SA3: Automatic Semantic Aware Attribution Analysis of Remote Exploits

Abstract

Abstract. Web services have been greatly threatened by remote exploit code attacks, where maliciously crafted HTTP requests are used to inject binary code to compromise web servers and web applications. In practice, besides detection of such attacks, attack attribution analysis, i.e., to automatically categorize exploits or to determine whether an exploit is a variant of an attack from the past, is also very important. In this paper, we present SA 3 , an exploit code attribution analysis which combines semantic analysis and statistical analysis to automatically categorize a given exploit code. SA 3 extracts semantic features from an exploit code through data anomaly analysis, and then attributes the exploit to an appropriate class based on our statistical model derived from a Markov model. We evaluate SA 3 over a comprehensive set of shellcode collected from Metasploit and other polymorphic engines. Experimental results show that SA 3 is effective and efficient. The attribution analysis accuracy can be over 90% in different parameter settings with false positive rate no more than 4.5%. To our knowledge, SA 3 is the first work combining semantic analysis with statistical analysis for exploit code attribution analysis.

Using instruction sequence abstraction for shellcode detection and attribution

“…We performed the same testing procedure mentioned in the previous section to test the accuracy of our model for 2, ..., 13 shellcode classes. Our model can achieve 100% classification accuracy for up to 6 shellcode engines and 95.0% classification accuracy for 11 classes, which is higher than previous efforts [16]. Note that, compared with [16] in which a specific model is built for each shellcode class, our approach only use one model to classify instances from all kinds of classes, hence does not need different parameter settings for each model.…”

“…Even though some payloads are not compatible with specific encoders, we successfully collected 13,176 encoded shellcode samples for attribution analysis. Compared with existing research bodies in both shellcode detection and attribution [7], [30], [26], [29], [16], our shellcode dataset covers a more comprehensive set of samples in term of underlying platform, payload functionality, and encoder class.…”

“…However, their solutions were vulnerable to byte cramming [12] and polymorphic blending attacks [13]. Recently, Kong et al [16] proposed to take advantage of semantic analysis and sequential models on n-gram data bytes to analyze the attribution of exploits. Wartell et al [31] developed machine learning-based algorithms to differentiate code from data.…”

“…Encoded shellcode attribution that tells whether the newly-captured shellcode sample is generated by a known shellcode engine provides security analysts and practitioners with more intelligence about the attack event and the adversaries behind the scene than simplistic detection approaches. However, existing work on this topic [16] that utilize byte characteristics still face the same challenges as binary code detection with byte anomaly analysis does.…”

Discriminant malware distance learning on structural information for automated malware classification

“…A few other efforts (e.g., [7,14,10,1,12,13]) also considered using the structure information in malware programs. For instance, Hu et al used FCGs extracted from malware programs for fast indexing, which aims to find the nearest neighbors of a new malware sample [7], and Kruegel et al formulated the problem of polymorphic worm detection as coloring of control flow graphs [14].…”