The Experts below are selected from a list of 99381 Experts worldwide ranked by ideXlab platform

Benjamin G Zorn - One of the best experts on this subject based on the ideXlab platform.

  • nozzle a defense against heap spraying code injection Attacks
    USENIX Security Symposium, 2009
    Co-Authors: Paruj Ratanaworabhan, Benjamin Livshits, Benjamin G Zorn
    Abstract:

    Heap spraying is a Security Attack that increases the exploitability of memory corruption errors in type-unsafe applications. In a heap-spraying Attack, an Attacker coerces an application to allocate many objects containing malicious code in the heap, increasing the success rate of an exploit that jumps to a location within the heap. Because heap layout randomization necessitates new forms of Attack, spraying has been used in many recent Security exploits. Spraying is especially effective in web browsers, where the Attacker can easily allocate the malicious objects using JavaScript embedded in a web page. In this paper, we describe NOZZLE, a runtime heap-spraying detector. NOZZLE examines individual objects in the heap, interpreting them as code and performing a static analysis on that code to detect malicious intent. To reduce false positives, we aggregate measurements across all heap objects and define a global heap health metric. We measure the effectiveness of NOZZLE by demonstrating that it successfully detects 12 published and 2,000 synthetically generated heap-spraying exploits. We also show that even with a detection threshold set six times lower than is required to detect published malicious Attacks, NOZZLE reports no false positives when run over 150 popular Internet sites. Using sampling and concurrent scanning to reduce overhead, we show that the performance overhead of NOZZLE is less than 7% on average. While NOZZLE currently targets heap-based spraying Attacks, its techniques can be applied to any Attack that attempts to fill the address space with malicious code objects (e.g., stack spraying [42]).

Paruj Ratanaworabhan - One of the best experts on this subject based on the ideXlab platform.

  • nozzle a defense against heap spraying code injection Attacks
    USENIX Security Symposium, 2009
    Co-Authors: Paruj Ratanaworabhan, Benjamin Livshits, Benjamin G Zorn
    Abstract:

    Heap spraying is a Security Attack that increases the exploitability of memory corruption errors in type-unsafe applications. In a heap-spraying Attack, an Attacker coerces an application to allocate many objects containing malicious code in the heap, increasing the success rate of an exploit that jumps to a location within the heap. Because heap layout randomization necessitates new forms of Attack, spraying has been used in many recent Security exploits. Spraying is especially effective in web browsers, where the Attacker can easily allocate the malicious objects using JavaScript embedded in a web page. In this paper, we describe NOZZLE, a runtime heap-spraying detector. NOZZLE examines individual objects in the heap, interpreting them as code and performing a static analysis on that code to detect malicious intent. To reduce false positives, we aggregate measurements across all heap objects and define a global heap health metric. We measure the effectiveness of NOZZLE by demonstrating that it successfully detects 12 published and 2,000 synthetically generated heap-spraying exploits. We also show that even with a detection threshold set six times lower than is required to detect published malicious Attacks, NOZZLE reports no false positives when run over 150 popular Internet sites. Using sampling and concurrent scanning to reduce overhead, we show that the performance overhead of NOZZLE is less than 7% on average. While NOZZLE currently targets heap-based spraying Attacks, its techniques can be applied to any Attack that attempts to fill the address space with malicious code objects (e.g., stack spraying [42]).

  • Nozzle: A Defense Against Heap-spraying Code Injection Attacks
    2008
    Co-Authors: Paruj Ratanaworabhan, Benjamin Livshits, Benjamin Zorn
    Abstract:

    noz zle Heap spraying is a new Security Attack that significantly increases the exploitability of existing memory corruption errors in type-unsafe applications. With heap spraying, Attackers leverage their ability to allocate arbitrary objects in the heap of a type-safe language, such as JavaScript, literally filling the heap with objects that contain dangerous exploit code. In recent years, spraying has been used in many real Security exploits, especially in web browsers. In this paper, we describe Nozzle, a runtime monitoring infrastructure that detects attempts by Attackers to spray the heap. Nozzle uses lightweight emulation techniques to detect the presence of objects that contain executable code. To reduce false positives, we developed a notion of global “heap health”. We measure the effectiveness of Nozzle by demonstrating that it successfully detects 12 published and 2,000 synthetically generated heap-spraying exploits. We also show that even with a detection threshold set six times lower than is required to detect published malicious Attacks, Nozzle reports no false positives when run over 150 popular Internet sites. Using sampling and concurrent scanning to reduce overhead, we show that the performance overhead of Nozzle is less than 7 % on average. While Nozzle currently targets heap-based spraying Attacks, its techniques can be applied to a more general class of Attacks in which an Attacker attempts to fill the address space with dangerous code objects. 2

Jay Bal - One of the best experts on this subject based on the ideXlab platform.

