Software vulnerabilities have had a devastating effect on the Internet. Worms such as CodeRed and Slammer can compromise hundreds of thousands of hosts within hours or even minutes, and cause millions of dollars of damage [26, 43]. To successfully combat these fast automatic Internet attacks, we need fast automatic attack detection and filtering mechanisms. In this paper we propose dynamic taint analysis for automatic detection of overwrite attacks, which include most types of exploits. This approach does not need source code or special compilation for the monitored program, and hence works on commodity software. To demonstrate this idea, we have implemented TaintCheck, a mechanism that can perform dynamic taint analysis by performing binary rewriting at run time. We show that TaintCheck reliably detects most types of exploits. We found that TaintCheck produced no false positives for any of the many different programs that we tested. Further, we describe how TaintCheck could improve automatic signature generation in

/pdf/dynamic-taint-analysis-for-automatic-detection-analysis-and-2bodbjb0mi.pdf

Dynamic Taint Analysis for Automatic Detection, Analysis, and Signature Generation of Exploits on Commodity Software

The increasing practicality of large-scale flow capture makes it possible to conceive of traffic analysis methods that detect and identify a large and diverse set of anomalies. However the challenge of effectively analyzing this massive data source for anomaly diagnosis is as yet unmet. We argue that the distributions of packet features (IP addresses and ports) observed in flow traces reveals both the presence and the structure of a wide range of anomalies. Using entropy as a summarization tool, we show that the analysis of feature distributions leads to significant advances on two fronts: (1) it enables highly sensitive detection of a wide range of anomalies, augmenting detections by volume-based methods, and (2) it enables automatic classification of anomalies via unsupervised learning. We show that using feature distributions, anomalies naturally fall into distinct and meaningful clusters. These clusters can be used to automatically classify anomalies and to uncover new anomaly types. We validate our claims on data from two backbone networks (Abilene and Geant) and conclude that feature distributions show promise as a key element of a fairly general network anomaly diagnosis framework.

/pdf/mining-anomalies-using-traffic-feature-distributions-5ebpb8yr1p.pdf

Mining anomalies using traffic feature distributions

It is widely believed that content-signature-based intrusion detection systems (IDS) are easily evaded by polymorphic worms, which vary their payload on every infection attempt. In this paper, we present Polygraph, a signature generation system that successfully produces signatures that match polymorphic worms. Polygraph generates signatures that consist of multiple disjoint content substrings. In doing so, Polygraph leverages our insight that for a real-world exploit to function properly, multiple invariant substrings must often be present in all variants of a payload; these substrings typically correspond to protocol framing, return addresses, and in some cases, poorly obfuscated code. We contribute a definition of the polymorphic signature generation problem; propose classes of signature suited for matching polymorphic worm payloads; and present algorithms for automatic generation of signatures in these classes. Our evaluation of these algorithms on a range of polymorphic worms demonstrates that Polygraph produces signatures for polymorphic worms that exhibit low false negatives and false positives.

/pdf/polygraph-automatically-generating-signatures-for-7qkzu7vqpe.pdf

Polygraph: automatically generating signatures for polymorphic worms

Machine learning's ability to rapidly evolve to changing and complex situations has helped it become a fundamental tool for computer security. That adaptability is also a vulnerability: attackers can exploit machine learning systems. We present a taxonomy identifying and analyzing attacks against machine learning systems. We show how these classes influence the costs for the attacker and defender, and we give a formal structure defining their interaction. We use our framework to survey and analyze the literature of attacks against machine learning systems. We also illustrate our taxonomy by showing how it can guide attacks against SpamBayes, a popular statistical spam filter. Finally, we discuss how our taxonomy suggests new lines of defenses.

/pdf/the-security-of-machine-learning-5p2ox3x6li.pdf

The security of machine learning

Network worms are a clear and growing threat to the security of today's Internet-connected hosts and networks. The combination of the Internet's unrestricted connectivity and widespread software homogeneity allows network pathogens to exploit tremendous parallelism in their propagation. In fact, modern worms can spread so quickly, and so widely, that no human-mediated reaction can hope to contain an outbreak.

In this paper, we propose an automated approach for quickly detecting previously unknown worms and viruses based on two key behavioral characteristics - a common exploit sequence together with a range of unique sources generating infections and destinations being targeted. More importantly, our approach - called "content sifting" - automatically generates precise signatures that can then be used to filter or moderate the spread of the worm elsewhere in the network.

