maisМоделирование и анализ информационных системModeling and Analysis of Information Systems1818-10152313-5417Yaroslavl State University10.18255/1818-1015-2020-2-138-151mais-1321Research ArticleComputer System OrganizationОб обнаружении эксплуатации уязвимостей, приводящей к запуску вредоносного кодаOn the Detection of Exploitation of Vulnerabilities Leading to the Execution of a Malicious Codehttps://orcid.org/0000-0002-1491-524XКосолаповЮрий ВладимировичKosolapovYury V.

канд. техн. наук

ул. Мильчакова, 8а, г. Ростов-на-Дону, 344090 

PhD.

8a Milchakova str., Rostov-on-Don 344090

itaim@mail.ruЮжный Федеральный УниверситетРоссияSouthern Federal UniversityRussian Federation202024062020272138151Copyright © Косолапов Ю.В., 20202020Косолапов Ю.В.Kosolapov Y.V.Данная работа распространяется под лицензией Creative Commons Attribution 4.0.This work is licensed under a Creative Commons Attribution 4.0 License.https://www.mais-journal.ru/jour/article/view/1321

Задача защиты программного обеспечения от эксплуатации возможных неизвестных уязвимостей может решаться как путем поиска (например, с помощью символьного исполнения) и последующего устранения уязвимостей, так и путем использования систем обнаружения и/или предотвращения вторжений. В последнем случае эта задача решается обычно путем формирования профиля нормального выполнения программ, а недопустимое отклонение от нормального состояния расценивается как аномалия или атака. В настоящей работе рассматривается задача защиты заданного исполнимого файла (программы) P от эксплуатации неизвестных уязвимостей в нем. Для этого предлагается способ построения профиля нормального выполнения программы P, в котором кроме набора легальных цепочек системных и библиотечных функций длины l учитывается расстояние между соседними вызовами функций, вычисляемое как разность адресов вызова соответствующих функций. Учет расстояний между вызовами функций позволяет выявлять исполнение вредоносного шеллкода, использующего вызовы системных и/или библиотечных функций, если хотя бы один из используемых в шеллкоде вызовов находится на нетипичном для программы P расстоянии от предыдущего вызова. В работе строится алгоритм и система обнаружения аномального выполнения кода и проводятся эксперименты в случае, когда P — браузер FireFox для операционной системы Windows.

Software protection from exploitation of possible unknown vulnerabilities can be performed both by searching (for example, using symbolic execution) and subsequent elimination of the vulnerabilities and by using detection and / or intrusion prevention systems. In the latter case, this problem is usually solved by forming a profile of a normal behavior and deviation from normal behavior over a predetermined threshold is regarded as an anomaly or an attack. In this paper, the task is to protect a given software P from exploiting unknown vulnerabilities. For this aim a method is proposed for constructing a profile of the normal execution of the program P, in which, in addition to a set of legal chains of system and library functions, it is proposed to take into account the distances between adjacent function calls. At the same time, a profile is formed for each program. It is assumed that taking into account the distances between function calls will reveal shell code execution using system and / or library function calls. An algorithm and a system for detecting abnormal code execution are proposed. The work carried out experiments in the case when P is the FireFox browser. During the experiments the possibility of applying the developed algorithm to identify abnormal behavior when launching publicly available exploits was investigated.

