检索结果-内蒙古大学图书馆

exploitGen: Template-augmented exploit code generation based on codeBERT

JOURNAL OF SYSTEMS AND SOFTWARE 2023年 197卷

作者： Yang, Guang Zhou, Yu Chen, Xiang Zhang, Xiangyu Han, Tingting Chen, Taolue Nanjing Univ Aeronaut & Astronaut Coll Comp Sci & Technol Nanjing Peoples R China Minist Ind & Informat Technol Key Lab Safety Crit Software Nanjing Peoples R China Nantong Univ Sch Informat Sci & Technol Nantong Peoples R China Birkbeck Univ London Dept Comp Sci & Data Sci London England

exploit code is widely used for detecting vulnerabilities and implementing defensive measures. However, automatic generation of exploit code for security assessment is a challenging task. In this paper, we propose a novel template-augmented exploit code generation approach exploitGen based on codeBERT. Specifically, we first propose a rule-based Template Parser to generate template-augmented natural language descriptions (NL). Both the raw and template-augmented NL sequences are encoded to context vectors by the respective encoders. For better learning semantic information, exploitGen incorporates a semantic attention layer, which uses the attention mechanism to extract and calculate each layer's representational information. In addition, exploitGen computes the interaction information between the template information and the semantics of the raw NL and designs a residual connection to append the template information into the semantics of the raw NL. Comprehensive experiments on two datasets show the effectiveness of exploitGen after comparison with six state-of-the-art baselines. Apart from the automatic evaluation, we conduct a human study to evaluate the quality of generated code in terms of syntactic and semantic correctness. The results also confirm the effectiveness of exploitGen.(c) 2022 Elsevier Inc. All rights reserved.

关键词： exploit code code generation Template parser codeBERT Neural network

来源：评论

学校读者我要写书评

暂无评论

STROP: Static Approach for Detection of Return-Oriented Programming Attack in Network

引用

IEICE TRANSACTIONS ON COMMUNICATIONS 2015年第1期E98B卷 242-251页

作者： Choi, YoungHan Lee, DongHoon ETRI Attached Inst Taejon 305600 South Korea Korea Univ Grad Sch Informat & Secur Seoul 136701 South Korea

Recently, a malicious user attacks a web browser through a malicious page that exploits the vulnerability of the browser and that executes malicious code. To prevent this attack, some methods have been devised such as DEP (Data Execution Prevention) that prevents data in stack frame or heap region from being executed. However, to evade these defense techniques, return-oriented programming (ROP) is introduced. ROP executes arbitrary code indirectly using gadget, which is group of instructions including ret instruction in a module that doesn't apply ASLR (Address Space Layout Randomization). In this paper, we propose a static approach to detect ROP payload in a network irrespective of the environment of the system under attack. Most studies have tried to detect ROP attacks using dynamic analysis, because ROP has various addresses of gadgets according to loaded modules. These methods have a limitation that must consider the environment of system to operate ROP, such as the version of OS and modules including gadgets. To overcome this limitation, our method detects ROP payload using static analysis without preliminary knowledge about the environment. We extract five characteristics of ROP and then propose a novel algorithm, STROP, to detect ROP in payload without execution. Our idea is as follows: STROP makes stack frame using input payload statically. It extracts addresses suspected as indicating gadgets and makes groups using the addresses. And then, STROP determine whether the payload includes ROP based on static characteristics. We implement a prototype using snort (network-based intrusion system) and evaluate it. Experiments show that our technique can detect ROP payload with a low number of false alarms. False positive (FP) is 1.3% for 2,239 benign files and 0.05-0.51% for 1GB packet dump file. Among 68 ROP payloads, STROP detects 51 payloads. This research can be applied to existing systems that collect malicious codes, such as Honeypot.

