Toward Software Diversity in Heterogeneous Networked Systems

Abstract. When there are either design or implementation flaws, a ho-mogeneous architecture is likely to be disrupted entirely by a single at-tack (e.g., a worm) that exploits its vulnerability. Following the surviv-ability through heterogeneity philosophy, we present a novel approach to improving survivability of networked systems by adopting the technique of software diversity. Specifically, we design an efficient algorithm to se-lect and deploy a set of off-the-shelf software to hosts in a networked system, such that the number and types of vulnerabilities presented on one host would be different from that on its neighboring nodes. In this way, we are able to contain a worm in an isolated “island”. This algo-rithm addresses software assignment problem in more complex scenarios by taking into consideration practical constraints, e.g., hosts may have diverse requirements based on different system prerequisites. We evaluate the performance of our algorithm through simulations on both simple and complex system models. The results not only confirm the effectiveness and scalability of our algorithm, but also show its capability in creating moving attack surface. The level of heterogeneity our algorithm can ac-tually create depends on the ratio of the number of installed software to the total number of available software.