Sting: An End-to-End Self-Healing System for Defending against Internet Worms

Advances in Information Security

Volumn 27, Issue , 2007, Pages 147-170

  Brumley, David ^a   Newsome, James ^a   Song, Dawn ^a  

^a CARNEGIE MELLON UNIVERSITY   (United States)

Author keywords

[No Author keywords available]

Indexed keywords

EID: 77953528520     PISSN: 15682633     EISSN: None     Source Type: Book Series    
DOI: 10.1007/978-0-387-44599-1_7     Document Type: Article

References (69)

1. K2, admmutate. http://www.ktwo.ca/c/ADMmutate-0.8.4.tar.gz
2. K. Anagnostakis, S. Sidiroglou, P. Akritidis, K. Xinidis, E. Markatos, and A. Keromytis. Detecting targeted attacks using shadow honeypots. In Proceedings in USENIX Security Symposium, 2005.
3. K. Avijit, P. Gupta, and D. Gupta. Tied, libsafeplus: Tools for runtime buffer overflow protection. In USENIX Security Symposium, August 2004.
4. A. Baratloo, N. Singh, and T. Tsai. Transparent run-time defense against stack smashing attacks. In USENIX Annual Technical Conference 2000,2000.
5. S. Bhatkar, D. C. DuVarney, and R. Sekar. Address obfuscation: An efficient approach to combat a broad range of memory error exploits. In Proceedings of 12th USENIX Security Symposium, 2003.
6. S. Bhatkar, R. Sekar, and D. C. DuVamey. Efficient techniques for comprehensive protection from memory error exploits. In Proceedings of the 14th USENIX Security Symposium, 2005.
7. D. Brumley, L.-H. Liu, P. Poosank, and D. Song. Design space and analysis of worm defense systems. In Proc of the 2006 ACM Symposium on Information, Computer, and Communication Security (ASIACCS), 2006. Full version in CMU TR CMU-CS-05-156.
8. D. Brumley, J. Newsome, D. Song, H. Wang, and S. Jha. Towards automatic generation of vulnerability-based signatures. In Proceedings of the IEEE Symposium on Security and Privacy, 2006.
9. C. Cerrudo. Story of a dumb patch. h t t p://a r g e n i s s. c o m/r e s e a r c h/MSBugPaper. pdf, 2005.
10. CERT/CC. CERT/CC statistics 1988-2005. h t t p://w w w. c e r t. o r g/s t a t s/c e r t_s t a t s. h t m l.
11. M. Chew and D. Song. Mitigating buffer overflows by operating system randomization. Technical report, Carnegie Mellon University, 2002.
12. st ACM Symposium on Operating System Principles (SOSP 2005), 2005.
13. M. Costa, J. Crowcroft, M. Castro, A. Rowstron, L. Zhou, L. Zhang, and P. Barham. Vigilante: End-to-end containment of internet worms. In Proceedings of the twentieth ACM symposium on Operating systems principles (SOSP), Oct. 2005.
14. C. Cowan, M. Barringer, S. Beattie, and G. Kroah-Hartman. FormatGuard: automatic protection from printf format string vulnerabilities. In Proceedings of the 10th USENIX Security Symposium, August 2001.
15. C. Cowan, S. Beattie, J. Johansen, and P. Wagle. PointGuard: Protecting pointers from buffer overflow vulnerabilities. In 12th USENIX Security Symposium, 2003.
16. C. Cowan, C. Pu, D. Maier, J. Walpole, P. Bakke, S. Beattie, A. Grier, P. Wagle, Q. Zhang, and H. Hinton. StackGuard: automatic adaptive detection and prevention of bufferoverflow attacks. In Proceedings of the 7th USENIX Security Symposium, January 1998.
17. J. R. Crandall and F. Chong. Minos: Architectural support for software security through control data integrity. In International Symposium on Microarchitecture, December 2004.
18. T. Detristan, T. Ulenspiegel, Y. Malcom, and M. V. Underduk. Polymorphic shellcode engine using spectrum analysis, h t t p://www. p h r a c k. o r g/s h o w. php?p=61 &a=9.
19. G. Dunlap, S. King, S. Cinar, M. Basrai, and P. Chen. Revirt: Enabling intrusion analysis through virtual-machine logging and replay. In Proceedings of the 2002 Symposium on Operating System Design and Implementation (OSDI), 2002.
20. D. C. DuVamey, R. Sekar, and Y.-J. Lin. Benign software mutations: A novel approach to protect against large-scale network attacks. Center for Cybersecurity White Paper, October 2002.
21. Dynamorio. http://www.cag.lcs.mit.edu/dynamorio/.