关键词： return-oriented programming exploit code network based intrusion detection system

来源：评论

学校读者我要写书评

暂无评论

An efficient network intrusion detection

引用

COMPUTER COMMUNICATIONS 2010年第4期33卷 477-484页

作者： Chen, Chia-Mei Chen, Ya-Lin Lin, Hsiao-Chung Natl Sun Yat Sen Univ Dept Informat Management Kaohsiung 80424 Taiwan

exploit code based on system vulnerability is often used by attacker. Such exploit program often sends attack packets in the first few packets. A Lightweight Network intrusion Detection system (LNID) is proposed for detecting such attacks on Telnet traffic. It characterizes normal traffic behavior and computes the anomaly score of a packet based on the deviation from the normal behavior. Instead of processing all traffic packets, an efficient filtering scheme proposed in the study can reduce system workload and only 0.3% of the original traffic volume is examined for anomaly. According to the performance comparisons with other network-based IDS, LNID is the most efficient on detection rate and workload reduction, (C) 2009 Elsevier B.V. All rights reserved.

关键词： Anomaly score Intrusion detection Network security exploit code

来源：评论

学校读者我要写书评

暂无评论

Externally verifiable code execution

引用

COMMUNICATIONS OF THE ACM 2006年第9期49卷 45-49页

作者： Seshadri, Arvind Luk, Mark Perrig, Adrian Van Doorn, Leendert Khosla, Pradeep Carnegie Mellon Univ Dept Elect & Comp Engn Pittsburgh PA 15213 USA Carnegie Mellon Univ CyLab Pittsburgh PA 15213 USA IBM Corp Thomas J Watson Res Ctr Secure Syst & Tools Dept Yorktown Hts NY 10598 USA Carnegie Mellon Univ Carnegie Inst Technol Pittsburgh PA 15213 USA

Computing devices are routinely targeted by a wide variety of mal-ware, suchas spyware, trojans, rootkits, and viruses. The presence of exploitable vulnerabilities in systemsoftware, and the widespread availability of tools for constructing exploit code, has reduced theamount of effort required for attackers to introduce malware into computing devices. Increasinglevels of network connectivity further exacerbates the problem of malware propagation by enablingattacks to be launched remotely. Current computing devices are routinely used for security-sensitiveapplications; thus malware present on these devices can potentially compromise the privacy andsafety of users. Furthermore, most computing devices today are part of a large networkedinfrastructure. Hence, the compromise of any one computing device can lead to the compromise of thenetworked applications. For example, a rogue wireless LAN access point can modify network traffic,thereby potentially affecting all computing devices that use this access point. Therefore, to usecomputing devices with confidence, users need assurance the software on their own computing devicesand other computing devices in their network executes untampered by malware.

关键词： compromise Spyware Systems software traffic network exploit code Enabling Attackers access points

来源：评论

学校读者我要写书评

暂无评论

Sparsity-based MIMO Noise Radar for Multiple Target Estimation

Sparsity-based MIMO Noise Radar for Multiple Target Estimati...

引用

IEEE 7th Sensor Array and Multichannel Signal Processing Workshop (SAM)

作者： Gogineni, Sandeep Nehorai, Arye Washington Univ Preston M Green Dept Elect & Syst Engn St Louis MO 63130 USA

ISBN: (纸本)9781467310710

We solve a multiple moving-target estimation problem using a colocated multiple-input multiple-output (MIMO) radar system. Each antenna of the radar array transmits noise waveforms to achieve high resolution. These waveforms are further covered by codes that are inspired from code division multiple access (CDMA) to exploit code diversity. We formulate the measurement model using a sparse representation in an appropriate basis to estimate the unknown target parameters (delays, Dopplers) using support recovery algorithms. We demonstrate the performance of the proposed system using numerical simulations.

关键词： noise radar code division multiple access sparse representation coded diversity exploit code waveforms code division

来源：评论

学校读者我要写书评

暂无评论

Identifying and Categorizing Malicious Content on Paste Sites: A Neural Topic Modeling Approach 19

Identifying and Categorizing Malicious Content on Paste Site...

