Article - control_flow_integrity_on_llvm ir - fontaine , chifflier , coudray_esfrDAI.pdf (visité le 18/02/2016).

[28] Crispan COWAN et al. « StackGuard : Automatic Adaptive Detection and Prevention of Buffer-Overflow Attacks. » In : Usenix Security . T. 98. 1998, p. 63–78. url : https://www.usenix.org/publications/library/proceedings/sec98/ full_papers/cowan/cowan.pdf (visité le 18/02/2016).

[29] Joan DAEMEN et Vincent RIJMEN. The design of Rijndael : AES-the advanced encryption standard. Springer Science & Business Media, 2013.

[30] Lucas DAVI, Ahmad-Reza SADEGHI et Marcel WINANDY. « ROPdefender : A detection tool to defend against return-oriented programming attacks ». In : *Proceedings of the 6th ACM Symposium on Information, Computer and Communications Security*. ACM. 2011, p. 40–51.

[31] Lucas DAVI et al. « Stitching the Gadgets : On the Ineffectiveness of Coarse-Grained Control-Flow Integrity Protection ». In : 2014, p. 401–416. ISBN : 978-1-931971-15-7. URL : https://www.usenix.org/conference/usenixsecurity14/ technical-sessions/presentation/davi (visité le 18/02/2016).

[32] Colin DE LA HIGUERA. « Current Trends in Grammatical Inference ». en. In : *Advances in Pattern Recognition*. Sous la dir. de Gerhard Goos et al. T. 1876. Berlin, Heidelberg : Springer Berlin Heidelberg, 2000, p. 28–31. ISBN : 978-3-540-67946-2 978-3-540-44522-7. DOI : 10.1007/3-540-44522-6_3. URL : http://link.springer.com/10.1007/3-540-44522-6_3 (visité le 24/09/2018).

[33] Bertrand Daniel DUNAY, Frederick E PETRY et Bill P BUCKLES. « Regular language induction with genetic programming ». In : *Evolutionary Computation, 1994*. IEEE World Congress on Computational Intelligence., Proceedings of the First IEEE Conference on. IEEE. 1994, p. 396–400.

[34] Pierre DUPONT. « Incremental regular inference ». en. In : *Grammatical Inter- ference : Learning Syntax from Sentences*. Lecture Notes in Computer Science. Springer, Berlin, Heidelberg, sept. 1996, p. 222–237. ISBN : 978-3-540-61778-5 978-3-540-70678-6. DOI : 10.1007/BFb0033357. URL : https://link.springer. com/chapter/10.1007/BFb0033357 (visité le 09/03/2018).

[35] Simon DUQUENNOY, Gilles GRIMAUD et Jean-Jacques VANDEWALLE. « Smews : Smart and mobile embedded web server ». In : *Complex, Intelligent and Software Intensive Systems, 2009*. CISIS’09. International Conference on. IEEE. 2009, p. 571–576.

[36] Isaac EVANS et al. « Control Jujutsu : On the Weaknesses of Fine-Grained Control Flow Integrity ». In : *Proceedings of the 22Nd ACM SIGSAC Conference on Computer and Communications Security*. CCS ’15. New York, NY, USA : ACM, 2015, p. 901–913. ISBN : 978-1-4503-3832-5. DOI : 10.1145/2810103.2813646. URL : http://doi.acm.org/10.1145/2810103.2813646 (visité le 18/02/2016).

[37] J FENLASON et R STALLMAN. « GNU gprof : The GNU profiler. Free Software Foundation ». In : *Inc*. 52pp (2000).

[38] Henning FERNAU. « Learning XML Grammars ». In : *Machine Learning and Data Mining in Pattern Recognition*. Sous la dir. de G. Goos et al. T. 2123. Berlin, Heidelberg : Springer Berlin Heidelberg, 2001, p. 73–87. ISBN : 978-3-540-42359-1 978-3-540-44596-8. DOI : 10.1007/3-540-44596-X_7. URL : http://link.springer.com/10.1007/3-540-44596-X_7 (visité le 09/03/2018).

[39] Aurélien FRANCILLON, Daniele PERITO et Claude CASTELLUCCIA. « Defending Embedded Systems Against Control Flow Attacks ». In : *Proceedings of the First ACM Workshop on Secure Execution of Untrusted Code*. SecuCode ’09. New York, NY, USA : ACM, 2009, p. 19–26. ISBN : 978-1-60558-782-0. DOI : 10.1145/1655077.
1655083. URL: http://doi.acm.org/10.1145/1655077.1655083 (visité le 18/02/2016).

