|
This article is cited in 1 scientific paper (total in 1 paper)
Computer system organization
On the detection of exploitation of vulnerabilities leading to the execution of a malicious code
Yu. V. Kosolapov Southern Federal University, 8a Milchakova str., Rostov-on-Don 344090, Russia
Abstract:
Software protection from exploitation of possible unknown vulnerabilities can be performed both by searching (for example, using symbolic execution) and subsequent elimination of the vulnerabilities and by using detection and / or intrusion prevention systems. In the latter case, this problem is usually solved by forming a profile of a normal behavior and deviation from normal behavior over a predetermined threshold is regarded as an anomaly or an attack. In this paper, the task is to protect a given software $P$ from exploiting unknown vulnerabilities. For this aim a method is proposed for constructing a profile of the normal execution of the program $P$, in which, in addition to a set of legal chains of system and library functions, it is proposed to take into account the distances between adjacent function calls. At the same time, a profile is formed for each program. It is assumed that taking into account the distances between function calls will reveal shell code execution using system and / or library function calls. An algorithm and a system for detecting abnormal code execution are proposed. The work carried out experiments in the case when $P$ is the FireFox browser. During the experiments the possibility of applying the developed algorithm to identify abnormal behavior when launching publicly available exploits was investigated.
Keywords:
system calls, library calls, software vulnerability.
Received: 09.03.2019 Revised: 23.03.2020 Accepted: 25.03.2020
Citation:
Yu. V. Kosolapov, “On the detection of exploitation of vulnerabilities leading to the execution of a malicious code”, Model. Anal. Inform. Sist., 27:2 (2020), 138–151
Linking options:
https://www.mathnet.ru/eng/mais709 https://www.mathnet.ru/eng/mais/v27/i2/p138
|
Statistics & downloads: |
Abstract page: | 171 | Full-text PDF : | 81 | References: | 22 |
|