Software diversity


Software diversity is a research field about the comprehension and engineering of diversity in the context of software.

Areas

The different areas of software diversity are discussed in surveys on diversity for fault-tolerance or for security. A recent survey emphasizes on the most recent advances in the field.
The main areas are:
Software can be diversified in most domains:
It is possible to amplify software diversity through automated transformation processes that create synthetic diversity. A "multicompiler" is compiler embedding a diversification engine. A multi-variant execution environment is responsible for selecting the variant to execute and compare the output.
Fred Cohen was among the very early promoters of such an approach. He proposed a series of rewriting and code reordering transformations that aim at producing massive quantities of different versions of operating systems functions. These ideas have been developed over the years and have led to the construction of integrated obfuscation schemes to protect key functions in large software systems.
Another approach to increase software diversity of protection consists in adding randomness in certain core processes, such as memory loading. Randomness implies that all versions of the same program run differently from each other, which in turn creates a diversity of program behaviors. This idea was initially proposed and experimented by Stephanie Forrest and her colleagues.
Recent work on automatic software diversity explores different forms of program transformations that slightly vary the behavior of programs. The goal is to evolve one program into a population of diverse programs that all provide similar services to users, but with a different code. This diversity of code enhances the protection of users against one single attack that could crash all programs at the same time.
Transformation operators include:
As exploring the space of diverse programs is computationally expensive, finding efficient strategies to conduct this exploration is important. To do so, recent work studies plastic regions in software code: plastic regions are those parts is code more susceptible to be changed without disrupting the functionalities provided by the piece of software. These regions can be specifically targeted by automatic code transformation to create artificial diversity in existing software.