SBIR Phase I: Automatic Extraction and Enforcement of Application-Specific Security Policy

This Small Business Innovation Research (SBIR) Phase I project is to develop a Program semantics-Aware Intrusion Detection (PAID) system that derives a security policy from an application's source code, and checks the application's system calls against the resulting policy at run time. Not only can this product derive these policies completely automatically, but also the resulting security policy is tailored to individual applications and thus is highly accurate. Some of the most dangerous cyber security threats are "control hijacking" attacks, which hijack the control of a victim application, and execute arbitrary system calls assuming the identity of the victim program's effective user. These types of attacks are highly perilous because commercial applications with such vulnerabilities appear to be wide spread, as shown in the rampancy of the recent SQL Slammer Worm. System call monitoring has been touted as an effective solution to "control hijacking" attacks because it could prevent remote attackers from inflicting damage upon a victim system even if they can successfully compromise applications running on the system. A weakness of this approach is how to construct accurate security policy that could minimize false positives and negatives. Although various approaches have been tried to solve this problem, none of them is satisfactory. Host-based intrusion detection based on system call monitoring, also referred to as behavioral blocking systems, is a well known tend to err on the conservative or false positive side. The tool will automatically derive accurate security policies corresponding to the system call patterns of individual applications, thus reducing both false positives and negatives to the minimum. The PAID system represents a big step in closing the gap between current behavioral blocking products and the actual needs of real world information technology (IT) systems.