Execution transactions for defending against software failures: use and evaluation

We examine the problem of containing buffer overflow attacks in a safe and efficient manner. Briefly, we automatically augment source code to dynamically catch stack and heap-based buffer overflow and underflow attacks, and recover from them by allowing the program to continue execution. Our hypothesis is that we can treat each code function as a transaction that can be aborted when an attack is detected, without affecting the application's ability to correctly execute. Our approach allows us to enable selectively or disable components of this defensive mechanism in response to external events, allowing for a direct tradeoff between security and performance. We combine our defensive mechanism with a honeypot-like configuration to detect previously unknown attacks, automatically adapt an application's defensive posture at a negligible performance cost, and help determine worm signatures. Our scheme provides low impact on application performance, the ability to respond to attac...

• Type: Journal
• Year: 2006
• Where: IJISEC
• Authors: Stelios Sidiroglou, Angelos D. Keromytis
• Keywords: Buffer Overflow Attacks, Defensive Mechanism, Heap-based Buffer, IJISEC 2006