Automatic Generation of Robust Network Intrusion Detection Signatures

We propose to build a program transformation system called DIRA that can automatically embed into network applications a comprehensive cyber defense against an important class of attacks called control-hijacking attacks, which allow remote attackers to hijack a remote program and eventually its underlying system, and include such attacks as buffer overflow, integer overflow and format string attacks. Given a network application's source or binary code, DIRA transforms it into a form that is able to automatically detect any control-hijacking attack, generate an accurate signature that the front-end firewall or intrusion prevention system can use to block the detected attack and its variants, and create a patch that permanently fixes the vulnerability exploited by the detected attack. DIRA performs both run-time logging/monitoring and post-attack log analysis in a way that is transparent to application developers and does not require any modifications to the operating system or hardware.