Semantic aware attribution analysis of remote exploits

Abstract

Web services have been greatly threatened by remote exploit code attacks, where maliciously crafted HTTP requests are used to inject binary code to compromise web servers and web applications. In practice, besides detection of such attacks, attack attribution analysis (i.e., to automatically categorize exploits or determine whether an exploit is a variant of an attack from the past) is also very important. In this paper, we present SA3, a novel exploit code attribution analysis that combines semantics‐based analysis and statistical modeling to automatically categorize given exploit code. SA3 extracts semantic features from exploit code through data anomaly analysis and then attributes the exploit to an appropriate class on the basis of our statistical model derived from a Markov model. We evaluate SA3 over a comprehensive set of shellcode collected from Metasploit and other polymorphic engines. Experimental results show that SA3 is effective and efficient. The attribution analysis accuracy can be over 90% in different parameter settings with false positive rate no more than 4.5%. The novelty of SA3 is that it combines semantic analysis with statistical modeling for exploit code attribution analysis. Copyright © 2012 John Wiley & Sons, Ltd.

Neyman-Pearson classification algorithms and NP receiver operating characteristics

“…The NP-ROC lower curves have been successfully applied in a comparison of similarity measures for gene expression samples, where the prioritized type of error is mispredicting dissimilar samples as similar, because the samples, if predicted similar, will be used for further biological interpretation (40). Other potential applications include biomedical applications such as disease diagnosis (18,19), engineering applications such as network security control (20,21), financial applications such as loan screening (30) and financial data forecasting (41)(42)(43)(44), and social applications such as prediction of regional and international conflicts (23)(24)(25).…”

“…In many biomedical, engineering, and social applications, users often have prespecified a values to reflect their tolerance on the type I errors and use diverse classification algorithms. Example applications include diagnosis of coronary artery disease (18), cancer early warning system (19), network security control (20,21), Environmental Protection Agency water security research (22), prediction of regional and international conflicts (23,24), and the Early Warning Project to identify countries at risk of new mass atrocities (25). However, existing ad hoc use of classification algorithms cannot control type I errors under a with high probability.…”

A Malware Obfuscation AI Technique to Evade Antivirus Detection in Counter Forensic Domain

“…Kong et al [15] have developed a semantic-aware analysis, the semantic aware inspection is having the ability to detect code manipulation such as renaming the processor registers or instruction reordering-all common obfuscation techniques. However, the disadvantage is that this tool can only identify a limited set of obfuscation tricks (i.e.…”

Attribution in cyberspace: techniques and legal implications

“…Although the scheme is focused on the detection of malware, it can be extended for attribution by incorporating behavioral analysis of attackers. Some researchers have also exploited the use of semantics and statistical modeling to establish attribution . Genetic algorithms …”