论文标题
设计强大的API监视解决方案
Designing Robust API Monitoring Solutions
论文作者
论文摘要
追踪程序制作的图书馆和系统调用的顺序对于表征其与周围环境的相互作用以及最终的语义相互作用。由于现实世界软件堆栈的纠缠，完成此任务可能会令人惊讶地具有挑战性，因为我们将准确性，可靠性和透明度用于方程式。为了有效地管理这些维度，我们确定了六个挑战，API监视解决方案应克服并概述可行的设计点，并报告我们在为软件安全研究构建API示踪剂方面的经验中的见解。我们详细介绍了两个基于硬件辅助虚拟化（实现此类通用用户空间示踪剂）和动态二进制翻译的实现变体，从而实现了API的稳固监视。我们共享狙击系统作为开源。
Tracing the sequence of library and system calls that a program makes is very helpful in the characterization of its interactions with the surrounding environment and ultimately of its semantics. Due to entanglements of real-world software stacks, accomplishing this task can be surprisingly challenging as we take accuracy, reliability, and transparency into the equation. To manage these dimensions effectively, we identify six challenges that API monitoring solutions should overcome and outline actionable design points for them, reporting insights from our experience in building API tracers for software security research. We detail two implementation variants, based on hardware-assisted virtualization (realizing the first general-purpose user-space tracer of this kind) and on dynamic binary translation, that achieve API monitoring robustly. We share our SNIPER system as open source.
