Buffer Overflow Detection via System Call Timestamp Correlation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional buffer overflow detection techniques often result in false positive detections, interfering with normal computer operation and confusing users, as they incorrectly identify legitimate programs that execute code in non-executable memory regions.
Innovation Solution
The proposed solution correlates evidence of buffer overflow attacks with potential initiating events, disregarding attacks lacking corresponding events, thereby reducing false positives by using a security module that detects data input system calls, generates timestamps for these events, and only declares a buffer overflow if a recent initiating event is detected within a specified time frame, such as 10 milliseconds.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional buffer overflow detection techniques are used to detect code execution in non-executable memory regions, then buffer overflow attacks can be detected, but false positive detections increase significantly
Solution Approach 1:
The system performs preliminary actions by detecting and recording data input system calls (such as read(), write(), socketrecv()) and their timestamps before buffer overflow attacks can occur. This preliminary detection of initiating events creates a baseline that allows the system to later distinguish between legitimate code execution and actual buffer overflow attacks, thereby reducing false positives while maintaining reliable attack detection
Solution Approach 2:
The system implements feedback by continuously monitoring for data input system calls and using their timestamps to evaluate subsequent code execution events. When code execution is detected in a non-executable memory region, the system feedback-loop checks whether a recent data input system call occurred within the correlation time window, using this feedback to accurately determine whether the execution represents a genuine buffer overflow attack or legitimate program behavior
2Reliability
If code execution in non-executable memory regions is monitored, then buffer overflow attacks can be detected, but normal program operations are interfered with
Solution Approach 1:
The system performs preliminary actions by detecting and recording data input system calls (such as read(), write(), socketrecv()) and their timestamps before buffer overflow attacks can occur. This preliminary detection of initiating events creates a baseline that allows the system to later distinguish between legitimate code execution and actual buffer overflow attacks, thereby reducing false positives while maintaining reliable attack detection
Solution Approach 2:
The system changes the parameter of time by introducing a correlation time window (e.g., 10 milliseconds) that defines the temporal relationship between data input system calls and code execution events. By evaluating whether code execution occurs within this specific time parameter after a data input call, the system can distinguish between legitimate execution and buffer overflow attacks without interfering with normal program operations that execute code at different times
3Measurement precision
If all code execution in non-executable regions is flagged as attacks, then detection sensitivity is maximized, but user confusion increases
Solution Approach 1:
The system performs preliminary actions by detecting and recording data input system calls (such as read(), write(), socketrecv()) and their timestamps before buffer overflow attacks can occur. This preliminary detection of initiating events creates a baseline that allows the system to later distinguish between legitimate code execution and actual buffer overflow attacks, thereby reducing false positives while maintaining reliable attack detection
Solution Approach 2:
The system implements feedback by continuously monitoring for data input system calls and using their timestamps to evaluate subsequent code execution events. When code execution is detected in a non-executable memory region, the system feedback-loop checks whether a recent data input system call occurred within the correlation time window, using this feedback to accurately determine whether the execution represents a genuine buffer overflow attack or legitimate program behavior, thereby providing accurate information to users without causing confusion
Data Source
AI summary
Certain events, such as data input operating system calls, are likely to initiate a buffer overflow attack. A timing module generates timestamps that indicate when such possible initiating events occur. The timestamp is associated with a particular process and/or thread executing on the computer. If subsequent evidence of a buffer overflow attack is detected on the computer, the timestamps are consulted to determine if a possible initiating event occurred recently. If there is a recent initiating event, a buffer overflow attack is declared. Evidence of a buffer overflow attack can include receiving a signal from the processor indicating that the processor was asked to execute an instruction residing in non-executable memory. Evidence of a buffer overflow attack can also include detecting an action on the computer that malicious software is likely to perform, such as opening a file or network connection, being performed by an instruction residing in non-executable memory.