Context: Modern Linux kernels face a critical security challenge due to the extended mitigation latency (averaging 100 days) for publicly disclosed vulnerabilities, which creates a prolonged attack window for privilege escalation. Existing defense mechanisms, including built-in security features and third-party kernel modules, are inadequate as they are often bypassed by advanced exploits, rely on historical vulnerability patterns, and require disruptive system reboots for deployment. Objective: This paper aims to design and implement a novel defense framework that overcomes the limitations of current solutions. The primary goals are to achieve technique-sensitive protection independent of specific vulnerabilities, eliminate the dependency on proof-of-concepts or kernel source code, and enable real-time deployment without system reboots. Method: We propose kShield, a lightweight runtime defense framework built on Extended Berkeley Packet Filter (eBPF) technology. Its design leverages the Compile Once-Run Everywhere (CO-RE) feature to ensure cross-kernel version compatibility. The core of our method is a vulnerability-agnostic architecture that focuses on mitigating general exploit techniques rather than patching specific vulnerabilities. The framework's effectiveness and performance were evaluated through comparative tests with the Linux Kernel Runtime Guard (LKRG). Result: The evaluation demonstrates that kShield successfully mitigates 91.3% of the tested real-world kernel exploits. In performance comparisons, kShield incurs comparable overhead to LKRG, a leading runtime guard solution, while providing significantly broader and more proactive protection against a wide range of vulnerability types. Conclusion: kShield establishes itself as a practical and generalizable solution for hardening production Linux systems. By leveraging eBPF, it provides comprehensive protection during critical vulnerability exposure windows seamlessly and without system interruptions, representing a fundamental shift from vulnerability-specific patching to technique-centric mitigation.

The security of web browsers, being fundamental to Internet access infrastructure, has garnered significant attention. Current approaches to identify browser vulnerabilities predominantly rely on code auditing and componentized unit testing. Fuzzing has emerged as an efficient technique for vulnerability discovery. However, adapting this method to browser security testing poses considerable challenges. Recent endeavors in browser vulnerability discovery primarily concentrate on the parsing engine, with limited solutions addressing the rendering engine. Moreover, coverage-guided mutation, a critical aspect, is not prevalent in existing fuzzing frameworks. In this paper, we present a coverage-guided fuzzing framework of DFL, which builds on Freedom and AFL to re-engineer various text generators based on DOM syntax and optimize the efficiency of sample generation. Additionally, serialization and deserialisation methods are developed for the implementation of generator text mutations and the seamless conversion between binary samples and the source DOM tree. When compared with three established DOM fuzzing frameworks in the latest Chromium kernel, DFL has demonstrated an ability to uncover 1.5–3 times more vulnerabilities within a short timeframe. Our research identifies potential avenues for further exploration in browser rendering engine security, specifically focusing on sample generation and path direction.

System call sequences representing the runtime behavior of an application is particularly useful for anomaly detection in mobile applications. However, one of the main obstacles in this area is the lack of publicly available high-quality datasets. Because of the low computational power and storage constraints of mobile application platforms, a single mobile device cannot accomplish the task of massively installing applications and extracting interaction details with the operating system, making it extremely challenging to build large-scale fine-grained system call datasets. In this paper, we present the MaDroid dataset. It is the first comprehensive dataset and benchmark for anomaly detection in mobile applications using high-dimensional feature sequence data and maliciousness, and the first to incorporate virus total rating (VT) values into dataset features. It is constructed based on an automated collection framework that collects system call sequences from simulation environments at a fine-grained level for both normal and malicious mobile applications. The dataset is 457 GB in size and consists of 50,429 labeled system call sequences. The dataset covers mobile applications released at different times over the past 14 years, and the selected applications span across 10 major mainstream APP markets. We extract different feature subsets from the dataset and perform evaluations using RF, MLP, and GBDT to show the effectiveness and accuracy in detecting malicious mobile APPs. Our dataset can be a useful resource for security and machine learning community.

