  Edge-cloud computing offloads parts of the computations that traditionally
occurs in the cloud to edge nodes,e.g., CDN servers, in order to get closer to
the users and reduce latency. To improve performance even further, WebAssembly
is increasingly used in this context. Edge-cloud computing providers, such as
Fastly or Cloudflare, let their clients deploy stateless services in the form
of WebAssembly binaries, which are then translated to machine code and
sandboxed for a safe execution at the edge.
  In this context, we propose a technique that (i) automatically diversifies
WebAssembly binaries that are deployed to the edge and (ii) randomizes
execution paths at runtime, turning the execution of the services into a moving
target. Given a service tobe deployed at the edge, we automatically synthesize
functionally equivalent variants for the functions that implement the
service.All the variants are then wrapped into a single multivariant
WebAssembly binary. When the service endpoint is executed,every time a function
is invoked, one of its variants is randomly selected. We implement this
technique in the MEWE tool and we validate it with 7 services for cryptography
and QR encoding. MEWE generates multivariant binaries that embed hundreds of
function variants. We execute the multivariant binaries on the worldwide edge
platform provided by Fastly. We show that,at runtime, the multivariant exhibit
a remarkable diversity ofexecution traces, across the whole edge platform.
