Using Greedy Hamiltonian Call Paths to Detect Stack Smashing Attacks
The ICAT statistics over the past few years have shown at least one out of every five CVE and CVE candidate vulnerabilities have been due to buffer overflows. This constitutes a significant portion of today’s computer related security concerns. In this paper we introduce a novel method for detecting stack smashing and buffer overflow attacks. Our runtime method extracts return addresses from the program call stack and uses these return addresses to extract their corresponding invoked addresses from memory. We demonstrate how these return and invoked addresses can be represented as a directed weighted graph and used in the detection of stack smashing attacks. We introduce the concept of a Greedy Hamiltonian Call Path and show how the lack of such a path can be used to detect stack-smashing attacks.
Unable to display preview. Download preview PDF.
- 1.Wagner, D., Foster, J., Brewer, E., Aiken, A.: A First Step Towards Automated Detection of Buffer Overrun Vulnerabilities. In: Proceedings 7th Network and Distributed System Security Symposium (February 2000)Google Scholar
- 2.ICAT Vulnerability Statistics, Downloaded at: http://icat.nist.gov/icat.cfm?function=statistics
- 3.SecurityTracker.com Statistics, Found at: http://www.securitytracker.com/learn/securitytracker-stats-2002.pdf
- 4.Cowan, C., Pu, C., Maier, D., Hinton, H., Walpole, J., Bakke, P., Beattie, S., Grier, A., Waggle, P., Zhang, Q.: StackGuard: Automatic Adaptive Detection and Prevention of Buffer- Overflow Attacks. In: Proceedings of the 7th USENIX Security Conference, San Antonio, TX (1998)Google Scholar
- 5.Baratloo, A., Singh, N.: Transparent Run-Time Defense Against Stack Smashing Attacks. In: Proceedings of the 2000 USENIX Technical Conference, San Diego, CA (January 2002)Google Scholar
- 6.Feng, H.H., Kolesnikov, O.M., Fogla, P., Lee, W., Gong, W.: Anomaly Detection Using Call Stack Information.In: IEEE Symposium on Security and Privacy, Berkeley, CA (May 2003)Google Scholar