Anzeige
Erschienen in:
2013 | OriginalPaper | Buchkapitel
Patrol: Revealing Zero-Day Attack Paths through Network-Wide System Object Dependencies
verfasst von : Jun Dai, Xiaoyan Sun, Peng Liu
Erschienen in: Computer Security – ESORICS 2013
Verlag: Springer Berlin Heidelberg
Aktivieren Sie unsere intelligente Suche, um passende Fachinhalte oder Patente zu finden.
Wählen Sie Textabschnitte aus um mit Künstlicher Intelligenz passenden Patente zu finden. powered by
Markieren Sie Textabschnitte, um KI-gestützt weitere passende Inhalte zu finden. powered by
Identifying attack paths in enterprise network is strategically necessary and critical for security defense. However, there has been insufficient efforts in studying how to identify an attack path that goes through unknown security holes. In this paper, we define such attack paths as
zero-day attack paths
, and propose a prototype system named Patrol to identify them at runtime. Using system calls, Patrol builds a
network-wide system object dependency graph
that captures dependency relations between OS objects, and identifies
suspicious intrusion propagation paths
in it as candidate zero-day attack paths through forward and backward tracking from intrusion symptoms. Patrol further identifies highly suspicious candidates among these paths, by recognizing indicators of unknown vulnerability exploitations along the paths through rule-based checking. Our evaluation shows that Patrol can work accurately and effectively at runtime with an acceptable performance overhead.