EffectiveSan: Type and Memory Error Detection using Dynamically Typed C/C++

Low-level programming languages with weak/static type systems, such as C and C++, are vulnerable to errors relating to the misuse of memory at runtime, such as (sub-)object bounds overflows, (re)use-after-free, and type confusion. Such errors account for many security and other undefined behavior bugs for programs written in these languages. In this paper, we introduce the notion of dynamically typed C/C++, which aims to detect such errors by dynamically checking the "effective type" of each object before use at runtime. We also present an implementation of dynamically typed C/C++ in the form of the Effective Type Sanitizer (EffectiveSan). EffectiveSan enforces type and memory safety using a combination of low-fat pointers, type meta data and type/bounds check instrumentation. We evaluate EffectiveSan against the SPEC2006 benchmark suite and the Firefox web browser, and detect several new type and memory errors. We also show that EffectiveSan achieves high compatibility and reasonable overheads for the given error coverage. Finally, we highlight that EffectiveSan is one of only a few tools that can detect sub-object bounds errors, and uses a novel approach (dynamic type checking) to do so.Comment: To appear in the Proceedings of 39th ACM SIGPLAN Conference on Programming Language Design and Implementation (PLDI2018

Shadow Honeypots

We present Shadow Honeypots, a novel hybrid architecture that combines the best features of honeypots and anomaly detection. At a high level, we use a variety of anomaly detectors to monitor all traffic to a protected network or service. Traffic that is considered anomalous is processed by a "shadow honeypot" to determine the accuracy of the anomaly prediction. The shadow is an instance of the protected software that shares all internal state with a regular ("production") instance of the application, and is instrumented to detect potential attacks. Attacks against the shadow are caught, and any incurred state changes are discarded. Legitimate traffic that was misclassified will be validated by the shadow and will be handled correctly by the system transparently to the end user. The outcome of processing a request by the shadow is used to filter future attack instances and could be used to update the anomaly detector. Our architecture allows system designers to fine-tune systems for performance, since false positives will be filtered by the shadow. We demonstrate the feasibility of our approach in a proof-of-concept implementation of the Shadow Honeypot architecture for the Apache web server and the Mozilla Firefox browser. We show that despite a considerable overhead in the instrumentation of the shadow honeypot (up to 20% for Apache), the overall impact on the system is diminished by the ability to minimize the rate of false-positives

Forecasting substantial data revisions in the presence of model uncertainty

A recent revision to the preliminary measurement of GDP(E) growth for 2003Q2 caused considerable press attention, provoked a public enquiry and prompted a number of reforms to UK statistical reporting procedures. In this article, we compute the probability of 'substantial revisions' that are greater (in absolute value) than the controversial 2003 revision. The predictive densities are derived from Bayesian model averaging over a wide set of forecasting models including linear, structural break and regime-switching models with and without heteroscedasticity. Ignoring the nonlinearities and model uncertainty yields misleading predictives and obscures recent improvements in the quality of preliminary UK macroeconomic measurements

Validation of Memory Accesses Through Symbolic Analyses

International audienceThe C programming language does not prevent out-of- bounds memory accesses. There exist several techniques to secure C programs; however, these methods tend to slow down these programs substantially, because they populate the binary code with runtime checks. To deal with this prob- lem, we have designed and tested two static analyses - sym- bolic region and range analysis - which we combine to re- move the majority of these guards. In addition to the analy- ses themselves, we bring two other contributions. First, we describe live range splitting strategies that improve the effi- ciency and the precision of our analyses. Secondly, we show how to deal with integer overflows, a phenomenon that can compromise the correctness of static algorithms that validate memory accesses. We validate our claims by incorporating our findings into AddressSanitizer. We generate SPEC CINT 2006 code that is 17% faster and 9% more energy efficient than the code produced originally by this tool. Furthermore, our approach is 50% more effective than Pentagons, a state- of-the-art analysis to sanitize memory accesses

A deep stratosphere-to-troposphere ozone transport event over Europe simulated in CAMS global and regional forecast systems: analysis and evaluation

