Towards automatic generation of vulnerability-based signatures

Proceedings - IEEE Symposium on Security and Privacy

Volumn 2006, Issue , 2006, Pages 2-16

  Brumley, David ^a   Newsome, James ^a   Song, Dawn ^a   Wang, Hao ^b   Jha, Somesh ^b  

^a CARNEGIE MELLON UNIVERSITY   (United States)

^b UNIVERSITY OF WISCONSIN MADISON   (United States)

Author keywords

[No Author keywords available]

Indexed keywords

PATTERN MATCHING; PROBLEM SOLVING; SEMANTICS; SYNTACTICS;

AUTOMATIC GENERATION; DESIGN SPACE; VULNERABILITY BASED SIGNATURES;

ELECTRONIC DOCUMENT IDENTIFICATION SYSTEMS;

EID: 33751056900     PISSN: 10816011     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/SP.2006.41     Document Type: Conference Paper

References (58)

1. Dynamorio. http://www.cag.lcs.mit.edu/dynamorio/.
2. K2, admmutate. http://www.ktwo.ca/c/ADMmutate-0.8.4.tar.gz.
3. Metasploit. http://metasploit.org.
4. A. Aho, R. Sethi, and J. Ullman. Compilers: Principles, Techniques, and Tools. Addison-Wesley Publishing Company, 1986.
5. P. Bosch, A. Carloganu, and D. Etiemble. Complete x86 instruction trace generation from hardware bus collect. In 23rd IEEE EUROMICRO Conference, 1997.
6. F. Bourdoncle. Efficient chaotic iteration strategies with widenings. In Proc. of the International Conference on Formal methods in Programming and their applications (LNCS 735), 1993.
7. D. Brumley, L.-H. Liu, P. Poosank, and D. Song. Design space and analysis of worm defense systems. In Proc of the 2006 ACM Symposium on Information, Computer, and Communication Security (ASIACCS), 2006. CMU TR CMU-CS-05-156.
8. D. Brumley, J. Newsome, D. Song, H. Wang, and S. Jha. Towards automatic generation of vulnerability-based signatures. Technical Report CMU-CS-06-108, Carnegie Mellon University, 2006.
9. R. E. Bryant, S. K. Lahiri, and S. A. Seshia. Modeling and verifying systems using a logic of counter arithmetic with lambda expressions and uninterpreted functions. In Proc. Computer-Aided Verification (CAV), 2002.
10. C. Cadar and D. Engler. Execution generated test cases: How to make system code crash itself. Technical Report CSTR-2005-04, Stanford, 2005.
11. C. Cerrudo. Story of a dumb patch, http://argeniss.com/research/ MSBugPaper.pdf, 2005.
12. CERT/CC. ISC BIND 8 contains buffer overflow in transaction signature TSIG handling code, http://www.kb.cert.org/vuls/id/196945.
13. A. S. Christensen, A. Møller, and M. I. Schwartzbach. Precise analysis of string expressions. In Proc. 10th International Static Analysis Symposium, SAS '03, volume 2694 of LNCS, pages 1-18. Springer-Verlag, June 2003. Available from http://www.brics.dk/JSA/.
14. th ACM Workshop on Program Analysis for Software Tools and Engineering PASTE, 2005.
15. E. Clarke, O. Grumberg, and D. Peled. Model Checking. The MIT Press, 1999.
16. E. Clarke, D. Kroening, and F. Lerda. A tool for checking ANSI-C programs. In K. Jensen and A. Podelski, editors, Tools and Algorithms for the Construction and Analysis of Systems (TACAS 2004), volume 2988 of Lecture Notes in Computer Science, pages 168-176. Springer, 2004.
17. th ACM Symposium on Operating System Principles (SOSP 2005), 2005.
18. th ACM Symposium on Principles of Programming Languages (POPL), Jan 1977.
19. J. Crandall, Z. Su, S. F. Wu, and F. Chong. On deriving unknown vulnerabilities from zero-day polymorphic and meta-morphic worm exploits. In Proc. 12th ACM Conference on Computer and Communications Security (CCS), 2005.
20. D. Detlefs, G. Nelson, and J. Saxe. Simplify: A theorem prover for program checking. Technical Report HPL-2003-148, HP Labs, 2003.
21. T. Detristan, T. Ulenspiegel, Y. Malcom, and M. V. Underduk. Polymorphic shellcode engine using spectrum analysis. http://www.phrack.org/show.php?p= 61&a=9.
22. P. Godefroid, N. Klarlund, and K. Sen. DART: Directed automated random testing. In Proc. of the 2005 International Conference on Programming Language Design and Implementation (PLDI), 2005.
23. A. Gotlieb, B. Botella, and M. Rueher. Automatic test data generation using constraint solving techniques. In ACM Symposium on Software Testing and Analysis, 1998.
24. A. Gotlieb, B. Botella, and M. Rueher. A clp framework for computing structural test data. In First International Conference on Computational Logic, 2000.
25. N. Gupta, A. Mathur, and M. L. Soffa. Automated test data generation using an iterative relaxation method. In ACM SIGSOFT Symposium on Foundations of Software Engineering, 1998.
26. J. Hopcroft, R. Motwani, and J. Ullman. Introduction to automata theory, langauges, and computation. Addison-Wesley, 2001.
