编译支持的多线程程序多变体执行方法  

Compilation supported method of multi-threaded program running in MVX

作　　者：朱鹏喆 姚远[1,2] 刘子敬 席睿成 Zhu Pengzhe;Yao Yuan;Liu Zijing;Xi Ruicheng(Cyber&Space Security College,Information Engineering University,Zhengzhou 450001,China;Purple Mountain Laboratories,Nanjing 211100,China)

机构地区：[1]信息工程大学网络与空间安全学院,郑州450001 [2]网络通信与安全紫金山实验室,南京211100

出　　处：《计算机应用研究》2023年第5期1504-1509,1514,共7页Application Research of Computers

摘　　要：多变体执行(multi-variant execution, MVX)是目前最流行的主动防御技术之一。理想情况下,当未受到攻击时,多变体执行架构提供正常的程序功能。但不幸的是,当多线程程序在多变体执行架构下运行时,由于各个程序变体中共享资源操作的线程执行顺序不一致,不同变体将会产生状态不一致,从而产生攻击误报,该问题导致了多线程程序难以以多变体执行方式运行。基于多变体执行环境,提出了一种编译支持的多线程程序对共享资源操作的同步编译模型,该模型以共享资源操作为同步点,分析确定多线程程序中对共享资源的操作时机和操作方式,保证各程序变体在运行时多线程对共享资源操作的一致性,从而消除了由此而引起的攻击误报。以LLVM 12.0编译框架为基础,设计实现了基于该同步编译模型的原型系统,并对该原型系统进行了仿真实验测试。实验结果显示,经过原型系统处理的多线程程序在多变体执行架构中的误报率显著降低,表明该同步编译模型作为一种通用性的方法,可有效消除多线程程序在多变体执行架构下运行时的攻击误报,提高了多变体执行的可用性。MVX is one of the most popular active defense technologies.Ideally,when not under attack,the MVX architecture provides normal program functions.Unfortunately,when a multi-threaded program runs in MVX architecture,because different program variants have inconsistent threads execution orders of shared resource operations,different variants will produce state inconsistency and trigger false attack alarm.This problem makes it difficult for multi-threaded programs to run in MVX architecture.This paper proposed a compiler-supported synchronous compilation model for shared resource operations in multi-threaded programs.This model took the shared resource operations as synchronization points,analyzed the timing and mode of shared resource operations in multi-threaded programs.The model ensured the consistency of multiple threads operating on shared resource in different variants at runtime,eliminating the false attack alarms.Based on LLVM 12.0 compilation framework,this paper designed and implemented a prototype system based on the synchronous compilation model,and conducted simulation experiments on the prototype.The experimental results show that,processed by prototype system,multi-threaded programs have significantly lower false positive rates in MVX architecture.This indicates that,as a universal method,the synchronous compilation model can effectively eliminate the false attack alarms of multi-threaded programs running in MVX architecture,and improve the availability of MVX.

关 键 词：主动防御 编译器 多变体执行 

分 类 号：TP311[自动化与计算机技术—计算机软件与理论]