Document Open Access Logo

DART: A Real-Time Address-Randomization Defense with Predictable Timing

Authors Patrick Dobranowski , Owen Rice, Ryan Burrow , Nathan Burow , Bryan C. Ward

PDF

File

Thumbnail PDF
PDF
LIPIcs.ECRTS.2026.10.pdf
  • Filesize: 1.93 MB
  • 26 pages

Document Identifiers

Subject Classification

ACM Subject Classification
  • Computer systems organization → Real-time systems
  • Security and privacy → Systems security
  • Computer systems organization → Embedded and cyber-physical systems
  • Software and its engineering → Real-time systems software
Keywords
  • real-time systems
  • address-space layout randomization
  • code randomization
  • worst-case execution time
  • cache coloring
  • embedded systems security

Metrics

Abstract

Embedded and real-time systems are increasingly connected and deployed in safety and mission-critical environments, making them a persistent target for attacks capable of compromising industrial control systems and other embedded devices. At the same time, these devices often have strict real-time requirements that require predictable worst-case performance. However, many strong and widely deployed software-security defenses are designed and evaluated with respect to average-case performance, a more important metric in enterprise systems. The worst-case performance of such defenses is not well understood and indeed such defenses are less commonly deployed in embedded systems. In particular, one class of commonly deployed defenses in enterprise systems is code randomization, which protects a system by altering the layout of the virtual address space so that attackers cannot easily target specific parts of a vulnerable application, but randomization is often seen as fundamentally counter to real-time predictability.
This paper presents DART, a real-time address randomization defense with page-level randomization. DART randomizes code in the virtual address space at page-level granularity under placement constraints that move cache behavior from a runtime OS-allocator property to a statically encoded binary property, allowing for timing analysis. An analysis of DART’s timing behavior on a real-time testbed demonstrates how the design makes layout-induced timing variance bounded and characterizable across the space of layouts produced, supporting predictable execution-time analysis. The resulting layout search space is then analyzed, and a closed-form expression for the randomization entropy induced by DART is derived. Evaluation results across TACLeBench binaries show increased combinatorial entropy with modest numbers of virtual memory pages per cache color, providing a suitable defense that outperforms traditional virtual-memory protections for attacks such as partial-pointer overwriting or more broadly control-flow hijacking.

Cite As Get BibTex

Patrick Dobranowski, Owen Rice, Ryan Burrow, Nathan Burow, and Bryan C. Ward. DART: A Real-Time Address-Randomization Defense with Predictable Timing. In 38th European Conference on Real-Time Systems (ECRTS 2026). Leibniz International Proceedings in Informatics (LIPIcs), Volume 375, pp. 10:1-10:26, Schloss Dagstuhl – Leibniz-Zentrum für Informatik (2026) https://doi.org/10.4230/LIPIcs.ECRTS.2026.10

Author Details

Patrick Dobranowski
  • Vanderbilt University, Nashville, TN, USA
Owen Rice
  • Vanderbilt University, Nashville, TN, USA
Ryan Burrow
  • MIT Lincoln Laboratory, Lexington, MA, USA
Nathan Burow
  • MIT Lincoln Laboratory, Lexington, MA, USA
Bryan C. Ward
  • Vanderbilt University, Nashville, TN, USA

