Network-level polymorphic shellcode detection using emulation

摘要: Significant progress has been made in recent years towards preventing code injection attacks at the network level. However, as state-of-the-art attack detection technology becomes more prevalent, attackers are likely to evolve, employing techniques such polymorphism and metamorphism defeat these defenses. A major outstanding question security research engineering is thus whether we can proactively develop tools needed contain advanced polymorphic metamorphic attacks. While results have promising, most of existing proposals be defeated using only minor enhancements vector. In fact, some publicly-available shellcode engines currently one step ahead publicly-documented network-level detectors. this paper, present a heuristic method that scans traffic streams for presence previously unknown shellcode. contrast previous work, our approach relies on NIDS- embedded CPU emulator executes every potential instruction sequence inspected traffic, aiming identify execution behavior Our analysis demonstrates proposed robust obfuscation like self-modifications compared proposals, but also highlights evasion need closely examined satisfactory solution problem.