SHELLOS: enabling fast detection and forensic analysis of code injection attacks

摘要: The availability of off-the-shelf exploitation toolkits for compromising hosts, coupled with the rapid rate exploit discovery and disclosure, has made or vulnerability-based detection far less effective than it once was. For instance, increasing use metamorphic polymorphic techniques to deploy code injection attacks continues confound signature-based techniques. key detecting these lies in ability discover presence injected (or, shellcode). One promising technique doing so is examine data (be that from network streams buffers a process) efficiently execute its content find what lurks within. Unfortunately, current approaches achieving this goal are not robust evasion scalable, primarily because their reliance on software-based CPU emulators. In paper, we argue emulation necessary, instead propose new framework leverages hardware virtualization better enable attacks. We also report our experience using analyze corpus malicious Portable Document Format (PDF) files network-based