In this paper, we present the design and implementation of ZBTree, a hotness-aware B $^+$ -Tree for persistent memory (PMem). ZBTree leverages the PMem+DRAM architecture, which is featured with a volatile operation layer to accelerate data access and an order-preserving persistent layer to achieve fast recovery and low-overhead consistency and persistence guarantees. The operation layer contains inner nodes for indexing and compacted leaf nodes (DLeaves) that hold metadata. Based on leaf node compaction, we present a data lodging method, which supports to load hot data into fast DRAM dynamically, avoiding PMem accesses for subsequent reads of hot data and achieving improved read performance without incurring extra DRAM usage. In addition, we present a lightweight node splitting mechanism with constant persistence overhead that does not vary with node size. Our extensive evaluations show that ZBTree achieves higher throughput by a factor of 1.4x-6.3x compared to state-of-the-art tree indexes under a wide range of workloads. Meanwhile, ZBTree achieves comparable or faster recovery speed compared to existing designs.

DongTing is the first large-scale dataset dedicated to Linux kernel anomaly detection. The dataset covers Linux kernels released in the last five years and includes a total of 18,966 well-labeled normal and attack sequences. The entire dataset is 85 GB in size (after decompression). The attack data covers 26 major kernel releases and contains a total of 12,116 system call sequences collected from running 17,855 bug-triggering programs. The normal data comes from 6,850 normal programs in four kernel regression test suites. We maintain the dataset and source code in Zenodo and Github, respectively, and back up the dataset and code in Baidu netdisk. Dataset The dataset is stored at http://doi.org/10.5281/zenodo.6627050 The data includes `abnormal_data`, `normal_data`, `models`, `npz` and baseline data, with a total volume of nearly 87 GB (including 85 GB for abnormal data and normal data, it's after decompression files size). The `Abnormal_data` directory contains 12,116 files containing system call sequence for 26 kernel releases, and the `Normal_data` directory contains 6,850 files containing system call sequences collected from four regression test suites. All of which are raw sequences. CNN/RNN, LSTM, and Wavenet (three sets of hyperparameters per model) machine learning models are selected, the ECOD model (without hyperparameters) was also chosen for the evaluation of DT. DT_abnormal, DT_normal, ADFA-LD, and PLAID are used for training respectively. The results of DT training models are stored in the directory `Models-DongTing`, and the results of ADFA-LD and PLAID training models are stored in the directory `Models-Comparison`. The directory `npz `stores the encoded dataset of DongTing, ADFA-LD, and PLAID (sequence length varies from 8 to 4495), according to syscall_64.tbl in Linux kernel 5.17, including the training set, validation set, and test set. The file `Baseline.xlsx` contains all the information about DongTing dataset, which can be used in training machine learning models. For example, the whole dataset is randomly divided into three sets with the ratio of 80%:10%:10% (training: validation: test). The implementation of dataset division can be found in the source code. Source Code The source code for dataset development is stored at https://github.com/HNUSystemsLab/DongTing and the following is a brief introduction. The source code contains three folders, i.e., `Source Code Files`, `Documents` and `DB`, where `Documents `stores the detailed documents related to development, `DB` stores samples data, and `Source Code Files` stores the source code related to the development of our dataset. The detailed description about the source code can be found in `Documents/Documentation.pdf`. The document consists of four parts: environment requirements, database, program structure and working steps, model training and evaluation (including training and evaluation). It details the preparation of the environment, data import method, functional description of each file in the source code directory, how model training and evaluation work and other related contents. We additionally maintain the dataset and source code on Baidu.com https://pan.baidu.com/s/1vu1WGZpf2DqMIoyGayNu3w?pwd=dtds to facilitate the access from China. Tips: If the DongTing dataset has been helpful to your research, please cite the article in your work. @article{DUAN2023111745, title = {DongTing: A large-scale dataset for anomaly detection of the Linux kernel}, journal = {Journal of Systems and Software}, volume = {203}, pages = {111745}, year = {2023}, issn = {0164-1212}, doi = {https://doi.org/10.1016/j.jss.2023.111745 url = {https://www.sciencedirect.com/science/article/pii/S0164121223001401}, author = {Guoyun Duan and Yuanzhi Fu and Minjie Cai and Hao Chen and Jianhua Sun}, keywords = {Anomaly detection, Dataset, Linux kernel, System calls, Kernel BUG, Deep learning}, }

