检索结果-内蒙古大学图书馆

3rd International Conference of Electronic Engineering and Information Science (ICEEIS)

作者： Zhai, J. Q. Zhou, Y. Y. Harbin Univ Sci & Technol Sch Comp Sci & Technol Harbin Heilongjiang Peoples R China

ISBN: (纸本)9781315265278;9781138029873

buffer overflows are a common type of network intrusion attack that continue to plague the networked community. This paper investigated the use of Random Forests, an ensemble technique that creates multiple decision trees, and then votes for the best tree. The paper investigated Random Forests' effectiveness in detecting buffer overflows compared to other data mining methods such as CART and Naive Bayes. The experiment was able to show that Random Forests outperformed CART and Naive Bayes in classification performance.

关键词： buffer overflow attacks random forests KDD'99

来源：评论

学校读者我要写书评

暂无评论

PwnShield: An Automated Approach to Detect and Exploit buffer overflows and Bypassing Modern Mitigation Techniques 3rd

PwnShield: An Automated Approach to Detect and Exploit Buffe...

引用

3rd International Conference on Advanced Network Technologies and Intelligent Computing (ANTIC)

作者： Eddine, Jamai Badr Abdellaoui, Abderrahim Anass, Bouchnafa Ibn Tofail Univ Engn Sci Lab ENSA Kenitra Morocco Mohammed V Univ Engn Sci Lab ENSIAS Rabat Morocco

ISBN: (纸本)9783031640636;9783031640643

In the dynamic realm of cybersecurity, the perpetual struggle between security systems and malicious exploits persists. Among these threats, buffer overflow vulnerabilities remain a persistent challenge continually adapting to evade modern mitigation techniques such as NX, RELRO, Stack canaries and PIE. To confront these sophisticated threats, our research introduces PwnShield as an advanced program designed to detect and exploit buffer overflow vulnerabilities effectively and bypass modern mitigation methods. Leveraging the robust capabilities of Python's Pwntools and r2pipe libraries, PwnShield excels in exploitation by combining fuzzing and static binary analysis compared to existing tools like BofAEG and autoBOF, PwnShield demonstrates superior performance and showcases its ability to handle buffer overflow exploitation and bypass a comprehensive range of modern mitigation techniques. PwnShield represents a significant advancement in cybersecurity in an environment where detecting and exploiting buffer overflows presents formidable challenges. With limited research dedicated to addressing these complexities, we are pushing the boundaries of buffer overflow detection and exploitation automation, heralding a new era of progress in the field.

关键词： buffer overflow attacks Mitigation Technique Dynamic Detection Exploit Generation

来源：评论

学校读者我要写书评

暂无评论

Study on the Principle and Defense of buffer overflow attacks

Study on the Principle and Defense of Buffer Overflow Attack...

引用

4th International Conference on Graphic and Image Processing (ICGIP)

作者： Lin, Wang Beijing City Univ Network Informat Ctr Beijing Peoples R China

ISBN: (纸本)9780819495662

buffer overflow attacks have been the most common form in the network attacks and become a predominant problem in the system and network security area. With specific programs, this paper describes in detail the type of buffer overflow attacks and technical principles, so we have a good understanding of them, and then gives several common preventive measures.

关键词： buffer overflow attacks secure coding bounds checking

来源：评论

学校读者我要写书评

暂无评论

ALEXIA: A Processor with Lightweight Extensions for Memory Safety

引用

ACM TRANSACTIONS ON EMBEDDED COMPUTING SYSTEMS 2020年第6期18卷 122-122页

作者： Krishnakumar, Gnanambikai Reddy, Kommuru Alekhya Rebeiro, Chester Indian Inst Technol Dept Comp Sci & Engn Chennai 600036 Tamil Nadu India

Illegal use of memory pointers is a serious security vulnerability. A large number of malwares exploit the spatial and temporal nature of these vulnerabilities to subvert execution or glean sensitive data from an application. Recent countermeasures attach metadata to memory pointers, which define the pointer's capabilities. The metadata is used by the hardware to validate pointer-based memory accesses. However, recent works have considerable overheads. Further, the pointer validation is decoupled from the actual memory access. We show that this could open up vulnerabilities in multithreaded applications and introduce new vulnerabilities due to speculation in out-of-order processors. In this article, we demonstrate that the overheads can be reduced considerably by efficient metadata management. We show that the hardware can be designed in a manner that would remain safe in multithreaded applications and immune to speculative vulnerabilities. We achieve these by ensuring that the pointer validations and the corresponding memory access is always done atomically and in order. To evaluate our scheme, which we call ALEXIA, we enhance an OpenRISC processor to perform the memory validation at runtime and also add compiler support. ALEXIA is the first hardware countermeasure scheme for memory protection that provides such an end-to-end solution. We evaluate the processor on an Altera FPGA and show that the runtime overhead, on average, is 14%, with negligible impact on the processor's size and clock frequency. There is also a negligible impact on the program's code and data sizes.

