2026-09-19T15:47:47Z https://www.ideals.illinois.edu/oai-pmh

oai:www.ideals.illinois.edu:2142/95601 2023-07-11 col_2142_5131 col_2142_8888 com_2142_5130 com_2142_8887 com_2142_234

Torrellas, Josep Shalabi, Yasser Hussein 2017-03-01T17:01:50Z 2017-03-01T17:01:50Z 2019-03-02T10:15:27Z 2016-12-01 2016-12 Hardware security features need to strike a careful balance between design intrusiveness and completeness of methods. Securing against attacks like Return Oriented Programming (ROP) requires frequent and expensive checks. Complete security defenses have been proposed yet modern systems are still vulnerable to ROP attacks. We provide complete security by decomposing the solution into two stages. The first stage raises alarms based on an imprecise, low cost hardware detector. The second stage applies complete methods in order to accurately distinguish real attacks from false alarms. This decomposition is enabled with Record and Deterministic Replay. The original execution is recorded and subjected to replay analysis as alarms are raised. In this way the Replay infrastructure can compensate for the occasional hardware imprecision. We demonstrate this approach by applying it to thwart ROP attacks on the Linux kernel. We call the design RnR-ROPSafe. It reuses a simple Return Address Stack (RAS) as the hardware detector. The RAS is slightly modified to prevent corruption of the RAS due to multithreading and due to non-procedural returns—improving its performance as a ROP detector. Rare false positives due to underflows are eliminated via replay instead of hardware over-design. RnR-ROPSafe relies on two on-the-fly replayers: an always-on, fast Checkpointing replayer that periodically creates checkpoints, and a detailed-analysis Alarm replayer that is triggered when there is a threat alarm. We find that the first one has execution speed comparable to that of the recorder, and can be replaying all the time, while the latter has to handle only very few false positives. Submission published under a 24 month embargo labeled 'Closed Access', the embargo will last until 2018-12-01 The student, Yasser Shalabi, accepted the attached license on 2016-12-01 at 11:00. The student, Yasser Shalabi, submitted this Thesis for approval on 2016-12-01 at 11:06. This Thesis was approved for publication on 2016-12-01 at 16:31. DSpace SAF Submission Ingestion Package generated from Vireo submission #10390 on 2017-02-28 at 14:42:42 Made available in DSpace on 2017-03-01T17:01:50Z (GMT). No. of bitstreams: 2 SHALABI-THESIS-2016.pdf: 362557 bytes, checksum: ba4eeff5fa52bdb6d5c23729df1b0f49 (MD5) LICENSE.txt: 4211 bytes, checksum: 01e25a99edccc51952adc113c951e8a5 (MD5) Previous issue date: 2016-12-01 Embargo set by: Seth Robbins for item 98717 Lift date: 2019-03-01T17:02:22Z Reason: Author requested closed access (OA after 2yrs) in Vireo ETD system Embargo set by: Seth Robbins for item 98717 Lift date: 2019-03-01T17:03:32Z Reason: Author requested closed access (OA after 2yrs) in Vireo ETD system Embargo set by: Seth Robbins for item 98717 Lift date: 2019-03-01T17:05:02Z Reason: Author requested closed access (OA after 2yrs) in Vireo ETD system Embargo set by: Seth Robbins for item 98717 Lift date: 2019-03-01T17:06:55Z Reason: Author requested closed access (OA after 2yrs) in Vireo ETD system Limited Restriction Lifted for Item 98717 on 2019-03-02T10:15:27Z. application/pdf http://hdl.handle.net/2142/95601 en Copyright 2016 Yasser Shalabi Security Operating systems (OS) Return oriented programming (ROP) Virtual machine Virtual machine introspection (VMI) Control flow integrity (CFI) Record and replay based virtual-machine introspection for system security text text Electrical & Computer Eng Electrical & Computer Engr University of Illinois at Urbana-Champaign Thesis M.S.