NDLI: Enforcing system-wide control flow integrity for exploit detection and diagnosis

Please wait, while we are loading the content...

AppInk: watermarking android apps for repackaging deterrence

Multi-key leakage-resilient threshold cryptography

Looking at the bag is not enough to find the bomb: an evasion of structural methods for malicious PDF files detection

SocialWatch: detection of online service abuse via large-scale social graphs

The role and effectiveness of cryptography in network virtualization: a position paper

Efficient dynamic provable possession of remote data via balanced update trees

Expressive search on encrypted data

Gadge me if you can: secure and efficient ad-hoc instruction-level randomization for x86 and ARM

Secure cloud-assisted location based reminder

k-anonymous reputation

Robust network traffic identification with unknown applications

TabShots: client-side detection of tabnabbing attacks

LogicScope: automatic discovery of logic vulnerabilities within web applications

Towards fully incremental cryptographic schemes

PSiOS: bring your own privacy & security to iOS devices

Privacy-preserving multi-keyword text search in the cloud supporting similarity-based ranking

Efficient user-space information flow control

Privacy settings in social networking systems: what you cannot control

Weak leakage-resilient client-side deduplication of encrypted data in cloud storage

Towards asymmetric searchable encryption with message recovery and flexible search authorization

Enforcing system-wide control flow integrity for exploit detection and diagnosis

DroidChameleon: evaluating Android anti-malware against transformation attacks

Privacy-preserving smart metering with regional statistics and personal enquiry services

STRIDE: sanctuary trail -- refuge from internet DDoS entrapment

Fuzzing the ActionScript virtual machine

Protecting function pointers in binary

Anonymous attribute-based encryption supporting efficient decryption test

On the effectiveness of API-level access control using bytecode rewriting in Android

Practical and post-quantum authenticated key exchange from one-way secure key encapsulation mechanism

Trustworthy distributed computing on social networks

Data-oblivious graph algorithms for secure computation and outsourcing

Boolean symmetric searchable encryption

Bind your phone number with caution: automated user profiling through address book matching on smartphone

Protecting privacy by sanitizing personal data: a new approach to anonymous credentials

Practical verification of WPA-TKIP vulnerabilities

Sensing-enabled channels for hard-to-detect command and control of mobile devices

The (un)reliability of NVD vulnerable versions data: an empirical experiment on Google Chrome vulnerabilities

A group signature scheme with unbounded message-dependent opening

Designing leakage-resilient password entry on touchscreen mobile devices

Blank digital signatures

On the feasibility of inference attacks by third-party extensions to social network systems

SecLaaS: secure logging-as-a-service for cloud forensics

Multi-channel broadcast encryption

Towards preventing QR code based attacks on android phone using security warnings

An information-flow type-system for mixed protocol secure computation

Faster secure two-party computation with less memory

Horizon extender: long-term preservation of data leakage evidence in web traffic

Attribute-based fine-grained access control with efficient revocation in cloud storage systems

Your love is public now: questioning the use of personal information in authentication

Pseudorandom signatures

Dynamix: anonymity on dynamic social structures

An empirical study on the software integrity of virtual appliances: are you really getting what you paid for?

Comparative study of multicast authentication schemes with application to wide-area measurement system

Time evolving graphical password for securing mobile devices

Covert computation: hiding code in code for obfuscation purposes

Protecting access privacy of cached contents in information centric networks

DroidAlarm: an all-sided static analysis tool for Android privilege-escalation malware

Proof of plaintext knowledge for code-based public-key encryption revisited

An efficient and probabilistic secure bit-decomposition

Defining verifiability in e-auction protocols

Verifiable and private top-k monitoring

Enforcing system-wide control flow integrity for exploit detection and diagnosis

Content Provider	ACM Digital Library
Author	Yin, Heng Prakash, Aravind Liang, Zhenkai
Abstract	Modern malware like Stuxnet is complex and exploits multiple vulnerabilites in not only the user level processes but also the OS kernel to compromise a system. A main trait of such exploits is manipulation of control flow. There is a pressing need to diagnose such exploits. Existing solutions that monitor control flow either have large overhead or high false positives and false negatives, hence making their deployment impractical. In this paper, we present Total-CFI, an efficient and practical tool built on a software emulator, capable of exploit detection by enforcing system-wide Control Flow Integrity (CFI). Total-CFI performs punctual guest OS view reconstruction to identify key guest kernel semantics like processes, code modules and threads. It incorporates a novel thread stack identification algorithm that identifies the stack boundaries for different threads in the system. Furthermore, Total-CFI enforces a CFI policy - a combination of whitelist based and shadow call stack based approaches to monitor indirect control flows and detect exploits. We provide a proof-of-concept implementation of Total-CFI on DECAF, built on top of Qemu. We tested 25 commonly used programs and 7 recent real world exploits on Windows OS and found 0 false positives and 0 false negatives respectively. The boot time overhead was found to be no more than 64.1% and the average memory overhead was found to be 7.46KB per loaded module, making it feasible for hardware integration.
Starting Page	311
Ending Page	322
Page Count	12
File Format	PDF
ISBN	9781450317672
DOI	10.1145/2484313.2484352
Language	English
Publisher	Association for Computing Machinery (ACM)
Publisher Date	2013-05-08
Publisher Place	New York
Access Restriction	Subscribed
Subject Keyword	Exploit diagnosis Vulnerability detection Virtual machine introspection Exploit detection Software security
Content Type	Text
Resource Type	Article

Central Library (ISO-9001:2015 Certified)
Indian Institute of Technology Kharagpur
Kharagpur, West Bengal, India | PIN - 721302

See location in the Map
03222 282435
Mail: support@ndl.gov.in

Sl.	Authority	Responsibilities	Communication Details
1	Ministry of Education (GoI), Department of Higher Education	Sanctioning Authority	https://www.education.gov.in/ict-initiatives
2	Indian Institute of Technology Kharagpur	Host Institute of the Project: The host institute of the project is responsible for providing infrastructure support and hosting the project	https://www.iitkgp.ac.in
3	National Digital Library of India Office, Indian Institute of Technology Kharagpur	The administrative and infrastructural headquarters of the project	Dr. B. Sutradhar bsutra@ndl.gov.in
4	Project PI / Joint PI	Principal Investigator and Joint Principal Investigators of the project	Dr. B. Sutradhar bsutra@ndl.gov.in Prof. Saswat Chakrabarti will be added soon
5	Website/Portal (Helpdesk)	Queries regarding NDLI and its services	support@ndl.gov.in
6	Contents and Copyright Issues	Queries related to content curation and copyright issues	content@ndl.gov.in
7	National Digital Library of India Club (NDLI Club)	Queries related to NDLI Club formation, support, user awareness program, seminar/symposium, collaboration, social media, promotion, and outreach	clubsupport@ndl.gov.in
8	Digital Preservation Centre (DPC)	Assistance with digitizing and archiving copyright-free printed books	dpc@ndl.gov.in
9	IDR Setup or Support	Queries related to establishment and support of Institutional Digital Repository (IDR) and IDR workshops	idr@ndl.gov.in