A Practical Approach for Detecting Executable Codes in Network Traffic

Kim, Ikkyun; Kang, Kwan Hyoung; Choi, Yang‐Kyu; Kim, Daewon; Oh, Jihyun; Han, Kijun

doi:10.1007/978-3-540-75476-3_36

Cited by 2 publications

(2 citation statements)

References 5 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…We note that even using the same 13 instruction groups in[8] we could not verify their results because of inconsistencies and ambiguous statements in their manuscript.…”

mentioning

confidence: 78%

See 1 more Smart Citation

English shellcode

Mason

Small

Monrose

et al. 2009

Proceedings of the 16th ACM Conference on Computer and Communications Security

View full text Add to dashboard Cite

History indicates that the security community commonly takes a divide-and-conquer approach to battling malware threats: identify the essential and inalienable components of an attack, then develop detection and prevention techniques that directly target one or more of the essential components. This abstraction is evident in much of the literature for buffer overflow attacks including, for instance, stack protection and NOP sled detection. It comes as no surprise then that we approach shellcode detection and prevention in a similar fashion. However, the common belief that components of polymorphic shellcode (e.g., the decoder) cannot reliably be hidden suggests a more implicit and broader assumption that continues to drive contemporary research: namely, that valid and complete representations of shellcode are fundamentally different in structure than benign payloads. While the first tenet of this assumption is philosophically undeniable (i.e., a string of bytes is either shellcode or it is not), truth of the latter claim is less obvious if there exist encoding techniques capable of producing shellcode with features nearly indistinguishable from non-executable content. In this paper, we challenge the assumption that shellcode must conform to superficial and discernible representations. Specifically, we demonstrate a technique for automatically producing English Shellcode, transforming arbitrary shellcode into a representation that is superficially similar to English prose. The shellcode is completely self-containedi.e., it does not require an external loader and executes as valid IA32 code)-and can typically be generated in under an hour on commodity hardware. Our primary objective in this paper is to promote discussion and stimulate new ideas for thinking ahead about preventive measures for tackling evolutions in code-injection attacks.

show abstract

“…We note that even using the same 13 instruction groups in[8] we could not verify their results because of inconsistencies and ambiguous statements in their manuscript.…”

mentioning

confidence: 78%

“…5 Instead, for pedagogical reasons, we revisit a recent approach that is based on using spectrum analysis to detect the presence of executable code in network traffic in lieu of emulation [8].…”

Section: Discussionmentioning

confidence: 99%

English shellcode

Mason

Small

Monrose

et al. 2009

Proceedings of the 16th ACM Conference on Computer and Communications Security

View full text Add to dashboard Cite

show abstract

A Hybrid Detection Approach for Zero-Day Polymorphic Shellcodes

Chen

Zhang

Liu

2009

2009 International Conference on E-Business and Information System Security

View full text Add to dashboard Cite

Zero-day shellcodes has become a major threat to the Internet with complex obfuscation techniques. However, even the state-of-the-art NIDS has small chances of detecting them because they rely on known signatures. This paper presents Hybrid Detection for zero-day Polymorphic Shellcodes (HDPS) against shellcodes using various obfuscations. Our approach employs a heuristic approach to detect return address and filter mass innocent network flows, and then constructs a Markov Model to detect the existence and location of executable codes in suspicious flows. Finally, it applies an elaborate approach to detect NOP Sleds in the executable codes. Initial experiments show HDPS detects nearly all types of shellcodes, and the false positive rate approximates zero with low overhead.

show abstract

A Practical Approach for Detecting Executable Codes in Network Traffic

Cited by 2 publications

References 5 publications

English shellcode

English shellcode

A Hybrid Detection Approach for Zero-Day Polymorphic Shellcodes

Contact Info

Product

Resources

About