Sökning: onr:"swepub:oai:lup.lub.lu.se:0fde4dfb-021b-4f03-8019-e239b9a19c02" >
eavesROP: Listening...
eavesROP: Listening for ROP Payloads in Data Streams
-
- Jämthagen, Christopher (författare)
- Lund University,Lunds universitet,Institutionen för elektro- och informationsteknik,Institutioner vid LTH,Lunds Tekniska Högskola,Department of Electrical and Information Technology,Departments at LTH,Faculty of Engineering, LTH
-
- Karlsson, Linus (författare)
- Lund University,Lunds universitet,Institutionen för elektro- och informationsteknik,Institutioner vid LTH,Lunds Tekniska Högskola,Department of Electrical and Information Technology,Departments at LTH,Faculty of Engineering, LTH
-
- Stankovski, Paul (författare)
- Lund University,Lunds universitet,Institutionen för elektro- och informationsteknik,Institutioner vid LTH,Lunds Tekniska Högskola,Department of Electrical and Information Technology,Departments at LTH,Faculty of Engineering, LTH
-
visa fler...
-
- Hell, Martin (författare)
- Lund University,Lunds universitet,Institutionen för elektro- och informationsteknik,Institutioner vid LTH,Lunds Tekniska Högskola,Department of Electrical and Information Technology,Departments at LTH,Faculty of Engineering, LTH
-
Chow, Sherman S. M. (redaktör/utgivare)
-
Camenisch, Jan (redaktör/utgivare)
-
Hui, Lucas C. K. (redaktör/utgivare)
-
Yiu, Siu Ming (redaktör/utgivare)
-
visa färre...
-
(creator_code:org_t)
- Cham : Springer International Publishing, 2014
- 2014
- Engelska.
-
Ingår i: Information Security/Lecture Notes in Computer Science. - Cham : Springer International Publishing. - 0302-9743. - 9783319132563 - 9783319132570 ; 8783, s. 413-424
- Relaterad länk:
-
https://portal.resea... (primary) (free)
-
visa fler...
-
http://dx.doi.org/10...
-
https://lup.lub.lu.s...
-
https://lup.lub.lu.s...
-
https://doi.org/10.1...
-
visa färre...
Abstract
Ämnesord
Stäng
- We consider the problem of detecting exploits based on return-oriented programming. In contrast to previous works we investigate to which extent we can detect ROP payloads by only analysing streaming data, i.e., we do not assume any modifications to the target machine, its kernel or its libraries. Neither do we attempt to execute any potentially malicious code in order to determine if it is an attack. While such a scenario has its limitations, we show that using a layered approach with a filtering mechanism together with the Fast Fourier Transform, it is possible to detect ROP payloads even in the presence of noise and assuming that the target system employs ASLR. Our approach, denoted eavesROP, thus provides a very lightweight and easily deployable mitigation against certain ROP attacks. It also provides the added merit of detecting the presence of a brute-force attack on ASLR since library base addresses are not assumed to be known by eavesROP.
Ämnesord
- TEKNIK OCH TEKNOLOGIER -- Elektroteknik och elektronik (hsv//swe)
- ENGINEERING AND TECHNOLOGY -- Electrical Engineering, Electronic Engineering, Information Engineering (hsv//eng)
- NATURVETENSKAP -- Data- och informationsvetenskap -- Datavetenskap (hsv//swe)
- NATURAL SCIENCES -- Computer and Information Sciences -- Computer Sciences (hsv//eng)
Nyckelord
- Return-Oriented Programming
- ROP
- Pattern Matching
- ASLR
Publikations- och innehållstyp
- kon (ämneskategori)
- ref (ämneskategori)
Hitta via bibliotek
Till lärosätets databas