loading...
 This Article 
   
 Share 
   
 Bibliographic References 
   
 Add to: 
 
Digg
Furl
Spurl
Blink
Simpy
Google
Del.icio.us
Y!MyWeb
 
 Search 
   
21st Annual Computer Security Applications Conference (ACSAC'05)
A Framework for Detecting Network-based Code Injection Attacks Targeting Windows and UNIX
Tucson, Arizona
December 05-December 09
ISBN: 0-7695-2461-3
Stig Andersson, Queensland University of Technology, Australia
Andrew Clark, Queensland University of Technology, Australia
George Mohay, Queensland University of Technology, Australia
Bradley Schatz, Queensland University of Technology, Australia
Jacob Zimmermann, Queensland University of Technology, Australia
Code injection vulnerabilities continue to prevail. Attacks of this kind such as stack buffer overflows and heap buffer overflows account for roughly half of the vulnerabilities discovered in software every year. The research presented in this paper extends earlier work in the area of code injection attack detection in UNIX environments. It presents a framework for detecting new or previously unseen code injection attacks in a heterogeneous networking environment and compares code injection attack and detection strategies used in the UNIX and Windows environments. The approach presented is capable of detecting both obfuscated and clear text attacks, and is suitable for implementation in the Windows environment. A prototype intrusion detection system (IDS) capable of detecting code injection attacks, both clear text attacks and obfuscated attacks, which targets Windows systems is presented.
Citation:
Stig Andersson, Andrew Clark, George Mohay, Bradley Schatz, Jacob Zimmermann, "A Framework for Detecting Network-based Code Injection Attacks Targeting Windows and UNIX," acsac, pp.49-58, 21st Annual Computer Security Applications Conference (ACSAC'05), 2005
Usage of this product signifies your acceptance of the Terms of Use.