With the rapid development of the Internet, data security faces new challenges. As a bridge between the underlying hardware and upper layer applications, the operating system plays a critical role in securing sensitive data. The trusted execution environments (TEEs) are special operating systems aiming at preventing the illegal access and tampering of sensitive data. Thus, TEEs have much stricter security requirements than normal operating systems. Fuzzing is a promising technique that is widely used to identify vulnerabilities in operating systems and applications. However, existing fuzzing frameworks are not directly applicable to TEE-enabled devices due to the specific architecture of TEE-based systems. In this paper, we present the design and implementation of a coverage-guided fuzzing framework for trusted execution environments. Specifically, we build TEEFuzzer, a system that can perform fuzz testing for the open portable trusted executive environment (OP-TEE), which is a widespread TrustZone operating system. Our system contains several purpose-build components, which include a seed generation module and a heuristic seed mutation module to achieve higher coverage, a coverage collection module, and an automatic bug-reproducing module to improve efficiency. With extensive evaluations, 38 crashes have been triggered in OP-TEE. In terms of performance, the average execution speed of TEEFuzzer is 79.4 test cases per second. In summary, we show that fuzzing is a feasible and effective approach to testing trusted execution environments.(c) 2023 Elsevier B.V. All rights reserved.

Persistent memory (PMem) is increasingly being leveraged to build hash-based indexing structures featuring cheap persistence, high performance, and instant recovery. Especially with the release of Intel Optane DC Persistent Memory Modules, we have witnessed a flourish in (re)designing persistent hash indexes. However, most of them are focus on the evaluation of specific metrics with important properties sidestepped. Thus, it is essential to understand how the proposed hash indexes perform under a unified testing framework and how they differentiate from each other if a wider range of performance metrics are considered. To this end, this paper provides a comprehensive evaluation of persistent hash tables. In particular, we focus on the evaluation of several state-of-the-art hash tables including CCEH, Dash, PCLHT, Clevel, Viper, Halo, SOFT, and Plush, with the second-generation PMem hardware. Our evaluation was conducted using a unified benchmarking framework and representative workloads. Besides characterizing common performance properties, we also explore how hardware configurations (such as PMem bandwidth, CPU instructions, and NUMA) affect the performance of PMem-based hash tables. With our in-depth analysis, we identify design trade-offs and good paradigms in prior arts and suggest desirable optimizations and directions for the future development of PMem-based hash tables.

As key components of DBMSs, various storage engines and index structures have been proposed based on incorrect assumptions before PMem hardware is publicly available. Recent studies reveal that there is a significant performance gap in evaluating index structures on real PMem platforms as compared to DRAM-based emulators. However, a comprehensive evaluation for those PMem-aware database storage engines on real PMem hardware is still missing. Meanwhile, dynamic memory management is more important on PMem systems because PMem is slower than DRAM and unfriendly to random small-writes, and ensuring crash-consistency for the metadata of PMem allocators introduces extra overhead. Therefore, it is essential to understand the performance intricacies of PMem-aware database storage engines from the perspective of PMem allocators. This paper presents a systematic evaluation of three PMem-aware database storage engines using representative workloads and a unified benchmarking framework that is integrated with four PMem allocators. Besides the commonly used metrics, the impact of different hardware configurations (such as NUMA and eADR) on performance is also considered. Through in-depth analysis, we reveal caveats and pitfalls on using or designing PMem-aware storage engines and important insights that can serve as guidelines for future development of PMem allocators and other related components.