[40] Torsten FRENZEL et al. « Arm trustzone as a virtualization technique in embedded systems ». In : *Proceedings of Twelfth Real-Time Linux Workshop, Nairobi, Kenya*. 2010, p. 29–42.

[41] P. GARCÍA, A. CANO et J. RUIZ. « A Comparative Study of Two Algorithms for Automata Identification ». en. In : *Grammatical Inference : Algorithms and Applications*. Lecture Notes in Computer Science. Springer, Berlin, Heidelberg, sept. 2000, p. 115–126. ISBN: 978-3-540-41011-9 978-3-540-45257-7. DOI: 10.1007/978-3-540-45257-7_10. URL: https://link.springer.com/chapter/10.1007/978-3-540-45257-7_10 (visité le 09/03/2018).

[42] Gartner Says 8.4 Billion Connected "Things" Will Be in Use in 2017. https://www.gartner.com/en/newsroom/press-releases/2017-02-07-gartner-says-8-billion-connected-things-will-be-in-use-in-2017-up-31-percent-from-2016.

[43] Xinyang GE et al. « Fine-Grained Control-Flow Integrity for Kernel Software ». In :(). URL: http://www.cse.psu.edu/~xxg113/eurosp16.pdf (visité le 18/02/2016).

[44] C Lee GILES et al. « Learning and extracting finite state automata with second-order recurrent neural networks ». In : *Neural Computation* 4.3 (1992), p. 393–405.

[45] Patrice GODEFROID, Adam KIEZUN et Michael Y LEVIN. « Grammar-based white-box fuzzing ». In : *ACM Sigplan Notices*. T. 43. 6. ACM. 2008, p. 206–215.

[46] Patrice GODEFROID, Michael Y LEVIN et David MOLNAR. « SAGE : whitebox fuzzing for security testing ». In : *Queue* 10.1 (2012), p. 20.

[47] E. Mark GOLD. « Language identification in the limit ». In : *Information and control* 10.5 (1967), p. 447–474.

[48] grsecurity. URL: https://grsecurity.net/rap_faq.php (visité le 13/10/2018).

[49] Istvan HALLER et al. « Dowsing for overflows : a guided fuzzer to find buffer boundary violations. » In : *USENIX Security Symposium*. 2013, p. 49–64.

[50] William H. HAWKINS, Jason D. HISER et Jack W. DAVIDSON. « Dynamic Canary Randomization for Improved Software Security ». In : *Proceedings of the 11th Annual Cyber and Information Security Research Conference*. CISRC '16. New York, NY, USA : ACM, 2016, 9:1–9:7. ISBN: 978-1-4503-3752-6. DOI: 10.1145/2897795.2897803. URL: http://doi.acm.org/10.1145/2897795.2897803 (visité le 13/10/2018).

[51] HP Study Reveals 70 Percent of Internet of Things Devices Vulnerable to Attack. https://www8.hp.com/us/en/hp-news/press-release.html?id=1744676.

[52] Hong Hu et al. « Data-Oriented Programming : On the Expressiveness of Non-Control Data Attacks ». In : (2016). URL: http://www.ieee-security.org/TC/SP2016/papers/0824a969.pdf (visité le 13/07/2016).

[53] Faizan JAVED et al. « Context-free grammar induction using genetic programming ». In : *Proceedings of the 42nd annual Southeast regional conference*. ACM. 2004, p. 404–405.

[54] Karthick JAYARAMAN et al. « jFuzz : A concolic whitebox fuzzer for Java ». In : (2009).

[55] A. KANUPARTHI, J. RAJENDRAN et R. KARRI. « Controlling your control flow graph ». In : 2016 IEEE International Symposium on Hardware Oriented Security and Trust (HOST). 2016, p. 43–48. DOI: 10.1109/HST.2016.7495554.
[56] SOO-YOUNG KIM et GYUNGHO LEE. « Monitoring Control Flow History To Detect Code Reuse Attacks ». In :(). URL : http://www.wseas.us/library/conferences/2015/Seoul/ACE/ACE-14.pdf (visité le 18/02/2016).

[57] Dan KLEIN et Christopher D MANNING. « Natural language grammar induction using a constituent-context model ». In : *Advances in neural information processing systems*. 2002, p. 35–42.

[58] Emin Erkan KORKMAZ et Göktürk ÜÇOLUK. « Genetic programming for grammar induction ». In : (2001).