Supplementary Materials

References

  1. Martín Abadi, Mihai Budiu, Ulfar Erlingsson, and Jay Ligatti. Control-flow integrity. In Proceedings of the 12th ACM conference on Computer and communications security, pages 340-353. ACM, 2005. Google Scholar
  2. Geir Agnarsson. On chordal graphs and their chromatic polynomials. MATHEMATICA SCANDINAVICA, 93(2):240-246, December 2003. URL: https://doi.org/10.7146/math.scand.a-14421.
  3. Manos Antonakakis, Tim April, Michael Bailey, Matt Bernhard, Elie Bursztein, Jaime Cochran, Zakir Durumeric, J. Alex Halderman, Luca Invernizzi, Michalis Kallitsis, Deepak Kumar, Chaz Lever, Zane Ma, Joshua Mason, Damian Menscher, Chad Seaman, Nick Sullivan, Kurt Thomas, and Yi Zhou. Understanding the mirai botnet. In 26th USENIX Security Symposium (USENIX Security 17), pages 1093-1110. USENIX Association, August 2017. URL: https://www.usenix.org/conference/usenixsecurity17/technical-sessions/presentation/antonakakis.
  4. Cl'ement Ballabriga, Hugues Cass'e, Christine Rochange, and Pascal Sainrat. OTAWA: An open toolbox for adaptive WCET analysis. In IFIP Workshop on Software Technologies for Embedded and Ubiquitous Systems (SEUS), pages 35-46. Springer, 2010. URL: https://doi.org/10.1007/978-3-642-16256-5_6.
  5. David Bigelow, Thomas Hobson, Robert Rudd, William Streilein, and Hamed Okhravi. Timely rerandomization for mitigating memory disclosures. In ACM Conference on Computer and Communications Security, CCS, 2015. Google Scholar
  6. Sergey Bratus, Michael E Locasto, Meredith L Patterson, Len Sassaman, and Anna Shubina. Exploit programming: From buffer overflows to weird machines and theory of computation. USENIX; login, 36(6):13-21, 2011. URL: https://www.usenix.org/publications/login/december-2011-volume-36-number-6/exploit-programming-buffer-overflows-weird.
  7. Nathan Burow, Ryan Burrow, Roger Khazan, Howard Shrobe, and Bryan C Ward. Moving target defense considerations in real-time safety-and mission-critical systems. In Proceedings of the 7th ACM Workshop on Moving Target Defense, pages 81-89, 2020. URL: https://doi.org/10.1145/3411496.3421224.
  8. Nicholas Carlini and David Wagner. ROP is still dangerous: Breaking modern defenses. In 23rd USENIX Security Symposium, USENIX Sec, 2014. Google Scholar
  9. Francisco J. Cazorla, Leonidas Kosmidis, Enrico Mezzetti, Carles Hernandez, Jaume Abella, and Tullio Vardanega. Probabilistic worst-case timing analysis: Taxonomy and comprehensive survey. ACM Computing Surveys, 52(1):14:1-14:35, 2019. URL: https://doi.org/10.1145/3301283.
  10. Francisco J. Cazorla, Eduardo Qui nones, Tullio Vardanega, Liliana Cucu, Benoit Triquet, Guillem Bernat, Emery Berger, Jaume Abella, Franck Wartel, Michael Houston, Luca Santinelli, Leonidas Kosmidis, Code Lo, and Dorin Maxim. PROARTIS: Probabilistically analyzable real-time systems. ACM Transactions on Embedded Computing Systems (TECS), 12(2s):94:1-94:26, 2013. URL: https://doi.org/10.1145/2465787.2465796.
  11. S. Checkoway, L. Davi, A. Dmitrienko, A.R. Sadeghi, H. Shacham, and M. Winandy. Return-oriented programming without returns. In ACM Conference on Computer and Communications Security, CCS, 2010. Google Scholar
  12. A. Clements, N. Almakhdhub, K. Saab, P. Srivastava, J. Koo, S. Bagchi, and M. Payer. Protecting bare-metal embedded systems with privilege overlays. In S&P '17, 2017. Google Scholar
  13. TIS Committee et al. Tool interface standard (tis) executable and linking format (elf) specification version 1.2, 1995. Google Scholar