22. S. Forrest, A. Somayaji, and D. H. Ackley. Building diverse computer systems. In Proceedings of 6th workshop on Hot Topics in Operating Systems, 1997.
23. J. Hopcroft, R. Motwani, and J. UUman. Introduction to automata theory, langauges, and computation. Addison-Wesley, 2001.
24. D. Jackson and E. Rollins. Chopping: A generalization of slicing. In Proc. of the Second ACM SIGSOFT Symposium on the Fouruiations of Software Engineering, 1994.
25. R. Jones and P. Kelly. Backwards-compatible bounds checking for arrays and pointers in C programs. In Proceedings of the Third International Workshop on Automated Debugging, 1995.
26. A. Joshi, S. T. King, G. W. Dunlap, and P. M. Chen. Detecting past and present intrusions through vulnerability-specific predicates. In Proceedings of the 2005 Symposium on Operating Systems Principles (SOSP), 2005.
27. H.-A. Kim and B. Karp. Autograph: toward automated, distributed worm signature detection. In Proceedings of the 13th USENIX Security Symposium, August 2004.
28. V. Kiriansky, D. Bruening, and S. Amarasinghe. Secure execution via program shepherding. In Proceedings of the 11th USENIX Security Symposium, August 2002.
29. C. Kreibich and J. Crowcroft. Honeycomb-creating intrusion detection signatures using honeypots. In Proceedings of the Second Workshop on Hot Topics in Networks (HotNets-II), November 2003.
30. R. Lemos. Counting the cost of the slammer worm, h t t p://n e w s. c o m. c o m/2 1 0 0-1 0 0 1-9 8 2 9 5 5. h t m l, 2003.
31. Z. Liang and R. Sekar. Fast and automated generation of attack signatures: A basis for building self-protecting servers. In Proc. of the I2thACM Conference on Computer and Communications Security (CCS), 2005.
32. D. Moore, V. Paxson, S. Savage, C. Shannon, S. Stamford, and N. Weaver. Inside the slanmier worm. In IEEE Security and Privacy, volume 1, 2003.
33. D. Moore, V. Paxson, S. Savage, C. Shannon, S. Staniford, and N. Weaver. Inside the slammer worm. In IEEE Security and Privacy, volume 1, 2003.
34. D. Moore, C. Shannon, G. Voelker, and S. Savage. Internet quarantine: Requirements for containing self-propagating code. In 2003 lEEEInfocom Conference, 2003.
35. C. Nachanberg. Computer virus-antivirus coevolution. Communications of The ACM, 1997.
36. G. C. Necula, S. McPeak, and W. Weimer. CCured: type-safe retrofitting of legacy code. In Proceedings of the Symposium on Principles of Programming Languages, 2002.
37. N. Nethercote and J. Fitzhardinge. Bounds-checking entire programs witiiout recompiling. In Proceedings of the Second Workshop on Semantics, Program Analysis, and Computing Environments for Memory Management (SPACE 2004), Venice, Italy, Jan. 2004. (Proceedings not formally published.).
38. N. Nethercote and J. Seward. Valgrind: A program supervision framework. In Proceedings of the Third Workshop on Runtime Verification (RV'03), Boulder, Colorado, USA, July 2003.
39. rd Annual Network and Distributed System Security Symposium (NDSS), 2006.
40. J. Newsome, D. Brumley, D. Song, and M. R. Pariente. Sting: An end-to-end self-healing system for defending against zero-day worm attacks on commodity software. Technical Report CMU-CS-05-191, Carnegie Mellon University, February 2006.
41. J. Newsome, B. Karp, and D. Song. Polygraph: Automatically generating signatures for polymorpiiic worms. In Proceedings of the IEEE Symposium on Security and Privacy, May 2005.
42. J. Newsome, B. Karp, and D. Song. Paragraph: Thwarting signature learning by training maliciously. In Proceedings of the International Symposium on Recent Advances in Intrusion Detection, Sept. 2006.
43. J. Newsome and D. Song. Dynamic taint analysis for automatic detection, analysis, and signature generation of exploits on commodity software. In Proceedings of the 12th Annual Network and Distributed System Security Symposium (NDSS), February 2005.
44. J. Newsome and D. Song. Dynamic taint analysis for automatic detection, analysis, and signature generation of exploits on commodity software. Technical Report CMU-CS-04-140, Carnegie Mellon University, May 2005.
