Automating mimicry attacks using static binary analysis

摘要: Intrusion detection systems that monitor sequences of system calls have recently become more sophisticated in defining legitimate application behavior. In particular, additional information, such as the value program counter and configuration program's call stack at each call, has been used to achieve better characterization While there is common agreement this information complicates task for attacker, it less clear which extent an intruder constrained. In paper, we present a novel technique evade extended features state-of-the-art intrusion reduce traditional mimicry attack. Given sequence calls, our allows attacker execute correct execution context by obtaining relinquishing control application's flow through manipulation code pointers. We developed static analysis tool Intel x86 binaries uses symbolic automatically identify instructions can be redirect compute necessary modifications environment process. We successfully exploit three vulnerable programs existing monitors. addition, analyzed real-world applications verify general applicability techniques.