_:n9ab092968d2f4255936e662e900db988xb11
<http://schema.org/description>
"Modern software systems heavily use C/C++ based libraries. Because of the\nweak memory model of C/C++, libraries may suffer from vulnerabilities which can\nexpose the applications to potential attacks. For example, a very large number\nof return oriented programming gadgets exist in glibc that allow stitching\ntogether semantically valid but malicious Turing-complete programs. In spite of\nsignificant advances in attack detection and mitigation, full defense is\nunrealistic against an ever-growing set of possibilities for generating such\nmalicious programs.\n  In this work, we create a defense mechanism by debloating libraries to reduce\nthe dynamic functions linked so that the possibilities of constructing\nmalicious programs diminishes significantly. The key idea is to locate each\nlibrary call site within an application, and in each case to load only the set\nof library functions that will be used at that call site. This approach of\ndemand-driven loading relies on an input-aware oracle that predicts a\nnear-exact set of library functions needed at a given call site during the\nexecution. The predicted functions are loaded just in time, and the complete\ncall chain (of function bodies) inside the library is purged after returning\nfrom the library call back into the application. We present a decision-tree\nbased predictor, which acts as an oracle, and an optimized runtime system,\nwhich works directly with library binaries like GNU libc and libstdc++. We show\nthat on average, the proposed scheme cuts the exposed code surface of libraries\nby 97.2\nprediction accuracy in most cases of at least 97\noverhead of 18\nbenchmarks of SPEC 2006, suggesting this scheme is practical."
<https://deepai.org/profile/girish-mururu>