Adapting Static and Dynamic Program Analysis to Effectively Harden Debloated Software

Statement of Work: The PIs at Columbia University & Steven Institute of Technology will investigate and develop technology for late stage security hardening at LLVM-IR level. It will focus on defenses in three different axes: ¥ fine-grained randomization techniques that dynamically alter the image of an application in memory even while it is running, creating a moving target for the attacker. ¥ control-flow restricting techniques that ensure the application remains on allowable execution paths, severely limiting the attacker's capability to launch code-reuse attacks. ¥ techniques for preventing race conditions to harden multithreaded applications. Objective: The objective of the research is to develop late stage software transformation at LLVM-IR level to harden debloated and delayered software by leveraging static and dynamic analysis. Approach: The joint effort of Columbia University & Steven Institute of Technology plan to develop hardening techniques that cater to such debloated and delayered software. The hardening will include static and dynamic analysis and transformation. Taking advantage of the debloated & delayer codeÕs relatively compact & reduced complexity properties, the PI hope that building an accurate control-flow graph (CFG) and performing pointer analysis which do not normally scale on larger and more complex programs, become achievable. The static components of the developed techniques will be built using the LLVM compiler framework and will operate on LLVM's intermediate representation (IR). There are multiple benefits on operating on the IR. First, the techniques will be applicable to both source code compiled with LLVM, as well as binaries raised to IR through reverse engineering, taking advantage of recent developments on the area. Second, multiple languages map to the same IR enabling the application of the techniques in a language agnostic way. Dynamic analysis components (e.g., rerandomize a binary at run time) will be incorporated in binaries during compilation an at load time. Even though the techniques will operate on LLVM IR, they will not rely on the existence of source code, while they will support incremental deployment. Overall Merit and ONR Mission/Relevance: The expected result for this research is to develop a prototype of a program (LLVM-IR) transformer supporting a rich set of security methods which can be configured and automatically inserted into the resulting/transformed code. The executable generated by this compilation process provides enhanced security, robustness and resiliency. The transformation process, investigated in by the research team, will allow for code transformation / customization and hardening to improve the robustness and resiliency of the resulting executable. The availability of more secure, resilient and robust software directly contributes to the efficiency and success of future Navy's missions.