This project introduces a novel concurrent software monitoring technology, called Software Cruising. It leverages multicore architectures and utilizes lock-free data structures and algorithms to achieve efficient and scalable security monitoring. Applications include, but are not limited to, heap buffer integrity checking, kernel memory cruising, data structure and object invariant checking, rootkit detection, and information provenance and flow checking. In the software cruising framework, one or more dedicated threads, called cruising threads, are running concurrently with the monitored user or kernel code, to constantly check, or cruise, for security violations. Customized lock-free non-blocking data structures and algorithms are designed to reduce the communication or synchronization overhead between the monitor threads and the application code. We believe the software cruising technology would result in a game-changing capability in security monitoring for the cloud-based and traditional computing and network systems. 

We have developed three prototypical cruising systems: Cruiser, a lock-free concurrent heap buffer overflow monitor in user space; Kruiser, a semi-synchronized non-blocking operating system kernel cruiser; and iCruiser, a monitoring tool for checking data structure integrity under attacks. Our experimental results showed that software cruising can be deployed in practice with modest overhead. In user space, heap buffer overflow cruising incurs only about 5% performance overhead on average for the SPEC CPU2006 benchmark, and the Apache throughput slowdown is only 3% maximum and negligible on average. In kernel space, it is negligible for SPEC, and 3.8% for Apache. Both technologies can be deployed in large scale for cloud data centers and server farms in an automated manner. For data structure integrity checking, new techniques such as secure canary are designed to increase the system security.

We have also developed TaintPipe, a tool that decouples taint analysis using the software cruising technology. Taint analysis has a wide variety of compelling applications in security tasks, from software attack detection to data lifetime analysis, but the high overhead associated with dynamic taint analysis has been severely restricted its application scope. By adopting the idea of software cruising, we parallelize the taint analysis using a pipeline style, which has resulted significant performance improvement (about 2.4 times speedup on execution time) over the existing technology.

The Uroboros tool (Reassembleable Disassembling, Usenix Security 2015) we developed for reverse engineering binary executables (e.g., for applying software cruising to binary code directly, or other security retrofitting on binary code) advocates a new direction on reverse engineering and binary code retrofitting. 

The project has resulted in significant publications in top tier venues including PLDI, NDSS, USENIX Security, ASE, and DSN. We have published more than 30 research papers on this project. In particular, the Cruiser result is published in PLDI, kruiser is published in NDSS, TaintPipe and Uroboros are published in USENIX Security, and StraightTaint in ASE.

We have also open source released the Cruiser and Uroboros prototypes to facilitate further research and dissemination. The source code is available at Cruiser: https://code.google.com/p/cruiser-psu/ and Uroboros: https://github.com/s3team/uroboros.

Last Modified: 10/05/2016
Modified by: Dinghao Wu