关键词： Security buffer overflow attacks memory corruption heap exploits

来源：评论

学校读者我要写书评

暂无评论

buffer overflow attack with multiple fault injection and a proven countermeasure

引用

JOURNAL OF CRYPTOGRAPHIC ENGINEERING 2017年第1期7卷 35-46页

作者： Nashimoto, Shoei Homma, Naofumi Hayashi, Yu-ichi Takahashi, Junko Fuji, Hitoshi Aoki, Takafumi Mitsubishi Electr Corp Informat Technol R&D Ctr 5-1-1Ofuna Kamakura Kanagawa 2478501 Japan Tohoku Univ Aoba Ku 6-6-05 Aramaki Aza Aoba Sendai Miyagi 9808579 Japan NTT Corp NTT Secure Platform Labs 3-9-11 Midori-Cho Tokyo 1808585 Japan

In this paper, we present a hardware/software coattack to hijack a program flow on microcontrollers. The basic idea is to skip a few instructions using multiple fault injection in microcontrollers in cooperation with a software attack. We focus on buffer overflow (BOF) attacks together with such multiple fault injection. The proposed attack can be applied to a program code with a typical software countermeasure against BOF attacks. The attack manipulates the program control flowby skipping specific instructions related to the countermeasure, and thus, the subsequent BOF attack code is successfully executed on the microcontroller. We show the effectiveness of our proposed attack through experiments using an 8-bit AVR ATmega163 microcontroller and a 32-bit ARM Cortex-M0+ microcontroller, where the target software was equipped with a countermeasure limiting the size of user input against BOF attacks. The result showed that our attack can overwrite a return address stored in a stack and call an arbitrary malicious function. We also propose a software countermeasure against our attack and prove its validity by examining all the possible instruction skips.

关键词： Embedded processors Program-flowhijacking Fault injection attacks buffer overflow attacks

来源：评论

学校读者我要写书评

暂无评论

Coping with 0-Day attacks through Unsupervised Network Intrusion Detection 10

Coping with 0-Day Attacks through Unsupervised Network Intru...

引用

10th International Wireless Communications & Mobile Computing Conference (IWCMC)

作者： Casas, Pedro Mazel, Johan Owezarski, Philippe FTW Telecommun Res Ctr Vienna Austria NII JFLI Tokyo Japan Univ Toulouse CNRS LAAS Toulouse France

ISBN: (纸本)9781479909599

Traditional Network Intrusion Detection Systems (NIDSs) rely on either specialized signatures of previously seen attacks, or on expensive and difficult to produce labeled traffic datasets for profiling and training. Both approaches share a common downside: they require the knowledge provided by an external agent, either in terms of signatures or as normal-operation profiles. In this paper we describe UNIDS, an Unsupervised NIDS capable of detecting 0-day attacks, i.e., network attacks for which no signature is yet available, without using any kind of signatures, labeled traffic, or training. UNIDS uses a novel unsupervised outliers detection approach based on Sub-Space Clustering and Multiple Evidence Accumulation techniques to pin-point different kinds of network intrusions and attacks such as DoS/DDoS, probing attacks, propagation of worms, buffer overflows, illegal access to network resources, etc. In this paper we make the strong point that the de-facto approach for NIDS, namely the application of rule-based detection techniques, can be highly harmful for the protected network in case of 0-day attacks. In contrast, we show how UNIDS can work as a complementary system to current NIDS to detect the occurrence of previously unseen attacks. For doing so, we compare the performance of a standard rule-based NIDS against UNIDS to detect 0-day attacks in the well-known KDD99 dataset. In addition, we also compare the performance of UNIDS against other popular unsupervised detection techniques to detect attacks in traces collected at two operation networks.

关键词： NIDS Unsupervised Machine Learning Clustering C4.5 Decision Trees DDoS buffer overflow attacks Probing attacks KDD99 Dataset

来源：评论

学校读者我要写书评

暂无评论

SigFree: A Signature-Free buffer overflow Attack Blocker

引用

IEEE TRANSACTIONS ON DEPENDABLE AND SECURE COMPUTING 2010年第1期7卷 65-79页

作者： Wang, Xinran Pan, Chi-Chun Liu, Peng Zhu, Sencun Penn State Univ Dept Comp Sci & Engn State Coll PA 16802 USA Penn State Univ Coll Informat Sci & Technol State Coll PA 16802 USA

We propose SigFree, an online signature-free out-of-the-box application-layer method for blocking code-injection buffer overflow attack messages targeting at various Internet services such as web service. Motivated by the observation that buffer overflow attacks typically contain executables whereas legitimate client requests never contain executables in most Internet services, SigFree blocks attacks by detecting the presence of code. Unlike the previous code detection algorithms, SigFree uses a new data-flow analysis technique called code abstraction that is generic, fast, and hard for exploit code to evade. SigFree is signature free, thus it can block new and unknown buffer overflow attacks;SigFree is also immunized from most attack-side code obfuscation methods. Since SigFree is a transparent deployment to the servers being protected, it is good for economical Internet-wide deployment with very low deployment and maintenance cost. We implemented and tested SigFree;our experimental study shows that the dependency-degree-based SigFree could block all types of code-injection attack packets ( above 750) tested in our experiments with very few false positives. Moreover, SigFree causes very small extra latency to normal client requests when some requests contain exploit code.

