Runtime Detection of Zero-Day Vulnerability Exploits in Contemporary Software Systems

Abstract

It is argued that runtime verification techniques can be used to identify unknown application security vulnerabilities that are a consequence of unexpected execution paths in software. A methodology is proposed that can be used to build a model of expected application execution paths during the software development cycle. This model is used at runtime to detect exploitation of unknown security vulnerabilities using anomaly detection style techniques. The approach is evaluated by considering its effectiveness in identifying 19 vulnerabilities across 26 versions of Apache Struts over a 5 year period. Contemporary software developmentContemporary software is implemented using a variety of high-level programming languages, software frameworks and third party components. While applicationlevel code may appear straightforward, enabling rapid and low-cost application development, its underlying system is a complex arrangement of inter-dependent class PostAction extends ApiAction { private String message; public void setMessage(String msg) { this.message = msg; } public void execute(){ String userId = getUser().getId(); datastore.add(userId, message); } public User getUser() { return getSession().get(USER); } } StrutsActionProxy: PostAction.<init>

Advanced Persistent Threats based on Supply Chain Vulnerabilities: Challenges, Solutions and Future Directions

“…This compromise allows the attacker to inject malicious code into the software or hardware [16], leading to the infection of downstream components in the supply chain. Another common threat is the exploitation of zero-day vulnerabilities in software (ZDS) [47], [48]. Zero-day vulnerabilities refer to unknown vulnerabilities in software that are not yet patched or mitigated by the software vendor.…”

SMINER: Detecting Unrestricted and Misimplemented Behaviors of Software Systems Based on Unit Test Cases

“…However, discovering the other types of vulnerabilities in an automated way is a field that has not been explored yet in depth [4]. As we can observe in the cases of Apache Struts [5], Shellshock [6], and Heartbleed [2], security design flaws do not affect the functionality of software systems, but they can cause serious security accidents such as remote code executions [7][8][9]. However, these vulnerabilities are difficult to detect and there have not been many research efforts conducted to develop effective, automated approaches that can find such security vulnerabilities [10].…”

Anomaly‐based exploratory analysis and detection of exploits in android mediaserver

“…System calls are a widely used feature for this [12,13]. Anomaly detection systems are highly interesting in this context, specially to fight against zero-day attacks and vulnerability exploitation [14].…”