The MINESTRONE architecture combining static and dynamic analysis techniques for software security

Angelos D. Keromytis, Salvatore J. Stolfo, Junfeng Yang, Angelos Stavrou, Anup Ghosh, Dawson Engler, Marc Dacier, Matthew Elder, Darrell Kienzle

Research output: Chapter in Book/Report/Conference proceedingConference contribution

5 Citations (Scopus)


We present MINESTRONE, a novel architecture that integrates static analysis, dynamic confinement, and code diversification techniques to enable the identification, mitigation and containment of a large class of software vulnerabilities in third-party software. Our initial focus is on software written in C and C++; however, many of our techniques are equally applicable to binary-only environments (but are not always as efficient or as effective) and for vulnerabilities that are not specific to these languages. Our system seeks to enable the immediate deployment of new software (e.g., a new release of an open-source project) and the protection of already deployed (legacy) software by transparently inserting extensive security instrumentation, while leveraging concurrent program analysis, potentially aided by runtime data gleaned from profiling actual use of the software, to gradually reduce the performance cost of the instrumentation by allowing selective removal or refinement. Artificial diversification techniques are used both as confinement mechanisms and for fault-tolerance purposes. To minimize the performance impact, we are leveraging multicore hardware or (when unavailable) remote servers that enable quick identification of likely compromise. To cover the widest possible range of systems, we require no specific hardware or operating system features, although we intend to take advantage of such features where available to improve both runtime performance and vulnerability coverage.

Original languageEnglish
Title of host publicationProceedings - 1st SysSec Workshop, SysSec 2011
Number of pages4
Publication statusPublished - 2011
Externally publishedYes
Event1st SysSec Workshop, SysSec 2011 - Amsterdam
Duration: 6 Jul 20116 Jul 2011


Other1st SysSec Workshop, SysSec 2011


ASJC Scopus subject areas

  • Control and Systems Engineering

Cite this

Keromytis, A. D., Stolfo, S. J., Yang, J., Stavrou, A., Ghosh, A., Engler, D., Dacier, M., Elder, M., & Kienzle, D. (2011). The MINESTRONE architecture combining static and dynamic analysis techniques for software security. In Proceedings - 1st SysSec Workshop, SysSec 2011 (pp. 53-56). [6092763]