引用

19th Annual IEEE International Conference on Intelligence and Security Informatics (IEEE ISI)

作者： Vahedi, Tala Ampel, Benjamin Samtani, Sagar Chen, Hsinchun Univ Arizona Dept Management Informat Syst Tucson AZ 85721 USA Indiana Univ Dept Operat & Decis Technol Bloomington IN USA

ISBN: (纸本)9781665438384

Malicious cyber activities impose substantial costs on the U.S. economy and global markets. Cyber-criminals often use information-sharing social media platforms such as paste sites (e.g., Pastebin) to share vast amounts of plain text content related to Personally Identifiable Information (PII), credit card numbers, exploit code, malware, and other sensitive content. Paste sites can provide targeted Cyber Threat Intelligence (CTI) about potential threats and prior breaches. In this research, we propose a novel Bidirectional Encoder Representation from Transformers (BERT) with Latent Dirichlet Allocation (LDA) model to categorize pastes automatically. Our proposed BERT-LDA model leverages a neural network transformer architecture to capture sequential dependencies when representing each sentence in a paste. BERT-LDA replaces the Bag-of-Words (BoW) approach in the conventional LDA with a Bag-of-Labels (BoL) that encompasses class labels at the sequence level. We compared the performance of the proposed BERT-LDA against the conventional LDA and BERT-LDA variants (e.g., GPT2-LDA) on 4,254,453 pastes from three paste sites. Experiment results indicate that the proposed BERT-LDA outperformed the standard LDA and each BERT-LDA variant in terms of perplexity on each paste site. Results of our BERT-LDA case study suggest that significant content relating to hacker community activities, malicious code, network and website vulnerabilities, and PII are shared on paste sites. The insights provided by this study could be used by organizations to proactively mitigate potential damage on their infrastructure.

关键词： Paste sites Pastebin topic modeling transformers BERT malicious content exploit code cyber threat intelligence

来源：评论

学校读者我要写书评

暂无评论

AN AUTOMATIC, PROMPT, AND ACCURATE exploit-BASED METHOD TO GENERATE POLYMORPHIC WORM'S SIGNATURE

AN AUTOMATIC, PROMPT, AND ACCURATE EXPLOIT-BASED METHOD TO G...

引用

4th IEEE International Conference on Broadband Network and Multimedia Technology (IEEE IC-BNMT 2011)

作者： Ramadass, Sureswaran Abdulla, Shubair A. Altyeb, Altyeb Altaher Univ Sains Malaysia Ctr Excellence NAV6 George Town 11800 Malaysia

ISBN: (纸本)9781612841564

Polymorphic worms evade network security systems by varying their payload every time an infection is attempted. The payload's variation operation is performed by using built-in self content encryptor. However, all encrypted payloads share the same invariant exploit code to ensure exploiting same vulnerability in same manner on all victims. This research paper is an endeavor to interpret the invariant part into signature. The basic idea of the proposed method is to assemble attacking payloads on a honeypot, and then extracting the worm's signature by using a matching technique. The experiments were conducted on two datasets, Witty worm's payloads and. synthetic payloads, and have demonstrated promising results.

关键词： exploit code intrusion detection systems synthetic worms worm signature

来源：评论

学校读者我要写书评

暂无评论

AN AUTOMATIC,PROMPT,AND ACCURATE exploit-BASED METHOD TO GENERATE POLYMORPHIC WORM'S SIGNATURE

AN AUTOMATIC,PROMPT,AND ACCURATE EXPLOIT-BASED METHOD TO GEN...

引用

2011 4th IEEE International Conference on Broadband Network and Multimedia Technology

作者： Sureswaran Ramadass Shubair A.Abdulla Altyeb Altaher Altyeb NAV6 Center of Excellence Universiti Sains Malaysia USM11800 PenangMalaysia

Polymorphic worms evade network security systems by varying their payload every time an infection is *** payload's variation operation is performed by using built-in self content ***,all encrypted payloads share the same invariant exploit code to ensure exploiting same vulnerability in same manner on all *** research paper is an endeavor to interpret the invariant part into *** basic idea of the proposed method is to assemble attacking payloads on a honeypot,and then extracting the worm's signature by using a matching *** experiments were conducted on two datasets,Witty worm's payloads and synthetic payloads,and have demonstrated promising results.

关键词： exploit code intrusion detection systems synthetic worms worm signature

来源：评论

学校读者我要写书评

暂无评论

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案：

请选择收藏分类：

通借通还

建议与咨询 留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案： 新增检索档案 确定 取消

请选择收藏分类： 新增自定义分类 确定 取消

通借通还

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

请选择保存的检索档案：

请选择收藏分类：