Towards Generating High Coverage Vulnerability-Based Signatures With Protocol-Level Constraint-Guided Exploration

Free registration required

Executive Summary

Signature-based input filtering is an important and widely deployed defense. But current signature generation methods have limited coverage and the generated signatures often can be easily evaded by an attacker with small variations of the exploit message. In this paper, the authors propose protocol-level constraint-guided exploration, a new approach towards generating high coverage vulnerability-based signatures. In particular, their approach generates high coverage, yet compact, vulnerability point reachability predicates, which capture many paths to the vulnerability point. In their experimental results, their tool, Elcano, generates compact, high coverage signatures for real-world vulnerabilities.

  • Format: PDF
  • Size: 163.9 KB