[59] Volodymyr KUZNETSOV et al. « Code-Pointer Integrity. » In :

[60] C. LATTNER et V. ADVE. « LLVM : a compilation framework for lifelong program analysis transformation ». In : *International Symposium on Code Generation and Optimization*, 2004. CGO 2004. Mar. 2004, p. 75–86. DOI : 10.1109/CGO.2004.1281665.

[61] Chris LATTNER. « LLVM and Clang : Next generation compiler technology ». In : *The BSD conference*. 2008, p. 1–2.

[62] Valentin LEFILS, Gilles GRIMAUD et Julien IGUCHI-CARTIGNY. « EE-CFI : Externalized Control Flow Integrity for Embedded Devices ». In : *Innovative Mobile and Internet Services in Ubiquitous Computing* (2018).

[63] Valentin LEFILS, Gilles GRIMAUD et Julien IGUCHI-CARTIGNY. « Model induction for better control flow integrity ». In : *To be published* (2018).

[64] Kyung-suk LHEE et Steve CHAPIN. « Buffer Overflow and Format String Overflow Vulnerabilities ». In : *Electrical Engineering and Computer Science* (jan. 2002). URL : http://surface.syr.edu/eecs/96.

[65] Zhuowei LI, A. DAS et Jianying ZHOU. « Theoretical basis for intrusion detection ». In : *Information Assurance Workshop, 2005. IAW '05. Proceedings from the Sixth Annual IEEE SMC*. Juin 2005, p. 184–192. DOI : 10.1109/IAW.2005.1495951.

[66] Kangjie LU et al. « How to Make ASLR Win the Clone Wars : Runtime Randomization ». In : (2016). URL : http://www.cc.gatech.edu/~klu38/publications/runtimeaslr-ndss16.pdf (visité le 18/02/2016).

[67] Ali Jose MASHTIZADEH et al. « CCFI : Cryptographically Enforced Control Flow Integrity ». In : *Proceedings of the 22Nd ACM SIGSAC Conference on Computer and Communications Security*. CCS '15. New York, NY, USA : ACM, 2015, p. 941–951. ISBN : 978-1-4503-3832-5. DOI : 10.1145/2810103.2813676. URL : http://doi.acm.org/10.1145/2810103.2813676 (visité le 18/02/2016).

[68] ARM MBED. « Welcome to Mbed ». In : *Disponible en ligne : https://mbed.org* (2017).

[69] Scott MILLER et al. « Hidden understanding models of natural language ». In : *Proceedings of the 32nd annual meeting on Association for Computational Linguistics*. Association for Computational Linguistics. 1994, p. 25–32.

[70] Vishwath MOHAN et al. « Opaque Control-Flow Integrity ». en. In : *Internet Society, 2015*. ISBN : 978-1-891562-38-9. DOI : 10.14722/ndss.2015.23271. URL : http://www.internetsociety.org/doc/opaque-control-flow-integrity (visité le 18/02/2016).

[71] Tilo MÜLLER. « ASLR smack & laugh reference ». In : *Seminar on Advanced Exploitation Techniques*. 2008. URL : https://www.cs.umd.edu/class/fall2015/cmsc414-0201/papers/aslr-smack-laugh.pdf (visité le 13/06/2016).

[72] Santosh NAGARAKATTE et al. « SoftBound : Highly compatible and complete spatial memory safety for C ». In : *ACM Sigplan Notices* 44.6 (2009), p. 245–258. URL : http://dl.acm.org/citation.cfm?id=1542504 (visité le 13/07/2016).
[73] Nicholas NETHERCOTE et Julian SEWARD. « Valgrind : a framework for heavy-weight dynamic binary instrumentation ». In : *ACM Sigplan notices*. T. 42. 6. ACM. 2007, p. 89-100.

[74] Ben NIU. « Practical Control-Flow Integrity ». In : (2016). URL: http://www.cse.psu.edu/~gxt29/paper/BEN_NIU_Dissertation.pdf (visité le 13/07/2016).

[75] Ben NIU et Gang TAN. « Modular control-flow integrity ». In : *ACM SIGPLAN Notices* 49.6 (2014), p. 577-587.

[76] Ben NIU et Gang TAN. « Per-Input Control-Flow Integrity ». In : *Proceedings of the 22Nd ACM SIGSAC Conference on Computer and Communications Security*. CCS '15. New York, NY, USA : ACM, 2015, p. 914-926. ISBN : 978-1-4503-3832-5. DOI : 10.1145/2810103.2813644. URL : http://doi.acm.org/10.1145/2810103.2813644 (visité le 18/02/2016).

