检索结果-内蒙古大学图书馆

19th International Conference on Security and Privacy in Communication Networks

作者： Starink, Jerre Huisman, Marieke Peter, Andreas Continella, Andrea Univ Twente Enschede Netherlands Carl von Ossietzky Univ Oldenburg Oldenburg Germany

ISBN: (纸本)9783031649530;9783031649547

Malware aims to stay undetected for as long as possible. One common method for avoiding or delaying detection is the use of code injection, by which a malicious process injects code into another running application. Despite code injection being known as one of the main features of today's malware, it is often overlooked and no prior research performed a comprehensive study to fundamentally understand and measure code injection in Windows malware. In this paper, we conduct a systematic study of code injection techniques and propose the first taxonomy to group these methods into classes based on common traits. Then, we leverage our taxonomy to implement models of the studied techniques and collect empirical evidence for the prevalence of each specific technique in the malware scene. Finally, we perform a large-scale, longitudinal measurement of the adoption of code injection, highlighting that at least 9.1% of Windows malware between 2017 and 2021 performs code injection. Our systematization and results show that Process Hollowing is the most commonly used technique across different malware families, but, more importantly, this trend is shifting towards other, less traditional methods. We conclude with takeaways that impact how future malware research should be conducted. Without comprehensively accounting for code injection and modeling emerging techniques, future studies based on dynamic analysis are bound to limited observations.

关键词： Malware code injection Malicious Behaviors

来源：评论

学校读者我要写书评

暂无评论

An Architectural Approach to Preventing code injection Attacks

引用

IEEE TRANSACTIONS ON DEPENDABLE AND SECURE COMPUTING 2010年第4期7卷 351-365页

作者： Riley, Ryan Jiang, Xuxian Xu, Dongyan Qatar Univ Dept Comp Sci & Engn POB 2713 Doha Qatar N Carolina State Univ Dept Comp Sci Raleigh NC 27695 USA Purdue Univ Dept Comp Sci W Lafayette IN 47907 USA Purdue Univ CERIAS W Lafayette IN 47907 USA

code injection attacks, despite being well researched, continue to be a problem today. Modern architectural solutions such as the execute-disable bit and PaX have been useful in limiting the attacks;however, they enforce program layout restrictions and can oftentimes still be circumvented by a determined attacker. We propose a change to the memory architecture of modern processors that addresses the code injection problem at its very root by virtually splitting memory into code memory and data memory such that a processor will never be able to fetch injected code for execution. This virtual split memory system can be implemented as a software-only patch to an operating system and can be used to supplement existing schemes for improved protection. Furthermore, our system is able to accommodate a number of response modes when a code injection attack occurs. Our experiments with both benchmarks and real-world attacks show the system is effective in preventing a wide range of code injection attacks while incurring reasonable overhead.

关键词： code injection secure memory architecture

来源：评论

学校读者我要写书评

暂无评论

New deep learning method to detect code injection attacks on hybrid applications

引用

JOURNAL OF SYSTEMS AND SOFTWARE 2018年 137卷 67-77页

作者： Yan, Ruibo Xiao, Xi Hu, Guangwu Peng, Sancheng Jiang, Yong Tsinghua Univ Grad Sch Shenzhen Shenzhen Peoples R China Shenzhen Inst Informat Technol Sch Comp Sci Shenzhen Peoples R China Guangdong Univ Foreign Studies Sch Informat Guangzhou Guangdong Peoples R China

Mobile phones are becoming increasingly pervasive. Among them, HTML5-based hybrid applications are more and more popular because of their portability on different systems. However these applications suffer from code injection attacks. In this paper, we construct a-novel deep learning network, Hybrid Deep Learning Network (HDLN), and use it to detect these attacks. At first, based on our previous work, we extract more features from Abstract Syntax Tree (AST) of JavaScript and employ three methods to select key features. Then we get the feature vectors and train HDLN to distinguish vulnerable applications from normal ones. Finally thorough experiments are done to validate our methods. The results show our detection approach with HDLN achieves 97.55% in accuracy and 97.60% in AUC, which outperforms those with other traditional classifiers and gets higher average precision than other detection methods. (C) 2017 Elsevier Inc. All rights reserved.

