loading...
 This Article 
   
 Share 
   
 Bibliographic References 
   
 Add to: 
 
Digg
Furl
Spurl
Blink
Simpy
Google
Del.icio.us
Y!MyWeb
 
 Search 
   
20th International Conference on Advanced Information Networking and Applications - Volume 1 (AINA'06)
An Intrusion Detection System using Alteration of Data
Vienna, Austria
April 18-April 20
ISBN: 0-7695-2466-4
Fumiaki NAGANO, Kyushu University, Fukuoka,Japan
Kohei TATARA, Kyushu University, Fukuoka,Japan
Kouichi SAKURAI, Kyushu University, Fukuoka,Japan
Toshihiro TABATA, Okayama University, Okayama,Japan
Attacks against data in memory are one of the most serious threats these days. Although many detection systems have been proposed so far, most of them can detect only part of alteration. Some detection systems use canaries to detect alteration. However, if an execution code has bugs that enable attackers to read data in memory, the system could be bypassed by attackers who can guess canaries. To overcome the problems, we propose a system using alteration of data. Our proposed system detects illegal alteration with verifier for vulnerable data. Verifier is made before vulnerable data could be altered by attackers, and verifier is checked when the program uses the vulnerable data. Part of Verifier is stored in kernel area to prevent attackers from reading data in user memory. Our approach can detect illegal alteration of arbitrary data in user memory. Our proposed system, moreover, does not have the problem systems using canaries have.
Citation:
Fumiaki NAGANO, Kohei TATARA, Kouichi SAKURAI, Toshihiro TABATA, "An Intrusion Detection System using Alteration of Data," aina, vol. 1, pp.243-248, 20th International Conference on Advanced Information Networking and Applications - Volume 1 (AINA'06), 2006
Usage of this product signifies your acceptance of the Terms of Use.