The main contribution of this paper is to provide an accurate taxonomy for Persistence techniques, which allows the detection of novel techniques and the identification of appropriate countermeasures. Persistence is a key tactic for advanced offensive cyber operations. The techniques that achieve persistence have been largely analyzed in particular environments, but there is no suitable platform–agnostic model to structure persistence techniques. This lack causes a serious problem in the modeling of activities of advanced threat actors, hindering both their detection and the implementation of countermeasures against their activities. In this paper we analyze previous work in this field and propose a novel taxonomy for persistence techniques based on persistence points, a key concept we introduce in our work as the basis for the proposed taxonomy. Our work will help analysts to identify, classify and detect compromises, significantly reducing the amount of effort needed for these tasks. It follows a logical structure that can be easy to expand and adapt, and it can be directly used in commonly accepted industry standards such as MITRE ATT&CK.

Stack Smashing Protector (SSP), Address-Space Layout Randomization (ASLR) and Non-executable (NX) are techniques for defending systems against buffer overflow attacks but not limited to them. These mechanism are available in modern operating systems like Android, GNU/Linux and Windows. Unfortunately, to keep up with the rapidly evolving landscape of cyber-security it is necessary to reassess the effectiveness of these protection techniques to avoid a false sense of security. This paper assess the effectiveness of these techniques against stack buffer overflow exploitation. Our study indicates that the SSP technique is the most effective against stack buffer overflows. On forking servers, the ASLR technique is almost useless on 32-bit architectures due to the limited entropy provided by the size of the address space. The recently proposed technique Renew SSP, which is an improvement of the well known SSP, outperforms the original SSP in all the cases, it is highly effective against the dangerous byte-for-byte attack and on systems with low secret entropy as x86 and ARM.

The buffer overflow is still an important problem despite the various protection methods developed and widely used on most systems (Stack-Smashing Protector, ASLR and Non-eXecutable). Most of these techniques rely on keeping secret some key information needed by the attackers to build the exploit. Unfortunately, the architecture of most Web servers allows attacker to implement brute force attacks that can be exploited to obtain those secrets by mean of brute force attacks, and eventually break into the server. We propose a modification of the stack-smashing protector (SSP) technique which eliminates brute force attacks against the canary. The technique is not intrusive, and can be applied by just pre-loading a shared library. The overhead is almost negligible. The technique has been tested on several web servers and on a complete GNU/Linux distribution by patching the standard C library. We expect that the strategy presented in this paper will become a standard technique on both desktop and servers.

Task period selection is often used to adjust the workload to the available computational resources. In this paper, we propose a model where each selected period is not restricted to be a natural number, but can be any rational number within a range. Under this generalization, we contribute a period selection algorithm that yields a much smaller hyperperiod than that of previous works: with respect to the largest period, the hyperperiod with integer constraints is exponentially bounded; with rational periods the worst case is only quadratic. By means of an integer approximation at each task activation, we show how our rational period approach can work under system clock granularity; it is thus compatible with scheduling analysis practice and implementation. Our finding has practical applications in several fields of real-time scheduling: lowering complexity in table driven schedulers, reducing search space in model checking analysis, generating synthetic workload for statistical analysis of real-time scheduling algorithms, etc.

In this paper a new task model with periods defined as ranges is proposed with the main goal of drastically reduce the hyperperiod of the task set. The model is focused to be applied in cyclic scheduling, where the length of the major cycle of the plan is determined by the hyperperiod. But it also can be applied in synthetic task sets generation, where having a small hyperperiod reduces complexity and simulation time. A new algorithm, which allows to calculate the minimum hyperperiod of such a set of tasks, is presented. This algorithm calculates the minimum value even with a large number of tasks, where exhaustive search becomes intractable.

Hierarchical scheduling has recently been used to provide temporal isolation to embedded virtualised systems. Response time analysis is a common way to derive a schedulability test for these systems. This paper points out that response time analysis for hierarchical fixed-priority scheduling found in the literature is only exact for tasks of the highest priority domain. For the rest of the tasks is an upper bound. In our work, we provide the exact analysis and we compare it with previously published works.

Nowadays, systems often integrate a variety of applications whose service requirements are heterogeneous. Consequently, systems must be able to concurrently serve applications which rely on different constraints. This raises the problem of the dynamic distribution of the system resources (CPU, memory, network, etc.). Therefore, an integrated Quality of Service (QoS) management is needed so as to efficiently assign resources according to the various application demands. Within this paper, we focus on a dynamic approach of QoS management for memory resource allocation based on the Skip-Over model. We detail our solution and we show how it improves the service of task memory requests while providing them guarantees. Quantitative results using the TLSF allocator have been performed in order to evaluate the memory failure probability with and without memory QoS manager.