45. PaX. http://pax.gr security, net/.
46. F. Qin, J. Tucek, J. Sundaresan, and Y. Zhou. Rx: Treating bugs as allergies-a safe method to survive software failures. In 20"" ACM Symposium on Operating System Principles (SOSP), 2005.
47. r code. ATPhttpd exploit. http://www.cotse.com/mailing-lists/todays/att-0003/01-atphttp0x06.c.
48. T. Reps and G. Rosay. Precise interprocedural chopping. In Proc. of the Third ACM SIGSOFT Symposium on the Foundations of Software Engineering, 1995.
49. M. Rinard, C. Cadar, D. Dumitran, D. Roy, T. Leu, and W. B. Jr. Enhancing server availabihty and security through failure-oblivious computing. In Operating System Design & Implementation (OSDI), 2004.
50. T. J. Robbins. libformat. http://www.securityfocus.com/tools/1818, 2001.
51. O. Ruwase and M. Lam. A practical dynamic buffer overflow detector. In Proceedings of the 11th Annual Network and Distributed System Security Symposium, February 2004.
52. H. Shacham, M. Page, B. Pfaff, E.-J. Goh, N. Modadugu, and D. Boneh. On the effectiveness of address-space randomization. In Proceedings of the 11th ACM Conference on Computer and Communications Security, October 2004.
53. S. Sidiroglou and A. D. Keromytis. A network worm vaccine architecture. In Proceedings of the IEEE International Workshops on Enabling Technologies: Infrastructure for Collaborative Enterprises (WETICE), Workshop on Enterprise Security, pages 220-225, June 2003.
54. S. Sidiroglou and A. D. Keromytis. Countering network worms through automatic patch generation. IEEE Security and Privacy, 2005.
55. rd Annual Network and Distributed System Security Symposium (NDSS), 2006.
56. S. Sidiroglou, M. E. Locasto, S. W. Boyd, and A. D. Keromytis. Building a reactive immune system for software services. In USENIX Annual Technical Conference, 2005.
57. S. Singh, C. Estan, G. Varghese, and S. Savage. Automated worm fingerprinting. In Proceedings of the 6th ACM/USENIX Symposium on Operating System Design and Implementation (OSDI), Dec. 2004.
58. st annual Network and Distributed System Security Symposium (NDSS), 2005.
59. S. M. Srinivasan, S. Kandula, C. R. Andrews, and Y. Zhou. Flashback: A lightweight extension for rollback and deterministic replay for software debugging. In Proceedings of the 2004 USENIX Technical Conference, 2004.
60. S. Staniford, D. Moore, V. Paxson, and N. Weaver. The top speed of flash worms. In ACM CCS WORM, Oct. 2004.
61. S. Staniford, V. Paxson, and N. Weaver. How to Own the Internet in your spare time. In 11th USENIX Security Symposium, 2002.
62. G. E. Suh, J. Lee, and S. Devadas. Secure program execution via dynamic information flow tracking. In Proceedings ofASPLOS, 2004.
63. P. Szor Hunting for metamorphic. In Proceedings of the Virus Bulletin Conference, 2001.
64. J. Twycross and M. M. Williamson. Implementing and testing a virus throttle. In Proceedings of 12th USENIX Security Symposium, August 2003.
65. US-CERT. Vulnerability note vu#196945-isc bind 8 contains buffer overflow in transaction signature (tsig) handling code, h t t p://www. k b. c e r t. o r g/v u l s/i d/196945.
66. H. J. Wang, C. Guo, D. Simon, and A. Zugenmaier. Shield: Vulnerability-driven network filters for preventing known vulnerability exploits. In ACM SIGCOMM, August 2004.
67. M. M. Williamson. Throttling viruses: Restricting propagation to defeat malicious mobile code. In Proceedings of the 18th Annual Computer Security Applications Conf erence, 2002.
68. J. Xu, Z. Kalbarczyk, and R. K. Iyer. Transparent runtime randomization for security. Technical report. Center for Reliable and Higher Performance Computing, University of Illinois at Urbana-Champaign, May 2003.
69. J. Xu, P. Ning, C. Kil, Y. Zhai, and C. Bookholt. Automatic diagnosis and response to memory corruption vulnerabilities. In Proceedings of the 12th Annual ACM Conference on Computer and Communication Security (CCS), 2005.