关键词： code injection Hybrid application Abstract syntax tree Deep learning

来源：评论

学校读者我要写书评

暂无评论

Monitoring Translation Lookahead Buffers to Detect code injection Attacks

引用

COMPUTER 2014年第7期47卷 66-72页

作者： Ahn, Youngjung Lee, Yongsuk Choi, Jin-Young Lee, Gyungho Ahn, Dongkyun Korea Univ Dept Comp Sci & Engn Seoul South Korea Korea Univ Seoul South Korea

By identifying memory pages that external I/O operations have modified, a proposed scheme blocks malicious injected code activation, accurately distinguishing an attack from legitimate code injection with negligible p... 详细信息

关键词： code injection TLB data execution prevention hackers invasive software security

来源：评论

学校读者我要写书评

暂无评论

code injection Attacks on HTML5-based Mobile Apps: Characterization, Detection and Mitigation 14

Code Injection Attacks on HTML5-based Mobile Apps: Character...

引用

21st ACM Conference on Computer and Communications Security (CCS)

作者： Jin, Xing Hu, Xunchao Ying, Kailiang Du, Wenliang Yin, Heng Peri, Gautam Nagesh SUNY Syracuse Dept Elect Engn & Comp Sci Syracuse NY 13210 USA

ISBN: (纸本)9781450329576

Due to the portability advantage, HTML5-based mobile apps are getting more and more popular. Unfortunately, the web technology used by HTML5-based mobile apps has a dangerous feature, which allows data and code to be mixed together, making code injection attacks possible. In this paper, we have conducted a systematic study on this risk in HTML5-based mobile apps. We found a new form of code injection attack, which inherits the fundamental cause of Cross-Site Scripting attack (XSS), but it uses many more channels to inject code than XSS. These channels, unique to mobile devices, include Contact, SMS, Barcode, MP3, etc. To assess the prevalence of the code injection vulnerability in HTML5-based mobile apps, we have developed a vulnerability detection tool to analyze 15,510 PhoneGap apps collected from Google Play. 478 apps are flagged as vulnerable, with only 2.30% false-positive rate. We have also implemented a prototype called Noinjection as a Patch to PhoneGap in Android to defend against the attack.

关键词： HTML5-based Mobile Application code injection Static Analysis

来源：评论

学校读者我要写书评

暂无评论

An Architectural approach to preventing code injection attacks

An Architectural approach to preventing code injection attac...

引用

37th Annual IEEE/IFIP International Conference on Dependable Systems and Networks

作者： Riley, Ryan Jiang, Xuxian Xu, Dongyan Purdue Univ W Lafayette IN 47907 USA George Mason Univ Fairfax VA 22030 USA

ISBN: (纸本)9780769528557

code injection attacks, despite being well researched, continue to be a problem today. Modern architectural solutions such as the NX-bit and PaX have been useful in limiting the attacks, however they enforce program layout restrictions and can often times still be circumvented by a determined attacker. We propose a change to the memory architecture of modern processors that addresses the code injection problem at its very root by virtually splitting memory into code memory and data memory such that a processor will never be able to fetch injected code for execution. This virtual split memory system can be implemented as a software only patch to an operating system, and can be used to supplement existing schemes for improved protection. Our experimental results show the system is effective in preventing a wide range of code injection attacks while incurring acceptable overhead.

关键词： code injection secure memory architecture

来源：评论

学校读者我要写书评

暂无评论

Toward the Analysis of Distributed code injection in Post-mortem Forensics 14th

Toward the Analysis of Distributed Code Injection in Post-mo...

引用

14th International Workshop on Security (IWSEC)

作者： Otsuki, Yuto Kawakoya, Yuhei Iwamura, Makoto Miyoshi, Jun Faires, Jacob Lillard, Terrence NTT Secure Platform Labs 3-9-11 Midoricho Musashino Tokyo 1808585 Japan NTT Secur US Inc 9420 Underwood Ave Omaha NE 68114 USA

ISBN: (纸本)9783030268343;9783030268336

Distributed code injection is a new type of malicious code injection technique. It makes existing forensics techniques for injected code detection infeasible by splitting a malicious code into several code snippets, injecting them into multiple running processes, and executing them in each process spaces. In spite of the impact of it on practical forensics fields, there was no discussion on countermeasures against this threat. In this paper, we present a memory forensics method for finding all code snippets distributively injected into multiple processes to defeat distributed code injection attacks. Our method is designed on the following observation for distributed code injection attacks. Even though malicious code is split and distributed in multiple processes, the split code snippets have to synchronize each other at runtime to maintain the order of the execution of the original malicious code. We exploit this characteristic of distributed code injection attacks with our method. The experimental results showed that our method successfully found all distributed code snippets and assisted to reconstruct the original code from them. We believe that we are the first to present a countermeasure against distributed code injection attacks. We also believe that our method is able to improve the efficiency of forensics especially for a host compromised with distributed code injection attacks.

