Utilizing Binary Rewriting for Improving End-Host Security

Conventional methods supporting Java binary security mainly rely on the security of the host Java Virtual Machine (JVM). However, malicious Java binaries keep exploiting the vulnerabilities of JVMs, escaping their sandbox restrictions and allowing attacks on end-user systems. Administrators must con...

Full description

Saved in:
Bibliographic Details
Published in:IEEE transactions on parallel and distributed systems 2007-12, Vol.18 (12), p.1687-1699
Main Authors: Yougang Song, Fleisch, B.D.
Format: Article
Language:English
Subjects:
Binary codes
Binary Rewriting
Binary systems
Caching
Centralized control
Compilers
Computer security
Computer Society
Control systems
Costs
Cybersecurity
Data encryption
End users
Java
Java (programming language)
Lead (metal)
Network security
Performance Evaluation
Policies
Protection
Security
Security and Protection
Security systems
Traffic Analysis
Traffic control
Virtual machining
Web Servers
Citations: Items that this one cites
Items that cite this one
Online Access:Get full text
Tags: Add Tag
No Tags, Be the first to tag this record!
Description
Summary:Conventional methods supporting Java binary security mainly rely on the security of the host Java Virtual Machine (JVM). However, malicious Java binaries keep exploiting the vulnerabilities of JVMs, escaping their sandbox restrictions and allowing attacks on end-user systems. Administrators must confront the difficulties and dilemmas brought on by security upgrades. On the other hand, binary rewriting techniques have been advanced to allow users to enforce security policies directly on the mobile code. They have the advantages of supporting a richer set of security policies and a self-constrained written code. However, the high administrative and performance overhead caused by security configuration and code rewriting have prevented rewriters from becoming a practical security tool. In this paper, we address these problems by integrating binary code rewriters with Web caching proxies and build the security system called PB-JARS, a Proxy-based JAva Rewriting System. PB-JARS works as a complimentary system to existing JVM security mechanisms by placing another line of defense between users and their end-user systems. It gives system administrators centralized security control and management for the mobile code and security policies. We evaluated PB-JARS using a real Java binary traffic model derived from analyzing real Web trace records. Our results show that adding binary rewriting to a Web caching system can be very efficient in improving end-host security at a low cost.
ISSN:1045-9219
1558-2183
DOI:10.1109/TPDS.2007.1083