DIRA: Automatic Detection, Identification and Repair of Control-Hijacking Attacks.

摘要: Buffer overflow attacks are known to be the most common type of that allow attackers hijack a remote system by sending specially crafted packet vulnerable network application running on it. A comprehensive defense strategy against such should include (1) an attack detection component determines fact program is compromised and prevents from further propagation, (2) identification identifies packets so one can block in future, (3) repair restores application’s state before allows it continue normally. Over last decade, significant amount research has been vested systems detect buffer either statically at compile time or dynamically run time. However, not much effort spent automated repair. In this paper we present unified solution three problems mentioned above. We implemented as GCC compiler extension called DIRA transforms program’s source code resulting automatically any it, memory damage left attack, identify actual packet(s). used several applications with vulnerabilities tested DIRA’s effectiveness attacking transformed programs publicly available exploit code. The DIRA-compiled were always able attacks, often themselves normal execution. average run-time performance overhead for repair/identification 4% 25% respectively.