Hash index, a fundamental component in many data management systems, can benefit from the emerging persistent memory (PMem) to achieve high performance and instant recovery. However, existing persistent hash indexes are suboptimal in at least three aspects. First, their performance suffers from the mismatch between small random write and access granularity of PMem hardware. Second, none of them are aware of the significance of write amplification caused by memory allocators and synchronization primitives. Third, hybrid designs (PMem+DRAM) focus on improving throughput at the cost of extremely long recovery time. In this paper, we present the design and implementation of Halo, a hybrid hash index for PMem+DRAM environment, featuring a specifically designed volatile index and log-structured persistent storage layout. In order to suppress write amplification caused by memory allocators and to facilitate recovery, we propose Halloc, a highly-efficient memory manager for Halo. In addition, we propose mechanisms such as batched writes, prefetching for hybrid reads, and reactive snapshot to further optimize performance. We conduct extensive evaluations on a 32-core platform equipped with Intel Optane DC Persistent Memory Modules. The results show that Halo achieves up to 17.5x and 81.2x higher read and write throughput than state-of-the-art hash indexes under a wide range of workloads. Halo also outperforms current hybrid designs in recovery speed, which is 1 to 2 orders of magnitude faster.

Co-running GPU kernels on a single GPU can provide high system throughput and improve hardware utilization, but this raises concerns on application security. We reveal that translation lookaside buffer (TLB) attack, one of the common attacks on CPU, can happen on GPU when multiple GPU kernels co-run. We investigate conditions or principles under which a TLB attack can take effect, including the awareness of GPU TLB microarchitecture, being lightweight, and bypassing existing software and hardware mechanisms. This TLB-based attack can be leveraged to conduct Denial-of-Service (or Degradation-of-Service) attacks. Furthermore, we propose a solution to mitigate TLB attacks. In particular, based on the microarchitecture properties of GPU, we introduce a software-based system, TLB-pilot, that binds thread blocks of different kernels to different groups of streaming multiprocessors by considering hardware isolation of last-level TLBs and the application’s resource requirement. TLB-pilot employs lightweight online profiling to collect kernel information before kernel launches. By coordinating software- and hardware-based scheduling and employing a kernel splitting scheme to reduce load imbalance, TLB-pilot effectively mitigates TLB attacks. The result shows that when under TLB attack, TLB-pilot mitigates the attack and provides on average 56.2% and 60.6% improvement in average normalized turnaround times and overall system throughput, respectively, compared to the traditional Multi-Process Service based co-running solution. When under TLB attack, TLB-pilot also provides up to 47.3% and 64.3% improvement (41% and 42.9% on average) in average normalized turnaround times and overall system throughput, respectively, compared to a state-of-the-art co-running solution for efficiently scheduling of thread blocks.

Mixed precision training uses a mixture of full and lower precisions for neural network (NN) training. Applying mixed precision must cast tensors in NN from float32 (FP32) to float16 (FP16) or vice versa. The existing strategy greedily applies FP16 to performance-critical operations without quantifying and considering the casting cost. However, we reveal that the casting cost can take more than 21% of NN operation execution time, and in some cases surpasses the performance benefit of using low precision. In this paper, we introduce Campo, a tool that improves performance of mixed-precision NN training with the awareness of casting costs. Campo is built upon performance modeling that predicts the casting cost and operation performance with low precision, and introduces a cost-aware graph rewriting strategy. Campo is user-transparent, and enables high performance NN training using mixed precision without training accuracy loss. Evaluating Campo with six NN models, we show that compared to TensorFlow using TF_AMP (a state-of-the-art performance optimizer for mixed precision training from Nvidia), Campo improves training throughput by 20.8% on average (up to 24.5%) on RTX 2080 Ti GPU and by 20.9% on average (up to 23.4%) on V100 GPU, without training accuracy loss. Because of using the cost-aware mixed precision training, Campo also improves energy efficiency by 21.4% on average (up to 24.2%), compared to TensorFlow using TF_AMP.

OpenCL programs typically employ complex storage models and diverse data types as well as manifest various memory access patterns, which make it challenging to detect the performance problems effectively. However, few research efforts have been dedicated to cope with this challenge so far. In this paper, we introduce CVFuzz, a domain-independent tool that can effectively detect and locate algorithmic complexity vulnerabilities in OpenCL kernels. The key enabling idea is leveraging automatically generated pathological inputs to trigger the worst-case behavior during the execution of OpenCL kernels. Our approach takes advantage of the metrics such as code coverage and run time to guide the generation of inputs that can slow down the execution of a given OpenCL kernel. We evaluate CVFuzz on more than 250 real-world OpenCL kernels. The evaluation results demonstrate that the inputs generated by CVFuzz are effective in detecting the worst-case time algorithmic complexity and optimization vulnerabilities.

