The Experts below are selected from a list of 13161 Experts worldwide ranked by ideXlab platform
Tzi-cker Chiueh - One of the best experts on this subject based on the ideXlab platform.
-
ACSAC - Execution Trace-Driven Automated Attack Signature Generation
2008 Annual Computer Security Applications Conference (ACSAC), 2008Co-Authors: Susanta Nanda, Tzi-cker ChiuehAbstract:In its most general form, an attack signature is a program that can correctly determine if an input network packet sequence can successfully attack a protected network application. Filter rules used in firewall and network intrusion prevention systems (NIPS) are an abstract form of attack signature. This paper presents the design, implementation, and evaluation of an automated attack signature generation system called Trag, that automatically generates an executable attack signature program from a victim programpsilas source and a given attack input. Trag leverages dynamic data and control dependencies to extract relevant code in the victim program, accurately identifies variable initialization statements that are not executed in the given attack, is able to generate attack signatures for multi-process network applications, and reduces the size of attack signatures by exploiting responses from victim programs. Experiments with a fully working Trag prototype show that Tragpsilas signatures can indeed prevent attacks against multiple production-grade vulnerable server/Web applications, such as apache, wu-ftpd and MyBullentinBoard, with up to 65% reduction in size when compared with the victim program. In terms of performance overhead, the additional latency as observed from the client-side is no more than 25 usec for multi-process Web applications, while the overall throughput remains unaffected.
-
Execution Trace-Driven Automated Attack Signature Generation
2008 Annual Computer Security Applications Conference (ACSAC), 2008Co-Authors: Susanta Nanda, Tzi-cker ChiuehAbstract:In its most general form, an attack signature is a program that can correctly determine if an input network packet sequence can successfully attack a protected network application. Filter rules used in firewall and network intrusion prevention systems (NIPS) are an abstract form of attack signature. This paper presents the design, implementation, and evaluation of an automated attack signature generation system called Trag, that automatically generates an executable attack signature program from a victim programpsilas source and a given attack input. Trag leverages dynamic data and control dependencies to extract relevant code in the victim program, accurately identifies variable initialization statements that are not executed in the given attack, is able to generate attack signatures for multi-process network applications, and reduces the size of attack signatures by exploiting responses from victim programs. Experiments with a fully working Trag prototype show that Tragpsilas signatures can indeed prevent attacks against multiple production-grade vulnerable server/Web applications, such as apache, wu-ftpd and MyBullentinBoard, with up to 65% reduction in size when compared with the victim program. In terms of performance overhead, the additional latency as observed from the client-side is no more than 25 usec for multi-process Web applications, while the overall throughput remains unaffected.
Milena Milenkovic - One of the best experts on this subject based on the ideXlab platform.
-
real time unobtrusive program Execution Trace compression using branch predictor events
Compilers Architecture and Synthesis for Embedded Systems, 2010Co-Authors: Vladimir Uzelac, Aleksandar Milenkovic, Martin Burtscher, Milena MilenkovicAbstract:Unobtrusive capturing of program Execution Traces in real-time is crucial in debugging cyber-physical systems. However, tracing even limited program segments is often cost-prohibitive, requiring wide Trace ports and large on-chip Trace buffers. This paper introduces a new cost-effective technique for capturing and compressing program Execution Traces in real time. It uses branch predictor-like structures in the Trace module to losslessly compress the Traces. This approach results in high compression ratios because it only has to transmit misprediction events to the software debugger. Coupled with an effective variable encoding scheme, our technique requires merely 0.036 bits/instruction of Trace port bandwidth (a 28-fold improvement over the commercial state-of-the-art) at a cost of roughly 5,200 logic gates.
-
CASES - Real-time unobtrusive program Execution Trace compression using branch predictor events
Proceedings of the 2010 international conference on Compilers architectures and synthesis for embedded systems - CASES '10, 2010Co-Authors: Vladimir Uzelac, Aleksandar Milenkovic, Martin Burtscher, Milena MilenkovicAbstract:Unobtrusive capturing of program Execution Traces in real-time is crucial in debugging cyber-physical systems. However, tracing even limited program segments is often cost-prohibitive, requiring wide Trace ports and large on-chip Trace buffers. This paper introduces a new cost-effective technique for capturing and compressing program Execution Traces in real time. It uses branch predictor-like structures in the Trace module to losslessly compress the Traces. This approach results in high compression ratios because it only has to transmit misprediction events to the software debugger. Coupled with an effective variable encoding scheme, our technique requires merely 0.036 bits/instruction of Trace port bandwidth (a 28-fold improvement over the commercial state-of-the-art) at a cost of roughly 5,200 logic gates.
