darpa i2o transparent computing program
play

DARPA/I2O Transparent Computing Program THEIA: Tagging and Tracking - PowerPoint PPT Presentation

DARPA/I2O Transparent Computing Program THEIA: Tagging and Tracking of Multi-Level Host Events for Transparent Computing and Information Assurance Mattia Fazzini Georgia Institute of Technology Nov 3rd, 2017 Agenda Project overview


  1. OS-level Transparency • Goal: – Capture events and dependencies of OS-level events • Approach: – Based on VM introspection • Events analyzed: – Process operations: clone, fork, execve, exit , etc. • – File operations: open, read, write, unlink , etc. • – Network operations: socket, connect, recvmsg , etc. • – Memory operations: mmap, mprotect, shmget , etc . •

  2. OS-level Transparency • Goal: – Capture events and dependencies of OS-level events • Approach: – Based on VM introspection • Events analyzed: – Process operations: clone, fork, execve, exit , etc. • – File operations: open, read, write, unlink , etc. • – Network operations: socket, connect, recvmsg , etc. • – Memory operations: mmap, mprotect, shmget , etc . •

  3. OS-level Transparency • Goal: – Capture events and dependencies of OS-level events • Approach: – Based on VM introspection • Events analyzed: – Process operations: clone, fork, execve, exit , etc. • – File operations: open, read, write, unlink , etc. • – Network operations: socket, connect, recvmsg , etc. • – Memory operations: mmap, mprotect, shmget , etc . •

  4. OS-level Transparency Implementation Example #ifdef TARGET_X86_64 void helper_syscall (int next_eip_addend { panda_cb_list *plist; for(plist = panda_cbs[PANDA_CB_BEFORE_SYSCALL]; plist != NULL; plist = panda_cb_list_next(plist)) { plist->entry.before_syscall(env); } … }

  5. OS-level Transparency Implementation Example #ifdef TARGET_X86_64 void helper_syscall (int next_eip_addend { panda_cb_list *plist; for(plist = panda_cbs[PANDA_CB_BEFORE_SYSCALL]; plist != NULL; plist = panda_cb_list_next(plist)) { plist->entry.before_syscall(env); } … }

  6. OS-level Transparency Implementation Example #ifdef TARGET_X86_64 void helper_syscall (int next_eip_addend { panda_cb_list *plist; for(plist = panda_cbs[PANDA_CB_BEFORE_SYSCALL]; plist != NULL; plist = panda_cb_list_next(plist)) { plist->entry.before_syscall(env); } … }

  7. Action History Graph (AHG) • Goal: – Represent causality across events • Causality: – Process->Process (e.g., fork) – Process->File (e.g., write) – File->Process (e.g., read) – Process->Host (e.g., send) – Host->Process (e.g., recv)

  8. Action History Graph (AHG) • Goal: – Represent causality across events • Causality: – Process->Process (e.g., fork) – Process->File (e.g., write) – File->Process (e.g., read) – Process->Host (e.g., send) – Host->Process (e.g., recv)

  9. Action History Graph (AHG) • Goal: – Represent causality across events • Causality: – Process->Process (e.g., fork) – Process->File (e.g., write) – File->Process (e.g., read) – Process->Host (e.g., send) – Host->Process (e.g., recv)

  10. Action History Graph Example

  11. Coarse-grained Taint Analysis • Goal: – Quickly capture the provenance of objects in the AHG • Working mechanism: – Runs while building AHG – Processes have a provenance set – Process operations: • fork , clone : copy provenance of parent to child process – File and network operations • read , recv : associate provenance of object to process • write , send : associate provenance of process to object

  12. Coarse-grained Taint Analysis • Goal: – Quickly capture the provenance of objects in the AHG • Working mechanism: – Runs while building AHG – Processes have a provenance set – Process operations: • fork , clone : copy provenance of parent to child process – File and network operations • read , recv : associate provenance of object to process • write , send : associate provenance of process to object

  13. Coarse-grained Taint Analysis • Goal: – Quickly capture the provenance of objects in the AHG • Working mechanism: – Runs while building AHG – Processes have a provenance set – Process operations: • fork , clone : copy provenance of parent to child process – File and network operations • read , recv : associate provenance of object to process • write , send : associate provenance of process to object

  14. Fine-grained Taint Analysis • Goal: – Accurately capture provenance of objects in the AHG • Working mechanism: – Decoupled from program execution – Instruction level propagation – Taint tags at byte level granularity • Optimizations: – Trace-based dynamic taint analysis

