Hybrid engine for polymorphic shellcode detection

Lecture Notes in Computer Science

Volumn 3548, Issue Detection of Intrusions and Malware, and Vulnerability Assessment: Second International Conference, DIMVA 2005. Proceedings, 2005, Pages 19-31

  Payer, Udo ^a   Teufl, Peter ^a   Lamberger, Mario ^a  

^a Institute for Applied Information Processing and Communications   (Austria)

Author keywords

Intrusion Detection; Neural networks; Polymorphic shellcode detection

Indexed keywords

CODES (SYMBOLS); DATA MINING;

INTRUSION DETECTION; POLYMORPHIC SHELLCODE DETECTION;

NEURAL NETWORKS;

EID: 26444479651     PISSN: 03029743     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1007/11506881_2     Document Type: Conference Paper

References (14)

1. Metasploit project, http://www.metasploit.com retrieved on 15.10.2004.
2. AlephOne. Smashing the stack for fun and profit. http://www.phrack.com, 1996. Phrack Magazine 49(14).
3. Christopher M. Bishop. Neural networks for pattern recognition. The Clarendon Press Oxford University Press, New York, 1995. With a foreword by Geoffrey Hinton.
4. CLET team. Polymorphic shellcode engine. http://www.phrack.com, 2003. Phrack Magazine 61(9).
5. Richard O. Duda, Peter E. Hart, and David G. Stork. Pattern classification. Wiley-Interscience, New York, second edition, 2001.
6. K2. Admutate 0.8.4. http://www.ktwo.ca. Retrieved 29.03.2004
7. Mathworks. Neural network toolbox. http://www.mathworks.com/products/ neuralnet/retrieved on 25.8.2004.
8. NASM SourceForge Project. http://nasm.sourceforge.net retrieved 11.02.2005
9. Pasupulati, A. Coit, J. Levitt, K. Wu, S.F. Li, S.H. Kuo, and J.C. Fan. Buttercup: on network-based detection of polymorphic buffer overflow vulnerabilities. In Network Operations and Management Symposium, 2004. NOMS 2004. IEEE/IFIP, volume 1, pages 235-248, 2004. http://wwwcsif.cs.ucdavis.edu/ ~pasupula/Buttercup-paper.doc.
10. S. Roweis. Levenberg-marquardt optimization. http://www.cs.toronto.edu/ ~roweis/notes/lm.pdf retrieved on 20.1.2005.
11. Dragos Ruiu. Snort preprocessor - Multi-architecture mutated NOP sled detector. Retrieved 11.02.2005. http://cansecwest.com/spp_fnord.c.
12. Matias Sedalo. Polymorphic Shellcode Engine. http://www.shellcode.com.ar retrieved on 25.8.2004
13. Snort. Open Source Network Intrusion Detection System. Retrieved 11.02.2005 http://www.snort.org.
14. T. Toth and Ch. Kruegel. Accurate buffer overflow detection via abstract payload execution. In Andreas Wespi, Giovanni Vigna, and Luca Deri, editors, Recent Advances in Intrusion Detection, 5th International Symposium, RAID 2002, Zurich, Switzerland, October 16-18, 2002, Proceedings, volume 2516 of Lecture Notes in Computer Science, pages 274-291. Springer, 2002.