A Robust Kernel-Based Solution to Control-Hijacking Buffer Overflow Attacks

NCU Institutional Repository > 資訊電機學院 > 資訊工程學系 > 期刊論文 > Item 987654321/51609

jsp.display-item.identifier=請使用永久網址來引用或連結此文件: http://ir.lib.ncu.edu.tw/handle/987654321/51609

题名:	A Robust Kernel-Based Solution to Control-Hijacking Buffer Overflow Attacks
作者:	Chen,LH;Hsu,FH;Huang,CH;Ou,CW;Lin,CJ;Liu,SC
贡献者:	資訊工程學系
关键词:	SIGNATURES
日期:	2011
上传时间:	2012-03-27 18:57:21 (UTC+8)
出版者:	國立中央大學
摘要:	In this paper, we propose a robust kernel-based solution, called AURORA, to a ubiquitous security problem - control-hijacking Buffer Overflow Attacks (BOAs). AURORA utilizes either the addresses of the buffers storing input strings or signatures to detect and block control-hijacking BOA strings in the kernel, including zero-day ones. Although AURORA detects some types of BOAs through signatures, AURORA does not need to create any new signature for new attack instances after its installation because AURORA's signatures are created based on commonality of control-hijacking BOAs. Moreover, even a process is under a BOA, AURORA allows it to continue its execution or to be terminated gracefully without the cost of process idleness or repeated process crashes. Thus, AURORA is robust to control-hijacking BOAs. AURORA does not need to modify the source code of any application programs. Furthermore, AURORA is compatible with existing operating systems and application programs; hence, AURORA could work with other protection mechanisms to provide an extra layer of protection. Our experimental results show that with less than 1% overhead and negligible false positives, AURORA can accurately block various control-hijacking BOAs.
關聯:	JOURNAL OF INFORMATION SCIENCE AND ENGINEERING
显示于类别:	[資訊工程學系] 期刊論文

文件中的档案:

档案	描述	大小	格式	浏览次数
index.html		0Kb	HTML	535	检视/开启

在NCUIR中所有的数据项都受到原著作权保护.

社群 sharing

数据加载中.....