  15. Fine-grained Taint Analysis • Goal: – Accurately capture provenance of objects in the AHG • Working mechanism: – Decoupled from program execution – Instruction level propagation – Taint tags at byte level granularity • Optimizations: – Trace-based dynamic taint analysis

  16. Fine-grained Taint Analysis • Goal: – Accurately capture provenance of objects in the AHG • Working mechanism: – Decoupled from program execution – Instruction level propagation – Taint tags at byte level granularity • Optimizations: – Trace-based dynamic taint analysis

  17. Fine-grained Taint Analysis Implementation TCG LLVM Guest Basic Block Basic Block Basic Block

  18. Fine-grained Taint Analysis Implementation TCG LLVM Guest Basic Block Basic Block Basic Block

  19. Fine-grained Taint Analysis Implementation TCG LLVM Guest Basic Block Basic Block Basic Block

  20. Fine-grained Taint Analysis Implementation TCG LLVM Guest Basic Block Basic Block Basic Block

  21. Trace-based Taint Analysis • Objective: – Improve performance of fine-grained taint analysis • Key intuition: – Within a trace instruction sequences are executed multiple times • Working mechanism: – Based on the execution trace of the system/program – Computes taint summaries for sequences of instructions – Re-use taint summaries on the trace and possible across traces • Implementation: – Sequitur algorithm: recognizes a lexical structure in an execution trace and generates a grammar where terminals are instructions – Analyze grammar and reuse taint results when possible

  22. Trace-based Taint Analysis • Objective: – Improve performance of fine-grained taint analysis • Key intuition: – Within a trace instruction sequences are executed multiple times • Working mechanism: – Based on the execution trace of the system/program – Computes taint summaries for sequences of instructions – Re-use taint summaries on the trace and possible across traces • Implementation: – Sequitur algorithm: recognizes a lexical structure in an execution trace and generates a grammar where terminals are instructions – Analyze grammar and reuse taint results when possible

  23. Trace-based Taint Analysis • Objective: – Improve performance of fine-grained taint analysis • Key intuition: – Within a trace instruction sequences are executed multiple times • Working mechanism: – Based on the execution trace of the system/program – Computes taint summaries for sequences of instructions – Re-use taint summaries on the trace and possible across traces • Implementation: – Sequitur algorithm: recognizes a lexical structure in an execution trace and generates a grammar where terminals are instructions – Analyze grammar and reuse taint results when possible

  24. Trace-based Taint Analysis Example Execution Trace Grammar mov qword ptr [r12+rax*8], rdx 9 10 jump 0x7f8c47a21b13 … mov qword ptr [r12+rax*8], rdx jz 0x7f8c47a21b52 jmp 0x7f8c47a21b13 476 add rdx, 0x10 11 11 8 mov rax, qword ptr [rdx] test rax, rax add rdx, 0x10 jz 0x7f8c47a21b52 43 cmp rax, 0x21 jbe 0x7f8c47a21b08 lea rcx, ptr [rip+0x21ef29] … mov rax, qword ptr [rdx] test rax, rax

  25. Trace-based Taint Analysis Example Execution Trace Grammar mov qword ptr [r12+rax*8], rdx 9 10 jump 0x7f8c47a21b13 … mov qword ptr [r12+rax*8], rdx jz 0x7f8c47a21b52 jmp 0x7f8c47a21b13 476 add rdx, 0x10 11 11 8 mov rax, qword ptr [rdx] test rax, rax add rdx, 0x10 jz 0x7f8c47a21b52 43 cmp rax, 0x21 jbe 0x7f8c47a21b08 lea rcx, ptr [rip+0x21ef29] … mov rax, qword ptr [rdx]

  26. Fine-grained Taint Analysis

  27. Fine-grained Taint Analysis

  28. Case Study Overview

  29. Case Study Overview

  30. Case Study Overview

  31. Case Study Overview

  32. Case Study Overview

  33. Case Study and AHG bash execute firefox Process recv firefox from Event 143.215.130.204 File execute sh Network wget 143.215.130.204 sh Tag execute recv wget from Causality screen execute write grab recv screen msg grab X0 write s.png nc execute nc read write 143.215.130.204

  34. Case Study and AHG bash execute firefox Process recv firefox from Event 143.215.130.204 File execute sh Network wget 143.215.130.204 sh Tag execute recv wget from Causality screen execute write grab recv screen msg grab X0 write s.png nc execute nc read write 143.215.130.204