Persistent memory (PM) is increasingly being leveraged to build hash-based indexing structures featuring cheap persistence, high performance, and instant recovery, especially with the recent release of Intel Optane DC Persistent Memory Modules. However, most of them are evaluated on DRAM-based emulators with unreal assumptions, or focus on the evaluation of specific metrics with important properties sidestepped. Thus, it is essential to understand how well the proposed hash indexes perform on real PM and how they differentiate from each other if a wider range of performance metrics are considered. To this end, this paper provides a comprehensive evaluation of persistent hash tables. In particular, we focus on the evaluation of six state-of-the-art hash tables including Level hashing, CCEH, Dash, PCLHT, Clevel, and SOFT, with real PM hardware. Our evaluation was conducted using a unified benchmarking framework and representative workloads. Besides characterizing common performance properties, we also explore how hardware configurations (such as PM bandwidth, CPU instructions, and NUMA) affect the performance of PM-based hash tables. With our in-depth analysis, we identify design trade-offs and good paradigms in prior arts, and suggest desirable optimizations and directions for the future development of PM-based hash tables.

Rich thread-level parallelism of GPU has motivated co-running GPU kernels on a single GPU. However, when GPU kernels co-run, it is possible that one kernel can leverage buffer overflow to attack another kernel running on the same GPU. There is very limited work aiming to detect buffer overflow for GPU. Existing work has either large performance overhead or limited capability in detecting buffer overflow. In this article, we introduce GMODx, a runtime software system that can detect GPU buffer overflow. GMODx performs always-on monitoring on allocated memory based on a canary-based design. First, for the fine-grained memory management, GMODx introduces a set of byte arrays to store buffer information for overflow detection. Techniques, such as lock-free accesses to the byte arrays, delayed memory free, efficient memory reallocation, and garbage collection for the byte arrays, are proposed to achieve high performance. Second, for the coarse-grained memory management, GMODx utilizes unified memory to delegate the always-on monitoring to the CPU. To reduce performance overhead, we propose several techniques, including customized list data structure and specific optimizations against the unified memory. For micro-benchmarking, our experiments show that GMODx is capable of detecting buffer overflow for the fine-grained memory management without performance loss, and that it incurs small runtime overhead (4.2 percent on average and up to 9.7 percent) for the coarse-grained memory management. For real workloads, we deploy GMODx on the TensorFlow framework, it only causes 0.8 percent overhead on average (up to 1.8 percent).

With the rapid development of the Internet, data security faces new challenges. As the interface between hardware and user-level applications, operating system is a critical component to ensure the security of sensitive data. Trusted execution environment (TEE) is a special operating system aiming at preventing the illegal access and tampering of sensitive data. Thus, the security of trusted operating system is essential for the whole system. Fuzzing is a promising technique that is widely used to identify vulnerabilities in operating systems and applications. In this paper, we present the design and implementation of a coverage-guided fuzzing framework for trusted operating systems. Specifically, we build a system that can perform fuzz testing for OP-TEE, a widespread TrustZone operating system. To improve efficiency, our systems contains several purpose-build components, which include seed generation and test case mutation to achieve higher coverage, coverage collection, and automatic bug-reproducing. With extensive evaluation, we trigger 38 crashes in OP-TEE. In terms of performance, the average execution speed of our system is 79.4 test cases per second. In summary, we show that fuzzing is a feasible and effective approach to testing trusted operating systems.