[77] Aleph ONE. « Smashing the stack for fun and profit ». In : *Phrack magazine* 7.49 (1996), p. 14-16. URL: http://www1.telhai.ac.il/sources/private/academic/cs/557/2659/Materials/Smashing.pdf (visité le 18/08/2016).

[78] Ulziibayar OTGONBAATAR. « Evaluating Modern Defenses Against Control Flow Hijacking ». Thèse de doct. MIT Lincoln Laboratory, 2015. URL : http://people.csail.mit.edu/hes/ROP/Publications/ulzi-thesis.pdf (visité le 18/02/2016).

[79] Vasilis PAPPAS. « kBouncr : Efficient and transparent ROP mitigation ». In : *Apr* 1 (2012), p. 1-2. URL : http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.383.261&rep=rep1&type=pdf (visité le 18/02/2016).

[80] Rajesh PAREKH et Vasant HONAVAR. « Learning DFA from simple examples ». en. In : *Algorithmic Learning Theory*. Lecture Notes in Computer Science. Springer, Berlin, Heidelberg, oct. 1997, p. 116-131. ISBN : 978-3-540-63577-2 978-3-540-69602-5. DOI : 10.1007/3-540-63577-7_39. URL : https://link.springer.com/chapter/10.1007/3-540-63577-7_39 (visité le 09/03/2018).

[81] Mathias PAYER et Thomas R. GROSS. « String Oriented Programming : When ASLR is Not Enough ». In : *Proceedings of the 2Nd ACM SIGPLAN Program Protection and Reverse Engineering Workshop*. PPREW '13. New York, NY, USA : ACM, 2013, 2:1-2:9. ISBN : 978-1-4503-1857-0. DOI : 10.1145/2430553.2430555. URL : http://doi.acm.org/10.1145/2430553.2430555 (visité le 18/02/2016).

[82] Aravind PRAKASH et Heng YIN. « Defeating ROP Through Denial of Stack Pi-vot ». In : *Proceedings of the 31st Annual Computer Security Applications Conference*. ACSAC 2015. New York, NY, USA : ACM, 2015, p. 111-120. ISBN : 978-1-4503-3682-6. DOI : 10.1145/2818000.2818023. URL : http://doi.acm.org/10.1145/2818000.2818023 (visité le 18/02/2016).

[83] Pengfei QIU et al. « Physical unclonable functions-based linear encryption against code reuse attacks ». en. In : *ACM Press*, 2016, p. 1-6. ISBN : 978-1-4503-4236-0. DOI : 10.1145/2897937.2898061. URL : http://dl.acm.org/citation.cfm?id=2897937.2898061 (visité le 13/07/2016).

[84] Ganesan RAMALINGAM. « The undecidability of aliasing ». In : *ACM Transactions on Programming Languages and Systems (TOPLAS)* 16.5 (1994), p. 1467-1471. URL : http://dl.acm.org/citation.cfm?id=186041 (visité le 13/07/2016).

[85] Will REESE. « Nginx : the high-performance web server and reverse proxy ». In : *Linux Journal* 2008.173 (2008), p. 2.

[86] Andrs RIANCHO. « w3af-web application attack and audit framework ». In : *World Wide Web electronic publication* 21 (2011).

[87] Ryan ROEMER et al. « Return-Oriented Programming : Systems, Languages, and Applications ». In : *ACM Trans. Inf. Syst. Secur.* 15.1 (mar. 2012), 2:1-2:34. ISSN :
1094-9224. DOI: 10.1145/2133375.2133377. URL: http://doi.acm.org/10.1145/2133375.2133377 (visité le 17/02/2016).

[88] RTOS - Free professionally developed and robust real time operating system for small embedded systems development. URL: http://www.freertos.org/RTOS.html (visité le 29/08/2016).

[89] Edward J. SCHWARTZ, Thanassis AVGERINOS et David BRUMLEY. « Q : Exploit Har-dening Made Easy. » In : USENIX Security Symposium. 2011, p. 25–41. URL : http://static.usenix.org/legacy/events/sec11/tech/full_papers/Schwartz.pdf (visité le 19/04/2016).

[90] Hovav SHACHAM. « The Geometry of Innocent Flesh on the Bone : Return-into-libc Without Function Calls (on the x86) ». In : Proceedings of the 14th ACM Conference on Computer and Communications Security. CCS '07. New York, NY, USA : ACM, 2007, p. 552–561. ISBN : 978-1-59593-703-2. DOI : 10.1145/1315245.1315313. URL : http://doi.acm.org/10.1145/1315245.1315313 (visité le 13/10/2018).

