A Model of Execution Monitoring Enforcement Mechanism

Execution monitoring (EM) is a ubiquitous way for monitoring untrusted applications. In this paper, we concern the characterization of security policies which was seldom concerned before. We define security policy as a security predicate which is a conjunction of two different sub-predicates: sequences predicate and states predicate. This work proves that different implementations of security policies specify different properties. Under this new definition of security policies, a model of EM enforcement mechanism is designed to describe the relations between the power of EM enforcement mechanism and the requirement of security policies.