Emulation-based detection of non-self-contained polymorphic shellcode

摘要: Network-level emulation has recently been proposed as a method for the accurate detection of previously unknown polymorphic code injection attacks. In this paper, we extend network-level along two lines. First, present an improved execution behavior heuristic that enables certain class non-self-contained shellcodes are currently missed by existing emulation-based approaches. Second, generic algorithmic optimizations improve runtime performance detector. We have implemented prototype technique and evaluated it using off-the-shelf shellcode engines benign data. The detector achieves modest processing throughput, which however is enough decent on actual deployments, while not produced any false positives. Finally, report attack activity statistics from seven-month deployment our in production network, demonstrate effectiveness practicality approach.