Detection of Heap-Spraying Attacks Using String Trace Graph
نویسندگان
چکیده
Heap-spraying is an attack technique that exploits memory corruptions in web browsers. A realtime detection of heap-spraying is difficult because of dynamic nature of JavaScript and monitoring overheads. In this paper, we propose a runtime detector of heap-spraying attacks in web browsers. We build a string trace graph by tracing all string objects and string operations in JavaScript. The graph is used for detecting abnormal behaviors of JavaScript. We detect heap-spraying attacks with low false positive rate and overheads.
منابع مشابه
NOZZLE: A Defense Against Heap-spraying Code Injection Attacks
Heap spraying is a security attack that increases the exploitability of memory corruption errors in type-unsafe applications. In a heap-spraying attack, an attacker coerces an application to allocate many objects containing malicious code in the heap, increasing the success rate of an exploit that jumps to a location within the heap. Because heap layout randomization necessitates new forms of a...
متن کاملAtomizer: Fast, Scalable and Lightweight Heap Analyzer for Virtual Machines in a Cloud Environment
In recent years process heap-based attacks have increased significantly. These attacks exploit the system under attack via the heap, typically by using a heap spraying attack. A large number of malicious files and URLs offering dangerous contents are potentially encountered every day, both by client-side and server-side applications. Static and dynamic methods have been proposed to detect heap-...
متن کاملDefending Browsers against Drive-by Downloads: Mitigating Heap-Spraying Code Injection Attacks
Drive-by download attacks are among the most common methods for spreading malware today. These attacks typically exploit memory corruption vulnerabilities in web browsers and browser plug-ins to execute shellcode, and in consequence, gain control of a victim’s computer. Compromised machines are then used to carry out various malicious activities, such as joining botnets, sending spam emails, or...
متن کاملAnalysis and Detection of Heap-based Malwares Using Introspection in a Virtualized Environment
Malware detection and analysis is a major part of computer security. There is an arm race between security experts and malware developers to develop various techniques to secure computer systems and to nd ways to circumvent these security methods. In recent years process heap-based attacks have increased signi cantly. These attacks exploit the system under attack via the heap, typically by usin...
متن کاملBuBBle: A Javascript Engine Level Countermeasure against Heap-Spraying Attacks
Web browsers that support a safe language such as Javascript are becoming a platform of great interest for security attacks. One such attack is a heap-spraying attack: a new kind of attack that combines the notoriously hard to reliably exploit heap-based buffer overflow with the use of an in-browser scripting language for improved reliability. A typical heap-spraying attack allocates a high num...
متن کامل