关键词： Intrusion detection buffer overflow attacks code-injection attacks

来源：评论

学校读者我要写书评

暂无评论

Binary rewriting and call interception for efficient runtime protection against buffer overflows

引用

SOFTWARE-PRACTICE & EXPERIENCE 2006年第9期36卷 971-998页

作者： Avijit, Kumar Gupta, Prateek Gupta, Deepak Indian Inst Technol Dept Comp Sci & Engn Kanpur 208016 Uttar Pradesh India Carnegie Mellon Univ Dept Comp Sci Pittsburgh PA 15213 USA Univ Texas Dept Comp Sci Austin TX 78712 USA

buffer overflow vulnerabilities are one of the most commonly and widely exploited security vulnerabilities in programs. Most existing solutions for avoiding buffer overflows are either inadequate, inefficient or incompatible with existing code. In this paper, we present a novel approach for transparent and efficient runtime protection against buffer overflows. The approach is implemented by two tools: Type Information Extractor and Depositor (TIED) and LibsafePlus. TIED is first used on a binary executable or shared library file to extract type information from the debugging information inserted in the file by the compiler and reinsert it in the file as a data structure available at runtime. LibsafePlus is a shared library that is preloaded when the program is run. LibsafePlus intercepts unsafe C library calls such as strcpy and uses the type information made available by TIED at runtime to determine whether it would be 'safe' to carry out the operation. With our simple design we are able to protect most applications with a performance overhead of less than 10%. Copyright (C) 2006 John Wiley & Sons, Ltd.

关键词： buffer overflow attacks binary rewriting dynamic linking function call interception

来源：评论

学校读者我要写书评

暂无评论

Detekce Útoků v Síťovém Provozu

Detekce Útoků v Síťovém Provozu

引用

作者： Homoliak, Ivan Brno University of Technology

Tato práce se zabývá problematikou anomální detekce síťových útoků s využitím technik strojového učení. Nejdříve jsou prezentovány state-of-the-art dato... 详细信息

Tato práce se zabývá problematikou anomální detekce síťových útoků s využitím technik strojového učení. Nejdříve jsou prezentovány state-of-the-art datové kolekce určené pro ověření funkčnosti systémů detekce útoků a také práce, které používají statistickou analýzu a techniky strojového učení pro nalezení síťových útoků. V další části práce je prezentován návrh vlastní kolekce metrik nazývaných Advanced Security Network Metrics (ASNM), který je součástí konceptuálního automatického systému pro detekci průniků (AIPS). Dále jsou navrženy a diskutovány dva různé přístupy k obfuskaci - tunelování a modifikace síťových charakteristik - sloužících pro úpravu provádění útoků. Experimenty ukazují, že použité obfuskace jsou schopny předejít odhalení útoků pomocí klasifikátoru využívajícího metriky ASNM. Na druhé straně zahrnutí těchto obfuskací do trénovacího procesu klasifikátoru může zlepšit jeho detekční schopnosti. Práce také prezentuje alternativní pohled na obfuskační techniky modifikující síťové charakteristiky a demonstruje jejich použití jako aproximaci síťového normalizéru založenou na vhodných trénovacích datech.

关键词： Network behavioral anomaly detection buffer overflow attacks tunneling obfuscations non-payload-based obfuscations supervised machine learning Behaviorální analýza síťových anomálií buffer overflow útoky tunelovací obfuskace obfuskace modifikující

来源：评论

学校读者我要写书评

暂无评论

Metriky pro detekci buffer-overflow útoků na UDP síťové služby

Metriky pro detekci buffer-overflow útoků na UDP síťové...

引用

作者： Šulák, Ladislav Brno University of Technology

Tato práce se zabývá problematikou síťových útoků a jich detekcí v síťovém provozu. Cílem práce je navrhnout takovou sadu metrik, která popisuje síťov&#... 详细信息

Tato práce se zabývá problematikou síťových útoků a jich detekcí v síťovém provozu. Cílem práce je navrhnout takovou sadu metrik, která popisuje síťový provoz na základě jeho chování a pomocí které jsou schopny odhalit i Zero-Day útoky. Další částí práce je popis navrženého nástroje pro jejich extrakci.

关键词： buffer overflow útoky zero day útoky síťové útoky IDS UDP honeypot škodlivý software síťová bezpečnost buffer overflow attacks zero day attacks network attacks IDS UDP honeypot malware network security Text

来源：评论

学校读者我要写书评

暂无评论

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案：

请选择收藏分类：

通借通还

建议与咨询 留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案： 新增检索档案 确定 取消

请选择收藏分类： 新增自定义分类 确定 取消

通借通还

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

请选择保存的检索档案：

请选择收藏分类：