Foreign Code Detection on the Windows/X86 Platform

摘要: As new attacks against Windows-based machines emerge almost on a daily basis, there is an increasing need to "lock down" individual users' desktop in corporate computing environments. One particular way lock down user computer guarantee that only authorized binary programs are allowed run computer. A major advantage of this approach binaries downloaded without the user's knowledge, such as spyware, ad-ware, or code entering through buffer overflow attacks, can never computers locked way. This paper presents design, implementation and evaluation FOOD, foreign detection system specifically for Windows/X86platform, where defined any do not go installation procedure. FOOD verifies legitimacy images involved process creation library loading ensure used these operations. In addition, checks target address every indirect branch instruction Windows prevent illegitimate control transfers either dynamically injected mobile pre-existing functions potentially damaging. Combined together, techniques strictly execution code. Experiments with fully working prototype show it indeed stop all spyware we tested, its worst-case run-time performance overhead associated less than 35%