Binary Software Fault Encouragement

We propose software brittleness as a layer of cyber-defense in depth for software systems. Brittle programs crash quickly when under attack, which helps prevent attackers from subverting systems through security flaws. We use binary rewriting to add brittleness to programs, providing low overhead security to both legacy and newly-developed systems. Brittleness is a property of programs that provides passive defense enforced as a side effect of program execution; there is no external monitor for attackers to bypass. The proposed work will develop 1) new types of software brittleness, 2) extended analysis infrastructure to admit more pervasive brittleness, and 3) techniques to enable forensic analysis of brittle crashes to aid in diagnostics and mitigation development. Our primary transition target for this work is to the Navy through work selected for award under ONR BAA N00014-16-R-BA04, which is developing tools to protect real-time and embedded systems from cyber attacks. The work we propose on brittle software will complement that work. We will identify test systems and evaluation criteria in cooperation with the Naval Surface Warfare Center.