Program transformation techniques for host-based intrusion prevention

摘要: A control hijacking attack exploits software vulnerabilities such as buffer overflow to seize the execution of a server program, and uses privileges victim program make system calls compromise computer. In this dissertation, we first present novel low overhead array bounds checking called Cash that prevents from happening. Even if an can successfully hijack defense Paid prevent making illegitimate calls. The approach allocates separate segment each static or dynamic array, generates instructions for references in way limit check X86's virtual memory protection mechanism performs required free. those cases hardware is not possible, it falls back checking. call based intrusion prevention system, which includes comprehensive analysis tool automatically derive accurate application-specific model, information sites, stacks, order, their constant arguments, application's source code. checks run-time pattern against model control-hijacking attacks doing any harm. User-driven are carried out by deceiving computer users download execute malicious programs viruses worms. Sandboxing well-known technique protect end hosts mobile dissertation focus on problem how determine when sandbox application given operate both local files (more trustworthy) network inputs (less trustworthy), sometimes even simultaneously. This presents taint compiler Aussum , instrument arbitrary C track throughout entire application, mark tainted contain data derived inputs. Eventually, helps underlying sandboxing executables applications files, selectively invocations use input arguments.