  14. Mauro Conti, Stephen Crane, Tommaso Frassetto, Andrei Homescu, Georg Koppen, Per Larsen, Christopher Liebchen, Mike Perry, and Ahmad-Reza Sadeghi. Selfrando: Securing the tor browser against de-anonymization exploits. Proceedings on Privacy Enhancing Technologies, 2016(4):454-469, 2016. URL: https://doi.org/10.1515/POPETS-2016-0050.
  15. Fabrice Cros, Leonidas Kosmidis, Franck Wartel, David Morales, Jaume Abella, Ian Broster, and Francisco J. Cazorla. Dynamic software randomisation: Lessons learned from an aerospace case study. In Design, Automation & Test in Europe Conference (DATE), pages 103-108, 2017. URL: https://doi.org/10.23919/DATE.2017.7926966.
  16. Charlie Curtsinger and Emery D. Berger. STABILIZER: Statistically sound performance evaluation. In ACM International Conference on Architectural Support for Programming Languages and Operating Systems (ASPLOS). ACM, 2013. URL: https://doi.org/10.1145/2451116.2451141.
  17. Alessandro Di Pinto, Younes Dragoni, and Andrea Carcano. TRITON: The first ICS cyber attack on safety instrument systems. In Proc. Black Hat USA, pages 1-26, 2018. Google Scholar
  18. G. A. Dirac. On rigid circuit graphs. Abhandlungen aus dem Mathematischen Seminar der Universität Hamburg, 25(1-2):71-76, 1961. Google Scholar
  19. Joachim Fellmuth, Thomas Göthel, and Sabine Glesner. Instruction caches in static WCET analysis of artificially diversified software. In 30th Euromicro Conference on Real-Time Systems (ECRTS 2018). Schloss Dagstuhl - Leibniz-Zentrum für Informatik, 2018. URL: https://doi.org/10.4230/LIPIcs.ECRTS.2018.21.
  20. Christian Ferdinand and Reinhold Heckmann. ait: Worst-case execution time prediction by static program analysis. In Building the Information Society, pages 377-383. Springer, 2004. URL: https://doi.org/10.1007/978-1-4020-8157-6_29.
  21. Delbert Ray Fulkerson and Oliver A. Gross. Incidence matrices and interval graphs. Pacific Journal of Mathematics, 15(3):835-855, 1965. URL: https://doi.org/10.2140/pjm.1965.15.835.
  22. Dan Goodin. That time a patient’s heart procedure was interrupted by a virus scan. Ars Technica, May 2016. URL: https://arstechnica.com/information-technology/2016/05/that-time-a-patients-heart-procedure-was-interrupted-by-a-virus-scan/.
  23. Giovani Gracioli, Ahmed Alhammad, Renato Mancuso, Antônio Augusto Fröhlich, and Rodolfo Pellizzoni. A survey on cache management mechanisms for real-time embedded systems. ACM Computing Surveys (CSUR), 48(2):1-36, 2015. URL: https://doi.org/10.1145/2830555.
  24. Enes Göktas, Benjamin Kollenda, Philipp Koppe, Erik Bosman, Georgios Portokalidis, Thorsten Holz, Herbert Bos, and Cristiano Giuffrida. Position-independent code reuse: On the effectiveness of aslr in the absence of information disclosure. In 2018 IEEE European Symposium on Security and Privacy (EuroS&P), pages 227-242, 2018. URL: https://doi.org/10.1109/EuroSP.2018.00024.
  25. J. Hiser, A. Nguyen, M. Co, M. Hall, and J.W. Davidson. ILR: Where'd my gadgets go. In 33rd IEEE Symposium on Security and Privacy, S&P, 2012. Google Scholar
  26. Andrei Homescu, Michael Stewart, Per Larsen, Stefan Brunthaler, and Michael Franz. Microgadgets: size does matter in turing-complete return-oriented programming. In Proceedings of the 6th USENIX conference on Offensive Technologies, pages 7-7. USENIX Association, 2012. Google Scholar
  27. Todd Jackson, Babak Salamat, Andrei Homescu, Karthikeyan Manivannan, Gregor Wagner, Andreas Gal, Stefan Brunthaler, Christian Wimmer, and Michael Franz. Compiler-generated software diversity. In Moving Target Defense, pages 77-98. Springer, 2011. URL: https://doi.org/10.1007/978-1-4614-0977-9_4.
