11355624
Theory and Techniques for Automatic Generation of Vulnerability-Based Signatures
In this paper, we explore the problem of creating \emph{vulnerability signatures}. A vulnerability signature is based on a program vulnerability, and is not specific to any particular exploit. The advantage of vulnerability signatures is that their quality can be guaranteed. In particular, we create vulnerability signatures which are guaranteed to have zero false positives. We show how to automate signature creation for any vulnerability that can be detected by a runtime monitor. We provide a formal definition of a vulnerability signature, and investigate the computational complexity of creating and matching vulnerability signatures. We systematically explore the design space of vulnerability signatures. We also provide specific techniques for creating vulnerability signatures in a variety of language classes. In order to demonstrate our techniques, we have built a prototype system. Our experiments show that we can, using a single exploit, automatically generate a vulnerability signature as a regular expression, as a small program, or as a system of constraints. We demonstrate techniques for creating signatures of vulnerabilities which can be exploited via multiple program paths. Our results indicate that our approach is a viable option for signature generation, especially when guarantees are desired.
15799228
Security policy reconciliation in distributed computing environments
A major hurdle in sharing resources between organizations is heterogeneity. Therefore, in order for two organizations to collaborate their policies have to be resolved. The process of resolving different policies is known as policy reconciliation, which in general is an intractable problem. This paper addresses policy reconciliation in the context of security. We present a formal framework and hierarchical representation for security policies. Our hierarchical representation exposes the structure of the policies and leads to an efficient reconciliation algorithm. We also demonstrate that agent preferences for security mechanisms can be readily incorporated into our framework. We have implemented our reconciliation algorithm in a library called the policy reconciliation engine or PRE. In order to test the implementation and measure the overhead of our reconciliation algorithm, we have integrated PRE into a distributed high-throughput system called Condor.
7290502
Towards automatic generation of vulnerability-based signatures
In this paper we explore the problem of creating vulnerability signatures. A vulnerability signature matches all exploits of a given vulnerability, even polymorphic or metamorphic variants. Our work departs from previous approaches by focusing on the semantics of the program and vulnerability exercised by a sample exploit instead of the semantics or syntax of the exploit itself. We show the semantics of a vulnerability define a language which contains all and only those inputs that exploit the vulnerability. A vulnerability signature is a representation (e.g., a regular expression) of the vulnerability language. Unlike exploit-based signatures whose error rate can only be empirically measured for known test cases, the quality of a vulnerability signature can be formally quantified for all possible inputs. We provide a formal definition of a vulnerability signature and investigate the computational complexity of creating and matching vulnerability signatures. We also systematically explore the design space of vulnerability signatures. We identify three central issues in vulnerability-signature creation: how a vulnerability signature represents the set of inputs that may exercise a vulnerability, the vulnerability coverage (i.e., number of vulnerable program paths) that is subject to our analysis during signature creation, and how a vulnerability signature is then created for a given representation and coverage. We propose new data-flow analysis and novel adoption of existing techniques such as constraint solving for automatically generating vulnerability signatures. We have built a prototype system to test our techniques. Our experiments show that we can automatically generate a vulnerability signature using a single exploit which is of much higher quality than previous exploit-based signatures. In addition, our techniques have several other security applications, and thus may be of independent interest
3839837
Creating Vulnerability Signatures Using Weakest Preconditions
Signature-based tools such as network intrusion detection systems are widely used to protect critical systems. Automatic signature generation techniques are needed to enable these tools due to the speed at which new vulnerabilities are discovered. In particular, we need automatic techniques which generate sound signatures - signatures which will not mistakenly block legitimate traffic or raise false alarms. In addition, we need signatures to have few false negatives and will catch many different exploit variants. We investigate new techniques for automatically generating sound vulnerability signatures with fewer false negatives than previous research using program binary analysis. The key problem to reducing false negatives is to consider as many as possible different program paths an exploit may take. Previous work considered each possible program path an exploit may take separately, thus generating signatures that are exponential in the size of the number of branches considered. In the exact same scenario, we show how to reduce the overall signature size and the generation time from exponential to polynomial. We do this without requiring any additional assumptions, or relaxing any properties. This efficiency gain allows us to consider many more program paths, which results in reducing the false negatives of generated signatures. We achieve these results by creating algorithms for generating vulnerability signatures that are based on computing weakest preconditions (WP). The weakest precondition for a program path to a vulnerability is a function which matches all exploits that may exploit the vulnerability along that path. We have implemented our techniques and generated signatures for several binary programs. Our results demonstrate that our WP-based algorithm generates more succinct signatures than previous approaches which were based on forward symbolic execution.
