云计算环境下采用随机化的攻击抑制机制研究

User data and tasks have been migrating to cloud computing environment, and it is important to assure the security and reliability of this environment. But, traditional virtualization separation and security enhanced may fail when an unknown memory error attack originated from monoculture and defect of programs in clouding computing environment happens. In light of memory error attack in clouding computing environment, this project is investigating the relationship of randomization between neighbor layers among IaaS, PaaS and SaaS, coordination of distributed randomization, and the measurement of randomization. Moreover, randomization architecture with multi-granularity and multi-layer for cloud computing and evaluation mechanism of randomization techniques will be presented, and a randomization tool will be developed. So, these researches can richen diversity and heterogeneity for cloud computing environment, and suppress memory error attacks. Meanwhile, this project is studying distributed fault diagnosis and fault tolerance for cloud computing environment. Furthermore, adaptive runtime monitor mechanism will be designed, and a method of distributed differential fault diagnosis exploiting static analysis, taint analysis and dynamic replaying, and a method of dynamic vulnerability repairment based on randomization will be proposed. Finally, these research achievements can disclose the relationship between the properties of randomization and the properties of memory error attack code, support prevention, detection and reponse of unknown malicious code and 0-Day vulnerability attacks, and also provide a novel idea and solution to 0-Day vulnerability collection in cloud computing environment.

用户数据和用户任务逐渐迁移到云计算环境的云端，此时云端的安全性和可靠性尤为重要。但是，云计算环境的虚拟隔离和安全加固无法应对源于云计算环境软件系统的单一性和自身漏洞引发的外部攻击。 该项目从云计算环境面临的内存错误攻击出发，研究IaaS、PaaS、SaaS下的层间随机化的关联、分布式随机化的协同、随机化的度量，提出多粒度、多层次的随机化体系结构以及随机化技术的多维度量模型，从而丰富云计算环境的多样性和异构性，遏制利用内存错误实施的外部攻击。与此同时，研究云计算环境下分布式故障诊断以及分布式的攻击免疫，提出静态分析、污点分析与动态重放相结合的差分故障诊断方法以及基于随机化的动态修补漏洞方法。因此，该项目成果揭示程序中随机化属性与内存错误攻击代码中的属性之间的关系，为云计算环境下的未知恶意代码、0-Day漏洞攻击的防御、检测、响应提供理论和技术支持，也为漏洞信息收集提供了一种新的思路。

用户数据和用户任务逐渐迁移到云计算环境的云端，此时云端的安全性和可靠性尤为重要。但是，传统云计算环境的虚拟隔离和安全加固无法应对源于云计算环境软件系统的单一性和自身漏洞引发的外部攻击。该项目研究了弹性移动云计算的计算模式及其安全威胁、敏感信息在全生命周期中的安全威胁、可重用代码的演化、随机化技术、随机化感知和随机化协同、控制流完整性度量等。采用生物多样性的思想，提出了指令随机化、Web接口的随机化、粗粒度的随机化、细粒度的随机化、融合控制流完整性的随机化等多种随机化方法，并构建了多层次、层间随机化感知模型和分布式协同的随机化部署模型，给出了随机化安全度量的基本准则，突破了服务软件的单一性，实现了以多变对不变的主动防御策略，这些能遏制利用内存错误实施的外部代码攻击。同时，立足微观控制流变化和宏观软件行为异常，提出了从粗粒度行为异常到细粒度栈帧变化的Shellcode检测方法，有效溯源漏洞攻击代码；提出了利用静态分析和污点分析的故障诊断、漏洞解析的方法，为漏洞理解、漏洞修补奠定基础。项目成果初步揭示了随机化的属性与内存错误攻击代码的属性之间的关系，可以捕获未知的攻击代码和0-Day漏洞，丰富了漏洞信息收集的方式，为云计算环境下的未知恶意代码、0-Day漏洞的防御、检测、响应提供理论和技术支持。