MTD: Run-time System Call Mapping Randomization

Abstract

The purpose of our research is to provide defense against code injection attacks on the system. Code injection attack is one of the most dangerous attacks to a system, which can even give an attacker a chance to fully compromise the system by executing arbitrary code. Moving Target Defense (MTD) can protect the system from attacks by dynamically changing the target area of attacks including vulnerability as well as reduce the reachability of attacks. System call randomization is an MTD technique that disables code injection attacks by randomizing the mapping between system call numbers and the functions called by them. The purpose of system call randomization is to limit the processing and resources that the injected program can perform and access. As system calls are the only way for user applications to access system resources, randomizing system calls can give attackers more difficulty to achieve their goals, even if they can inj ect the program. Existing system call randomization techniques once performed randomization before loading the program, however, such methods only once in advance have no effect when information about randomization is disclosed to attackers. In this paper, we propose a method of re-randomizing multiple times at runtime to solve this problem. We implemented a script that directly edits the ELF executable format. In fact, as a result of running the script on a small program, we succeeded in generating a new executable file to which the method is applied. Our experiments show that run-time system call randomization is effective against code injection attacks, and this technique may also be applied to existing compiled programs. We implemented a script that directly edits the ELF executable format. In fact, as a result of running the script on a small program, we succeeded in generating a new executable file to which the method is applied. Our experiments show that run-time system call randomization is effective against code injection attacks, and this technique may also be applied to existing compiled programs.