Automatic Generation of Robust Network Intrusion Detection Signatures

A comprehensive cyber attack defense should include (1) an attack detection} component that can determine if a network application has been compromised and prevent the attack from further spreading, (2) an attack identification component that can identify the corresponding attack packets and generate the associated attack signatures so as to prevent such attacks from taking place in the future, and (3) an attack repair component that can restore the compromised application's state to that before the attack and allow it to continue normally, and if possible permanently eliminate the vulnerability being exploited. In this SBIR project, we propose to build a program transformation system called DIRA that can automatically embed into network applications an attack detection and identifcation capability against a particular type of attacks called control-hijacking attacks, which are the most common and thus most dangerous attack methods used today, and in fact are building blocks for many recent Internet worms. Control-hijacking attacks allow remote attackers to hijack a remote program and eventually its underlying system, and include such attacks as buffer overflow, integer overflow and format string attacks. Given a network application's source or binary code, DIRA can transform it in such a way that the resulting program can automatically detect any incoming control-hijacking attack, and identify the actual attack packet(s) and inform the front-end firewall and intrusion prevention system accordingly, all without requiring any modifications to the operating system or hardware.