A* search is a best-first search algorithm that is widely used in pathfinding and graph traversal. To meet the ever-increasing demand of performance, various high-performance architectures (e.g., multi-core CPU and GPU) have been explored to accelerate the A* search. However, the current GPU based A* search approaches are merely designed based on single-GPU architecture. Nowadays, the amount of data grows at an exponential rate, making it inefficient or even infeasible for the current A* to process the data sets entirely on a single GPU. In this paper, we propose DA*, a parallel A* search algorithm based on the multi-GPU architecture. DA* enables the efficient acceleration of the A* algorithm using multiple GPUs with effective graph partitioning and data communication strategies. To make the most of the parallelism of multi-GPU architecture, in the state extension phase, we adopt the method of multiple priority queues for the open list, which allows multiple states being calculated in parallel. In addition, we use the parallel hashing of replacement and frontier search mechanism to address node duplication detection and memory bottlenecks respectively. The evaluation shows that DA* is effective and efficient in accelerating A* based computational tasks on the multi-GPU system. Compared to the state-of-the-art A* search algorithm based on a single GPU, our algorithm can achieve up to 3x performance speedup with four GPUs. (C) 2021 Elsevier B.V. All rights reserved.

Persistent memory (PM) is increasingly being leveraged to build hash-based indexing structures featuring cheap persistence, high performance, and instant recovery, especially with the recent release of Intel Optane DC Persistent Memory Modules. However, most of them are evaluated on DRAM-based emulators with unreal assumptions, or focus on the evaluation of specific metrics with important properties sidestepped. Thus, it is essential to understand how well the proposed hash indexes perform on real PM and how they differentiate from each other if a wider range of performance metrics are considered. To this end, this paper provides a comprehensive evaluation of persistent hash tables. In particular, we focus on the evaluation of six state-of-the-art hash tables including Level hashing, CCEH, Dash, PCLHT, Clevel, and SOFT, with real PM hardware. Our evaluation was conducted using a unified benchmarking framework and representative workloads. Besides characterizing common performance properties, we also explore how hardware configurations (such as PM bandwidth, CPU instructions, and NUMA) affect the performance of PM-based hash tables. With our in-depth analysis, we identify design trade-offs and good paradigms in prior arts, and suggest desirable optimizations and directions for the future development of PM-based hash tables.

Based on the investigation result on the training program of information security to undergraduates in Hunan university, an analysis from four aspects was made: domestic and international universities, external specialists, teachers in the college and students in the college. Aiming at issues being found, the training program based on existing experiences and achievements on university-enterprise cooperation were improved. The new training program features university-enterprise joint cultivation.

Graphics Processing Units (GPUs) is widely used to perform general purpose computing in many areas such as scientific computing and deep learning. In order to offer more flexibility in GPU programming, dynamic memory allocation has been introduced in GPU programming frameworks such as CUDA. However, the dynamic memory allocator in CUDA is inefficient in highly concurrent environments. Thus, several dynamic memory allocators are recently proposed to enhance the performance of dynamic memory management. However, these allocators only focus on achieving higher performance but ignore the security issues. In this paper, we propose a fast and secure GPU memory allocator based on ScatterAlloc. In order to efficiently protect against memory attacks such as buffer overflows, our allocator consists of several key techniques including canary-based memory protection (two options such as detection-on-free and always-on-detection are provided), address compression, and over-provisioning. Experimental results show that the allocator can effectively detect buffer overflow errors while it is still approximately 100 times faster than the CUDA toolkit allocator.

GPUs have been widely used in multi-user environments such as the cloud due to its rich thread-level parallelism. In such an environment, multiple kernels can execute in parallel. However, it is possible that a kernel leverages buffer overflow to attack other kernels on the same GPU. The limited existing work focuses on the detection of buffer overflows instead of prevention. Address randomization is an effective approach to preventing memory-related attacks on the CPU. However, current GPUs lack similar support to defend the increasing threats of memory overflow. In this paper, we propose an address randomization method for dynamic memory allocation on the GPU. We have implemented and compared different pseudo-random algorithms on the GPU, and integrated the address randomization into an existing allocator. Elaborate discussions are presented to analyze the security of our proposed address randomization. Experimental evaluations show that the overhead incurred by our randomized algorithm is less than 20% on top of existing memory allocators.