системные вызовывызовы библиотекуязвимости программного обеспеченияsystem callslibrary callssoftware vulnerabilityReferencesA. Khraisat, I. Gondal, P. Vamplew, and J. Kamruzzaman, “Survey of intrusion detection systems: techniques, datasets and challenges”, Cybersecurity, vol. 2, no. 1, p. 20, 2019.A. Khraisat, I. Gondal, P. Vamplew, and J. Kamruzzaman, “Survey of intrusion detection systems: techniques, datasets and challenges”, Cybersecurity, vol. 2, no. 1, p. 20, 2019.S. Forrest, S. Hofmeyr, and A. Somayaji, “The Evolution of System-Call Monitoring”, in Proceedings of 2008 Annual Computer Security Applications Conference (ACSAC), 2008, pp. 418–430.S. Forrest, S. Hofmeyr, and A. Somayaji, “The Evolution of System-Call Monitoring”, in Proceedings of 2008 Annual Computer Security Applications Conference (ACSAC), 2008, pp. 418–430.S. Gupta, H. Sharma, and S. Kaur, “Malware Characterization Using Windows API Call Sequences”, Journal of Cyber Security and Mobility, vol. 7, no. 4, pp. 363–378, 2018.S. Gupta, H. Sharma, and S. Kaur, “Malware Characterization Using Windows API Call Sequences”, Journal of Cyber Security and Mobility, vol. 7, no. 4, pp. 363–378, 2018.R. Veeramani and N. Rai, “Windows API based Malware Detection and Framework Analysis”, International Journal of Scientific & Engineering Research, vol. 3, no. 3, pp. 1–6, 2012.R. Veeramani and N. Rai, “Windows API based Malware Detection and Framework Analysis”, International Journal of Scientific & Engineering Research, vol. 3, no. 3, pp. 1–6, 2012.A. Singh, R. Arora, and H. Pareek, “Malware Analysis using Multiple API Sequence Mining Control Flow Graph”, CoRR. arXiv preprint arXiv:1707.02691, 2017.A. Singh, R. Arora, and H. Pareek, “Malware Analysis using Multiple API Sequence Mining Control Flow Graph”, CoRR. arXiv preprint arXiv:1707.02691, 2017.M. L. Bernardi, M. Cimitile, D. Distante, F. Martinelli, and F. Mercaldo, “Dynamic malware detection and phylogeny analysis using process mining”, International Journal of Information Security, vol. 18, no. 3, pp. 257–284, 2019.M. L. Bernardi, M. Cimitile, D. Distante, F. Martinelli, and F. Mercaldo, “Dynamic malware detection and phylogeny analysis using process mining”, International Journal of Information Security, vol. 18, no. 3, pp. 257–284, 2019.L. Viljanen, “A Survey of Application Level Intrusion Detection”, Technical report, Series of Publications C, Report C-2004-61 Helsinki, 2004.L. Viljanen, “A Survey of Application Level Intrusion Detection”, Technical report, Series of Publications C, Report C-2004-61 Helsinki, 2004.G. Creech, “Developing a high-accuracy cross platform Host-Based Intrusion Detection System capable of reliably detecting zero-day attacks”, PhD thesis, University of New South Wales, Canberra, Australia, 2014.G. Creech, “Developing a high-accuracy cross platform Host-Based Intrusion Detection System capable of reliably detecting zero-day attacks”, PhD thesis, University of New South Wales, Canberra, Australia, 2014.H. Hu, S. Shinde, S. Adrian, Z. L. Chua, P. Saxena, and Z. Liang, “Data-oriented programming: On the expressiveness of non-control data attacks”, in 2016 IEEE Symposium on Security and Privacy (SP), 2016, pp. 969–986.H. Hu, S. Shinde, S. Adrian, Z. L. Chua, P. Saxena, and Z. Liang, “Data-oriented programming: On the expressiveness of non-control data attacks”, in 2016 IEEE Symposium on Security and Privacy (SP), 2016, pp. 969–986.K. K. Ispoglou, B. AlBassam, T. Jaeger, and M. Payer, “Block Oriented Programming: Automating Data-Only Attacks”, in Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security, 2018, pp. 1868–1882.K. K. Ispoglou, B. AlBassam, T. Jaeger, and M. Payer, “Block Oriented Programming: Automating Data-Only Attacks”, in Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security, 2018, pp. 1868–1882.Y. V. Kosolapov, “About detection of code reuse attacks”, Modelirovanie i Analiz Informatsionnykh Sistem, vol. 26, no. 2, pp. 213–228, 2019.Y. V. Kosolapov, “About detection of code reuse attacks”, Modelirovanie i Analiz Informatsionnykh Sistem, vol. 26, no. 2, pp. 213–228, 2019.D. Wagner and P. Soto, “Mimicry attacks on host-based intrusion detection systems”, in Proceedings of the 9th ACM Conference on Computer and Communications Security, 2002, pp. 255–264.D. Wagner and P. Soto, “Mimicry attacks on host-based intrusion detection systems”, in Proceedings of the 9th ACM Conference on Computer and Communications Security, 2002, pp. 255–264.K. Z. Snow, F. Monrose, L. Davi, A. Dmitrienko, C. Liebchen, and A.