NDLI: On deriving unknown vulnerabilities from zero-day polymorphic and metamorphic worm exploits

Please wait, while we are loading the content...

Homeland security: cyber security R&D initiatives

A modular correctness proof of IEEE 802.11i and TLS

Preventing attribute information leakage in automated trust negotiation

Applications of secure electronic voting to automated privacy-preserving troubleshooting

New approaches for deniable authentication

CPOL: high-performance policy evaluation

Modeling insider attacks on group key-exchange protocols

Fast and automated generation of attack signatures: a basis for building self-protecting servers

A framework for concrete reputation-systems with applications to history-based access control

Password authenticated key exchange using hidden smooth subgroups

Automatic placement of authorization hooks in the linux security modules framework

Fast dictionary attacks on passwords using time-space tradeoff

Security market: incentives for disclosure of vulnerabilities

Deciding security of protocols against off-line guessing attacks

Automated trust negotiation using cryptographic credentials

Tracking anonymous peer-to-peer VoIP calls on the internet

On authenticated computing and RSA-based authentication

Understanding and developing role-based administrative models

Dynamic and efficient key management for access hierarchies

Automatic diagnosis and response to memory corruption vulnerabilities

An auctioning reputation system based on anomaly

Proxy re-signatures: new definitions, algorithms, and applications

Control-flow integrity

Keyboard acoustic emanations revisited

Identity-based encryption from algorithm to enterprise deployment

Secrecy types for a simulatable cryptographic library

Secure collaboration in mediator-free environments

Untraceable RFID tags via insubvertible encryption

Aggregated path authentication for efficient BGP security

PeerAccess: a logic for distributed authorization

A model and architecture for pseudo-random generation with applications to /dev/random

On deriving unknown vulnerabilities from zero-day polymorphic and metamorphic worm exploits

On the cost-ineffectiveness of redundancy in commercial P2P computing

Direct chosen ciphertext security from identity-based techniques

Preventing format-string attacks via automatic and efficient dynamic checking

Misbehaving TCP receivers can cause internet-wide congestion collapse

Biometrics hit the mainstream: an analysis of security and privacy implications

Obfuscated databases and group privacy

Improving Brumley and Boneh timing attack on unprotected SSL implementations

Countering DoS attacks with stateless multipath overlays

Securing publish-subscribe overlay services with EventGuard

Exploiting open functionality in SMS-capable cellular networks

On deriving unknown vulnerabilities from zero-day polymorphic and metamorphic worm exploits

Content Provider	ACM Digital Library
Author	Wu, S. Felix Chong, Frederic T. Crandall, Jedidiah R. Su, Zhendong
Abstract	Vulnerabilities that allow worms to hijack the control flow of each host that they spread to are typically discovered months before the worm outbreak, but are also typically discovered by third party researchers. A determined attacker could discover vulnerabilities as easily and create zero-day worms for vulnerabilities unknown to network defenses. It is important for an analysis tool to be able to generalize from a new exploit observed and derive protection for the vulnerability.Many researchers have observed that certain predicates of the exploit vector must be present for the exploit to work and that therefore these predicates place a limit on the amount of polymorphism and metamorphism available to the attacker. We formalize this idea and subject it to quantitative analysis with a symbolic execution tool called DACODA. Using DACODA we provide an empirical analysis of 14 exploits (seven of them actual worms or attacks from the Internet, caught by Minos with no prior knowledge of the vulnerabilities and no false positives observed over a period of six months) for four operating systems.Evaluation of our results in the light of these two models leads us to conclude that 1) single contiguous byte string signatures are not effective for content filtering, and token-based byte string signatures composed of smaller substrings are only semantically rich enough to be effective for content filtering if the vulnerability lies in a part of a protocol that is not commonly used, and that 2) practical exploit analysis must account for multiple processes, multithreading, and kernel processing of network data necessitating a focus on primitives instead of vulnerabilities.
Starting Page	235
Ending Page	248
Page Count	14
File Format	PDF
ISBN	1595932267
DOI	10.1145/1102120.1102152
Language	English
Publisher	Association for Computing Machinery (ACM)
Publisher Date	2005-11-07
Publisher Place	New York
Access Restriction	Subscribed
Subject Keyword	Metamorphism Polymorphic worms Symbolic execution Worms Honeypots Polymorphism
Content Type	Text
Resource Type	Article

Sl.	Authority	Responsibilities	Communication Details
1	Ministry of Education (GoI), Department of Higher Education	Sanctioning Authority	https://www.education.gov.in/ict-initiatives
2	Indian Institute of Technology Kharagpur	Host Institute of the Project: The host institute of the project is responsible for providing infrastructure support and hosting the project	https://www.iitkgp.ac.in
3	National Digital Library of India Office, Indian Institute of Technology Kharagpur	The administrative and infrastructural headquarters of the project	Dr. B. Sutradhar bsutra@ndl.gov.in
4	Project PI / Joint PI	Principal Investigator and Joint Principal Investigators of the project	Dr. B. Sutradhar bsutra@ndl.gov.in Prof. Saswat Chakrabarti will be added soon
5	Website/Portal (Helpdesk)	Queries regarding NDLI and its services	support@ndl.gov.in
6	Contents and Copyright Issues	Queries related to content curation and copyright issues	content@ndl.gov.in
7	National Digital Library of India Club (NDLI Club)	Queries related to NDLI Club formation, support, user awareness program, seminar/symposium, collaboration, social media, promotion, and outreach	clubsupport@ndl.gov.in
8	Digital Preservation Centre (DPC)	Assistance with digitizing and archiving copyright-free printed books	dpc@ndl.gov.in
9	IDR Setup or Support	Queries related to establishment and support of Institutional Digital Repository (IDR) and IDR workshops	idr@ndl.gov.in

On deriving unknown vulnerabilities from zero-day polymorphic and metamorphic worm exploits (2005)

On Deriving Unknown Vulnerabilities from Zero-Day Polymorphic and Metamorphic Worm Exploits (2005)

WormTerminator: an effective containment of unknown and polymorphic fast spreading worms

Polyvaccine: protecting web servers against zero-day, polymorphic and metamorphic exploits ⋆.

PolyVaccine: Protecting Web Servers against Zero-Day, Polymorphic and Metamorphic Exploits

A Host-Based Approach for Unknown Fast-Spreading Worm Detection and Containment

WormTerminator

Eudaemon: involuntary and on-demand emulation against zero-day exploits

Efficient hybrid technique for detecting zero-day polymorphic worms

On deriving unknown vulnerabilities from zero-day polymorphic and metamorphic worm exploits

Similar Documents

On deriving unknown vulnerabilities from zero-day polymorphic and metamorphic worm exploits (2005)

On Deriving Unknown Vulnerabilities from Zero-Day Polymorphic and Metamorphic Worm Exploits (2005)

WormTerminator: an effective containment of unknown and polymorphic fast spreading worms

Polyvaccine: protecting web servers against zero-day, polymorphic and metamorphic exploits ⋆.

PolyVaccine: Protecting Web Servers against Zero-Day, Polymorphic and Metamorphic Exploits

A Host-Based Approach for Unknown Fast-Spreading Worm Detection and Containment

WormTerminator

Eudaemon: involuntary and on-demand emulation against zero-day exploits

Efficient hybrid technique for detecting zero-day polymorphic worms

On deriving unknown vulnerabilities from zero-day polymorphic and metamorphic worm exploits