Analyzing network traffic to detect self-decrypting exploit code

Proceedings of the 2nd ACM Symposium on Information, Computer and Communications Security, ASIACCS '07

Volumn , Issue , 2007, Pages 4-12

  Zhang, Qinghua ^a   Reeves, Douglas S ^a   Ning, Peng ^a   Iyer, S Purushothaman ^a  

^a North Carolina State University   (United States)

Author keywords

Decryption; Detection; Emulation; Exploit code; Polymorphic; Static analysis

Indexed keywords

CODES (SYMBOLS); COMPUTER SOFTWARE; CRYPTOGRAPHY; INTRUSION DETECTION; POLYMORPHISM; STATIC ANALYSIS;

CODE OBFUSCATION; DECRYPTION ROUTINES; REMOTE EXPLOITATION;

COMPUTER NETWORKS;

EID: 34748920757     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1145/1229285.1229291     Document Type: Conference Paper

References (25)

1. Common vulnerabilities and exposures. http://cve.mitre.org/cve/downloads/ full-cve.csv.
2. Computer Economics. http://www.computereconomics.com.
3. Intel Architecture Software Developers Manual. Volume 2: Instruction Set Reference.
4. Metasploit project, http://www.metasploit.org.
5. The ADMmutate polymorphic engine. http://www.ktwo.ca/ADMmutate-u.8.4.tar. gz.
6. The CLET polymorphism engine. http://www.phrack.org/show.php?p=61&a= 9.
7. Bro Intrusion Detection System, 2003. http://www.bro-ids.org.
8. Snort: an open source network intrusion prevention and detection system, 2005. http://www.snort.org.
9. th IFIP International Information Security Conference (SEC'05), pages 375-392, June 2005.
10. R. Chinchani and E. Berg. A Fast Static Analysis Approach To Detect Exploit Code Inside Network Flows. In Proceedings of the 8 International Symposium on Recent Advances in Intrusion Detection (RAID'05), pages 284-308, September 2005.
11. M. Christodorescu, S. Jha, S. A. Seshia, D. Song, and R. E. Bryant. Semantics-Aware Malware Detection. In Proceedings of 2005 IEEE Symposium on Security and Privacy (S&P'05), pages 32-46, May 2005.
12. J. C Foster and M. Price. Sockets, Shellcode, Porting, & Coding: Reverse Engineering Exploits and Tool Coding for Security Professionals. Syngress Publishing, USA, 2005.
13. C. Kruegel, W. Robertson, F. Valeur, and G. Vigna. Static Disassembly of Obfuscated Binaries. In Proceedings of the 1& USENIX Security Symposium, pages 255-270, Auguest 2004.
14. Z. Li, M. Sanghi, Y. Chen, M. Kao, and B. Chavez. Hamsa: Fast signature generation for zero-day polymorphic worms with provable attack resilience. In Proceedings of 2006 IEEE Symposium on Security and Privacy (S&P'06), pages 32-47, May 2006.
15. S. S. Muchnick. Advanced Comiler Design Implementation. Morgan Kaufmann Publisher, CA, USA, 1997.
16. J. Newsome, B. Karp, and D. Song. Polygraph: Automatically Generating Signatures for Polymorphic Worms. In Proceedings of 2005 IEEE Symposium on Security and Privacy (S&P'05), pages 226-241, May 2005.
17. th International Symposium on Recent Advances in Intrusion Detection (RAID'06), September 2006.
18. U. Payer, M. Lamberger, and P. Teufl. Hybrid engine for polymorphic code detection. In Proceedings of the Conference on Detection of Intrusions and Malware & Vulnerability Assessment(DIMVA'05), pages 19-31, July 2005.
19. M. Polychronakis, K. Anagnostakis, and E. Markatos. Network-Level Polymorphic Shellcode Detection Using Emulation. In Proceedings of the Conference on Detection of Intrusions and Malware & Vulnerability Assessment(DIMVA '06), July 2006.
20. th Annual Computer Security Applications Conference (ACSAC'06), December 2006.
21. S. Sidiroglou and A. Keromytis. Countering Network Worms Through Automatic Patch Generation. In Research Report, 2003.
22. th International Symposium on Recent Advances in Intrusion Detection (RAID'02), pages 274-291, October 2002.
23. th USENIX Security Symposium, pages 225-240, July 2006.
24. J. Xu, Z. Kalbarczyk, and R. K. Iyer. Transparent runtime randomization for security. In Proceedings of the 22th International Symposium on Reliable Distributed Systems (SRDS'03), pages 260-269, October 2003.
25. th USENIX Security Symposium, pages 97-112, August 2005.