Reliable Distributed Systems, IEEE Symposium on (2009)
Niagara Falls, New York
Sept. 27, 2009 to Sept. 30, 2009
DOI Bookmark: http://doi.ieeecomputersociety.org/10.1109/SRDS.2009.15
Today web servers are ubiquitous having become critical infrastructures of many organizations. However, they are still one of the most vulnerable parts of organizations infrastructure. Exploits are many times used by worms to fast propagate across the full Internet being web servers one of their main targets. New exploit techniques have arouse in the last few years that have rendered useless traditional IDS techniques based on signature identification. Exploits use polymorphism (code encryption) and metamorphism (code obfuscation) to evade detection from signature-based IDSs. In this paper, we address precisely the topic of how to protect web servers against zero-day (new), polymorphic, and metamorphic malware embedded in data streams (requests) that target web servers. We rely on a novel technique to detect harmful binary code injection (i.e., exploits) in HTTP requests that is more efficient than current techniques based on binary code emulation or instrumentation of virtual engines. The detection of exploits is done through sandbox processes. The technique is complemented by another set of techniques such as caching, and pooling, to reduce its cost to neglectable levels.Our technique has little assumptions regarding the exploit unlike previous approaches that assume the existence of sled or getPC code, loops, read of the payload, writes to different addresses, etc. The evaluation shows that caching is highly effective and that the average latency introduced by our system is neglectable.
exploit, vulnerability, web server, polymorphic malware, metamorphic malware, zero-day malware
R. Jimenez-Peris, L. Campo-Giralte and M. Patiño-Martinez, "PolyVaccine: Protecting Web Servers against Zero-Day, Polymorphic and Metamorphic Exploits," Reliable Distributed Systems, IEEE Symposium on(SRDS), Niagara Falls, New York, 2009, pp. 91-99.