Dynamic taint analysis for automatic detection, analysis, and signature generation of exploits on commodity software

DMCA

Dynamic taint analysis for automatic detection, analysis, and signature generation of exploits on commodity software (2005)

Cached

Download Links

by James Newsome , Dawn Song

Venue:	In Network and Distributed Systems Security Symposium
Citations:	647 - 32 self

BibTeX

@INPROCEEDINGS{Newsome05dynamictaint,
    author = {James Newsome and Dawn Song},
    title = {Dynamic taint analysis for automatic detection, analysis, and signature generation of exploits on commodity software},
    booktitle = {In Network and Distributed Systems Security Symposium},
    year = {2005}
}

OpenURL

Abstract

Software vulnerabilities have had a devastating effect on the Internet. Worms such as CodeRed and Slammer can compromise hundreds of thousands of hosts within hours or even minutes, and cause millions of dollars of damage [32, 51]. To successfully combat these fast automatic Internet attacks, we need fast automatic attack detection and filtering mechanisms. In this paper we propose dynamic taint analysis for automatic detection and analysis of overwrite attacks, which include most types of exploits. This approach does not need source code or special compilation for the monitored program, and hence works on commodity software. To demonstrate this idea, we have implemented TaintCheck, a mechanism that can perform dynamic taint analysis by performing binary rewriting at run time. We show that TaintCheck reliably detects most types of exploits. We found that TaintCheck produced no false positives for any of the many different programs that we tested. Further, we show how we can use a two-tiered approach to build a hybrid exploit detector that enjoys the same accuracy as TaintCheck but have extremely low performance overhead. Finally, we propose a new type of automatic signature generation—semanticanalysis based signature generation. We show that by backtracing the chain of tainted data structure rooted at the detection point, TaintCheck can automatically identify which original flow and which part of the original flow have caused the attack and identify important invariants of the payload that can be used as signatures. Semantic-analysis based signature generation can be more accurate, resilient against polymorphic worms, and robust to attacks exploiting polymorphism than the pattern-extraction based signature generation methods.

Keyphrases

signature generation dynamic taint analysis automatic detection commodity software original flow many different program automatic attack detection run time low performance overhead important invariant monitored program polymorphic worm hybrid exploit detector binary rewriting source code software vulnerability two-tiered approach signature generation method tainted data structure automatic signature generation semanticanalysis devastating effect overwrite attack detection point false positive new type fast automatic internet attack special compilation

DMCA