Trin-Trin: Who’s Calling? A Pin-Based Dynamic Call Graph Extraction Framework

Jalan, Rohit; Kejariwal, Arun

doi:10.1007/s10766-012-0193-x

Cited by 13 publications

(5 citation statements)

References 46 publications

(34 reference statements)

Supporting

Mentioning

Contrasting

Order By: Relevance

“…sshd experiences a 167% overhead on average when our Pintool is loaded. A similar 141% overhead is reported by Jalan and Kejariwal in their dynamic call graph Pintool Trin-Trin [31].…”

Section: Performance Analysissupporting

confidence: 75%

Long-Span Program Behavior Modeling and Attack Detection

Shu¹,

Yao

Ramakrishnan

et al. 2017

ACM Trans. Priv. Secur.

View full text Add to dashboard Cite

Intertwined developments between program attacks and defenses witness the evolution of program anomaly detection methods. Emerging categories of program attacks, e.g., non-control data attacks and data-oriented programming, are able to comply with normal trace patterns at local views. This article points out the deficiency of existing program anomaly detection models against new attacks and presents long-span behavior anomaly detection (LAD), a model based on mildly context-sensitive grammar verification. The key feature of LAD is its reasoning of correlations among arbitrary events that occurred in long program traces. It extends existing correlation analysis between events at a stack snapshot, e.g., paired call and ret, to correlation analysis among events that historically occurred during the execution. The proposed method leverages specialized machine learning techniques to probe normal program behavior boundaries in vast high-dimensional detection space. Its two-stage modeling/detection design analyzes event correlation at both binary and quantitative levels. Our prototype successfully detects all reproduced real-world attacks against sshd, libpcre, and sendmail. The detection procedure incurs 0.1 ms to 1.3 ms overhead to profile and analyze a single behavior instance that consists of tens of thousands of function call or system call events. North Glebe Road, Arlington, VA 22203; email: naren@cs.vt.edu; T. Jaeger, 346A IST Building, University Park, PA 16802; email: tjaeger@cse.psu.edu. Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. Copyrights for components of this work owned by others than the author(s) must be honored. Abstracting with credit is permitted. To copy otherwise, or republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. Request permissions from permissions@acm.org. 12:2 X. Shu et al. INTRODUCTIONAttacks to programs are one of the oldest and fundamental threats to computing systems, which evolve and constitute latest attack vectors and advanced persistent threats. Anomaly-based intrusion detection discovers aberrant executions caused by attacks, misconfigurations, program bugs, and unusual usage patterns. The approach models normal program behaviors instead of the threats. It does not bear time lags between emerging attacks and deployed countermeasures as standard defenses do, which are built upon retrospects of inspected attacks. The merit of program anomaly detection is its independence from attack signatures. This property potentially enables proactive defenses against new and unknown threats.The detection accuracy of program anomaly detection methods relies on the precision of normal program behavior description and the completeness of the training [54]. Primitive program attacks, e.g., return addresses mani...

show abstract

“…sshd experiences a 167% overhead on average when our Pintool is loaded. A similar 141% overhead is reported by Jalan and Kejariwal in their dynamic call graph Pintool Trin-Trin [31].…”

Section: Performance Analysissupporting

confidence: 75%

Long-Span Program Behavior Modeling and Attack Detection

Shu¹,

Yao

Ramakrishnan

et al. 2017

ACM Trans. Priv. Secur.

View full text Add to dashboard Cite

show abstract

“…sshd experiences a 167% overhead on average when our Pintool is loaded. A similar 141% overhead is reported by Jalan and Kejariwal in their dynamic call graph Pintool Trin-Trin [24]. Advanced tracing techniques, e.g., probe mode pintool, branch target store [48], etc., can potentially reduce the tracing overhead to less than 10% toward a real-time detection system.…”

Section: Performance Analysissupporting

confidence: 61%

Unearthing Stealthy Program Attacks Buried in Extremely Long Execution Paths

Shu

Yao

Ramakrishnan

2015

Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security

View full text Add to dashboard Cite

Modern stealthy exploits can achieve attack goals without introducing illegal control flows, e.g., tampering with noncontrol data and waiting for the modified data to propagate and alter the control flow legally. Existing program anomaly detection systems focusing on legal control flow attestation and short call sequence verification are inadequate to detect such stealthy attacks. In this paper, we point out the need to analyze program execution paths and discover event correlations in large-scale execution windows among millions of instructions. We propose an anomaly detection approach with two-stage machine learning algorithms to recognize diverse normal call-correlation patterns and detect program attacks at both inter-and intra-cluster levels. We implement a prototype of our approach and demonstrate its effectiveness against three real-world attacks and four synthetic anomalies with less than 0.01% false positive rates and 0.1~1.3 ms analysis overhead per behavior instance (1k to 50k function or system calls).

show abstract

“…Generation methods such as those that use the Pin mechanism can only be utilized in user-level program analysis. Jalan built a framework called Trin-Trin to analyze function calling relations using the Pin mechanism [18]. Pin is provided by Intel CPU for the purpose of analyzing programs, and allows programmers to conFig.…”

Section: Related Workmentioning

confidence: 99%

AIT: A method for operating system kernel function call graph generation with a virtualization technique

Jiao¹,

Luo²,

Liu³

et al. 2020

KSII TIIS

View full text Add to dashboard Cite

Operating system (OS) kernel function call graphs have been widely used in OS analysis and defense. However, most existing methods and tools for generating function call graphs are designed for application programs, and cannot be used for generating OS kernel function call graphs. This paper proposes a virtualization-based call graph generation method called Acquire in Trap (AIT). When target kernel functions are called, AIT dynamically initiates a system trap with the help of a virtualization technique. It then analyzes and records the calling relationships for trap handling by traversing the kernel stacks and the code space. Our experimental results show that the proposed method is feasible for both Linux and Windows OSs, including 32 and 64-bit versions, with high recall and precision rates. AIT is independent of the source code, compiler and OS kernel architecture, and is a universal method for generating OS kernel function call graphs.

show abstract

Trin-Trin: Who’s Calling? A Pin-Based Dynamic Call Graph Extraction Framework

Cited by 13 publications

References 46 publications

Long-Span Program Behavior Modeling and Attack Detection

Long-Span Program Behavior Modeling and Attack Detection

Unearthing Stealthy Program Attacks Buried in Extremely Long Execution Paths

AIT: A method for operating system kernel function call graph generation with a virtualization technique

Contact Info

Product

Resources

About