Performance/security trade-off is widely noticed in CFI research,however,we observe that not every CFI scheme is subject to the trade-off.Motivated by the key observation,we ask three questions:1does trade-off really ...Performance/security trade-off is widely noticed in CFI research,however,we observe that not every CFI scheme is subject to the trade-off.Motivated by the key observation,we ask three questions:1does trade-off really exist in different CFI schemes?2if trade-off do exist,how do previous works comply with it?3how can it inspire future research?Although the three questions probably cannot be directly answered,they are inspiring.We find that a deeper understanding of the nature of the trade-off will help answer the three questions.Accordingly,we proposed the GPT conjecture to pinpoint the trade-off in designing CFI schemes,which says that at most two out of three properties(fine granularity,acceptable performance,and preventive protection)could be achieved.展开更多
Performance/security trade-off is widely noticed in CFI research, however, we observe that not every CFI scheme is subject to the trade-off. Motivated by the key observation, we ask three questions: ➊ does trade-off r...Performance/security trade-off is widely noticed in CFI research, however, we observe that not every CFI scheme is subject to the trade-off. Motivated by the key observation, we ask three questions: ➊ does trade-off really exist in different CFI schemes? ➋ if trade-off do exist, how do previous works comply with it? ➌ how can it inspire future research? Although the three questions probably cannot be directly answered, they are inspiring. We find that a deeper understanding of the nature of the trade-off will help answer the three questions. Accordingly, we proposed the GPT conjecture to pinpoint the trade-off in designing CFI schemes, which says that at most two out of three properties (fine granularity, acceptable performance, and preventive protection) could be achieved.展开更多
This paper reports on a pioneer effort for the establishment of a software composite metric with key capability of distinguishing among different structures. As a part of this effort most of the previously proposed pr...This paper reports on a pioneer effort for the establishment of a software composite metric with key capability of distinguishing among different structures. As a part of this effort most of the previously proposed program control-flow complexity metrics are evaluated. It is observed that most of these metrics are inherently limited in distinguishing capability. However, the concept of composite metrics is potentially useful for the development of a practical metrics. This paper presents a methodology for the develop- ment of a practical composite metric using statistical techniques. The proposed metric differs from all previous metrics in 2 ways: (1) It is based on an overall structural analysis of a given program in deeper and broader context. It captures various structural measurements taken from all existing structural levels; (2) It unifies a set of 19 important structural metrics. The compositing model of these metrics is based on statistical techniques rather than on an arbitrary method. Experinces with the pro- posed metric clearly indicate that it distinguishes different structures better than the previous metrics.展开更多
可编程性恢复是软件定义广域网(Software Defined Wide Area Network, SD-WAN)中节点失效后保障网络服务质量的有效方法 .针对可编程性恢复中失效节点形式单一的问题,提出一种基于启发式算法的主备份控制器部署方法来确保交换机和控制...可编程性恢复是软件定义广域网(Software Defined Wide Area Network, SD-WAN)中节点失效后保障网络服务质量的有效方法 .针对可编程性恢复中失效节点形式单一的问题,提出一种基于启发式算法的主备份控制器部署方法来确保交换机和控制器失效时网络的可编程性.在主控制器部署时,利用控制路径密度和强度衡量域内控制路径的可靠性,提升交换机故障情况下的路径可编程性;在备份控制器部署时,将一定数量的、相邻的主控制域划分为多个备份区域,在备份区域中部署一个备份控制器,建立它与交换机的映射策略,使脱机交换机以及离线流的恢复能力最大化,以提升控制器故障情况下的离线流的可编程性.此外,重新定义狼群算法的智能行为,提出一种离散狼群算法解决主备控制器的部署问题.在四种真实网络拓扑上进行实验,结果表明提出的方法在交换机故障的情况下能降低失效控制路径的影响,在控制器故障时能最大程度上恢复离线流.展开更多
基金supported by ARO W911NF-13-1-0421(MURI),NSF CNS-1814679,NSF CNS-2019340.
文摘Performance/security trade-off is widely noticed in CFI research,however,we observe that not every CFI scheme is subject to the trade-off.Motivated by the key observation,we ask three questions:1does trade-off really exist in different CFI schemes?2if trade-off do exist,how do previous works comply with it?3how can it inspire future research?Although the three questions probably cannot be directly answered,they are inspiring.We find that a deeper understanding of the nature of the trade-off will help answer the three questions.Accordingly,we proposed the GPT conjecture to pinpoint the trade-off in designing CFI schemes,which says that at most two out of three properties(fine granularity,acceptable performance,and preventive protection)could be achieved.
基金This work was supported by ARO W911NF-13-1-0421 (MURI), NSF CNS-1814679, and NSF CNS-2019340.
文摘Performance/security trade-off is widely noticed in CFI research, however, we observe that not every CFI scheme is subject to the trade-off. Motivated by the key observation, we ask three questions: ➊ does trade-off really exist in different CFI schemes? ➋ if trade-off do exist, how do previous works comply with it? ➌ how can it inspire future research? Although the three questions probably cannot be directly answered, they are inspiring. We find that a deeper understanding of the nature of the trade-off will help answer the three questions. Accordingly, we proposed the GPT conjecture to pinpoint the trade-off in designing CFI schemes, which says that at most two out of three properties (fine granularity, acceptable performance, and preventive protection) could be achieved.
文摘This paper reports on a pioneer effort for the establishment of a software composite metric with key capability of distinguishing among different structures. As a part of this effort most of the previously proposed program control-flow complexity metrics are evaluated. It is observed that most of these metrics are inherently limited in distinguishing capability. However, the concept of composite metrics is potentially useful for the development of a practical metrics. This paper presents a methodology for the develop- ment of a practical composite metric using statistical techniques. The proposed metric differs from all previous metrics in 2 ways: (1) It is based on an overall structural analysis of a given program in deeper and broader context. It captures various structural measurements taken from all existing structural levels; (2) It unifies a set of 19 important structural metrics. The compositing model of these metrics is based on statistical techniques rather than on an arbitrary method. Experinces with the pro- posed metric clearly indicate that it distinguishes different structures better than the previous metrics.
文摘可编程性恢复是软件定义广域网(Software Defined Wide Area Network, SD-WAN)中节点失效后保障网络服务质量的有效方法 .针对可编程性恢复中失效节点形式单一的问题,提出一种基于启发式算法的主备份控制器部署方法来确保交换机和控制器失效时网络的可编程性.在主控制器部署时,利用控制路径密度和强度衡量域内控制路径的可靠性,提升交换机故障情况下的路径可编程性;在备份控制器部署时,将一定数量的、相邻的主控制域划分为多个备份区域,在备份区域中部署一个备份控制器,建立它与交换机的映射策略,使脱机交换机以及离线流的恢复能力最大化,以提升控制器故障情况下的离线流的可编程性.此外,重新定义狼群算法的智能行为,提出一种离散狼群算法解决主备控制器的部署问题.在四种真实网络拓扑上进行实验,结果表明提出的方法在交换机故障的情况下能降低失效控制路径的影响,在控制器故障时能最大程度上恢复离线流.