27. D. Jackson and E. Rollins. Chopping: A generalization of slicing. In Proc. of the Second ACM SIGSOFT Symposium on the Foundations of Software Engineering, 1994.
28. M. Jordan. Dealing with metamorphism. In Virus Bulletin Magazine, 2002.
29. G. Kildall. A unified approach to global program optimization. In 1st ACM Symposium on Principles of Programming Languages (POPL), 1973.
30. H.-A. Kim and B. Karp. Autograph: toward automated, distributed worm signature detection. In Proc. of the 13th USENIX Security Symposium, August 2004.
31. J. King. Symbolic execution and program testing. Communications of the ACM, 19:386-394, 1976.
32. C. Kreibich and J. Crowcroft. Honeycomb - creating intrusion detection signatures using honeypots. In Proc. of the Second Workshop on Hot Topics in Networks (HotNets-II), November 2003.
33. C. Kruegel, E. Kirda, D. Mutz, W. Robertson, and G. Vigna. Polymophic worm detection using structural information of executables. In Rapid Advances in Intrusion Detection (RAID), 2005.
34. C. Kruegel, W. Robertson, F. Valeur, and G. Vigna. Static disassembly of obfuscated binaries. In Proc. of the 13th USENIX Security Symposium, 2004.
35. Z. Liang and R. Sekar. Fast and automated generation of attack signatures: A basis for building self-protecting servers. In Proc. of the 12th ACM Conference on Computer and Communications Security (CCS), 2005.
36. th International Symposium on Recent Advances in Intrusion Detection (RAID 2005), 2005.
37. C.-K. Luk, R. Cohn, R. Muth, H. Patil, A. Klauser, G. Lowney, S. Wallace, V. J. Reddi, and K. Hazelwood. Pin: Building customized program analysis tools with dynamic instrumentation. In Proc. of 2005 Programming Language Design and Implementation (PLDI) conference, June 2005.
38. th international conference on parallel and distributed computing, 2003.
39. M. Mohri and M.-J. Nederhof. Robustness in Language and Speech Technology. Kluwer Academic Publishers, 2001.
40. D. Moore, C. Shannon, G. Voelker, and S. Savage. Internet quarantine: Requirements for containing self-propagating code. In 2003 IEEE Infocom Conference, 2003.
41. S. Muchnick. Advanced Compiler Design and Implementation. Academic Press, 1997.
42. N. Nethercote and J. Seward. Valgrind: A program supervision framework. In Proc. of the Third Workshop on Runtime Verification (RV'03), Boulder, Colorado, USA, July 2003.
43. J. Newsome, B. Karp, and D. Song. Polygraph: Automatically generating signatures for polymorphic worms. In Proc. of the IEEE Symposium on Security and Privacy, May 2005.
44. J. Newsome and D. Song. Dynamic taint analysis for automatic detection, analysis, and signature generation of exploits on commodity software. In Proc. of the 12th Annual Network and Distributed System Security Symposium (NDSS), February 2005.
45. B. C. Pierce. Types and Programming Languages. The MIT Press, 2002.
46. r code. ATPhttpd exploit. http://www.cotse.com/mailing-lists/todays/att- 0003/01-atphttp0x06.c.
47. Y. Ramin. ATPhttpd.http://www.redshift.com/~yramin/atp/atphttpd/.
48. T. Reps and G. Rosay. Precise interprocedural chopping. In Proc. of the Third ACM SIGSOFT Symposium on the Foundations of Software Engineering, 1995.
49. P. A. Sandon, Y. Liao, T. Cook, D. Schultz, and P. M. de Nicolas. Nstrace: A bus-driven instruction trace tool for powerpc microprocessors. IBM Journal of Research and Development, 41(3), 1997.
50. S. Singh, C. Estan, G. Varghese, and S. Savage. Automated worm fingerprinting. In Proc. of the. 6th ACM/USENIX Symposium on Operating System Design and Implementation (OSDI), Dec. 2004.
51. S. Staniford, V. Paxson, and N. Weaver. How to Own the Internet in your spare time. In 11th USENIX Security Symposium, 2002.
52. P. Szor. Hunting for metamorphic. In Virus Bulletin Conference, 2001.
53. R. A. Uhlig and T. Mudge. Trace-driven memory simulation: a survey. ACM Computing Surveys, 29, 1997.
54. US-CERT. Vulnerability note vu#196945 - isc bind 8 contains buffer overflow in transaction signature (tsig) handling code, http://www.kb.cert.org/ vuls/id/196945.
55. P. Vixie, O. Gudmundsson, D. Eastlake, and B. Wellington. RFC 2845: Secret key transaction authentication for dns (TSIG). http://www.ietf.org/rfc/ rfc2845.txt.
56. H. J. Wang, C. Quo, D. Simon, and A. Zugenmaier. Shield: Vulnerability-driven network filters for preventing known vulnerability exploits. In Proc. of the 2004 ACM SIGCOMM Conference, August 2004.
57. M. Weiser. Programmers use slices when debugging. Communications of the ACM, 25:446-452, 1982.
58. th ACM Conference on Computer and Communication Security (CCS), 2005.