Unearthing Stealthy Program Attacks Buried in Extremely Long Execution Paths

Simple item page
dc.contributor.authorShu, Xiaokuien
dc.contributor.authorYao, Danfeng (Daphne)en
dc.contributor.authorRamakrishnan, Narenen
dc.contributor.departmentComputer Scienceen
dc.date.accessioned2017-11-17T16:11:24Zen
dc.date.available2017-11-17T16:11:24Zen
dc.date.issued2015-10en
dc.description.abstractModern stealthy exploits can achieve attack goals without introducing illegal control flows, e.g., tampering with noncontrol data and waiting for the modified data to propagate and alter the control flow legally. Existing program anomaly detection systems focusing on legal control flow attestation and short call sequence verification are inadequate to detect such stealthy attacks. In this paper, we point out the need to analyze program execution paths and discover event correlations in large-scale execution windows among millions of instructions. We propose an anomaly detection approach with two-stage machine learning algorithms to recognize diverse normal call-correlation patterns and detect program attacks at both inter- and intra-cluster levels. We implement a prototype of our approach and demonstrate its effectiveness against three real-world attacks and four synthetic anomalies with less than 0.01% false positive rates and 0.1~1.3 ms analysis overhead per behavior instance (1k to 50k function or system calls).en
dc.identifier.doihttps://doi.org/10.1145/2810103.2813654en
dc.identifier.urihttp://hdl.handle.net/10919/80428en
dc.language.isoen_USen
dc.publisherACMen
dc.relation.ispartofACM CCS 2015en
dc.rightsIn Copyrighten
dc.rights.urihttp://rightsstatements.org/vocab/InC/1.0/en
dc.subjectIntrusion Detectionen
dc.subjectProgram Attacken
dc.subjectLong Execution Pathen
dc.subjectFunction Callen
dc.subjectEvent Correlationen
dc.subjectMachine Learningen
dc.titleUnearthing Stealthy Program Attacks Buried in Extremely Long Execution Pathsen
dc.title.serialProceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Securityen
dc.typeArticleen

Files

Original bundle
Now showing 1 - 1 of 1
Thumbnail Image
Name:
YaoStealthyProgramAttacks2015.pdf
Size:
608.37 KB
Format:
Adobe Portable Document Format
Description:
Download

Collections

Destination Area: Integrated Security (IS)
Scholarly Works, Computer Science