Switchblade: Enforcing dynamic personalized system call models

EuroSys'08 - Proceedings of the EuroSys 2008 Conference

Volumn , Issue , 2008, Pages 273-286

  Fetzer, Christof ^a   Sükraut, Martin ^a  

^a DRESDEN UNIVERSITY OF TECHNOLOGY   (Germany)

Author keywords

Security; System call interposition; System call models; Taint analysis

Indexed keywords

FALSE POSITIVES; INCOMPLETE MODELS; NEW SYSTEMS; ON DEMANDS; PROGRAM EXECUTIONS; RUN-TIME; SECURITY; SYSTEM CALL INTERPOSITION; SYSTEM CALL MODELS; TAINT ANALYSIS;

INTRUSION DETECTION;

EID: 59249101595     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1145/1352592.1352621     Document Type: Conference Paper

References (54)

1. ghttpd Log() Function Buffer Overflow Vuinerability. http://www. securityfocus.com/bid/5960.
2. Kumar Avijit, Prateek Gupta, and Deepak Gupta. Binary rewriting and call interception for efficient runtime protection against buffer overflows. SOFTWARE-PRACTICE AND EXPERIENCE, (36):971-998, 2006.
3. A. Baratloo, N. Singh, and T. Tsai. Transparent run-time defense against stack smashing attacks. In Proc. of the 2000 Usenix Annual Technical Conference, Jun 2000.
4. Mick Bauer. Paranoid penguin: an introduction to Novell AppArmor. Linux J., 2006(148):13, 2006.
5. Fabrice Bellard. Qemu, a fast and portable dynamic translator. In Proceedings of the 2005 USENIX Annual Technical Conference, April 2005.
6. Sandeep Bhatkar, Abhishek Chaturvedi, and R. Sekar. Dataflow anomaly detection. In SP'06: Proceedings of the 2006 IEEE Symposium on Security and Privacy (S&P'06), pages 48-62, Washington, DC, USA, 2006. IEEE Computer Society.
7. David Brumley, James Newsome, and Dawn Song. Sting: An end-to-end self-healing system for definding against internet worms. In Malware Detection. Springer, 2007.
8. David Brumley, James Newsome, Dawn Song, Hao Wang, and Somesh Jha. Towards automatic generation of vulnerability-based signatures. In SP'06: Proceedings of the 2006 IEEE Symposium on Security and Privacy (S&P'06), pages 2-16, Washington, DC, USA, 2006. IEEE Computer Society.
9. Subhachandra Chandra and Peter M. Chen. The impact of recovery mechanisms on the likelihood of saving corrupted state. In ISSRE'02: Proceedings of the 13th International Symposium on Software Reliability Engineering (ISSRE'02), page 91, Washington, DC, USA, 2002. IEEE Computer Society.
10. Manuel Costa, Jon Crowcroft, Miguel Castro, Antony Rowstron, Lidong Zhou, Lintao Zhang, and Paul Barham. Vigilante: end-to-end containment of internet worms. In SOSP'05: Proceedings of the twentieth ACM symposium on Operating systems principles, pages 133-147, New York, NY, USA, 2005. ACM Press.
11. Crispan Cowan, Calton Pu, Dave Maier, Jonathan Walpole, Peat Bakke, Steve Beattie, Aaron Grier, Perry Wagle, Qian Zhang, and Heather Hinton. StackGuard: Automatic adaptive detection and prevention of buffer-overflow attacks. In Proc. 7th USENIX Security Conference, pages 63-78, San Antonio, Texas, Jan 1998.
12. Crispin Cowan, Matt Barringer, Steve Beattie, and Greg Kroah-Hartman. Formatguard: Automatic protection from printf format string vulnerabilities. In Proceedings of the 10th USENIX Security Symposium., 2001.
13. Crispin Cowan, Steve Beattie, John Johansen, and Perry Wagle. Pointguard: Protecting pointers from buffer overflow vulnerabilities. In Proceedings of the 12th USENIX Security Symposium, 2003.
14. Crispin Cowan, Steve Beattie, Greg Kroah-Hartman, Calton Pu, Perry Wagle, and Virgil Gligor. Subdomain: Parsimonious server security. In LISA'00: Proceedings of the 14th USENIX conference on System administration, pages 355-368, Berkeley, CA, USA, 2000. USENIX Association.
15. Jedidiah R. Crandall and Frederic T. Chong. Minos: Control data attack prevention orthogonal to memory model. In 37th International Symposium on Microarchitecture, 2004.
16. Pawel Jakub Dawidek and Slawomir Zak. Cerb - system firewall mechanism, 2007. http://cerber.sourceforge.net/.
