API Profiling for Buffer Overflow Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Buffer overflow exploits occur when insufficient bounds checking allows data to corrupt adjacent memory addresses, making systems vulnerable to attacks, especially when processing untrusted data in cloud computing environments.
Innovation Solution
Instrumenting system binaries to profile memory management APIs, generating profiles of expected memory size parameters during a baselining period, and comparing subsequent API calls to detect suspicious activity, such as deviations from expected ranges, to prevent buffer overflow exploits.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If bounds checking is implemented to prevent buffer overflow, then system security is improved, but processing speed and efficiency deteriorate
Solution Approach 1:
The system performs preliminary profiling during a baselining period to establish expected parameter ranges for memory management APIs before actual operation. This preliminary characterization of normal behavior enables faster anomaly detection during runtime without requiring complex real-time bounds checking, thus maintaining security while preserving processing speed.
Solution Approach 2:
The system implements feedback by continuously monitoring API calls and comparing them against established profiles. When deviations are detected, the system can respond by blocking suspicious calls or alerting administrators. This feedback mechanism provides security through anomaly detection rather than traditional bounds checking, avoiding the performance penalty of exhaustive validation.
2Difficulty of detecting and measuring
If traditional bounds checking is used to detect buffer overflow, then detection capability is improved, but system complexity increases
Solution Approach 1:
The patent introduces an intermediary profiling system that sits between the application and the memory management APIs. This intermediary layer captures and analyzes API calls, comparing them against established profiles to detect anomalies. This approach simplifies the overall system by replacing complex real-time bounds checking logic with a more manageable profile-based anomaly detection mechanism that operates at the API level rather than requiring modification of individual buffer operations.
3Measurement precision
If profile-based detection is implemented, then false positive rate is reduced, but detection time increases
Solution Approach 1:
The system performs preliminary profiling during a baselining period to establish expected parameter ranges for memory management APIs before actual operation. This preliminary characterization of normal behavior enables faster anomaly detection during runtime without requiring complex real-time bounds checking, thus maintaining security while preserving processing speed.
Data Source
AI summary
A call to a memory management application programming interface (API) that results in a buffer overflow due to inaccurate bounds checking could potentially leave the system vulnerable to being exploited by a third party. Approaches presented herein can monitor calls to these APIs in order to determine typical memory sizes passed to these APIs. During an initial baselining period a number of profiles are generated that indicate expected memory size parameters under various different call conditions, such from specific sources or call stacks. Comparing subsequently received API calls against the expected values from the relevant profile enables the legitimacy of an API call to be determined with relatively high accuracy. A suspicious call is identified based at least in part upon determining that the memory size of the call falls outside an expected range for that API and the relevant context.