Program Semantics-Aware Intrusion Detection and Prevention

Almost all known Internet worms use some variants of control-hijacking attack to spread themselves. It is generally agreed that defeating control-hijacking attacks using sandboxing is the most effective and user-transparent approach. This SBIR Phase II project proposes to design, implement and evaluate a novel sandboxing system called Paid. Paid uses a program analysis approach to automatically extract a system call model from an application program’s source code or binary code, and at run time checks the application’s runtime system call behavior against the extracted model to detect and stop any unauthorized system calls. An application program’s extracted system call model essentially becomes the security policy used to sandbox that application’s execution at run time. Through advanced program analysis techniques, Paid will be the first known sandboxing systems that can automatically derive an accurate and application-specific security policy for each individual application that guarantees zero false positive rate and almost zero false negative rate. Because of its ability to reduce both the false positive and negative rate to an unprecedented level, Paid is expected to mark a revolutionary advance in execution sandboxing technology and significantly improve the technical capability and thus market appeal of commercial sandboxing-based intrusion detection/prevention products.