Abstract This paper describes the design criteria and implementation details of a dynamic storage allocator for real‐time systems. The main requirements that have to be considered when designing a new allocator are concerned with temporal and spatial constraints. The proposed algorithm, called TLSF (two‐level segregated fit), has an asymptotic constant cost,O(1), maintaining a fast response time (less than 200 processor instructions on a x86 processor) and a low level of memory usage (low fragmentation). TLSF uses two levels of segregated lists to arrange free memory blocks and anincomplete searchpolicy. This policy is implemented with word‐size bitmaps and logical processor instructions. Therefore, TLSF can be categorized as a good‐fit allocator. The incomplete search policy is shown also to be a good policy in terms of fragmentation. The fragmentation caused by TLSF is slightly smaller (better) than that caused by best fit (which is one of the best allocators regarding memory fragmentation). In order to evaluate the proposed allocator, three analyses are presented in this paper. The first one is based on worst‐case scenarios. The second one provides a detailed consideration of the execution cost of the internal operations of the allocator and its fragmentation. The third analysis is a comparison with other well‐known allocators from the temporal (number of cycles and processor instructions) and spatial (fragmentation) points of view. In order to compare them, a task model has been presented. Copyright © 2007 John Wiley & Sons, Ltd.

Real-time systems are often designed using a set of periodic tasks. Task periods are usually set by the system requirements, but deadlines and computation times can be modified in order to improve system performance. Sensitivity analysis in real-time systems has focused on changes in task computation times using fixed priority analysis. Only a few studies deal with the modification of deadlines in dynamic-priority scheduling. The aim of this work is to provide a sensitivity analysis for task deadlines in the context of dynamic-priority, preemptive, uniprocessor scheduling. In this paper, we present a deadline minimization method that computes the shortest deadline of a periodic task. As undertaken in other studies concerning computation times, we also define and calculate the critical scaling factor for task deadlines. Our proposal is evaluated and compared with other works. The deadline minimization proposed strongly reduces jitter and the response time of control tasks, which can lead to a significant improvement in system performance.

Dynamic memory storage has been widely used for years in computer science. However, its use in real-time systems has not been considered as an important issue, and memory management has not receive much consideration, whereas today's real-time applications are often characterized by highly fluctuating memory requirements. In this paper we present an approach to dynamic memory management for real-time systems. In response to application behavior and requests, the underlying memory management system adjusts resources to meet changing demands and user needs. The architectural framework that realizes this approach allows adaptive allocation of memory resources to applications involving both periodic or aperiodic tasks. Simulation results demonstrate the suitability of the proposed mechanism.

Real-time systems are often designed using a set of periodic tasks. Task periods are usually set by the system requirements, but deadlines and computation times can be modified in order to improve system performance. Sensitivity analysis in real-time systems has focused on changes in task computation times using fixed priority analysis. Only a few studies deal with the modification of deadlines in dynamic priority scheduling. The aim of this work is to provide a sensitivity analysis for task deadlines in the context of dynamic-priority, pre-emptive, uniprocessor scheduling. In this paper, we present a deadline minimisation method that achieves the maximum reduction. As undertaken in other studies concerning computation times, we also define and calculate the critical scaling factor for task deadlines. Our proposal is evaluated and compared with other works in terms of jitter. The deadline minimisation can be used to strongly reduce jitter of control tasks, in a real-time control application

The real-time implementation of a controller typically introduces artefacts like delay and jitters that have not been considered at the design stage. As a consequence, the system behaves in a non-periodic manner, and the real performance is degraded with respect to the expected response. This paper proposes a hybrid task model to reduce the impact of the scheduling on the control performance. For a large batch of typical plants, we analyze how sensitive the control system is to jitter when the sampling rate is slow or fast compared to the bandwidth of the system

Feasibility tests for hard real-time systems provide information about the schedulability of a set of tasks. However, this information is a yes or no answer whether the task set achieves the test or not. From the system design point of view, it would be useful to have more information, for example, how much can one vary some task parameters, such as computation time, without jeopardizing the system feasibility. The aim of the work is to provide a method to determine how much a task can increase its computation time, maintaining the system feasibility under a dynamic priority scheduling. This extra time can be determined not only in all the task activations, but in n of a window of m task invocations. This is what we call a window-constrained execution time system. In control applications, this information can be used to execute supervision activities, such as model updating which is not required to be executed in all the periods, or to determine new controller parameters for the current operating conditions. In fault tolerance, this information allows us to recover n faults in m activations.

This paper describes the experience of customizing RT-Linux for its use in embedded real-time control. It describes the system configuration and the issues involved in minimizing Linux for a small embedded system. It introduces the concept of file system profiles to deal with this minimization. Another interesting feature is how to achieve real-time features through the use of RT-Linux Finally, the paper describes the design of a CAN network driver for providing real-time transmission on a RT-Linux system.

The paper addresses the problem of jointly scheduling tasks with both hard and soft real time constraints. We present a new analysis applicable to systems scheduled using a priority preemptive dispatcher, with priorities assigned dynamically according to the EDF policy. Further, we present a new efficient online algorithm (the acceptor algorithm) for servicing aperiodic work load. The acceptor transforms a soft aperiodic task into a hard one by assigning a deadline. Once transformed, aperiodic tasks are handled in exactly the same way as periodic tasks with hard deadlines. The proposed algorithm is shown to be optimal in terms of providing the shortest aperiodic response time among fixed and dynamic priority schedulers. It always guarantees the proper execution of periodic hard tasks. The approach is composed of two parts: an offline analysis and a run time scheduler. The offline algorithm runs in pseudopolynomial time O(mn), where n is the number of hard periodic tasks and m is the hyperperiod/min deadline.