-R. Sadeghi, “Just-In-Time Code Reuse: On the Effectiveness of Fine-Grained Address Space Layout Randomization”, in 2013 IEEE Symposium on Security and Privacy, 2013, pp. 574–588.K. Z. Snow, F. Monrose, L. Davi, A. Dmitrienko, C. Liebchen, and A.-R. Sadeghi, “Just-In-Time Code Reuse: On the Effectiveness of Fine-Grained Address Space Layout Randomization”, in 2013 IEEE Symposium on Security and Privacy, 2013, pp. 574–588.E. Stalmans and S. El-Sherei, Macro-less Code Exec in MSWord, Last access 12.12.2019. [Online]. Available: https://sensepost.com/blog/2017/macro-less-code-exec-in-msword/.E. Stalmans and S. El-Sherei, Macro-less Code Exec in MSWord, Last access 12.12.2019. [Online]. Available: https://sensepost.com/blog/2017/macro-less-code-exec-in-msword/.P. D. Borisov and Y. V. Kosolapov, “On the automatic analysis of the practical resistance of obfusting transformations”, Modelirovanie i Analiz Informatsionnykh Sistem, vol. 26, no. 3, pp. 317–331, 2019.P. D. Borisov and Y. V. Kosolapov, “On the automatic analysis of the practical resistance of obfusting transformations”, Modelirovanie i Analiz Informatsionnykh Sistem, vol. 26, no. 3, pp. 317–331, 2019.API Monito, Last access 28.11.2019. [Online]. Available: http://www.rohitab.com/apimonitor.API Monito, Last access 28.11.2019. [Online]. Available: http://www.rohitab.com/apimonitor.ListDLLs, Last access 28.11.2019. [Online]. Available: https://docs.microsof.com/en-us/sysinternals/downloads/listdlls.ListDLLs, Last access 28.11.2019. [Online]. Available: https://docs.microsof.com/en-us/sysinternals/downloads/listdlls.M. Vervier, M. Orru, B. J. Wever, and E. Sesterhenn, Browser Security Whitepaper, Last access 05.12.2019. [Online]. Available: https://browser-security.x41-dsec.de/X41-Browser-Security-White-Paper.pdf.M. Vervier, M. Orru, B. J. Wever, and E. Sesterhenn, Browser Security Whitepaper, Last access 05.12.2019. [Online]. Available: https://browser-security.x41-dsec.de/X41-Browser-Security-White-Paper.pdf.R. Gawlik and T. Holz, “Sok: Make JIT-spray great again”, in WOOT’18 Proceedings of the 12th USENIX Conference on Offensive Technologies, 2018, pp. 1–14.R. Gawlik and T. Holz, “Sok: Make JIT-spray great again”, in WOOT’18 Proceedings of the 12th USENIX Conference on Offensive Technologies, 2018, pp. 1–14.Offensive Security, Exploitdb/exploits/windows/remote/42484.html, Last access 05.12.2019. [Online]. Available: https://github.com/ofensive-security/exploitdb/blob/master/exploits/windows/remote/42484.html.Offensive Security, Exploitdb/exploits/windows/remote/42484.html, Last access 05.12.2019. [Online]. Available: https://github.com/ofensive-security/exploitdb/blob/master/exploits/windows/remote/42484.html.0vercl0k, CVE-2019-9810, Last access 05.12.2019. [Online]. Available: https://github.com/0vercl0k/CVE-2019-9810.0vercl0k, CVE-2019-9810, Last access 05.12.2019. [Online]. Available: https://github.com/0vercl0k/CVE-2019-9810.Exploit Database, Last access 05.12.2019. [Online]. Available: https://www.exploit-db.com/.Exploit Database, Last access 05.12.2019. [Online]. Available: https://www.exploit-db.com/.CVE-2017-5375_ASM.JS_JIT-Spray, Last access 30.12.2019. [Online]. Available: https://github.com/rh0dev/expdev/tree/master.CVE-2017-5375_ASM.JS_JIT-Spray, Last access 30.12.2019. [Online]. Available: https://github.com/rh0dev/expdev/tree/master.

The authors declare that there are no conflicts of interest present.