  • evaluating practitioner cyber Security Attack graph configuration preferences
    Computers & Security, 2018
    Co-Authors: Harjinder Singh Lallie, Kurt Debattista, Jay Bal
    Abstract:

    Abstract Attack graphs and Attack trees are a popular method of mathematically and visually representing the sequence of events that lead to a successful cyber-Attack. Despite their popularity, there is no standardised Attack graph or Attack tree visual syntax configuration,and more than seventy self-nominated Attack graph and twenty Attack tree configurations have been described in the literature – each of which presents attributes such as preconditions and exploits in a different way. This research proposes a practitioner-preferred Attack graph visual syntax configuration which can be used to effectively present cyber-Attacks. Comprehensive data on participant ( n = 212 ) preferences was obtained through a choice based conjoint design in which participants scored Attack graph configuration based on their visual syntax preferences. Data was obtained from multiple participant groups, which included lecturers, students and industry practitioners with cyber-Security specific or general computer science backgrounds. The overall analysis recommends a winning representation with the following attributes. The flow of events is represented top-down as in a flow diagram – as opposed to a fault tree or Attack tree where it is presented bottom-up, preconditions – the conditions required for a successful exploit, are represented as ellipses and exploits are represented as rectangles. These results were consistent across the multiple groups and across scenarios which differed according to their Attack complexity. The research tested a number of bottom-up approaches – similar to that used in Attack trees. The bottom-up designs received the lowest practitioner preference score indicating that Attack trees – which also utilise the bottom-up method, are not a preferred design amongst practitioners – when presented with an alternative top-down design. Practitioner preferences are important for any method or framework to become accepted, and this is the first time that an Attack modelling technique has been developed and tested for practitioner preferences.

Dheer Dhwaj Barak - One of the best experts on this subject based on the ideXlab platform.

  • wormhole Attack avoidance technique in mobile adhoc networks
    International Conference on Advanced Computing, 2013
    Co-Authors: Yudhvir Singh, A Khatkar, Prabha Rani, D Deepika, Dheer Dhwaj Barak
    Abstract:

    Security is an essential service for wired and wireless network communication. This work concerned with a particularly sever Security Attack that affects the ad hoc networks routing protocols, called "wormhole Attack". There are many solutions to detect and prevent this Attack like packet leashes, cluster base, hop count analysis etc., but none of them is perfect solution. This paper contains a proposal for new technique for wormhole avoidance. Proposed technique has been implemented with NS2 simulator over the DSR protocol. This technique for wormhole avoidance addresses the malicious nodes and avoids the routes having wormhole nodes without affecting the overall performance of the network. The performance metrics used for evaluating network performance are jitter, throughput and end to end delay. The performance of proposed techniques is good.

Benjamin Livshits - One of the best experts on this subject based on the ideXlab platform.

  • nozzle a defense against heap spraying code injection Attacks
    USENIX Security Symposium, 2009
    Co-Authors: Paruj Ratanaworabhan, Benjamin Livshits, Benjamin G Zorn
    Abstract:

    Heap spraying is a Security Attack that increases the exploitability of memory corruption errors in type-unsafe applications. In a heap-spraying Attack, an Attacker coerces an application to allocate many objects containing malicious code in the heap, increasing the success rate of an exploit that jumps to a location within the heap. Because heap layout randomization necessitates new forms of Attack, spraying has been used in many recent Security exploits. Spraying is especially effective in web browsers, where the Attacker can easily allocate the malicious objects using JavaScript embedded in a web page. In this paper, we describe NOZZLE, a runtime heap-spraying detector. NOZZLE examines individual objects in the heap, interpreting them as code and performing a static analysis on that code to detect malicious intent. To reduce false positives, we aggregate measurements across all heap objects and define a global heap health metric. We measure the effectiveness of NOZZLE by demonstrating that it successfully detects 12 published and 2,000 synthetically generated heap-spraying exploits. We also show that even with a detection threshold set six times lower than is required to detect published malicious Attacks, NOZZLE reports no false positives when run over 150 popular Internet sites. Using sampling and concurrent scanning to reduce overhead, we show that the performance overhead of NOZZLE is less than 7% on average. While NOZZLE currently targets heap-based spraying Attacks, its techniques can be applied to any Attack that attempts to fill the address space with malicious code objects (e.g., stack spraying [42]).

  • Nozzle: A Defense Against Heap-spraying Code Injection Attacks
    2008
    Co-Authors: Paruj Ratanaworabhan, Benjamin Livshits, Benjamin Zorn
    Abstract:

    noz zle Heap spraying is a new Security Attack that significantly increases the exploitability of existing memory corruption errors in type-unsafe applications. With heap spraying, Attackers leverage their ability to allocate arbitrary objects in the heap of a type-safe language, such as JavaScript, literally filling the heap with objects that contain dangerous exploit code. In recent years, spraying has been used in many real Security exploits, especially in web browsers. In this paper, we describe Nozzle, a runtime monitoring infrastructure that detects attempts by Attackers to spray the heap. Nozzle uses lightweight emulation techniques to detect the presence of objects that contain executable code. To reduce false positives, we developed a notion of global “heap health”. We measure the effectiveness of Nozzle by demonstrating that it successfully detects 12 published and 2,000 synthetically generated heap-spraying exploits. We also show that even with a detection threshold set six times lower than is required to detect published malicious Attacks, Nozzle reports no false positives when run over 150 popular Internet sites. Using sampling and concurrent scanning to reduce overhead, we show that the performance overhead of Nozzle is less than 7 % on average. While Nozzle currently targets heap-based spraying Attacks, its techniques can be applied to a more general class of Attacks in which an Attacker attempts to fill the address space with dangerous code objects. 2