Computer Network Operations (CNO) for Ground-based Midcourse Defense (GMD)

Buffer overflow attack is the main attack method that most if not all existing malicious worms use to propagate themselves from machine to machine. Despite the fact that buffer overflow bug is a well known programming problem, existing and new network applications continue to exhibit this type of vulnerability, thus exposing themselves to remote exploits. Although a great deal of research has been invested in defense mechanisms against buffer overflow attack, most of these mechanisms require modifications to network applications and/or the platforms that host them. The goal of this project is to develop network-based buffer overflow attack detection techniques that can detect a wide variety of buffer overflow attacks based solely on the packets observed without requiring any modifications to the end hosts. Moreover, rather than derive a signature specific to each individual buffer overflow attack instance, this project aims to develop a generalized signature that can capture all buffer overflow attacks that are known to exist while reducing false positives to a negligible level. Finally, this project proposes several novel performance optimization techniques that can scale the proposed generalized buffer overflow attack detection mechanism to gigabit network links, including payload bypassing, multi-resolution packet analysis, and contextual analysis.