Network-Based Buffer Overflow Detection by Exploit Code Analysis

摘要: Buffer overflow attacks continue to be a major security problem and detecting of this nature is therefore crucial network security. Signature based intrusion detection systems (NIDS) compare traffic signatures modelling suspicious or attack detect attacks. Since on pattern matching, signature the must exist for NIDS it, it only capable known This paper proposes method buffer by parsing payload packets in search shellcode which remotely executable component attack. By analysing possible determine system calls exploit uses, hence operation exploit. Current NIDS-based techniques mainly rely upon specific each new Our approach able previously unseen attacks, addition existing ones, without need The has been implemented tested Linux Intel x86 architecture using Snort NIDS.