1. SoK: Automated Software Diversity
Per Larsen, Andrei Homescu, Stefan Brunthaler, Michael Franz
University of California, Irvine

2. Abstract
“...systematically study the state-of-the-art in software diversity and highlight fundamental trade-offs between fully automated approaches. We also point to open areas and unresolved challenges. These include “hybrid solutions”, error reporting, patching, and implementation disclosure attacks on diversified software.”

3. Taxonomy of Attacks Information Leaks Side Channel Attacks
Memory Corruption Attacks
Code Injection
Code Reuse
Just-In-Time Attacks
Program Tampering
Reverse Engineering

4. Taxonomy of Defenses Enforcement-based Defenses
Program Integrity Monitors
Diversity-based Defenses
Program Obfuscation

5. What To Diversify Instruction Level Basic Block Level Loop Level
Function Level
Program Level
System Level

7. When To Diversify Implementation Compilation and Linking Installation
Loading
Execution
Updating

8. Security Impact
Entropy – Higher Entropy means less chance of brute force attack being successful
Attack specific code analysis
Logical Arguments
Testing against concrete attacks

9. Performance Impact

10. Unresolved Problems Hybrid Approaches Error Reports and Patches
Implementation Disclosure
Measuring Efficacy
Diversity as a Counter to Side Channel Attacks

11. Conclusion
Pre-distribution approaches are easy to implement, support the widest range of transformations, and can defense against client-side attacks
Post-distribution support legacy and proprietary software, amortize diversification costs, and require no changes to current distribution mechanisms.