CT: Automatic Generation of High-Quality Attack Signatures and Patches

一个全面的网络攻击防御应该包括(1)一个攻击检测组件，它可以确定网络应用是否已经被破坏，并防止攻击进一步传播；(2)攻击识别组件，能够识别出相应的攻击报文，并生成相应的攻击签名，防止此类攻击再次发生；(3)攻击修复组件，能够将被攻破的应用恢复到攻击前的状态，并允许其正常继续，如果可能的话，永久消除被利用的漏洞。该项目旨在建立一个名为DIRA的程序转换系统，该系统可以自动嵌入到网络应用程序中，对控制劫持攻击进行全面的网络防御，从而允许远程攻击者劫持远程程序并最终劫持其底层系统。控制劫持攻击已被用作最近许多Internet蠕虫的构建块，包括缓冲区溢出、整数溢出和格式字符串攻击等攻击。给定网络应用程序的源代码或二进制代码，DIRA可以将其转换为这样一种方式，即生成的程序可以自动检测任何传入的控制劫持攻击，修复攻击留下的内存损坏，派生相应的攻击签名并相应地通知前端防火墙，并创建永久补丁以密封正在利用的安全漏洞，所有这些都不需要对操作系统或硬件进行任何修改。为了将这些增强安全性的程序转换技术扩展到商业分布的Win32/X86二进制文件，DIRA项目将开发一种新的二进制分析和仪器基础设施，使用静态和动态反汇编的组合。

Automatic Generation of High-Quality Attack Signatures and PatchesTzi-CherChiuehState University of New York, Stony BrookAbstract A comprehensive cyber attack defense should include (1) an attack detection component that can determine if a network application has been compromised and prevent the attack from further spreading, (2) an attack identification component that can identify the corresponding attack packets and generate the associated attack signatures so as to prevent such attacks from taking place in the future, and (3) an attack repair component that can restore the compromised application's state to that before the attack and allow it to continue normally, and if possible permanently eliminate the vulnerability being exploited. This project aims to build a program transformation system called DIRA that can automatically embed into network applications a comprehensive cyber defense against control-hijacking attacks, which allow remote attackers to hijack a remote program and eventually its underlying system. Control-hijacking attacks have been used as building blocks for many recent Internet worms, and include such attacks as buffer overflow, integer overflow and format string attacks. Given a network application's source or binary code, DIRA can convert it in such a way that the resulting program can automatically detect any incoming control-hijacking attack, repair the memory damage left by the attack, derive the corresponding attack signature and inform the front-end firewall accordingly, and create a permanent patch that seals the security hole being exploited, all without requiring any modifications to the operating system or hardware. To extend these security-enhancing program transformation techniques to commercially distributed Win32/X86 binaries, the DIRA project will develop a novel binary analysis and instrumentation infrastructure using a combination of static and dynamic disassembling.