On the effectiveness of the metamorphic shield

In this paper we analyze the effectiveness of dynamic artificial diversity, i.e., artificial diversity in which the subject of the diversity is re-randomized periodically. We refer to a mechanism that implements dynamic diversity as a Metamorphic Shield since this mechanism applies metamorphosis to the system's attack surface to try to shield the system from certain attacks. Contrary to intuition, our analysis reveals that dynamic diversity provides limited benefit except in special cases. In particular, it offers benefit for attacks that seek to leak information. We present a case study of the use of dynamic diversity applied to Instruction Set Randomization that is subject to an incremental attack on the key.

• Type: Conference
• Year: 2010
• Where: ECSA
• Authors: Anh Nguyen-Tuong, Andrew Wang, Jason Hiser, John C. Knight, Jack W. Davidson
• Keywords: Artificial Diversity, Dynamic Artificial Diversity, Dynamic Diversity, ECSA 2010, Software Engineering