In accordance with regulations and requirements, the editorial department's website domain has been changed to arocmag.cn. The original domain (arocmag.com) will be discontinued after Dec. 31st, 2024.
See More
Survey
|
App. Res. of Comp. Printed Article
Vol. 39, 2022 No. 10
2907-2915

Summary of analysis and solution of multi-variate execution false alarm

Xi Ruicheng1,2
Zhang Zheng1,2
Zhu Pengzhe1,2
Liu Zijing1,2
1. School of Cyber & Space Security, Information Engineering University, Zhengzhou 450001, China
2. Purple Mountain Laboratories, Nanjing 211100, China
DOI: 10.19734/j.issn.1001-3695.2022.02.0093

Abstract

From a security view, MVX is widely used in network security defense, but there is a common problem in multi-variant execution: when each executive body returns content to the arbiter, it is difficult to solve the false alarm caused by the combination. Excluding objective factors such as the machine environment, false alarms are generated because the voter starts to make security judgments on non-consistent variables after receiving the combined information. In addition to non-consistent variables caused by real attacks, there are also non-consistent variables generated by normal system operation(such as memory descriptors, port numbers, random numbers, codes, and the calling sequence of threads in the process), which would cause the wrong judgement of the voter and affect the normal operation of the multi-variant system. If the false alarm rate of multi-variant execution can be reduced, the system efficiency and defense capability would be improved effectively. This paper classified the types of multi-variant execution in recent years, summarized the false alarms caused by multi-variant execution and the solutions. It analyzed the causes of false alarms caused by multi-variant execution, selected the Pina algorithm for synchronization, the compiler module instrumentation strategy, and the strategy for narrowing the voting boundary, analyzed the three schemes in specific application scenarios, and analyzed each method. Then it pointed the functions and performance of each strategy, pointed the advantages and disadvantages of each strategy. Finally, it discussed the unsolved difficulties and future research directions of the existing multi-variant implementation.

Foundation Support

国家自然科学基金资助项目

Publish Information

DOI: 10.19734/j.issn.1001-3695.2022.02.0093
Publish at: Application Research of Computers Printed Article, Vol. 39, 2022 No. 10
Section: Survey
Pages: 2907-2915
Serial Number: 1001-3695(2022)10-003-2907-09

Publish History

[2022-05-12] Accepted Paper
[2022-10-05] Printed Article

Cite This Article

席睿成, 张铮, 朱鹏喆, 等. 多变体执行误报问题分析与解决方法综述 [J]. 计算机应用研究, 2022, 39 (10): 2907-2915. (Xi Ruicheng, Zhang Zheng, Zhu Pengzhe, et al. Summary of analysis and solution of multi-variate execution false alarm [J]. Application Research of Computers, 2022, 39 (10): 2907-2915. )

About the Journal

  • Application Research of Computers Monthly Journal
  • Journal ID ISSN 1001-3695
    CN  51-1196/TP

Application Research of Computers, founded in 1984, is an academic journal of computing technology sponsored by Sichuan Institute of Computer Sciences under the Science and Technology Department of Sichuan Province.

Aiming at the urgently needed cutting-edge technology in this discipline, Application Research of Computers reflects the mainstream technology, hot technology and the latest development trend of computer application research at home and abroad in a timely manner. The main contents of the journal include high-level academic papers in this discipline, the latest scientific research results and major application results. The contents of the columns involve new theories of computer discipline, basic computer theory, algorithm theory research, algorithm design and analysis, blockchain technology, system software and software engineering technology, pattern recognition and artificial intelligence, architecture, advanced computing, parallel processing, database technology, computer network and communication technology, information security technology, computer image graphics and its latest hot application technology.

Application Research of Computers has many high-level readers and authors, and its readers are mainly senior and middle-level researchers and engineers engaged in the field of computer science, as well as teachers and students majoring in computer science and related majors in colleges and universities. Over the years, the total citation frequency and Web download rate of Application Research of Computers have been ranked among the top of similar academic journals in this discipline, and the academic papers published are highly popular among the readers for their novelty, academics, foresight, orientation and practicality.

Indexed & Evaluation

  • The Second National Periodical Award 100 Key Journals
  • Double Effect Journal of China Journal Formation
  • the Core Journal of China (Peking University 2023 Edition)
  • the Core Journal for Science
  • Chinese Science Citation Database (CSCD) Source Journals
  • RCCSE Chinese Core Academic Journals
  • Journal of China Computer Federation
  • 2020-2022 The World Journal Clout Index (WJCI) Report of Scientific and Technological Periodicals
  • Full-text Source Journal of China Science and Technology Periodicals Database
  • Source Journal of China Academic Journals Comprehensive Evaluation Database
  • Source Journals of China Academic Journals (CD-ROM Version), China Journal Network
  • 2017-2019 China Outstanding Academic Journals with International Influence (Natural Science and Engineering Technology)
  • Source Journal of Top Academic Papers (F5000) Program of China's Excellent Science and Technology Journals
  • Source Journal of China Engineering Technology Electronic Information Network and Electronic Technology Literature Database
  • Source Journal of British Science Digest (INSPEC)
  • Japan Science and Technology Agency (JST) Source Journal
  • Russian Journal of Abstracts (AJ, VINITI) Source Journals
  • Full-text Journal of EBSCO, USA
  • Cambridge Scientific Abstracts (Natural Sciences) (CSA(NS)) core journals
  • Poland Copernicus Index (IC)
  • Ulrichsweb (USA)