  35. Case Study and AHG Step 1 1) Victim starts Firefox Process Event bash File Network Tag execute firefox recv from recv from screen grab firefox recv screen msg grab

  36. Case Study and AHG Step 2 2) Victim visits malicious.com (143.215.130.204) that runs shell process Process Event recv firefox from File Network 143.215.130.204 Tag execute sh recv from recv sh from screen grab recv screen msg grab

  37. Case Study and AHG Step 3 3) Attacker downloads and executes screengrab Process wget Event 143.215.130.204 sh execute File recv wget Network from Tag screen execute write grab recv from recv screen X0 recv msg grab from screen grab recv screen msg grab write s.png

  38. Case Study and AHG Step 4 4) Screenshot is sent to attacker’s server Process nc Event sh execute File Network s.png nc read Tag write recv from 143.215.130.204 recv from screen grab recv screen msg grab

  39. Case Study and 
 Coarse-grained Taint Analysis. libssl.so wget read Process Event libc.so read File sh execute Network Tag Coarse Taint Set wgetrc read wget recv from recv from recv from 143.215.130.204 screen grab recv screen msg grab screen write grab

  40. Case Study and 
 Coarse-grained Taint Analysis. libssl.so wget read CT1 Process Event libc.so read File sh execute Network Tag Coarse Taint Set wgetrc read wget recv from recv from recv from 143.215.130.204 screen grab recv screen msg grab screen write grab

  41. Case Study and 
 Coarse-grained Taint Analysis. libssl.so wget read CT1 Process Event libc.so read File sh execute Network Tag Coarse Taint Set wgetrc read CT1 wget recv from recv from recv from 143.215.130.204 screen grab recv screen msg grab screen write grab

  42. Case Study and 
 Coarse-grained Taint Analysis. libssl.so wget read CT1 Process Event libc.so read CT2 File sh execute Network Tag Coarse Taint Set wgetrc read CT1 wget recv from recv from recv from 143.215.130.204 screen grab recv screen msg grab screen write grab

  43. Case Study and 
 Coarse-grained Taint Analysis. libssl.so wget read CT1 Process Event libc.so read CT2 File sh execute Network Tag Coarse Taint Set wgetrc read CT1 CT2 wget recv from recv from recv from 143.215.130.204 screen grab recv screen msg grab screen write grab

  44. Case Study and 
 Coarse-grained Taint Analysis. libssl.so wget read CT1 Process Event libc.so read CT2 File sh execute Network Tag Coarse Taint Set wgetrc read CT3 CT1 CT2 wget recv from recv from recv from 143.215.130.204 screen grab recv screen msg grab screen write grab

  45. Case Study and 
 Coarse-grained Taint Analysis. libssl.so wget read CT1 Process Event libc.so read CT2 File sh execute Network Tag Coarse Taint Set wgetrc read CT3 CT1 CT2 CT3 wget recv from recv from recv from 143.215.130.204 screen grab recv screen msg grab screen write grab

  46. Case Study and 
 Coarse-grained Taint Analysis. libssl.so wget read CT1 Process Event libc.so read CT2 File sh execute Network Tag Coarse Taint Set wgetrc read CT3 CT1 CT2 CT3 wget recv from recv CT4 from recv from 143.215.130.204 screen grab recv screen msg grab screen write grab

  47. Case Study and 
 Coarse-grained Taint Analysis. libssl.so wget read CT1 Process Event libc.so read CT2 File sh execute Network Tag Coarse Taint Set wgetrc read CT3 CT1 CT2 CT3 CT4 wget recv from recv CT4 from recv from 143.215.130.204 screen grab recv screen msg grab screen write grab

  48. Case Study and 
 Coarse-grained Taint Analysis. libssl.so wget read CT1 Process Event libc.so read CT2 File sh execute Network Tag Coarse Taint Set wgetrc read CT3 CT1 CT2 CT3 CT4 wget recv from recv CT4 from recv from 143.215.130.204 screen grab recv screen msg grab screen write CT5 grab

  49. Case Study and 
 Fine-grained Taint Analysis libssl.so wget read Process Event libc.so read File sh execute Network Tag wgetrc read wget recv from recv from recv from 143.215.130.204 screen grab recv screen msg grab screen write grab

  50. Case Study and 
 Fine-grained Taint Analysis libssl.so wget read FT1 Process Event libc.so read File sh execute Network Tag wgetrc read wget recv from recv from recv from 143.215.130.204 screen grab recv screen msg grab screen write grab

