Taint Graph of System Call Arguments for Intrusion Detection in Mobile Intelatrac

Abstract:

The intended data-flow in a vulnerable program is subject to be subverted by attacks which exploit buffer overflows or format string vulnerabilities to write data to unintended location. In Mobile Telecommunication it is especially important on data safety. These attacks can be classified into two types: control-flow-attacks exploit buffer overflows or other vulnerabilities to overwrite a return address, a function pointer, or some other piece of control-data; non-control-data attacks exploit similar vulnerabilities to overwrite security critical data without subverting the intended control-flow in the program. The control-flow attacks are well studied and widely used, so there are several typical approaches to prevent them, which monitor the sequence of system calls emitted by the application being monitored and utilize control-flow information of the system calls for intrusion detection. However, the non-control-data attacks are rare for the reason that they rely on specific semantics of the target applications, and there are only few works that defend them to some extent. In order to prevent non-control-data attacks, we leverage dynamic taint technique to track the instruction level relationship between different system call arguments and construct taint graph which can represent behavior profile of a benign program in this paper..

• Periodical: Advanced Materials Research (Volumes 546-547)
• Pages: 1101-1106
• DOI: https://doi.org/10.4028/www.scientific.net/AMR.546-547.1101
• Online since: July 2012
• Authors: Dan Nie, Yu Hui Wang
• Keywords: Internet Security, Mobile Computing, Taint Grapth

References

[1] CHEN, S., XU, J., SEZER, E. C., GAURIAR, P., AND IYER,R. K. : Non-control-data attacks are realistic threats, In USENIX Security Symposium(2005).

[2] HH. Feng, OM. Kolesnikov, P. Fogla, and W. Lee L. : Anomaly detection using call stack information( IEEE Symposium on Security and Privacy , Berkeley, California, 2003).

[3] Giffin J T, Dagon D, Jha S. : Environment-sensitive intrusion detection( In Recent Advances in Intrusion Detection (RAID). Seattle, Washington: Springer Press, 2005).

DOI: 10.1007/11663812_10

[4] Peng Li, Hyundo Park, Debin Gao and Jianming Fu. : Bridging the Gap between Data-flow and Control-flow Analysis for Anomaly Detection, In Proceedings of the 24th Annual Computer, (2008).

DOI: 10.1109/acsac.2008.17

[5] Sandeep, Bhatkar, Abhishek, Chaturvedi, R. Sekar. : T Dataflow Anomaly Detection (IEEE Symposium on Security and Privacy, 2006).

DOI: 10.1109/sp.2006.12

[6] James Clause, Wanchun Li, Alessanddro Orso. : Dytan: A Generic Dynamic Taint Analysis Framework( London, England, United Kingdom, ISSTA'07, 2007).

DOI: 10.1145/1273463.1273490

[7] Heng Yin, Dawn Song, Manuel Egele, Christopher Kruegel, Engin Kirda, . : Panorama: Capturing System-wide Information Flow for Malware Detection and Analysis, (CCS'07, Alexandria, Virginia, USA, 2007).

DOI: 10.1145/1315245.1315261

[8] Ulrich Bayer, Paolo Milani Comparetti, Clemens Hlauscheck, Christopher Kruegel, Engin Kirda.: Scalable, behavior-based malware clustering (In Network and Distributed System Security Symposium, 2009).

[9] Dawn Song, David Brumley, HengYin, Juan Caballero, Ivan Jager, Min Gyung Kang, Zhenkai Liang, James Newsome, Pongsin Poosankam, Prateek Saxena1. : BitBlaze: A New Approach to Computer Security via Binary Analysis, "(Information systems security : 4th International Conference, 2008).

DOI: 10.1007/978-3-540-89862-7_1