[91] Hovav SHACHAM et al. « On the Effectiveness of Address-space Randomization ». In : Proceedings of the 11th ACM Conference on Computer and Communications Security. CCS '04. New York, NY, USA : ACM, 2004, p. 298–307. ISBN : 978-1-58113-961-7. DOI : 10.1145/1030083.1030124. URL : http://doi.acm.org/10.1145/1030083.1030124 (visité le 13/10/2018).

[92] Chengyu SONG et al. « Enforcing Kernel Security Invariants with Data Flow Integrity ». In : (2016). URL : http://www.cc.gatech.edu/grads/c/csong43/ndss16-kenali.pdf (visité le 18/02/2016).

[93] St. Jude Medical drops after Muddy Water findings of 'negligent product design'. https://www.cnbc.com/2016/08/25/st-jude-medical-drops-after-muddy-water-findings-of-negligent-product-design.html.

[94] Nick STEPHENS et al. « Driller : Augmenting Fuzzing Through Selective Symbolic Execution. » In : NDSS. T. 16. 2016, p. 1–16.

[95] STM32F4 Series - STMicroelectronics. URL: http://www.st.com/content/st_com/en/products/microcontrollers/stm32-32-bit-arm-cortex-mcus/stm32f4-series.html?querycriteria=产品的Id=SS1577 (visité le 29/08/2016).

[96] Stuxnet Worm Attack on Iranian Nuclear Facilities. http://large.stanford.edu/courses/2015/ph241/holloway1/.

[97] Michael SUTTON, Adam GREENE et Pedram AMINI. Fuzzing : brute force vulnerability discovery. Pearson Education, 2007.

[98] « Control Flow Integrity for COTS Binaries ». eng. In : sous la dir. de SYSTEMS ADMINISTRATION CONFERENCE et USENIX ASSOCIATION. Berkeley, Calif : USENIX Association, 2013. ISBN : 978-1-931971-03-4.

[99] Caroline TICE et al. « Enforcing Forward-Edge Control-Flow Integrity in GCC & LLVM ». en. In : (), p. 16.

[100] U.S. security expert says surveillance cameras can be hacked. https://www.reuters.com/article/us-surveillance-hackers-idUSBRE95G10520130617.

[101] Perry WAGLE, Crispin COWAN et al. « Stackguard : Simple stack smash protection for gcc ». In : Proceedings of the GCC Developers Summit. Citeseer. 2003, p. 243–255.

[102] D. WAGNER et D. DEAN. « Intrusion detection via static analysis ». In : 2001 IEEE Symposium on Security and Privacy, 2001. S P 2001. Proceedings. 2001, p. 156–168. DOI: 10.1109/SECPRI.2001.924296.

[103] Z. WANG et X. JIANG. « HyperSafe : A Lightweight Approach to Provide Lifetime Hypervisor Control-Flow Integrity ». In : 2010 IEEE Symposium on Security and Privacy. Mai 2010, p. 380–395. DOI : 10.1109/SP.2010.30.
[104] Raymond L WATROUS et Gary M KUHN. « Induction of finite-state languages using second-order recurrent networks ». In : *Neural Computation* 4.3 (1992), p. 406-414.

[105] Reinhold P WEICKER. « Dhrystone : a synthetic systems programming benchmark ». In : *Communications of the ACM* 27.10 (1984), p. 1013-1030.

[106] TA WELCH. « A Technique for High-Performance Data Compression ». In : *Computer* 6 (1984), p. 8-19.

[107] En-Hui YANG et John C KIEFFER. « Efficient universal lossless data compression algorithms based on a greedy sequential grammar transform. I. Without context models ». In : *IEEE Transactions on Information Theory* 46.3 (2000), p. 755-777.

[108] M.M. YASIN et A.A. AWAN. « A study of host-based IDS using system calls ». In : *Networking and Communication Conference, 2004. INCC 2004. International*. Juin 2004, p. 36-41. DOI : 10.1109/INCC.2004.1366573.

[109] Chao ZHANG et al. « VTrust : Regaining Trust on Virtual Calls ». In : (2016). URL : http://chao.100871.net/papers/VTrust-NDSS16-CR.pdf (visité le 18/02/2016).

[110] C. ZHANG et al. « Practical Control Flow Integrity and Randomization for Binary Executables ». In : 2013 *IEEE Symposium on Security and Privacy*. Mai 2013, p. 559-573. DOI : 10.1109/SP.2013.44.

[111] Jacob ZIV et Abraham LEMPEL. « Compression of individual sequences via variable-rate coding ». In : *IEEE transactions on Information Theory* 24.5 (1978), p. 530-536.