Stratosphere-to-troposphere transport (STT) is an important natural source of tropospheric ozone, which can occasionally influence ground-level ozone concentrations relevant for air quality. Here, we analyse and evaluate the Copernicus Atmosphere Monitoring Service (CAMS) global and regional forecast systems during a deep STT event over Europe for the time period from 4 to 9 January 2017. The predominant synoptic condition is described by a deep upper level trough over eastern and central Europe, favouring the formation of tropopause folding events along the jet stream axis and therefore the intrusion of stratospheric ozone into the troposphere. Both global and regional CAMS forecast products reproduce the hook-shaped streamer of ozone-rich and dry air in the middle troposphere depicted from the observed satellite images of water vapour. The CAMS global model successfully reproduces the folding of the tropopause at various European sites, such as Trapani (Italy), where a deep folding down to 550&thinsp;hPa is seen. The stratospheric ozone intrusions into the troposphere observed by WOUDC ozonesonde and IAGOS aircraft measurements are satisfactorily forecasted up to 3 days in advance by the CAMS global model in terms of both temporal and vertical features of ozone. The fractional gross error (FGE) of CAMS ozone day 1 forecast between 300 and 500&thinsp;hPa is 0.13 over Prague, while over Frankfurt it is 0.04 and 0.19, highlighting the contribution of data assimilation, which in most cases improves the model performance. Finally, the meteorological and chemical forcing of CAMS global forecast system in the CAMS regional forecast systems is found to be beneficial for predicting the enhanced ozone concentrations in the middle troposphere during a deep STT event.</p

In Situ Microscopy Analysis Reveals Local Innate Immune Response Developed around Brucella Infected Cells in Resistant and Susceptible Mice

Brucella are facultative intracellular bacteria that chronically infect humans and animals causing brucellosis. Brucella are able to invade and replicate in a broad range of cell lines in vitro, however the cells supporting bacterial growth in vivo are largely unknown. In order to identify these, we used a Brucella melitensis strain stably expressing mCherry fluorescent protein to determine the phenotype of infected cells in spleen and liver, two major sites of B. melitensis growth in mice. In both tissues, the majority of primary infected cells expressed the F4/80 myeloid marker. The peak of infection correlated with granuloma development. These structures were mainly composed of CD11b+ F4/80+ MHC-II+ cells expressing iNOS/NOS2 enzyme. A fraction of these cells also expressed CD11c marker and appeared similar to inflammatory dendritic cells (DCs). Analysis of genetically deficient mice revealed that differentiation of iNOS+ inflammatory DC, granuloma formation and control of bacterial growth were deeply affected by the absence of MyD88, IL-12p35 and IFN-γ molecules. During chronic phase of infection in susceptible mice, we identified a particular subset of DC expressing both CD11c and CD205, serving as a reservoir for the bacteria. Taken together, our results describe the cellular nature of immune effectors involved during Brucella infection and reveal a previously unappreciated role for DC subsets, both as effectors and reservoir cells, in the pathogenesis of brucellosis

A supervised machine learning classification algorithm for research articles

The issue of the automatic classification of research articles into one or more fields of science is of primary importance for scientific databases and digital libraries. A sophisticated classification strategy renders searching more effective and assists the users in locating similar relevant items. Although the most publishing services require from the authors to categorize their articles themselves, there are still cases where older documents remain unclassified, or the taxonomy changes over time. In this work we attempt to address this interesting problem by introducing a machine learning algorithm which combines several parameters and meta-data of a research article. In particular, our model exploits the training set to correlate keywords, authors, co-authorship, and publishing journals to a number of labels of the taxonomy. In the sequel, it applies this information to classify the rest of the documents. The experiments we have conducted with a large dataset comprised of about 1,5 million articles, demonstrate that in this specific application, our model outperforms the AdaBoost.MH and SVM methods. Copyright 2013 ACM

Positional data organization and compression in web inverted indexes

To sustain the tremendous workloads they suffer on a daily basis, Web search engines employ highly compressed data structures known as inverted indexes. Previous works demonstrated that organizing the inverted lists of the index in individual blocks of postings leads to significant efficiency improvements. Moreover, the recent literature has shown that the current state-of-the-art compression strategies such as PForDelta and VSEncoding perform well when used to encode the lists docIDs. In this paper we examine their performance when used to compress the positional values. We expose their drawbacks and we introduce PFBC, a simple yet efficient encoding scheme, which encodes the positional data of an inverted list block by using a fixed number of bits. PFBC allows direct access to the required data by avoiding costly look-ups and unnecessary information decoding, achieving several times faster positions decompression than the state-of-the-art approaches. © 2012 Springer-Verlag