[Paper Review] Taming the War in Memory: A Resilient Mitigation Strategy Against Memory Safety Attacks in CPS

Eyasu Getahun Chekole, Unnikrishnan Cheramangalath+3 more|arXiv (Cornell University)|Sep 20, 2018

Security and Verification in Computing29 references4 citations

TL;DR

CIMA is a lightweight, resilient mitigation strategy that prevents memory-safety attacks in cyber-physical systems (CPS) by dynamically detecting and bypassing illegal memory accesses at runtime, ensuring system availability and physical-state resiliency with only 8.06% overhead. It achieves this through compiler-based control-flow transformation and runtime monitoring, enabling continuous operation even under attack.

ABSTRACT

Memory-safety attacks have been one of the most critical threats against computing systems. Although a wide-range of defense techniques have been developed against these attacks, the existing mitigation strategies have several limitations. In particular, most of the existing mitigation approaches are based on aborting or restarting the victim program when a memory-safety attack is detected, thus making the system unavailable. This might not be acceptable in systems with stringent timing constraints, such as cyber-physical systems (CPS), since the system unavailability leaves the control system in an unsafe state. To address this problem, we propose CIMA -- a resilient and light-weight mitigation technique that prevents invalid memory accesses at runtime. CIMA manipulates the compiler-generated control flow graph to automatically detect and bypass unsafe memory accesses at runtime, thereby mitigating memory-safety attacks along the process. An appealing feature of CIMA is that it also ensures system availability and resilience of the CPS even under the presence of memory-safety attacks. To this end, we design our experimental setup based on a realistic Secure Water Treatment (SWaT) and Secure Urban Transportation System (SecUTS) testbeds and evaluate the effectiveness and the efficiency of our approach. The experimental results reveal that CIMA handles memory-safety attacks effectively with low overhead. Moreover, it meets the real-time constraints and physical-state resiliency of the CPS under test.

Motivation & Objective

• Address the critical limitation of existing memory-safety defenses that abort or restart systems upon attack detection, which compromises availability in time-critical CPS.
• Enable system resilience in CPS by maintaining physical-state stability and real-time constraints during memory-safety attacks.
• Develop a lightweight, compiler-integrated solution that avoids the high overhead of checkpointing or full system restarts.
• Ensure that memory-safety vulnerabilities do not lead to system crashes or unsafe control states in safety-critical environments.

Proposed method

• Instrument the compiler-generated control-flow graph to insert conditional checks before every memory access, detecting invalid accesses at runtime.
• When a memory access violation is detected, CIMA skips the illegal instruction instead of aborting execution, preserving system availability.
• Use a hybrid approach combining static compile-time instrumentation with dynamic runtime monitoring to detect and bypass unsafe operations.
• Transform program control flow within mainstream compilers to enable safe bypassing of illegal instructions without altering functional correctness.
• Leverage AddressSanitizer (ASan) as a detection backend to identify memory-safety errors, while CIMA handles mitigation via execution bypassing.
• Design and evaluate the approach on real-world CPS testbeds—Open-SWaT and Open-SecUTS—mimicking industrial SCADA systems with strict timing and physical dynamics constraints.

Experimental results

Research questions

• RQ1 Can a mitigation strategy detect and handle memory-safety attacks without aborting or restarting the system, thereby preserving availability in time-critical CPS?
• RQ2 To what extent can a compiler-based runtime bypass mechanism maintain physical-state resiliency in CPS under memory-safety attacks?
• RQ3 What is the performance overhead of a runtime mitigation strategy that skips illegal instructions instead of terminating execution?
• RQ4 How effective is the proposed approach in real-world CPS testbeds with stringent real-time and physical dynamics constraints?

Key findings

• CIMA successfully mitigates memory-safety attacks in CPS with only 8.06% runtime overhead, demonstrating high efficiency.
• The system maintains real-time constraints and physical-state resiliency even when subjected to memory-safety attacks, as validated on the Open-SWaT and Open-SecUTS testbeds.
• CIMA ensures system availability by skipping illegal memory accesses instead of aborting, avoiding the unsafe states caused by system restarts.
• The approach is effective across diverse CPS workloads, including water treatment and urban transportation systems, with minimal performance degradation.
• CIMA’s reliance on ASan for detection allows it to inherit and benefit from improvements in existing memory-safety detection tools.
• The solution is generic and extendable, with potential for future integration into automated live patching by using CIMA’s runtime reports to guide code fixes.