Advertisement
Published in:
2013 | OriginalPaper | Chapter
Patrol: Revealing Zero-Day Attack Paths through Network-Wide System Object Dependencies
Authors : Jun Dai, Xiaoyan Sun, Peng Liu
Published in: Computer Security – ESORICS 2013
Publisher: Springer Berlin Heidelberg
Activate our intelligent search to find suitable subject content or patents.
Select sections of text to find matching patents with Artificial Intelligence. powered by
Select sections of text to find additional relevant content using AI-assisted search. powered by
Identifying attack paths in enterprise network is strategically necessary and critical for security defense. However, there has been insufficient efforts in studying how to identify an attack path that goes through unknown security holes. In this paper, we define such attack paths as
zero-day attack paths
, and propose a prototype system named Patrol to identify them at runtime. Using system calls, Patrol builds a
network-wide system object dependency graph
that captures dependency relations between OS objects, and identifies
suspicious intrusion propagation paths
in it as candidate zero-day attack paths through forward and backward tracking from intrusion symptoms. Patrol further identifies highly suspicious candidates among these paths, by recognizing indicators of unknown vulnerability exploitations along the paths through rule-based checking. Our evaluation shows that Patrol can work accurately and effectively at runtime with an acceptable performance overhead.