Network Traffic Pattern Detection for Buffer Overflow Exploits
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current intrusion detection and prevention systems face challenges in identifying and mitigating buffer overflow attacks due to their exploit-specific nature, which allows polymorphic exploits to evade detection and generate false alarms, necessitating the development of exploit-nonspecific methods and smart filters.
Innovation Solution
A method and system for identifying network traffic patterns indicative of exploits by capturing and analyzing traffic for specific instruction sequences such as the 'JUMP-CALL-POP' or 'JUMP-CALL-JUMP-POP' sequences, using logical operations to determine memory offsets and intervals, allowing for the detection of buffer overflow attacks without relying on specific exploit signatures.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If signature-based intrusion detection is used to detect specific exploits, then detection accuracy for known exploits is improved, but the system becomes vulnerable to polymorphic exploits and generates false alarms
Solution Approach 1:
The patent applies universality by detecting common instruction sequences (JUMP-CALL-POP, JUMP-CALL-JUMP-POP) that are present across multiple exploit types rather than creating separate signatures for each exploit. This multi-functional detection approach allows a single filter to identify various buffer overflow attacks and polymorphic variants, resolving the contradiction between detection accuracy for known exploits and resistance to polymorphic exploits.
2Reliability
If exploit-specific signatures are created for each attack variant, then detection of known exploits is improved, but system complexity and maintenance burden increase
Solution Approach 1:
The patent extracts the commonalities from diverse exploit signatures, isolating the universal instruction sequences (JUMP-CALL-POP, JUMP-CALL-JUMP-POP) that appear across all buffer overflow attacks. By taking out only the essential common pattern rather than incorporating all exploit-specific details, the system achieves reliable detection while significantly reducing filter management complexity.
3Difficulty of detecting and measuring
If network traffic is monitored for detailed analysis, then detection capability is improved, but processing time and system resource consumption increase
Solution Approach 1:
The patent extracts only the most critical detection patterns (specific instruction sequences) from the vast amount of network traffic data. Instead of analyzing every packet in detail, the system searches for the presence of JUMP-CALL-POP or JUMP-CALL-JUMP-POP sequences, which dramatically reduces processing time while maintaining high detection capability for buffer overflow attacks.
Data Source
AI summary
Exploit nonspecific host intrusion prevention/detection methods, systems and smart filters are described. Portion of network traffic is captured and searched for a network traffic pattern, comprising: searching for a branch instruction transferring control to a first address in the memory; provided the first instruction is found, searching for a subroutine call instruction within a first predetermined interval in the memory starting from the first address and pointing to a second address in the memory; provided the second instruction is found, searching for a third instruction at a third address in the memory, located at a second predetermined interval from the second address; provided the third instruction is a fetch instruction, indicating the presence of the exploit;provided the third instruction is a branch instruction, transferring control to a fourth address in the memory, and provided a fetch instruction is located at the fourth address, indicating the presence of the exploit.