The ability to recognize quickly inside network flows to be executable is prerequisite for malware detection. For this purpose, we introduce an instruction transition probability matrix (ITPX) which is comprised of the - instruction sets and reveals the characteristics of executable code's instruction transition patterns. And then, we propose a simple algorithm to detect executable code inside network flows using a reference ITPX which is learned from the known Windows Portable Executable files. We have tested the algorithm with more than thousands of executable and non-executable codes. The results show that it is very promising enough to use in real world.

抄録全体を表示

Cache prefetching technique brings huge benefits to performance improvement, but it comes at the cost of microarchitectural security in processors. In this letter, we deep dive into internal workings of a DCUIP prefetcher, which is one of prefetchers equipped in Intel processors. We discover that a DCUIP table is shared among different execution contexts in hyperthreading-enabled processors, which leads to another microarchitectural vulnerability. By exploiting the vulnerability, we propose a DCUIP poisoning attack. We demonstrate an AES encryption key can be extracted from an AES-NI implementation by mounting the proposed attack.

抄録全体を表示

富士通のＨＰＣの取り組みについて

抄録全体を表示

Non-Volatile Memories (NVMs) are considered as promising memory technologies for Last-Level Cache (LLC) due to their low leakage and high density. However, NVMs have some drawbacks such as high dynamic energy in modifying NVM cells, long latency for write operation, and limited write endurance. A number of approaches have been proposed to overcome these drawbacks. But very little attention is paid to consider the cache coherency issue. In this letter, we suggest a new cache coherence protocol to reduce the write operations of the LLC. In our protocol, the block data of the LLC is updated only if the cache block is written-back from a private cache, which leads to avoiding useless write operations in the LLC. The simulation results show that our protocol provides 27.1% energy savings and 26.3% lifetime improvements in STT-RAM at maximum.

抄録全体を表示

This paper describes our approach to making the Gandalf Virtual Machine Monitor (VMM) interruptible. Gandalf is designed to be a lightweight VMM for use in embedded systems. Hardware interrupts are directly notified to its guest operating system (OS) kernel without the interventions of the VMM, and the VMM only processes the exceptions caused by the guest kernel. Since the VMM processes those exceptions with interrupts disabled, the detailed performance analysis using PMC (Performance Monitoring Counters) revealed that the time duration while the interrupts are disabled is rather long. By making Gandalf interruptible, we are able to make VMM based systems more suitable for embedded systems. We analyzed the requirements for making Gandalf interruptible, and designed and implemented mechanisms to achieve this. The experimental results show that making Gandalf interruptible significantly reduces a duration of execution time with interrupts disabled while it does not impact performance.

抄録全体を表示

This paper describes our approach to making the Gandalf Virtual Machine Monitor (VMM) interruptible. Gandalf is designed to be a lightweight VMM for use in embedded systems. Hardware interrupts are directly notified to its guest operating system (OS) kernel without the interventions of the VMM, and the VMM only processes the exceptions caused by the guest kernel. Since the VMM processes those exceptions with interrupts disabled, the detailed performance analysis using PMC (Performance Monitoring Counters) revealed that the time duration while the interrupts are disabled is rather long. By making Gandalf interruptible, we are able to make VMM based systems more suitable for embedded systems. We analyzed the requirements for making Gandalf interruptible, and designed and implemented mechanisms to achieve this. The experimental results show that making Gandalf interruptible significantly reduces a duration of execution time with interrupts disabled while it does not impact performance.

抄録全体を表示

HugeTLBfs improves performance of the applications which need huge data area by using Huge Page because of reducing TLB misses that affect an efficiency of address translation. However, Huge Page sizes which can be used concurrently are limited to only one size. If a pretty large size in Huge Pages is adopted to reduce TLB misses dramatically, its size is allocated even to the remaining fragment in the last part of data area. As a result of allocating a large size to small area, large useless data area that any processes can not use is generated. On the other hand, if a small size is adopted, improvement of performance is trivial. Then we added the second Huge Page size to fill fragment that is concurrently available with the large ones. Consequently, our method makes it possible to minimize useless data area without going down in performance.

