NDLI: Shield:vulnerability-driven network filters for preventing known vulnerability exploits

Content Provider	ACM Digital Library
Author	Simon, Daniel R. Wang, Helen J. Zugenmaier, Alf Guo, Chuanxiong
Abstract	Software patching has not been effective as a first-line defense against large-scale worm attacks, even when patches have long been available for their corresponding vulnerabilities. Generally, people have been reluctant to patch their systems immediately, because patches are perceived to be unreliable and disruptive to apply. To address this problem, we propose a first-line worm defense in the network stack, using shields -- vulnerability-specific, exploit-generic network filters installed in end systems once a vulnerability is discovered, but before a patch is applied. These filters examine the incoming or outgoing traffic of vulnerable applications, and correct traffic that exploits vulnerabilities. Shields are less disruptive to install and uninstall, easier to test for bad side effects, and hence more reliable than traditional software patches. Further, shields are resilient to polymorphic or metamorphic variations of exploits [43].In this paper, we show that this concept is feasible by describing a prototype Shield framework implementation that filters traffic above the transport layer. We have designed a safe and restrictive language to describe vulnerabilities as partial state machines of the vulnerable application. The expressiveness of the language has been verified by encoding the signatures of several known vulnerabilites. Our evaluation provides evidence of Shield's low false positive rate and small impact on application throughput. An examination of a sample set of known vulnerabilities suggests that Shield could be used to prevent exploitation of a substantial fraction of the most dangerous ones.
Starting Page	193
Ending Page	204
Page Count	12
File Format	PDF
ISSN	01464833
DOI	10.1145/1030194.1015489
Journal	ACM SIGCOMM Computer Communication Review (CCRV)
Volume Number	34
Issue Number	4
Language	English
Publisher	Association for Computing Machinery (ACM)
Publisher Date	1993-07-01
Publisher Place	New York
Access Restriction	One Nation One Subscription (ONOS)
Subject Keyword	Generic protocol analyzer Network filter Worm defense Vulnerability signature Patching
Content Type	Text
Resource Type	Article
Subject	Computer Networks and Communications Software

Sl.	Authority	Responsibilities	Communication Details
1	Ministry of Education (GoI), Department of Higher Education	Sanctioning Authority	https://www.education.gov.in/ict-initiatives
2	Indian Institute of Technology Kharagpur	Host Institute of the Project: The host institute of the project is responsible for providing infrastructure support and hosting the project	https://www.iitkgp.ac.in
3	National Digital Library of India Office, Indian Institute of Technology Kharagpur	The administrative and infrastructural headquarters of the project	Dr. B. Sutradhar bsutra@ndl.gov.in
4	Project PI / Joint PI	Principal Investigator and Joint Principal Investigators of the project	Dr. B. Sutradhar bsutra@ndl.gov.in Prof. Saswat Chakrabarti will be added soon
5	Website/Portal (Helpdesk)	Queries regarding NDLI and its services	support@ndl.gov.in
6	Contents and Copyright Issues	Queries related to content curation and copyright issues	content@ndl.gov.in
7	National Digital Library of India Club (NDLI Club)	Queries related to NDLI Club formation, support, user awareness program, seminar/symposium, collaboration, social media, promotion, and outreach	clubsupport@ndl.gov.in
8	Digital Preservation Centre (DPC)	Assistance with digitizing and archiving copyright-free printed books	dpc@ndl.gov.in
9	IDR Setup or Support	Queries related to establishment and support of Institutional Digital Repository (IDR) and IDR workshops	idr@ndl.gov.in

Shield: vulnerability-driven network filters for preventing known vulnerability exploits

Shield: Vulnerability-Driven Network Filters for Preventing Known Vulnerability Exploits (2004)

Shield: Vulnerability-driven network filters for preventing known vulnerability exploits (2004)

Thwarting zero-day polymorphic worms with network-level length-based signature generation

NetShield:massive semantics-based vulnerability signature matching for high-speed networks

Comparing Vulnerability Severity and Exploits Using Case-Control Studies

Thwarting Zero-Day Polymorphic Worms With Network-Level Length-Based Signature Generation

An extensible probe architecture for network protocol performance measurement

A Case Study of Intelligence-Driven Defense

Shield:vulnerability-driven network filters for preventing known vulnerability exploits

Similar Documents

Shield: vulnerability-driven network filters for preventing known vulnerability exploits

Shield: Vulnerability-Driven Network Filters for Preventing Known Vulnerability Exploits (2004)

Shield: Vulnerability-driven network filters for preventing known vulnerability exploits (2004)

Thwarting zero-day polymorphic worms with network-level length-based signature generation

NetShield:massive semantics-based vulnerability signature matching for high-speed networks

Comparing Vulnerability Severity and Exploits Using Case-Control Studies

Thwarting Zero-Day Polymorphic Worms With Network-Level Length-Based Signature Generation

An extensible probe architecture for network protocol performance measurement

A Case Study of Intelligence-Driven Defense

Shield:vulnerability-driven network filters for preventing known vulnerability exploits