Susanta Nanda - One of the best experts on this subject based on the ideXlab platform.
-
ACSAC - Execution Trace-Driven Automated Attack Signature Generation
2008 Annual Computer Security Applications Conference (ACSAC), 2008Co-Authors: Susanta Nanda, Tzi-cker ChiuehAbstract:In its most general form, an attack signature is a program that can correctly determine if an input network packet sequence can successfully attack a protected network application. Filter rules used in firewall and network intrusion prevention systems (NIPS) are an abstract form of attack signature. This paper presents the design, implementation, and evaluation of an automated attack signature generation system called Trag, that automatically generates an executable attack signature program from a victim programpsilas source and a given attack input. Trag leverages dynamic data and control dependencies to extract relevant code in the victim program, accurately identifies variable initialization statements that are not executed in the given attack, is able to generate attack signatures for multi-process network applications, and reduces the size of attack signatures by exploiting responses from victim programs. Experiments with a fully working Trag prototype show that Tragpsilas signatures can indeed prevent attacks against multiple production-grade vulnerable server/Web applications, such as apache, wu-ftpd and MyBullentinBoard, with up to 65% reduction in size when compared with the victim program. In terms of performance overhead, the additional latency as observed from the client-side is no more than 25 usec for multi-process Web applications, while the overall throughput remains unaffected.
-
Execution Trace-Driven Automated Attack Signature Generation
2008 Annual Computer Security Applications Conference (ACSAC), 2008Co-Authors: Susanta Nanda, Tzi-cker ChiuehAbstract:In its most general form, an attack signature is a program that can correctly determine if an input network packet sequence can successfully attack a protected network application. Filter rules used in firewall and network intrusion prevention systems (NIPS) are an abstract form of attack signature. This paper presents the design, implementation, and evaluation of an automated attack signature generation system called Trag, that automatically generates an executable attack signature program from a victim programpsilas source and a given attack input. Trag leverages dynamic data and control dependencies to extract relevant code in the victim program, accurately identifies variable initialization statements that are not executed in the given attack, is able to generate attack signatures for multi-process network applications, and reduces the size of attack signatures by exploiting responses from victim programs. Experiments with a fully working Trag prototype show that Tragpsilas signatures can indeed prevent attacks against multiple production-grade vulnerable server/Web applications, such as apache, wu-ftpd and MyBullentinBoard, with up to 65% reduction in size when compared with the victim program. In terms of performance overhead, the additional latency as observed from the client-side is no more than 25 usec for multi-process Web applications, while the overall throughput remains unaffected.
Katsuro Inoue - One of the best experts on this subject based on the ideXlab platform.
-
nod4j near omniscient debugging tool for java using size limited Execution Trace
Science of Computer Programming, 2021Co-Authors: Kazumasa Shimari, Takashi Ishio, Tetsuya Kanda, Naoto Ishida, Katsuro InoueAbstract:Abstract Logging is an important feature of a software system to record run-time information. Detailed logging allows developers to collect run-time information in situations where they cannot use an interactive debugger, such as continuous integration and web application server cases. However, extensive logging leads to larger Execution Traces because few instructions can be repeated many times. This paper presents our tool NOD4J, which monitors a Java program's Execution within limited storage space constraints and annotates the source code with observed values in an HTML format. Developers can easily investigate the Execution and share the report on a web server. We show two examples that our tool can debug defects using incomplete Execution Traces.