  28. Namhoon Kim, Bryan C Ward, Micaiah Chisholm, James H Anderson, and F Donelson Smith. Attacking the one-out-of-m multicore problem by combining hardware management with mixed-criticality provisioning. Real-Time Systems, 53(5):709-759, 2017. URL: https://doi.org/10.1007/S11241-017-9272-9.
  29. Hyungjoon Koo, Yaohui Chen, Long Lu, Vasileios P Kemerlis, and Michalis Polychronakis. Compiler-assisted code randomization. In 2018 IEEE Symposium on Security and Privacy (SP), pages 461-477. IEEE, 2018. URL: https://doi.org/10.1109/SP.2018.00029.
  30. Leonidas Kosmidis, Jaume Abella, Eduardo Qui nones, and Francisco J. Cazorla. A cache design for probabilistically analysable real-time systems. In Design, Automation & Test in Europe Conference (DATE), pages 513-518, 2013. Google Scholar
  31. Leonidas Kosmidis, Charlie Curtsinger, Eduardo Qui nones, Jaume Abella, Emery D. Berger, and Francisco J. Cazorla. Probabilistic timing analysis on conventional cache designs. In Design, Automation & Test in Europe Conference (DATE), pages 603-606, 2013. Google Scholar
  32. Leonidas Kosmidis, Roberto Vargas, David Morales, Eduardo Qui nones, Jaume Abella, and Francisco J. Cazorla. TASA: Toolchain-agnostic static software randomisation for critical real-time systems. In IEEE/ACM International Conference on Computer-Aided Design (ICCAD). ACM, 2016. Google Scholar
  33. Per Larsen, Andrei Homescu, Stefan Brunthaler, and Michael Franz. SoK: Automated software diversity. In 2014 IEEE Symposium on Security and Privacy, pages 276-291. IEEE, 2014. URL: https://doi.org/10.1109/SP.2014.25.
  34. C. Lekkeikerker and J. Boland. Representation of a finite graph by a set of intervals on the real line. Fundamenta Mathematicae, 51(1):45-64, 1962. URL: http://eudml.org/doc/213681.
  35. Bill Mahoney, Philip Sigillito, Jeff Smolinski, Todd McDonald, and George Grispos. Analyzing the performance of block-splitting in llvm fingerprinting. In International Conference on Cyber Warfare and Security, pages 176-184. ACI, 2022. URL: https://doi.org/10.34190/iccws.17.1.39.
  36. Renato Mancuso, Roman Dudko, Emiliano Betti, Marco Cesati, Marco Caccamo, and Rodolfo Pellizzoni. Real-time cache management framework for multi-core architectures. In 2013 IEEE 19th Real-Time and Embedded Technology and Applications Symposium (RTAS), pages 45-54. IEEE, 2013. URL: https://doi.org/10.1109/RTAS.2013.6531078.
  37. Microsoft. A detailed description of the data execution prevention (dep) feature in windows xp service pack 2, windows xp tablet pc edition 2005, and windows server 2003. Online, September 2006. URL: http://support.microsoft.com/kb/875352/en-us.
  38. Charlie Miller and Chris Valasek. Remote exploitation of an unaltered passenger vehicle. Black Hat USA, 2015. Google Scholar
  39. Santosh Nagarakatte, Jianzhou Zhao, Milo M.K. Martin, and Steve Zdancewic. SoftBound: Highly compatible and complete spatial memory safety for C. In ACM Conference on Programming Language Design and Implementation, PLDI, 2009. Google Scholar
  40. OpenBSD. Openbsd 3.3, 2003. Google Scholar
  41. Ronald C. Read. An introduction to chromatic polynomials. Journal of Combinatorial Theory, 4(1):52-71, 1968. URL: https://doi.org/10.1016/S0021-9800(68)80087-0.
  42. Donald J. Rose, R. Endre Tarjan, and George S. Lueker. Algorithmic aspects of vertex elimination on graphs. SIAM Journal on Computing, 5(2):266-283, 1976. URL: https://doi.org/10.1137/0205021.