抄録全体を表示

In recent years, dramatic improvements have been made to computer hardware. In particular, the number of cores on a chip has been growing exponentially, enabling an ever-increasing number of processes to be executed in parallel. Having been originally developed for single-core processors, database (DB) management systems (DBMSs) running on multicore processors suffer from cache conflicts as the number of concurrently executing DB processes (DBPs) increases. Therefore, a cache-efficient solution for arranging the execution of concurrent DBPs on multicore platforms would be highly attractive for DBMSs. In this paper, we propose CARIC-DA, middleware for achieving higher performance in DBMSs on multicore processors, by reducing cache misses with a new cache-conscious dispatcher for concurrent queries. CARIC-DA logically range-partitions the dataset into multiple subsets. This enables different processor cores to access different subsets by ensuring that different DBPs are pinned to different cores and by dispatching queries to DBPs according to the data-partitioning information. In this way, CARIC-DA is expected to achieve better performance via a higher cache hit rate for the private cache of each core. It can also balance the loads between cores by changing the range of each subset. Note that CARIC-DA is pure middleware, meaning that it avoids any modification to existing operating systems (OSs) and DBMSs, thereby making it more practical. This is important because the source code for existing DBMSs is large and complex, making it very expensive to modify. We implemented a prototype that uses unmodified existing Linux and PostgreSQL environments, and evaluated the effectiveness of our proposal on three different multicore platforms. The performance evaluation against benchmarks revealed that CARIC-DA achieved improved cache hit rates and higher performance.

抄録全体を表示

This paper proposes simultaneous virtual-machine logging and replay. It performs logging and replay simultaneously on the same machine through the use of two virtual machines, one for the primary execution and the other for the backup execution. While the primary execution produces the execution history, the backup execution consumes the history by replaying it. The size of an execution log can be limited to a certain size; thus, huge storage devices becomes unnecessary. We developed such a logging and replaying feature in a VMM. It can log and replay the execution of the Linux operating system. Our experiment results show the overhead of the primary execution is only fractional.

抄録全体を表示

This paper proposes simultaneous virtual-machine logging and replay. It performs logging and replay simultaneously on the same machine through the use of two virtual machines, one for the primary execution and the other for the backup execution. While the primary execution produces the execution history, the backup execution consumes the history by replaying it. The size of an execution log can be limited to a certain size; thus, huge storage devices becomes unnecessary. We developed such a logging and replaying feature in a VMM. It can log and replay the execution of the Linux operating system. Our experiment results show the overhead of the primary execution is only fractional.

抄録全体を表示

With the recent dissemination of embedded systems, it has become important to certify low-level software such as specialized operating systems. Our work aims at providing a framework to carry out convincingly such certifications. In this paper, we illustrate our approach by formalizing in the Coq proof assistant an important property of memory management in Topsy, an operating system for active-network cards. The difficulty in such a certification is twofold: we need to (1) identify relevant modules in the concrete implementation, and (2) model properly the memory management policy implemented over memory protection mechanisms of the hardware. Using Separation Logic (an extension of Hoare Logic with memory operations and spatial assertion language), we have extracted, formalized, and specified the relevant parts of the boot-loader, the memory and the thread management modules of Topsy, and we are now in the process of certifying Memory Isolation, i.e. the property that user ! threads cannot read or write outside of their memory space. We believe that a large part of our formalization (in particular, the Coq implementation of Separation Logic) is reusable in the context of other certifications.

抄録全体を表示

Non-volatile memory (NVM) is a promising technology for low-energy and high-capacity main memory of computers. The characteristics of NVM devices, however, tend to be fundamentally different from those of DRAM (i.e., the memory device currently used for main memory), because of differences in principles of memory cells. Typically, the write latency of an NVM device such as PCM and ReRAM is much higher than its read latency. The asymmetry in read/write latencies likely affects the performance of applications significantly. For analyzing behavior of applications running on NVM-based main memory, most researchers use software-based emulation tools due to the limited number of commercial NVM products. However, these existing emulation tools are too slow to emulate a large-scale, realistic workload or too simplistic to investigate the details of application behavior on NVM with asymmetric read/write latencies. This paper therefore proposes a new NVM emulation mechanism that is not only light-weight but also aware of a read/write latency gap in NVM-based main memory. We implemented the prototype of the proposed mechanism for the Intel CPU processors of the Haswell architecture. We also evaluated its accuracy and performed case studies for practical benchmarks. The results showed that our prototype accurately emulated write-latencies of NVM-based main memory: it emulated the NVM write latencies in a range from 200 ns to 1000 ns with negligible errors from 0.2% to 1.1%. We confirmed that the use of our emulator enabled us to successfully estimate performance of practical workloads for NVM-based main memory, while an existing light-weight emulation model misestimated.

