JMF: Java Measurement Framework

Runtime integrity measurement systems provide the capability to observe the runtime state of a process and to determine whether or not it is acceptable. Existing software systems tend to forgo integrity checks altogether or to enlist static mechanisms (e.g., assertions) to detect unacceptable process states at runtime. A large and growing base of malicious software necessitates more sophisticated handling of threats to process integrity. In this paper, we describe an approach to runtime integrity measurement we call the Java Measurement Framework (JMF) that presents a new way to define and check runtime integrity policies. We define a policy language based on Java that provides an accessible way to write integrity policies and we describe a periodic, dynamic measurer that obtains snapshots of process state, which are evaluated with respect to a policy by an appraiser. With full process state available to the appraiser, policies can express rich relationships between multiple objects, thereby detecting abnormalities in an application’s data structures. Our framework may be used to detect a powerful adversary who has the capability to modify both the runtime bytecode and data structures of Java applications. We show that our prototype implementation in Java has acceptable overhead and that it can be used to detect runtime integrity violations in several real Java programs.