Building up on SIDAN: improved and new invariants for a software hardening Frama-C plugin

摘要

We present improvements made on SIDAN, an intrusion detection system working at the software level. The operating principle of SIDAN consists in statically computing invariant properties of the targeted programs and in generating an instrumentation to check those properties at runtime, in order to detect attacks. More precisely, it focuses on invariants involving the values of variables of the program. It checks these invariants when calling functions. We present improvements on the existing invariants used by SIDAN and propose new invariants as well. We also describe how these have been implemented in SIDAN by using the Frama-C framework, and how they could improve its attack detection capabilities.