  51. Case Study and 
 Fine-grained Taint Analysis libssl.so wget read FT1 Process Event libc.so read FT2 File sh execute Network Tag wgetrc read wget recv from recv from recv from 143.215.130.204 screen grab recv screen msg grab screen write grab

  52. Case Study and 
 Fine-grained Taint Analysis libssl.so wget read FT1 Process Event libc.so read FT2 File sh execute Network Tag wgetrc read FT3 wget recv from recv from recv from 143.215.130.204 screen grab recv screen msg grab screen write grab

  53. Case Study and 
 Fine-grained Taint Analysis libssl.so wget read FT1 Process Event libc.so read FT2 File sh execute Network Tag wgetrc read FT3 wget recv from recv FT4 from recv from 143.215.130.204 screen grab recv screen msg grab screen write grab

  54. Case Study and 
 Fine-grained Taint Analysis libssl.so wget read FT1 Process Event libc.so read FT2 File sh execute Network Tag wgetrc read FT3 wget recv from recv FT4 from recv from 143.215.130.204 screen grab recv screen msg grab screen write FT5 grab

  55. THEIA-Panda Overheads Bare Exec KVM Exec QEMU Record Replay TIME Time Time Exec Time Exec Time Exec Time Bare Exec Time KVM Exec 2.09 x Time QEMU 6.19 x 2.96 x Exec Time Record 7.75 x 3.71 x 1.25 x Exec Time Replay 13.82 x 6.62 x 2.23 x 1.78 x Exec Time • Fine grained taint analysis: – ~40x to ~300x compared to bare execution • Space overhead: – ~86 GB/day non det log data + ~1.3GB/day graph data

  56. THEIA-Panda Overheads Bare Exec KVM Exec QEMU Record Replay TIME Time Time Exec Time Exec Time Exec Time Bare Exec Time KVM Exec 2.09 x Time QEMU 6.19 x 2.96 x Exec Time Record 7.75 x 3.71 x 1.25 x Exec Time Replay 13.82 x 6.62 x 2.23 x 1.78 x Exec Time • Fine grained taint analysis: – ~40x to ~300x compared to bare execution • Space overhead: – ~86 GB/day non det log data + ~1.3GB/day graph data

  57. THEIA-Panda Overheads Bare Exec KVM Exec QEMU Record Replay TIME Time Time Exec Time Exec Time Exec Time Bare Exec Time KVM Exec 2.09 x Time QEMU 6.19 x 2.96 x Exec Time Record 7.75 x 3.71 x 1.25 x Exec Time Replay 13.82 x 6.62 x 2.23 x 1.78 x Exec Time • Fine grained taint analysis: – ~40x to ~300x compared to bare execution • Space overhead: – ~86 GB/day non det log data + ~1.3GB/day graph data

  58. THEIA-Panda Overheads Bare Exec KVM Exec QEMU Record Replay TIME Time Time Exec Time Exec Time Exec Time Bare Exec Time KVM Exec 2.09 x Time QEMU 6.19 x 2.96 x Exec Time Record 7.75 x 3.71 x 1.25 x Exec Time Replay 13.82 x 6.62 x 2.23 x 1.78 x Exec Time • Fine grained taint analysis: – ~40x to ~300x compared to bare execution • Space overhead: – ~86 GB/day non det log data + ~1.3GB/day graph data

  59. THEIA-Panda Overheads Bare Exec KVM Exec QEMU Record Replay TIME Time Time Exec Time Exec Time Exec Time Bare Exec Time KVM Exec 2.09 x Time QEMU 6.19 x 2.96 x Exec Time Record 7.75 x 3.71 x 1.25 x Exec Time Replay 13.82 x 6.62 x 2.23 x 1.78 x Exec Time • Fine grained taint analysis: – ~40x to ~300x compared to bare execution • Space overhead: – ~86 GB/day non det log data + ~1.3GB/day graph data

  60. THEIA-Panda Observations -Panda

  61. THEIA-KI Overview THEIA-KI Query Interface + OS Replay FA Record Fine-grained Storage Taint Analysis System Call Information Action History Graph Process Information Real-time THEIA-KI-Analysis On-demand

Download Presentation
Download Policy: The content available on the website is offered to you 'AS IS' for your personal information and use only. It cannot be commercialized, licensed, or distributed on other websites without prior consent from the author. To download a presentation, simply click this link. If you encounter any difficulties during the download process, it's possible that the publisher has removed the file from their server.

Recommend


More recommend