关键词： Memory forensics code injection Malware analysis

来源：评论

学校读者我要写书评

暂无评论

Detection and Prevention of code injection Attacks on HTML5-based Apps 3

Detection and Prevention of Code Injection Attacks on HTML5-...

引用

3rd International Conference on Advanced Cloud and Big Data (CBD)

作者： Xiao, Xi Yan, Ruibo Ye, Runguo Li, Qing Peng, Sancheng Jiang, Yong Tsinghua Univ Grad Sch Shenzhen Shenzhen Peoples R China China Elect Standardizat Inst Beijing Peoples R China Zhaoqing Univ Sch Comp Sci Zhaoqing Peoples R China

ISBN: (纸本)9781467385374

Security on mobile devices is becoming increasingly important. HTML5 are widely used to develop mobile applications due to its portability on multi platforms. However it is allowed to mix data and code together in web technology. HTML5-based applications are prone to suffer from code injection attacks that are similar to XSS. In this paper, at first, we introduce a more hidden type of code injection attacks, coding-based attacks. In the new type of code injection attacks, JavaScript code is encoded in a human-unreadable form. Then we use classification algorithms of machine learning to determine whether an app suffers from the code injection attack or not. The experimental result shows that the Precision of our detection method reaches 95.3%. Compare with the other method, our approach improves a lot in detection speed with the precision nearly unchanged. Furthermore, an improved access control model is proposed to mitigate the attack damage. In addition, filters are adopted to remove JavaScript code from data to prevent the attacks. The effectiveness and rationality have been validated through extensive simulations.

关键词： code injection classification algorithm machine learning access control model filter

来源：评论

学校读者我要写书评

暂无评论

A methodology for designing countermeasures against current and future code injection attacks 3

A methodology for designing countermeasures against current ...

引用

3rd IEEE International Workshop on Information Assurance

作者： Younan, Y Joosen, W Piessens, F Katholieke Univ Leuven Dept Comp Sci B-3001 Louvain Belgium

ISBN: (纸本)076952317X

This paper proposes a methodology to develop countermeasures against code injection attacks, and validates the methodology by working out a specific countermeasure. This methodology is based on modeling the execution environment of a program. Such a model is then used to build countermeasures. The paper justifies the need for a more structured approach to protect programs against code injection attacks: we examine advanced techniques for injecting code into C and C++ programs and we discuss state-of-the-art (often ad hoc) approaches that typically protect singular memory locations. We validate our methodology by building countermeasures that prevent attacks by protecting a broad variety of memory locations that may be used by attackers to perform code injections. The paper evaluates our approach and discusses ongoing and future work.

关键词： advanced exploitation techniques buffer overflows C C plus code injection countermeasures

来源：评论

学校读者我要写书评

暂无评论

Security Standards Perspective to Fortify Web Database Applications From code injection Attacks

Security Standards Perspective to Fortify Web Database Appli...

引用

UKSim/AMSS 1st International Conference on Intelligent Systems, Modelling and Simulation

作者： Madan, Sushila Madan, Supriya Univ Delhi Dept Comp Sci Lady ShriRam Coll Women Delhi 110007 India GGSIP Univ Delhi Vivekananda Inst Profess Studies Dept Comp Sci New Delhi India

ISBN: (纸本)9781424459841

In recent years, web application security has become the primary discussion for security experts, as application attacks are constantly on rise and posing new risks for organizations. Several trends have emerged lately in the attacks launched against web application. The implementation of International security standard is to minimize the security failures and to mitigate their consequences. The aim of this research paper is to study and analyze the various International Standards like ISO-27002, OWASP, COBIT, PCI/DSS and depict the extent of coverage of countermeasures which focus on security of web applications from the perspective of preventing web applications attacks predominantly from code injections attacks.

关键词： Application code injection Error handling injection flaws Input Validation International security standards Security SQL injection

来源：评论

学校读者我要写书评

暂无评论

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案：

请选择收藏分类：

通借通还

建议与咨询 留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案： 新增检索档案 确定 取消

请选择收藏分类： 新增自定义分类 确定 取消

通借通还

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

请选择保存的检索档案：

请选择收藏分类：