Switchblade: enforcing dynamic personalized system call models

Authors:
Christof Fetzer;Martin Süßkraut
Affiliations:
Techniche Universität Dresden, Dresden, Germany;Techniche Universität Dresden, Dresden, Germany
Venue:
Proceedings of the 3rd ACM SIGOPS/EuroSys European Conference on Computer Systems 2008
Year:
2008

Citing 39
Cited 3

Mimicry attacks on host-based intrusion detection systems

Proceedings of the 9th ACM conference on Computer and communications security
A Flexible Containment Mechanism for Executing Untrusted Code

Proceedings of the 11th USENIX Security Symposium
Linux Security Modules: General Security Support for the Linux Kernel

Proceedings of the 11th USENIX Security Symposium
Secure Execution via Program Shepherding

Proceedings of the 11th USENIX Security Symposium
The Impact of Recovery Mechanisms on the Likelihood of Saving Corrupted State

ISSRE '02 Proceedings of the 13th International Symposium on Software Reliability Engineering
A Sense of Self for Unix Processes

SP '96 Proceedings of the 1996 IEEE Symposium on Security and Privacy
A Fast Automaton-Based Method for Detecting Anomalous Program Behaviors

SP '01 Proceedings of the 2001 IEEE Symposium on Security and Privacy
Recovery Oriented Computing (ROC): Motivation, Definition, Techniques,

Recovery Oriented Computing (ROC): Motivation, Definition, Techniques,
Model-carrying code: a practical approach for safe execution of untrusted applications

SOSP '03 Proceedings of the nineteenth ACM symposium on Operating systems principles
Secure program execution via dynamic information flow tracking

ASPLOS XI Proceedings of the 11th international conference on Architectural support for programming languages and operating systems
On the effectiveness of address-space randomization

Proceedings of the 11th ACM conference on Computer and communications security
Minos: Control Data Attack Prevention Orthogonal to Memory Model

Proceedings of the 37th annual IEEE/ACM International Symposium on Microarchitecture
SubDomain: Parsimonious Server Security

LISA '00 Proceedings of the 14th USENIX conference on System administration
Vigilante: end-to-end containment of internet worms

Proceedings of the twentieth ACM symposium on Operating systems principles
Rx: treating bugs as allergies---a safe method to survive software failures

Proceedings of the twentieth ACM symposium on Operating systems principles
SELinux: NSA's Open Source Security Enhanced Linux

SELinux: NSA's Open Source Security Enhanced Linux
Anomalous system call detection

ACM Transactions on Information and System Security (TISSEC)
Towards Automatic Generation of Vulnerability-Based Signatures

SP '06 Proceedings of the 2006 IEEE Symposium on Security and Privacy
Dataflow Anomaly Detection

SP '06 Proceedings of the 2006 IEEE Symposium on Security and Privacy
Binary rewriting and call interception for efficient runtime protection against buffer overflows: Research Articles

Software—Practice & Experience
Paranoid penguin: an introduction to Novell AppArmor

Linux Journal
LIFT: A Low-Overhead Practical Information Flow Tracking System for Detecting Security Attacks

Proceedings of the 39th Annual IEEE/ACM International Symposium on Microarchitecture
Argos: an emulator for fingerprinting zero-day attacks for advertised honeypots with automatic signature generation

Proceedings of the 1st ACM SIGOPS/EuroSys European Conference on Computer Systems 2006
Practical taint-based protection using demand emulation

Proceedings of the 1st ACM SIGOPS/EuroSys European Conference on Computer Systems 2006
QEMU, a fast and portable dynamic translator

ATEC '05 Proceedings of the annual conference on USENIX Annual Technical Conference
Valgrind: a framework for heavyweight dynamic binary instrumentation

Proceedings of the 2007 ACM SIGPLAN conference on Programming language design and implementation
Automated response using system-call delays

SSYM'00 Proceedings of the 9th conference on USENIX Security Symposium - Volume 9
FormatGuard: automatic protection from printf format string vulnerabilities

SSYM'01 Proceedings of the 10th conference on USENIX Security Symposium - Volume 10
PointguardTM: protecting pointers from buffer overflow vulnerabilities

SSYM'03 Proceedings of the 12th conference on USENIX Security Symposium - Volume 12
Improving host security with system call policies

SSYM'03 Proceedings of the 12th conference on USENIX Security Symposium - Volume 12
How to shadow every byte of memory used by a program

Proceedings of the 3rd international conference on Virtual execution environments
StackGuard: automatic adaptive detection and prevention of buffer-overflow attacks

SSYM'98 Proceedings of the 7th conference on USENIX Security Symposium - Volume 7
A secure environment for untrusted helper applications confining the Wily Hacker

SSYM'96 Proceedings of the 6th conference on USENIX Security Symposium, Focusing on Applications of Cryptography - Volume 6
Transparent run-time defense against stack smashing attacks

ATEC '00 Proceedings of the annual conference on USENIX Annual Technical Conference
Sweeper: a lightweight end-to-end system for defending against fast worms

Proceedings of the 2nd ACM SIGOPS/EuroSys European Conference on Computer Systems 2007
Triage: diagnosing production run failures at the user's site

Proceedings of twenty-first ACM SIGOPS symposium on Operating systems principles
Intrusion detection using sequences of system calls

Journal of Computer Security
XFI: software guards for system address spaces

OSDI '06 Proceedings of the 7th symposium on Operating systems design and implementation
Exploiting concurrency vulnerabilities in system call wrappers

WOOT '07 Proceedings of the first USENIX workshop on Offensive Technologies

Capability wrangling made easy: debugging on a microkernel with valgrind

Proceedings of the 6th ACM SIGPLAN/SIGOPS international conference on Virtual execution environments
Fine-grained user-space security through virtualization

Proceedings of the 7th ACM SIGPLAN/SIGOPS international conference on Virtual execution environments
Taint-enhanced anomaly detection

ICISS'11 Proceedings of the 7th international conference on Information Systems Security

Quantified Score

Hi-index	0.01

Visualization

Abstract

System call interposition is a common approach to restrict the power of applications and to detect code injections. It enforces a model that describes what system calls and/or what sequences thereof are permitted. However, there exist various issues like concurrency vulnerabilities and incomplete models that restrict the power of system call interposition approaches. We present a new system, SwitchBlade, that uses randomized and personalized fine-grained system call models to increase the probability of detecting code injections. However, using a fine-grain system call model, we cannot exclude the possibility that the model is violated during normal program executions. To cope with false positives, SwitchBlade uses on-demand taint analysis to update a system call model during runtime.