-
near omniscient debugging for java using size limited Execution Trace
International Conference on Software Maintenance, 2019Co-Authors: Kazumasa Shimari, Takashi Ishio, Tetsuya Kanda, Katsuro InoueAbstract:Logging is an important feature for a software system to record its run-time information. Detailed logging allows developers to collect information in situations where they cannot use an interactive debugger, such as continuous integration and web application server cases. However, extensive logging leads to larger Execution Traces because few instructions could be repeated many times. To record detailed program behavior within limited storage space constraints, we propose Near-Omniscient Debugging, a methodology that records an Execution Trace using fixed size buffers for each observed instruction. Our tool monitors a Java program's Execution and annotates source code with observed values in an HTML format. Developers can easily investigate the Execution and share the report on a web server. In case of DaCapo benchmark applications, our tool requires fewer than 1% of the complete Execution Traces to visualize all runtime values used by 66% of instructions that are executed less than 64 times. Developers also can obtain data dependencies with precision 91.8% and recall 79.0% using this tool.
-
feature level phase detection for Execution Trace using object cache
International Workshop on Dynamic Analysis, 2008Co-Authors: Yui Watanabe, Takashi Ishio, Katsuro InoueAbstract:Visualizing collaborations of objects is important for developers understanding and debugging an object-oriented program. Many techniques and tools are proposed to visualize dynamic collaborations involved in an Execution Trace of a system, however, an Execution Trace may be too large to be transformed into a single diagram. In this paper, we propose a novel approach to efficiently detecting phases, or high-level behavioral units described in a use-case scenario. Our idea is based on the nature of object-oriented programming; a phase starts with preparing objects for the phase and ends with destroying temporary objects. Our technique uses a LRU cache for observing a working set of objects, and interprets a sharp rise in the frequency of the cache update as a phase transition. We have applied our approach to two industrial applications and found that our approach is promising to visualize a phase corresponding to a feature as a sequence diagram.
-
extracting sequence diagram from Execution Trace of java program
International Workshop on Principles of Software Evolution, 2005Co-Authors: K Taniguchi, Takashi Ishio, Toshihiro Kamiya, Shinji Kusumoto, Katsuro InoueAbstract:A software system is changed many times. When we try to change software, we must understand how the software is implemented, especially the functions to be modified. However, such repeated changes may cause situations in which there is no document which reflects the changes and represents the behavior of the software correctly. So, it is important to develop a technique to extract useful information to understand the behavior of the software. We propose a method to extract compact sequence diagrams from dynamic information of object-oriented programs. Our method generates sequence diagrams by compacting a repetition included in the Execution Trace. This paper presents four compaction rules. The experiment illustrates how our rules effectively compact the Execution Trace and generate compact sequence diagrams.
Vladimir Uzelac - One of the best experts on this subject based on the ideXlab platform.
-
real time unobtrusive program Execution Trace compression using branch predictor events
Compilers Architecture and Synthesis for Embedded Systems, 2010Co-Authors: Vladimir Uzelac, Aleksandar Milenkovic, Martin Burtscher, Milena MilenkovicAbstract:Unobtrusive capturing of program Execution Traces in real-time is crucial in debugging cyber-physical systems. However, tracing even limited program segments is often cost-prohibitive, requiring wide Trace ports and large on-chip Trace buffers. This paper introduces a new cost-effective technique for capturing and compressing program Execution Traces in real time. It uses branch predictor-like structures in the Trace module to losslessly compress the Traces. This approach results in high compression ratios because it only has to transmit misprediction events to the software debugger. Coupled with an effective variable encoding scheme, our technique requires merely 0.036 bits/instruction of Trace port bandwidth (a 28-fold improvement over the commercial state-of-the-art) at a cost of roughly 5,200 logic gates.
-
CASES - Real-time unobtrusive program Execution Trace compression using branch predictor events
Proceedings of the 2010 international conference on Compilers architectures and synthesis for embedded systems - CASES '10, 2010Co-Authors: Vladimir Uzelac, Aleksandar Milenkovic, Martin Burtscher, Milena MilenkovicAbstract:Unobtrusive capturing of program Execution Traces in real-time is crucial in debugging cyber-physical systems. However, tracing even limited program segments is often cost-prohibitive, requiring wide Trace ports and large on-chip Trace buffers. This paper introduces a new cost-effective technique for capturing and compressing program Execution Traces in real time. It uses branch predictor-like structures in the Trace module to losslessly compress the Traces. This approach results in high compression ratios because it only has to transmit misprediction events to the software debugger. Coupled with an effective variable encoding scheme, our technique requires merely 0.036 bits/instruction of Trace port bandwidth (a 28-fold improvement over the commercial state-of-the-art) at a cost of roughly 5,200 logic gates.