TY - GEN
T1 - Turret
T2 - 2014 IEEE 34th International Conference on Distributed Computing Systems, ICDCS 2014
AU - Lee, Hyojeong
AU - Seibert, Jeff
AU - Hoque, Endadul
AU - Killian, Charles
AU - Nita-Rotaru, Cristina
N1 - Publisher Copyright:
© 2014 IEEE.
PY - 2014/8/29
Y1 - 2014/8/29
N2 - Security and performance are critical goals for distributed systems. The increased design complexity, incomplete expertise of developers, and limited functionality of existing testing tools often result in bugs and vulnerabilities that prevent implementations from achieving their design goals in practice. Many of these bugs, vulnerabilities, and misconfigurations manifest after the code has already been deployed making the debugging process difficult and costly. In this paper, we present Turret, a platform for automatically finding performance attacks in unmodified implementations of distributed systems. Turret does not require the user to provide any information about vulnerabilities and runs the implementation in the same operating system setup as the deployment, with an emulated network. Turret uses a new attack finding algorithm and several optimizations that allow it to find attacks in a matter of minutes. We ran Turret on 5 different distributed system implementations specifically designed to tolerate insider attacks, and found 30 performance attacks, 24 of which were not previously reported to the best of our knowledge.
AB - Security and performance are critical goals for distributed systems. The increased design complexity, incomplete expertise of developers, and limited functionality of existing testing tools often result in bugs and vulnerabilities that prevent implementations from achieving their design goals in practice. Many of these bugs, vulnerabilities, and misconfigurations manifest after the code has already been deployed making the debugging process difficult and costly. In this paper, we present Turret, a platform for automatically finding performance attacks in unmodified implementations of distributed systems. Turret does not require the user to provide any information about vulnerabilities and runs the implementation in the same operating system setup as the deployment, with an emulated network. Turret uses a new attack finding algorithm and several optimizations that allow it to find attacks in a matter of minutes. We ran Turret on 5 different distributed system implementations specifically designed to tolerate insider attacks, and found 30 performance attacks, 24 of which were not previously reported to the best of our knowledge.
KW - automatic attack finding
KW - distributed systems
UR - http://www.scopus.com/inward/record.url?scp=84907732898&partnerID=8YFLogxK
UR - http://www.scopus.com/inward/citedby.url?scp=84907732898&partnerID=8YFLogxK
U2 - 10.1109/ICDCS.2014.73
DO - 10.1109/ICDCS.2014.73
M3 - Conference contribution
AN - SCOPUS:84907732898
T3 - Proceedings - International Conference on Distributed Computing Systems
SP - 660
EP - 669
BT - Proceedings - International Conference on Distributed Computing Systems
PB - Institute of Electrical and Electronics Engineers Inc.
Y2 - 30 June 2014 through 3 July 2014
ER -