loading...
 This Article 
   
 Share 
   
 Bibliographic References 
   
 Add to: 
 
Digg
Furl
Spurl
Blink
Simpy
Google
Del.icio.us
Y!MyWeb
 
 Search 
   
12th Pacific Rim International Symposium on Dependable Computing (PRDC'06)
Base Address Recognition with Data Flow Tracking for Injection Attack Detection
Riverside, California
December 18-December 20
ISBN: 0-7695-2724-8
Satoshi Katsunuma, University of Tokyo
Hiroyuki Kurita, University of Tokyo
Ryota Shioya, University of Tokyo
Kazuto Shimizu, University of Tokyo
Hidetsugu Irie, Japan Science and Technology Agency
Masahiro Goshima, University of Tokyo
Shuichi Sakai, University of Tokyo
Vulnerabilities such as buffer overflows exist in some programs, and such vulnerabilities are susceptible to address injection attacks. The input data tracking method, which was proposed before, prevents I-data, which are the data derived from the input data, being used as addresses. However, the rules to determine address injection attacks are vague, which produces many false-positives and falsenegatives in detection results. Generally, the data used as an address consist of a base address and an address offset. We propose an architectural technique to prevent Idata overwriting B-data, which are the data used as base addresses in this paper. It dynamically recognizes the Idata and the B-data. Address injection is detected if I-data that are not B-data are used as addresses. We implemented the proposed technique on a Pentium-based Bochs emulator and investigated its detection capability. I believe that the technique is the most accurate injection detection technique proposed thus far.
Index Terms:
security, vulnerability, injection attack, base address, data flow tracking
Citation:
Satoshi Katsunuma, Hiroyuki Kurita, Ryota Shioya, Kazuto Shimizu, Hidetsugu Irie, Masahiro Goshima, Shuichi Sakai, "Base Address Recognition with Data Flow Tracking for Injection Attack Detection," prdc, pp.165-172, 12th Pacific Rim International Symposium on Dependable Computing (PRDC'06), 2006
Usage of this product signifies your acceptance of the Terms of Use.