  43. Felix Schuster, Thomas Tendyck, Christopher Liebchen, Lucas Davi, Ahmad-Reza Sadeghi, and Thorsten Holz. Counterfeit object-oriented programming: On the difficulty of preventing code reuse attacks in C++ applications. In 36th IEEE Symposium on Security and Privacy, S&P, 2015. Google Scholar
  44. Konstantin Serebryany, Derek Bruening, Alexander Potapenko, and Dmitriy Vyukov. Addresssanitizer: A fast address sanity checker. In USENIX Annual Technical Conference, pages 309-318, 2012. URL: https://www.usenix.org/conference/atc12/technical-sessions/presentation/serebryany.
  45. Hovav Shacham. The geometry of innocent flesh on the bone: Return-into-libc without function calls (on the x86). In ACM Conference on Computer and Communications Security, CCS, 2007. Google Scholar
  46. Jiameng Shi, Le Guan, Wenqiang Li, Dayou Zhang, Ping Chen, and Ning Zhang. HARM: Hardware-assisted continuous re-randomization for microcontrollers. In 2022 IEEE 7th European Symposium on Security and Privacy (EuroS&P), pages 520-536. IEEE, 2022. URL: https://doi.org/10.1109/EUROSP53844.2022.00039.
  47. Dokyung Song, Julian Lettner, Prabhu Rajasekaran, Yeoul Na, Stijn Volckaert, Per Larsen, and Michael Franz. Sok: sanitizing for security. In 2019 IEEE Symposium on Security and Privacy (SP), pages 1275-1295. IEEE, 2019. URL: https://doi.org/10.1109/SP.2019.00010.
  48. Laszlo Szekeres, Mathias Payer, Tao Wei, and Dawn Song. Sok: Eternal war in memory. In Proc. of IEEE Symposium on Security and Privacy, 2013. Google Scholar
  49. PaX Team. PaX address space layout randomization (aslr), 2003. URL: ttp://pax.grsecurity.net/docs/aslr.txt.
  50. United States Department of Homeland Security. ICS advisory (ICSA-21-119-04), 2021. URL: https://us-cert.cisa.gov/ics/advisories/icsa-21-119-04.
  51. Viasat, Inc. Ka-sat network cyber attack overview. https://www.viasat.com/perspectives/corporate/2022/ka-sat-network-cyber-attack-overview/, 2022. Accessed: 2025-03-30.
  52. Bryan C. Ward, Steven R. Gomez, Richard W. Skowyra, D. Bigelow, Jason N. Martin, James W. Landry, and Hamed Okhravi. Survey of cyber moving targets second edition. Technical Report 1228, MIT Lincoln Laboratory, January 2018. Google Scholar
  53. Bryan C Ward, Jonathan L Herman, Christopher J Kenna, and James H Anderson. Making shared caches more predictable on multicore platforms. In 2013 25th Euromicro Conference on Real-Time Systems, pages 157-167. IEEE, 2013. Google Scholar
  54. Bryan C Ward, Richard Skowyra, Chad Spensky, Jason Martin, and Hamed Okhravi. The leakage-resilience dilemma. In European Symposium on Research in Computer Security, pages 87-106. Springer, 2019. URL: https://doi.org/10.1007/978-3-030-29959-0_5.
  55. Meng Xu, Linh Thi, Xuan Phan, Hyon-Young Choi, and Insup Lee. vCAT: Dynamic cache management using cat virtualization. In 2017 IEEE Real-Time and Embedded Technology and Applications Symposium (RTAS), pages 211-222. IEEE, 2017. Google Scholar
  56. Ruotong Yu, Francesca Del Nin, Yuchen Zhang, Shan Huang, Pallavi Kaliyar, Sarah Zakto, Mauro Conti, Georgios Portokalidis, and Jun Xu. Building embedded systems like it’s 1996. Network and Distributed Systems Security (NDSS) Symposium, 2022. Google Scholar
Any Issues?
X

Feedback on the Current Page

CAPTCHA

Thanks for your feedback!

Feedback submitted to Dagstuhl Publishing

Could not send message

Please try again later or send an E-mail
© 2023-2026 Schloss Dagstuhl – LZI GmbH Schloss Dagstuhl – LZI GmbH About DROPS Imprint Privacy Contact