From a security view, MVX is widely used in network security defense, but there is a common problem in multi-variant execution: when each executive body returns content to the arbiter, it is difficult to solve the false alarm caused by the combination. Excluding objective factors such as the machine environment, false alarms are generated because the voter starts to make security judgments on non-consistent variables after receiving the combined information. In addition to non-consistent variables caused by real attacks, there are also non-consistent variables generated by normal system operation(such as memory descriptors, port numbers, random numbers, codes, and the calling sequence of threads in the process), which would cause the wrong judgement of the voter and affect the normal operation of the multi-variant system. If the false alarm rate of multi-variant execution can be reduced, the system efficiency and defense capability would be improved effectively. This paper classified the types of multi-variant execution in recent years, summarized the false alarms caused by multi-variant execution and the solutions. It analyzed the causes of false alarms caused by multi-variant execution, selected the Pina algorithm for synchronization, the compiler module instrumentation strategy, and the strategy for narrowing the voting boundary, analyzed the three schemes in specific application scenarios, and analyzed each method. Then it pointed the functions and performance of each strategy, pointed the advantages and disadvantages of each strategy. Finally, it discussed the unsolved difficulties and future research directions of the existing multi-variant implementation.

[2022-05-12] Accepted Paper /doc/2022.02.0093/v1

[2022-10-05] Printed Article /doc/2022.02.0093/v2