, called the hyperbolic model, is developed for analyzing systems with software congestion