Browsing by Author "Chiu, Kwo-Cheng"

Now showing 1 - 2 of 2

A Lightweight Buffer Overflow Protection Mechanism with Failure-Oblivious Capability
(2009)
Lee, Tz-Rung
;
Chiu, Kwo-Cheng
;
Chang, Da-Wei
;
資訊工程學系
;
Department of Computer Science
Buffer overflow has become a major source of network security vulnerability. Traditional schemes for detecting buffer overflow attacks usually terminate the attacked service, degrading the service availability. In this paper, we propose a lightweight buffer overflow protection mechanism that allows continued network service. The proposed mechanism allows a service program to reconfigure itself to identify and protect the vulnerable functions upon buffer overflow attacks. Protecting only the Vulnerable functions, instead of the whole program, keeps the runtime overhead small. Moreover, the mechanism adopts the idea Of failure-oblivious computing to allow service programs to execute through memory errors caused by the attacks once the Vulnerable functions have been identified, eliminating the need of restarting the service program upon further attacks to the vulnerable functions. We have applied the mechanism on five Internet servers. The experiment results show that the mechanism has little impact oil the runtime performance.
Virtual machine support for zero-loss Internet service recovery and upgrade
(2007-11-10)
Chang, Da-Wei
;
Hsieh, Cheng-En
;
Chen, Yan-Pai
;
Chiu, Kwo-Cheng
;
資訊工程學系
Software is critical for Internet service availability since an Internet service may become unavailable due to software faults or software maintenance. In this paper, we propose a framework to allow zeroloss recovery and online maintenance for Internet services. The framework is based on the virtual machine (VM) technology and a connection migration technique called FT-TCP. It can recover transient application/operating system faults and it allows fault recovery and online maintenance on a single host. The framework substantially enhances FT-TCP so that it can be run efficiently in the VM environment. Specifically, we propose techniques to reduce the inter-VM switches and communication. Moreover, we propose service-specific optimizations to reduce the recovery time of FT-TCP. Finally, the framework provides an interface for the service designers to implement more service-specific optimizations. The framework was implemented by modifying an open source VM monitor, Xen, and the Linux kernel running on top of Xen. The effectiveness and efficiency of the framework were evaluated by running two Internet services, WWW proxy and FTP, on the proposed framework and measuring the impact on their performance. According to the experimental results, our approach causes only slight performance overhead (i.e. less than 4%) and memory overhead (i.e. less than 750 KB) for both the services. Copyright (C) 2007 John Wiley & Sons, Ltd.