Using a combination of existing and novel algorithms we have developed a scalable content sifting implementation with low memory and CPU requirements. Over months of active use at UCSD, our Earlybird prototype system has automatically detected and generated signatures for all pathogens known to be active on our network as well as for several new worms and viruses which were unknown at the time our system identified them. Our initial experience suggests that, for a wide range of network pathogens, it may be practical to construct fully automated defenses - even against so-called "zero-day" epidemics.

https://people.scs.carleton.ca/~soma/id-2006w/readings/singh-earlybird.pdf

Automated worm fingerprinting

Today's Internet intrusion detection systems (IDSes) monitor edge networks' DMZs to identify and/or filter malicious flows. While an IDS helps protect the hosts on its local edge network from compromise and denial of service, it cannot alone effectively intervene to halt and reverse the spreading of novel Internet worms. Generation of the worm signatures required by an IDS--the byte patterns sought in monitored traffic to identify worms--today entails non-trivial human labor, and thus significant delay: as network operators detect anomalous behavior, they communicate with one another and manually study packet traces to produce a worm signature. Yet intervention must occur early in an epidemic to halt a worm's spread. In this paper, we describe Autograph, a system that automatically generates signatures for novel Internet worms that propagate using TCP transport. Autograph generates signatures by analyzing the prevalence of portions of flow payloads, and thus uses no knowledge of protocol semantics above the TCP level. It is designed to produce signatures that exhibit high sensitivity (high true positives) and high specificity (low false positives); our evaluation of the system on real DMZ traces validates that it achieves these goals. We extend Autograph to share port scan reports among distributed monitor instances, and using trace-driven simulation, demonstrate the value of this technique in speeding the generation of signatures for novel worms. Our results elucidate the fundamental trade-off between early generation of signatures for novel worms and the specificity of these generated signatures.

/pdf/autograph-toward-automated-distributed-worm-signature-2x4rrdojaz.pdf

Autograph: toward automated, distributed worm signature detection

Today's Internet intrustion detection systems (IDSes) monitor edge networks' DMZs to identify and/or filter malicious flows. While an IDS helps protect the hosts on its local edge network from compromise and denial of service, it cannot alone effectively intervene to halt and reverse the spreading of novel Internet worms. Generation of the worm signatures required by an IDS--the byte patterns sought in monitored traffic to identify worms--today entails non-trivial human labor, and thus significant delay: as network operators detect anomalous behavior, they communicate with one another and manually study packet traces to produce a worm signature. Yet intervention must occur early in an epidemic to halt a worm's spread. In this paper, we describe Autograph, a system that automatically generates signatures for novel Internet worms that propagate using TCP transport. Autograph generates signatures by analyzing the prevalence of portions of flow payloads, and thus uses no knowledge of protocol semantics above the TCP level. It is designed to produce signatures that exhibit high sensitivity (high true positives) and high specificity (low false positives); our evaluation of the system on real DMZ traces validates that it achieves these goals. We extend Autograph to share port scan reports among distributed monitor instances, and using trace-driven simulation, demonstrate the value of this technique in speeding the generation of signatures for novel worms. Our results elucidate the fundamental trade-off between early generation of signatures for novel worms and the specificity of these generated signatures.

In future wireless broadband networks, bandwidth demands could fluctuate abruptly due to movement of high data rate users. Dynamic bandwidth reservation plays a key rule in ensuring that mobile calls are not disrupted after they are admitted into the network. We propose a dynamic guard bandwidth scheme that adapts the amount of guard bandwidth in both wired and wireless links according to real-time handoff predictions made by individual mobile terminals, leveraged by the expected widespread availability of GPS-capable wireless devices in the near future. We describe procedures for approximating irregular handoff-request boundary, and for estimating a mobile's remaining time to handoff and target handoff cell. Guard bandwidth is adjusted on the fly only when a handoff is anticipated to occur shortly. The scheme is robust against modifications in handoff parameters, as well as changes in terrain and manmade features that could affect radio propagation. It also caters for heterogeneous bandwidth requirements. Admission control algorithms for both new calls and handoff calls are provided. Simulation results show that our scheme is able to meet specified forced termination probability under high offered load, and that resources are not reserved unnecessarily.

Dynamic guard bandwidth scheme for wireless broadband networks

We are concerned with the problem of counting the distinct flows on a high speed network link. Flow counting programs, which must peek at all incoming packets, must run very quickly in order to keep up with the high packet arrival rates of modern networks. Previous approaches for flow counting based on bitmap algorithms can underestimate the number of flows. We propose a new timestamp-vector algorithm that retains the fast estimation and small memory requirement of the bitmap-based algorithms, while reducing the possibility of underestimating the number of active flows.

Counting network flows in real time

In this paper, we propose a distributed admission control scheme based on dynamic bandwidth reservation, with the aid of GPS to trade the position of the mobile terminal (MT) and predict its trajectory. We consider both wireless and wired links as potential bottlenecks and perform reservation in both types of links. By predicting a MT's target handoff cell and its remaining time to handoff, bandwidth reservation can be performed dynamically and efficiently. We perform simulations using an arbitrary hierarchical wireless ATM network with 256 cells, and show that the proposed scheme is able to prioritize handoff requests with moderate tradeoff of the blocking probability for new calls. We also show that the proposed scheme does not affect the amount of bandwidth utilization significantly, and the amount of prediction errors is approximately 1% of the total number of handoffs.

/pdf/dynamic-bandwidth-reservation-in-hierarchical-wireless-atm-k0knbe4szq.pdf

H.S. Kim

Papers

Autograph: toward automated, distributed worm signature detection

Autograph: toward automated, distributed worm signature detection

Dynamic guard bandwidth scheme for wireless broadband networks

Counting network flows in real time

Dynamic bandwidth reservation in hierarchical wireless ATM networks using GPS-based prediction