DPL: A Data Patching Language
| atmire.migration.oldid | 1937 | |
| dc.contributor.advisor | Locasto, Michael | |
| dc.contributor.author | Gonzalez, Robin | |
| dc.date.accessioned | 2014-02-05T17:09:15Z | |
| dc.date.available | 2014-03-15T07:00:21Z | |
| dc.date.issued | 2014-02-05 | |
| dc.date.submitted | 2014 | en |
| dc.description.abstract | Patching applications remains one of the most effective techniques for defending against exploitation of vulnerabilities and is a basic defensive mechanisms against attacks. However, it entails unwanted complications for the user, such as restarting the application after it gets patched. Restarting the application influences the user to stop updating applications and operating systems, making out of date software that presents an attractive target for exploitation. Even though many authors address this issue by proposing frameworks and tools for applying these patches {\it on the fly}, most modern systems and applications do not implement this technique. One of the biggest challenges for mainstreaming this technique is the fact that patches not only change source code but also the state or semantics of the application. This thesis proposes a mechanism that aids the activity of hot patching applications by updating its data semantics while dynamically applying a patch. More precisely, the mechanism updates the data structures of an application according to what a patch entails by making sure that the application's state is updated according to the new semantics introduced by the patch. For this, we present a proof of concept of a framework that is capable of patching the data semantics (i.e., data structure modifications according to a security patch) of an application. This thesis explores the question of what makes a patch feasible for hot--patching according to how it modifies the semantics of an application. We also study the application of machine learning algorithms to predict patches that were considered to be feasible for hot--patching based on an empirical study. We also explain the design and implementation of a proof of concept capable of hot--patching data structures of applications. As in many other scientific studies, we found that there is a subset of patches that we are not able to use for hot--patching because of the operations they are introducing. By studying this subset of patches, we learned that certain data operations introduce changes in the control flow that can create conflicts when hot--patching. We explain what type of operations defined a patch to be infeasible -- according to our heuristics -- and we hot--patched the statements that we found to be feasible. Our system is capable of hot--patching different types of data structures according to the aforementioned feasible operations with a very low performance overhead. At the end, we present the evaluation and results of our investigation. We learned that 13 out of 75 security patches that modify data structures are not feasible to implement using our heuristics, making them difficult to update because of the semantics the patch introduces. On the other hand, we found 38 out of 75 security patches feasible to implement by using our set of data operations and the remaining 24 were not modifying data semantics. In conclusion, we found that, if patch developers are aware of the type of statements that introduce conflicts when hot--patching, they could make hot--patching a feasible activity. | en_US |
| dc.identifier.citation | Gonzalez, R. (2014). DPL: A Data Patching Language (Master's thesis, University of Calgary, Calgary, Canada). Retrieved from https://prism.ucalgary.ca. doi:10.11575/PRISM/25747 | en_US |
| dc.identifier.doi | http://dx.doi.org/10.11575/PRISM/25747 | |
| dc.identifier.uri | http://hdl.handle.net/11023/1367 | |
| dc.language.iso | eng | |
| dc.publisher.faculty | Graduate Studies | |
| dc.publisher.institution | University of Calgary | en |
| dc.publisher.place | Calgary | en |
| dc.rights | University of Calgary graduate students retain copyright ownership and moral rights for their thesis. You may use this material in any way that is permitted by the Copyright Act or through licensing that has been assigned to the document. For uses that are not allowable under copyright legislation or licensing, you are required to seek permission. | |
| dc.subject | Computer Science | |
| dc.subject.classification | data, patching, language | en_US |
| dc.title | DPL: A Data Patching Language | |
| dc.type | master thesis | |
| thesis.degree.discipline | Computer Science | |
| thesis.degree.grantor | University of Calgary | |
| thesis.degree.name | Master of Science (MSc) | |
| ucalgary.item.requestcopy | true |