CT: Automatic Generation of High-Quality Attack Signatures and Patches

高质量攻击特征和补丁的自动生成Tzi-CherChiueh State University of纽约，Stony BrookAbstract全面的网络攻击防御应该包括（1）攻击检测组件，可以确定网络应用程序是否已经受到危害并防止攻击进一步蔓延，（二）攻击识别组件，其可以识别对应的攻击分组并生成相关联的攻击签名，以便防止这样的攻击（3）攻击修复组件，可以将受损应用程序的状态恢复到攻击前的状态，并允许其正常继续，如果可能的话，永久消除被利用的漏洞。该项目旨在构建一个名为DIRA的程序转换系统，该系统可以自动嵌入到网络应用程序中，以抵御控制劫持攻击，这些攻击允许远程攻击者劫持远程程序并最终劫持其底层系统。控制权劫持攻击是近年来许多网络蠕虫的主要攻击手段，包括缓冲区溢出、整数溢出和格式字符串攻击等。给定一个网络应用程序的源代码或二进制代码，DIRA可以将其转换为这样一种方式，即生成的程序可以自动检测任何传入的控制劫持攻击，修复攻击留下的内存损坏，导出相应的攻击签名并相应地通知前端防火墙，并创建一个永久的补丁来密封被利用的安全漏洞，所有这些都不需要对操作系统或硬件进行任何修改。为了将这些安全增强程序转换技术扩展到商业分发的Win32/X86二进制文件，DIRA项目将开发一种新的二进制分析和仪器基础设施，使用静态和动态反汇编的组合。

Automatic Generation of High-Quality Attack Signatures and PatchesTzi-CherChiuehState University of New York, Stony BrookAbstract A comprehensive cyber attack defense should include (1) an attack detection component that can determine if a network application has been compromised and prevent the attack from further spreading, (2) an attack identification component that can identify the corresponding attack packets and generate the associated attack signatures so as to prevent such attacks from taking place in the future, and (3) an attack repair component that can restore the compromised application's state to that before the attack and allow it to continue normally, and if possible permanently eliminate the vulnerability being exploited. This project aims to build a program transformation system called DIRA that can automatically embed into network applications a comprehensive cyber defense against control-hijacking attacks, which allow remote attackers to hijack a remote program and eventually its underlying system. Control-hijacking attacks have been used as building blocks for many recent Internet worms, and include such attacks as buffer overflow, integer overflow and format string attacks. Given a network application's source or binary code, DIRA can convert it in such a way that the resulting program can automatically detect any incoming control-hijacking attack, repair the memory damage left by the attack, derive the corresponding attack signature and inform the front-end firewall accordingly, and create a permanent patch that seals the security hole being exploited, all without requiring any modifications to the operating system or hardware. To extend these security-enhancing program transformation techniques to commercially distributed Win32/X86 binaries, the DIRA project will develop a novel binary analysis and instrumentation infrastructure using a combination of static and dynamic disassembling.