抄録全体を表示

The current generation of computer hardware has brought several new challenges for the underlying software. The number of cores on a chip has grown exponentially, enabling an ever-increasing number of processes to execute in parallel. The efficient utilization of the full range of concurrent processing capabilities offered by such a multicore platform is critical to achieving good system performance. As the number of cores on a chip increases, the increasing processor-memory gap is the bottleneck for most data-intensive applications. We therefore propose a cache-efficient CARIC-DA framework for arranging the execution of concurrent database queries on multicore platforms. This achieves improved database management system (DBMS) performance by improving cache utilization for concurrent queries. Our middleware optimizes the performance of the private-cache levels by providing query-needs-aware dispatching for concurrent online transaction-processing queries to run on different processor cores. By considering both the operating system and the DBMS application, our proposal achieves higher cache utilization for various cache levels. In this paper, we demonstrate how the middleware of CARIC-DA manages a mixed workload, where complex queries with join operations cannot share data with other queries in caches. We describe strategies that enable the middleware to partition complex queries and dispatch concurrent queries to different processor cores. The performance of the extended CARIC-DA for the TPC-W benchmark is evaluated on modern Intel and AMD multicore platforms.

抄録全体を表示

最近公表されるマイクロプロセッサの殆どが具備するようになったメディア処理向けSIMD拡張命令セットは，ベクタ命令セットの特別な場合と考えられるが，従来のベクタ命令にはない特徴や制約があり，そのための最適化技術をそのまま流用するだけでは潜在能力を引き出すことができない．COINSプロジェクトではSIMD拡張命令セット向け最適化を，ベクタ化を軸としたソースコードレベルで可能な最適化と，そのような変換を施されたプログラムに対して適切なSIMD命令を生成する最適化の2段階に分割し，我々が「SIMD並列化」と呼ぶ後者を中心に研究を行った．本稿では，COINSにおけるSIMD並列化について報告する．

抄録全体を表示

A whitelisting approach is a promising solution to prevent unwanted processes (e.g., malware) getting executed. However, previous solutions suffer from limitations in that: 1) Most methods place the whitelist information in the kernel space, which could be tempered by attackers; 2) Most methods cannot prevent the execution of kernel processes. In this paper, we present VAW, a novel application whitelisting system by using the virtualization technology. Our system is able to block the execution of unauthorized user and kernel processes. Compared with the previous solutions, our approach can achieve stronger security guarantees. The experiments show that VAW can deny the execution of unwanted processes effectively with a little performance overhead.

抄録全体を表示

The behavior of virtual machine (VM) programs are monitored by virtual machine monitors (VMMs) for security purposes. System calls are frequently used as a monitoring point. To monitor the system calls, the VMM inserts a breakpoint, called a hook point, into the memory of the monitored VM. The hook points are determined based on experimental knowledge. However, reading the source codes of operating systems (OSes) requires specialized knowledge. In addition, the appropriate hook point differs among OSes and OS versions. Analyzing the source code in each OS update is impractical. Searching for the appropriate hook point for various OSes is also difficult. To address these problems, we propose a method for estimating the hook point using a memory analysis technique. The proposed method acquires the memory of the monitored VM and then searches for an appropriate instruction appropriate to hook. The search instructions depend on the processor architecture. In addition, we also proposed a method for searching the appropriate instruction using a single step execution. This version reduces the cost for searching the instructions and improve robustness for various Linux versions. The experimental results showed that the proposed method precisely estimates the hook point for various OS versions and OSes. In addition, the overhead of the proposed method is small, considering the boot time of the monitored VM.

抄録全体を表示

This note has two goals. First, for those who have heard the term but do not know what it means, it provides a gentle introduction to Malliavin's calculus as it applies to degenerate parabolic partial differential equations. Second, it applies that theory to generalizations of Kolmogorov's example of a highly degenerate operator which is nonetheless hypoelliptic.

抄録全体を表示