SA3: Automatic semantic aware attribution analysis of remote exploits

Deguang Kong, Donghai Tian, Peng Liu, Dinghao Wu

Research output: Chapter in Book/Report/Conference proceedingConference contribution

2 Scopus citations

Abstract

Web services have been greatly threatened by remote exploit code attacks, where maliciously crafted HTTP requests are used to inject binary code to compromise web servers and web applications. In practice, besides detection of such attacks, attack attribution analysis, i.e., to automatically categorize exploits or to determine whether an exploit is a variant of an attack from the past, is also very important. In this paper, we present SA3, an exploit code attribution analysis which combines semantic analysis and statistical analysis to automatically categorize a given exploit code. SA 3 extracts semantic features from an exploit code through data anomaly analysis, and then attributes the exploit to an appropriate class based on our statistical model derived from a Markov model. We evaluate SA3 over a comprehensive set of shellcode collected from Metasploit and other polymorphic engines. Experimental results show that SA3 is effective and efficient. The attribution analysis accuracy can be over 90% in different parameter settings with false positive rate no more than 4.5%. To our knowledge, SA3 is the first work combining semantic analysis with statistical analysis for exploit code attribution analysis.

Original languageEnglish (US)
Title of host publicationSecurity and Privacy in Communication Networks - 7th International ICST Conference, SecureComm 2011, Revised Selected Papers
Pages190-208
Number of pages19
DOIs
StatePublished - 2012
Event7th International ICST Conference on Security and Privacy in Communication Networks, SecureComm 2011 - London, United Kingdom
Duration: Sep 7 2011Sep 9 2011

Publication series

NameLecture Notes of the Institute for Computer Sciences, Social-Informatics and Telecommunications Engineering
Volume96 LNICST
ISSN (Print)1867-8211

Other

Other7th International ICST Conference on Security and Privacy in Communication Networks, SecureComm 2011
CountryUnited Kingdom
CityLondon
Period9/7/119/9/11

All Science Journal Classification (ASJC) codes

  • Computer Networks and Communications

Fingerprint Dive into the research topics of 'SA<sup>3</sup>: Automatic semantic aware attribution analysis of remote exploits'. Together they form a unique fingerprint.

Cite this