17. Ulfar Erlingsson, George C. Necula, Martin Abadi, Michael Vrable, and Mihai Budiu. XFI: Software guards for system address spaces. In Microsoft Research Silicon Valley, editor, OSDI, 2006.
18. H. Etoh and K. Yoda P (CSEC). Propolice-improved stack smashing attack detection. IPSJ SIGNotes Computer Security, 14(25), 2001.
19. S. Forrest, S. A. Hofmeyr, A. Somayaji, and T. A. Longstaff. A sense of self for unix processes. In Proceedings of the 1996 IEEE Symposium on Security and Privacy, pages 120-128, Oakland, CA, 1996.
20. Timothy Fraser, Lee Badger, and Mark Feldman. Hardening COTS software with generic software wrappers. In IEEE Symposium on Security and Privacy, pages 2-16, 1999.
21. Tal Garfinkel. Traps and pitfalls: Practical problems in system call interposition based security tools. In Proceedings of the ISOC Symposium on Network and Distributed System Security, 2003.
22. I. Goldberg, D. Wagner, R. Thomas, and E. A. Brewer. A secure environment for untrusted helper applications. In Proceedings of the 6th USENIX Security Symposium, San Jose, CA, USA, 1996.
23. Alex Ho, Michael Fetterman, Christopher Clark, Andrew Warfield, and Steven Hand. Practical taint-based protection using demand emulation. In Proc. ACM SICOPS EUROSYS, 2006.
24. S. A. Hofmeyr, S. Forrest, and A. Somayaji, Intrusion detection using sequences of system calls. Journal of Computer Security, 6:151-180, 1999.
25. Vladimir Kiriansky, Derek Bruening, and Saman P. Amarasinghe. Secure execution via program shepherding. In Proceedings of the 11th USENIX Security Symposium, pages 191-206, Berkeley, CA, USA, 2002. USENIX Association.
26. C. Kruegel, D. Mutz, F. Valeur, and G. Vigna. On the detection of anomalous system call arguments. In Proceedings of European Symposium on Research in Computer Security (ESORICS), pages 326-343, 2003.
27. David Litchfield. Defeating the stack based buffer overflow prevention mechanism of microsoft windows 2003 server, Sep 2003. http://www.nextgenss.com/ papers/defeatingw2k3-stack-protection.pdf.
28. Bill McCarty. SELinux: NSA 's Open Source Security Enhanced Linux. O'Reilly Media, Inc., 2004.
29. Roland McGrath. Utrace, 2007. http://people.redhat.com/roland/utrace/.
30. D. Mutz, F. Valeur, G. Vigna, and C. Kruegel. Anomalous system call detection. ACM Transactions on Information and System Security (TISSEC), 9(1):61-93, February 2006.
31. Nicholas Nethercote and Julian Seward. How to shadow every byte of memory used by a program. In VEE'07: Proceedings of the 3rd international conference on Virtual execution environments, pages 65-74, New York, NY, USA, 2007. ACM Press.
32. Nicholas Nethereote and Julian Seward. Valgrind: A framework for heavyweight dynamic binary instrumentation. In In Proceedings of the PLDI 2007, Jun 2007.
33. James Newsome, David Brumley, and Dawn Xiaodong Song. Vulnerability-specific execution filtering for exploit prevention on commodity software. In NDSS. The Internet Society, 2006.
34. James Newsome and Dawn Song. Dynamic taint analysis for automatic detection, analysis, and signature generation of exploits on commodity software. In Proceedings of the 12th Annual Network and Distributed System. Security Symposium (NDSS05), 2005.
35. David Patterson, Aaron Brown, Pete Broadwell, George Candea, Mike Chen, James Cutler, Patricia Enriquez, Armando Fox, Emre Kiciman, Matthew Merzbacher, David Oppenheimer, Naveen Sastry, William Tetzlaff, Jonathan Traupman, and Noah Treuhaft. Recovery oriented computing (roc): Motivation, definition, techniques,. Technical report, UCB, Berkeley, CA, USA, 2002.
36. D. S. Peterson, M. Bishop, and R. Pandey. A flexible containment mechanism for executing untrusted code. In Proceedings of the 11th USENIX Security Symposium, pages 207-225, 2002.
37. Georgios Portokalidis, Asia Slowinska, and Herbert Bos. Argos: an emulator for fingerprinting zero-day attacks. In Proc. ACM SIGOPS EUROSYS, Leuven, Belgium, April 2006.
