CSDL Home IEEE Transactions on Dependable and Secure Computing 2010 vol.7 Issue No.01 - January-March
Issue No.01 - January-March (2010 vol.7)
Xinran Wang , Pennsylvania State University, State College
Chi-Chun Pan , The Pennsylvania State University, State College
Peng Liu , The Pennsylvania State University, State College
Sencun Zhu , The Pennsylvania State University, University Park
DOI Bookmark: http://doi.ieeecomputersociety.org/10.1109/TDSC.2008.30
We propose SigFree, an online signature-free out-of-the-box application-layer method for blocking code-injection buffer overflow attack messages targeting at various Internet services such as web service. Motivated by the observation that buffer overflow attacks typically contain executables whereas legitimate client requests never contain executables in most Internet services, SigFree blocks attacks by detecting the presence of code. Unlike the previous code detection algorithms, SigFree uses a new data-flow analysis technique called code abstraction that is generic, fast, and hard for exploit code to evade. SigFree is signature free, thus it can block new and unknown buffer overflow attacks; SigFree is also immunized from most attack-side code obfuscation methods. Since SigFree is a transparent deployment to the servers being protected, it is good for economical Internet-wide deployment with very low deployment and maintenance cost. We implemented and tested SigFree; our experimental study shows that the dependency-degree-based SigFree could block all types of code-injection attack packets (above 750) tested in our experiments with very few false positives. Moreover, SigFree causes very small extra latency to normal client requests when some requests contain exploit code.
Intrusion detection, buffer overflow attacks, code-injection attacks.
Xinran Wang, Chi-Chun Pan, Peng Liu, Sencun Zhu, "SigFree: A Signature-Free Buffer Overflow Attack Blocker", IEEE Transactions on Dependable and Secure Computing, vol.7, no. 1, pp. 65-79, January-March 2010, doi:10.1109/TDSC.2008.30