Patrol: Revealing zero-day attack paths through network-wide system object dependencies

Jun Dai, Xiaoyan Sun, Peng Liu

Research output: Chapter in Book/Report/Conference proceedingConference contribution

6 Scopus citations

Abstract

Identifying attack paths in enterprise network is strategically necessary and critical for security defense. However, there has been insufficient efforts in studying how to identify an attack path that goes through unknown security holes. In this paper, we define such attack paths as zero-day attack paths, and propose a prototype system named Patrol to identify them at runtime. Using system calls, Patrol builds a network-wide system object dependency graph that captures dependency relations between OS objects, and identifies suspicious intrusion propagation paths in it as candidate zero-day attack paths through forward and backward tracking from intrusion symptoms. Patrol further identifies highly suspicious candidates among these paths, by recognizing indicators of unknown vulnerability exploitations along the paths through rule-based checking. Our evaluation shows that Patrol can work accurately and effectively at runtime with an acceptable performance overhead.

Original languageEnglish (US)
Title of host publicationComputer Security, ESORICS 2013 - 18th European Symposium on Research in Computer Security, Proceedings
Pages536-555
Number of pages20
DOIs
StatePublished - 2013
Event18th European Symposium on Research in Computer Security, ESORICS 2013 - Egham, United Kingdom
Duration: Sep 9 2013Sep 13 2013

Publication series

NameLecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)
Volume8134 LNCS
ISSN (Print)0302-9743
ISSN (Electronic)1611-3349

Other

Other18th European Symposium on Research in Computer Security, ESORICS 2013
CountryUnited Kingdom
CityEgham
Period9/9/139/13/13

All Science Journal Classification (ASJC) codes

  • Theoretical Computer Science
  • Computer Science(all)

Fingerprint Dive into the research topics of 'Patrol: Revealing zero-day attack paths through network-wide system object dependencies'. Together they form a unique fingerprint.

Cite this