38. Niels Provos. Improving host security with system call policies. In 12th USENIX Security Symposium, pages 257-272, August 2003.
39. Feng Qin, Joseph Tucek, Jagadeesan Sundaresan, and Yuanyuan Zhou. Rx: treating bugs as allergies-a safe method to survive software failures. In SOSP'05: Proceedings of the twentieth ACM symposium on Operating systems principles, pages 235-248, New York, NY, USA, 2005. ACM Press.
40. Feng Qin, Cheng Wang, Zhenmin Li, Ho seop Kim, Yuanyuan Zhou, and Youfeng Wu. Lift: A low-overhead practical information flow tracking system for detecting security attacks. In MICRO 39: Proceedings of the 39th Annual IEEE/ACM International Symposium on Microarchitecture, pages 135-148, Washington, DC, USA, 2006. IEEE Computer Society.
41. R. Sekar, M. Bendre, D. Dhurjati, and P. Bollineni. A fast automaton-based method for detecting anomalous program behaviors. In Proceedings of the 2001 IEEE Symposium on Security and Privacy, pages 144-155, Oakland, CA, 2001.
42. R. Sekar, V.N. Venkatakrishnan, Samik Basu, Sandeep Bhatkar, and Daniel C. DuVarney. Model-carrying code: a practical approach for safe execution of untrusted applications. In SOSP'03: Proceedings of the nineteenth ACM symposium on Operating systems principles, pages 15-28, New York, NY, USA, 2003. ACM Press.
43. Hovav Shacham, Matthew Page, Ben Pfaff, Eu-Jin Goh, Nagendra Modadugu, and Dan Boneh. On the effectiveness of address-space randomization. In CCS'04: Proceedings of the 11th ACM conference on Computer and communications security, pages 298-307, New York, NY, USA, 2004. ACM Press.
44. A. Somayaji and S. Forrest. Automated response using system call delays. In Proceedings of the 9th USENIX Security Symposium, Denver, CO, 2000.
45. Stephan Esser. PHP 4 unserializeQ ZVAL Reference Counter Overflow. http://www.phpsecurity.org/MOPB/MOPB-04-2007.html.
46. Stephan Esser. PHP 4 Userland ZVAL Reference Counter Overflow Vulnerability. http://www.phpsecurity.org/MOPB/MOPB-01-2007.html.
47. G. Edward Suh, Jae W. Lee, David X. Zhang, and Srinivas Devadas. Secure program execution via dynamic information flow tracking. In Proceedings of the 11th International Conference on Architectural Support for Programming Languages and Operating Systems (ASPLOS-XI), 2004.
48. Joseph Tucek, Shan Lu, Chengdu Huang, Spiros Xanthos, and Yuanyuan Zhou. Triage: diagnosing production run failures at the user's site. In SOSP'07: Proceedings of twenty-first ACM SIGOPS symposium on Operating systems principles, pages 131-144, New York, NY, USA, 2007. ACM.
49. Joseph Tucek, James Newsome, Shan Lu, Chengdu Huang, Spiros Xanthos, David Brumley, Yuanyuan Zhou, and Dawn Song. Sweeper: a lightweight end-to-end system for defending against fast worms. In EuroSys'07: Proceedings of the ACM SIGOPS/EuroSys European Conference on Computer Systems 2007, pages 115-128, New York, NY, USA, 2007. ACM.
50. David Wagner and Paolo Soto. Mimicry attacks on host-based intrusion detection systems. In Proceedings of the 9th A CM Conference on Computer and Communications Security, November 2002.
51. C. Warrender, S. Forrest, and B. Pearlmutter. Detecting intrusions using system calls: Alternative data models. In Proceedings of the 1999 IEEE Symposium on Security and Privacy, pages 133-145, 1999.
52. Robert N. M. Watson. Exploiting concurrency vulnerabilities in system call wrappers. In WOOT'07 First USENIX Workshop on Offensive Technologies, 2007.
53. John Wilander and Mariam Kamkar. A comparison of publicly available tools for dynamic buffer overflow prevention. In Proceedings of the 10th Network and Distributed System Security Symposium, pages 149-162, San Diego, California, February 2003.
54. Chris Wright, Crispin Cowan, Stephen Smalley, James Morris, and Greg Kroah-Hartman. Linux security modules: General security support for the linux kernel. In Proceedings of the 11th USENIX Security Symposium, pages 17-31, Berkeley, CA, USA, 2002. USENIX Association.