5961776
NetSpy: Automatic Generation of Spyware Signatures for NIDS
We present NetSpy, a tool to automatically generate network-level signatures for spyware. NetSpy determines whether an untrusted program is spyware by correlating user input with network traffic generated by the untrusted program. If classified as spyware, NetSpy also generates a signature characterizing the malicious substrate of the spyware's network behavior. Such a signature can be used by network intrusion detection systems to detect spyware installations in large networks. In our experiments, NetSpy precisely identified each of the 7 spyware programs that we considered and generated network-level signatures for them. Of the 9 supposedly-benign programs that we considered, NetSpy correctly characterized 6 of them as benign. The remaining 3 programs showed network behavior that was highly suggestive of spying activity
5812455
Knowledge Enhanced IT Service Management
To manage the increasing complexity of IT systems and align IT services with business is the main theme of IT Service Management (ITSM). Current ITSM architecture adopts ITU as the framework to integrate silos of operational management tools and configuration information to build an end-to-end solution based on best practices. However, it lacks of a systematic means to address an important aspect of IT operation, i.e., managing the knowledge separated in various tools and experts' minds. In this paper, a novel knowledge-enhanced architecture is proposed to improve the effectiveness and efficiency of ITSM. The essential contribution of this novel architecture is to involve a Knowledge Management Database (KMDB) which provides assistance for knowledge capture, mining, storage and sharing. The paper will discuss an approach of how to construct such a KMDB with motivating scenarios and detailed description of key components. To validate the approach, a prototype system is developed and evaluated by being applied for problem analysis on a Cisco Voice over IP (VoIP) system. The experiment results show a remarkable improvement in the effectiveness and efficiency for practical IT service management operations.
694386
A Data Storage Mechanism for P2P VoD Based on Multi-channel Overlay
It is a big challenge to provide Video-on-Demand streaming services over Internet in a scalable way. Currently, many researchers use a single channel overlay to implement the scalability of on-demand streaming services. However, in a real application environment, various channels in a P2P VOD system have different popularities, which probably cause the imbalance of data storage-capability of the whole system. It results in a problem that a mass of unpopular channels' caching capability can not be used to satisfy the data requirements of the whole system. In order to solve the problem, this paper proposes a new data-storage mechanism, which constructs a multi-channel overlay to optimize the whole system's caching-capability and greatly improves unpopular channel's caching efficiency. The experimental results show that this mechanism can achieve significant effects.
20547783
The Formalization of Mathematics
Zest for both system and objectivity is the formal logician's original sin. He pays for it by constant frustrations and by living ofttimes the life of an intellectual outcaste. The task of squeezing a large body of stubborn facts into a more or less rigid system can be a painful one, especially since the facts of mathematics are among the most stubborn of all facts. Moreover, the more general and abstract we get, the farther removed we are from the raw mathematical experience. As intuition ceases to operate effectively, we fall into many unexpected traps. The formal logician gets little sympathy for his frustrations. He is regarded as too rigid by his philosophical colleagues and too speculative by his mathematical friends. The life of an intellectual outcaste may be a result partly of temperament and partly of the youthfulness of the logic profession. The unfortunate lack of wide appeal of logic may, however, be prolonged partly on account of the fact that very little of the well-established techniques of mathematics seems applicable to the treatment of serious problems of logic. The axiomatic method is well suited to provide results which are both exact and systematic. How attractive would it be if we could get an axiom system in which all the axioms and deductions were intuitively clear and all theorems of mathematics were provable? Such a system would undoubtedly satisfy Descartes who admits solely intuition and deduction, which are, for him, the only “mental operations by which we are able, wholly without fear of illusion, to arrive at the knowledge of things.” Indeed, according to Descartes, intuition and deduction “are the most certain routes to knowledge, and the mind should admit no others. All the rest should be rejected as suspect of error and dangerous.”
8487669
An SMR based advance resource reservation scheme for combined mobility and QoS Provisioning
One of the major problems of deploying RSVP in the mobile environment is called the advance resource reservation problem. If an RSVP reservation path is reserved in advance in the subnet that a mobile node will visit, the mobile node can continue its QoS session smoothly when it hands over to that subnet. However, if too many network resources are used for advance reservation, new QoS sessions originating from that subnet will experience a higher probability of being blocked needlessly. In this paper, we propose a new advance resource reservation scheme that properly constrains the amount of advance reservations in a subnet and only allows the mobile nodes with large value of session-to-mobility ratio (SMR) to make advance reservation. We evaluate the proposed scheme and the results show that our scheme can effectively reduce both active and passive reservation blocking probabilities and achieves a better utilisation of the network resources, especially when the traffic intensity is high.
14929484
An Auxiliary Ground Station Based Traffic Load Balancing Scheme for LEO Satellite Systems
In the Low Earth Orbit (LEO) satellite mobile communication system, traffic load in a spot beam fluctuates dramatically with a wide dynamic range due to the non-uniform geographical distribution of the traffic sources and the periodic satellite motion. The compromise between the utilization rate of valuable satellite channels and the blocking probability of a call causes higher proportion of channel idle time and cost of per connection. A new scheme based on auxiliary ground station (AGS) is proposed to solve this problem. The AGS is set to manage short distance calls. Simulation results illustrate that the proposed scheme balances the whole traffic load in LEO, improves the utilization rate of channels, and reduces the blocking probabilities of new calls and the dropping probabilities of handover calls. The cost of per connection is reduced at the same time.