Stride: Polymorphic sled detection through instruction sequence analysis

IFIP Advances in Information and Communication Technology

Volumn 181, Issue , 2005, Pages 375-391

  Akritidis, P ^a   Markatos, E P ^a   Polychronakis, M ^a   Anagnostakis, K ^b  

^a INSTITUTE OF COMPUTER SCIENCE   (Greece)

^b UNIVERSITY OF PENNSYLVANIA   (United States)

Author keywords

buffer overflow detection; intrusion detection; security

Indexed keywords

BUFFER OVERFLOW ATTACKS; BUFFER OVERFLOWS; COMPUTATIONALLY EFFICIENT; SECURITY; SECURITY THREATS; SELFPROPAGATION; SEQUENCE ANALYSIS; TRANSFER CONTROL;

INTRUSION DETECTION; UBIQUITOUS COMPUTING; VEHICLES; VIRUSES; BUFFER STORAGE; COMPUTER VIRUSES; MOBILE SECURITY;

BUFFER STORAGE; SECURITY OF DATA;

EID: 84866362135     PISSN: 18684238     EISSN: None     Source Type: Book Series    
DOI: 10.1007/0-387-25660-1_25     Document Type: Conference Paper

References (22)

1. Aleph One. Smashing the stack for fun and profit. Phrack, 7(49), Nov. 1996. http://www. phrack.org/phrack/49/P49-14.
2. A. Baratloo, N. Singh, and T. Tsai. Transparent run-time defense against stack smashing attacks. In Proceedings of USENIX Annual Technical Conference, June 2000.
3. C. Cowan, M. Barringer, S. Beattie, and G. Kroah-Hartman. Formatguard: Automatic protection from printf format string vulnerabilities. In Proceedings of the 10th USENIX Security Symposium, August 2001.
4. J. J. C. Cowan, S. Beattie and P. Wagle. Point Guard: Protecting pointers from buffer overflow vulnerabilities. In Proceedings of the 12th USENIX Security Symposium, August 2003.
5. C. Cowan, C. Pu, D. Maier, M. Hinton, J. Walpole, P. Bakke, S. Beattie, A. Grier, P. Wagle, and Q. Zhang. Stackguard: Automatic adaptive detection and prevention of buffer-overflow attacks. In Proc. of the 7th USENIX Security Symposium, January 1998.
6. M. Frantzen and M. Shuey. Stack Ghost: Hardware facilitated stack protection. In Proceedings of the 10th USENIX Security Symposium, August 2001.
7. I. Goldberg, D. Wagner, R. Thomas, and E. A. Brewer. A Secure Environment for Untrusted Helper Applications: Confining the Wily Hacker. In Proc, of the 5th USENIX Security Symposium, 1996.
8. V. Kiriansky, D. Bruening, and S. Amarasinghe. Secure execution via program sheperding. In Proceedings of the 1 lth USENIX Security Symposium, 2002.
9. T. Detristan, T. Ulenspiegel, Y. Malcom, and M. Underduk. Polymorphic shellcode engine using spectrum analysis. Phrack, 11(61), Aug. 2003. http://www.phrack.org/ phrack/6l/p61-0x09-Polymorphic-Shellcode-Engine.txt.
10. C. Nachenberg. Understanding and managing polymorphic viruses. White Paper, July 1996. http://www.symantec.com/avcenter/reference/striker.pdf.
11. O. Kolesnikov, D. Dagon, and W. Lee. Advanced polymorphic worms: Evading IDS by blending in with normal traffic, 2004, http://www.cc.gatech.edu/aok/w/ok-pw.pdf.
12. P. Szor and P. Ferrie. Hunting for metamorphic. White Paper, Sept. 2001. http://www. symantec, com/avcenter/referencelhunting.for.metamorphic.pdf.
13. M. Roesch. Snort: Lightweight intrusion detection for networks. In Proceedings of USENIX LISA 99, Nov. 1999. (software available from http://www.snort.org/).
14. D. Ruiu. Fnord: Multi-architecture mutated NOP sled detector, Feb. 2002. http://www.canseewest.com/spp_fnord.c
15. T. Toth and C. Kruegel. Accurate buffer overflow detection via abstract payload execution. In Proceedings of the 5th International Symposium on Recent Advances in Intrusion Detection (RAID), Oct. 2002.
16. K2. ADMmutate. http://www.ktwo.ca/ADMmutate-0.8.4.tar.gz.
17. Metasploit project, 2004, http://www.metasploit.com/.
18. IA-32 Intel Architecture Software Developer's Manual vol. 1-3. http://developer.intel. com/designl pentium4/manuals/index-new.htm.
19. K. S. Gatlin. Windows data alignment on IPF, x86, and x86-64, Feb. 2003. MSDN Library, http://msdn.microsoft.com/.
20. Prelude IDS, http://www.prelude-ids.org/.
21. NIDS Find Shellcode. http://www.ngsec.com/downloads/misc/NIDSfindshellcode.tgz.
22. T. Toth. Apache buffer overflow detector module, Mar. 2002. http://www.infosys.tuwien. ac.at/Staff/tt/abstract-execution/.