Reducing false positive indications of buffer overflow attacks
View Patent ↗Certain events, such as data input operating system calls, are likely to initiate a buffer overflow attack. A timing module generates timestamps that indicate when such possible initiating events occur. The timestamp is associated with a particular process and/or thread executing on the computer. If subsequent evidence of a buffer overflow attack is detected on the computer, the timestamps are consulted to determine if a possible initiating event occurred recently. If there is a recent initiating event, a buffer overflow attack is declared. Evidence of a buffer overflow attack can include receiving a signal from the processor indicating that the processor was asked to execute an instruction residing in non-executable memory. Evidence of a buffer overflow attack can also include detecting an action on the computer that malicious software is likely to perform, such as opening a file or network connection, being performed by an instruction residing in non-executable memory.
1. A method of detecting a buffer overflow attack attempting to execute malicious software on a computer, comprising:
recording, by a security module executing on the computer, a time of occurrence of a possible buffer overflow attack initiation event;
determining, by the security module executing on the computer, a time of occurrence of an action possibly performed as a result of a buffer overflow attack;
determining, by the security module executing on the computer and responsive to the times of occurrence, whether the action correlates with the possible buffer overflow attack initiation event; and
responsive to a positive correlation, declaring, by the security module executing on the computer, a buffer overflow attack on the computer.
2. The method of claim 1 , wherein recording a time of occurrence of a possible buffer overflow attack initiation event comprises:
detecting a data input action performed on the computer; and
generating a timestamp for the data input action.
3. The method of claim 1 , wherein determining a time of occurrence of an action possibly performed as a result of a buffer overflow attack comprises:
determining whether the computer is instructed to execute an instruction stored in a region of computer memory marked as non-executable.
4. The method of claim 1 , wherein determining a time of occurrence of an action possibly performed as a result of a buffer overflow attack comprises:
monitoring the computer for an action that the malicious software is likely to perform;
upon detecting an action that the malicious software is likely to perform, determining whether the action was performed by an instruction stored in a region of memory marked as non-executable.
5. The method of claim 4 , wherein monitoring the computer comprises:
hooking into operating system application program interface (API) calls for performing one or more actions from the group consisting of:
opening a file, opening a network connection, deleting a file, and launching a system shell.
6. The method of claim 1 , wherein determining, responsive to the times of occurrence, whether the action correlates with the possible buffer overflow attack initiation event comprises:
comparing the time of occurrence of the action with the time of occurrence of the possible buffer overflow attack initiation event; and
declaring a positive correlation if the times of occurrence are within a predetermined time interval.
7. The method of claim 1 , wherein determining whether the action correlates with the possible buffer overflow attack initiation event comprises:
determining whether the possible buffer overflow attack initiation event and the action possibly performed as a result of the buffer overflow attack were performed by a same process executing on the computer.
8. The method of claim 1 , wherein determining whether the action correlates with the possible buffer overflow attack initiation event comprises:
determining whether the possible buffer overflow attack initiation event and the action possibly performed as a result of the buffer overflow attack were performed by threads of a same process executing on the computer.
9. A system for detecting a buffer overflow attack attempting to execute malicious software on a computer, comprising:
a computer-readable storage medium storing executable computer program instructions comprising:
a data input module adapted to detect a possible buffer overflow attack initiation event;
a timing module adapted to record a time of occurrence of the possible buffer overflow attack initiation event; and
a buffer overflow module adapted to:
determine a time of occurrence of an action possibly performed as a result of a buffer overflow attack;
determine, responsive to the times of occurrence, whether the action correlates with the possible buffer overflow attack initiation event; and
responsive to a positive correlation, declare a buffer overflow attack on the computer; and
a processor for executing the computer program instructions.
10. The system of claim 9 , wherein the possible buffer overflow attack initiation event comprises a data input action performed on the computer and wherein the timing module is further adapted to:
generating a timestamp for the data input action.
11. The system of claim 9 , wherein the buffer overflow module is further adapted to:
monitor the computer for an action that the malicious software is likely to perform; and
upon detecting an action that the malicious software is likely to perform, determine whether the action was performed by an instruction stored in a region of memory marked as non-executable.
12. The system of claim 11 , wherein the buffer overflow module is further adapted to:
hook into operating system application program interface (API) calls for performing one or more actions from the group consisting of:
opening a file, opening a network connection, deleting a file, and launching a system shell.
13. The system of claim 9 , wherein the buffer overflow module is further adapted to:
compare the time of occurrence of the action with the time of occurrence of the possible buffer overflow attack initiation event; and
declare a positive correlation if the times of occurrence are within a predetermined time interval.
14. The system of claim 9 , wherein the buffer overflow module is further adapted to:
determine whether the possible buffer overflow attack initiation event and the action possibly performed as a result of the buffer overflow attack were performed by a same process executing on the computer.
15. The system of claim 9 , wherein the buffer overflow module is further adapted to:
determine whether the possible buffer overflow attack initiation event and the action possibly performed as a result of the buffer overflow attack were performed by threads of a same process executing on the computer.
16. A computer-readable storage medium storing executable computer program instructions for detecting a buffer overflow attack attempting to execute malicious software on a computer, the computer program instructions comprising instructions for:
recording a time of occurrence of a possible buffer overflow attack initiation event;
determining a time of occurrence of an action possibly performed as a result of a buffer overflow attack;
determining, responsive to the times of occurrence, whether the action correlates with the possible buffer overflow attack initiation event; and
responsive to a positive correlation, declaring a buffer overflow attack on the computer.
17. The computer-readable storage medium of claim 16 , wherein recording a time of occurrence of a possible buffer overflow attack initiation event comprises:
detecting a data input action performed on the computer; and
generating a timestamp for the data input action.
18. The computer-readable storage medium of claim 16 , wherein determining a time of occurrence of an action possibly performed as a result of a buffer overflow attack comprises:
determining whether the computer is instructed to execute an instruction stored in a region of computer memory marked as non-executable.
19. The computer-readable storage medium of claim 16 , wherein determining a time of occurrence of an action possibly performed as a result of a buffer overflow attack comprises:
monitoring the computer for an action that the malicious software is likely to perform; and
upon detecting an action that the malicious software is likely to perform, determining whether the action was performed by an instruction stored in a region of memory marked as non-executable.
20. The computer-readable storage medium of claim 19 wherein monitoring the computer comprises:
hooking into operating system application program interface (API) calls for performing one or more actions from the group consisting of:
opening a file, opening a network connection, deleting a file, and launching a system shell.
21. The computer-readable storage medium of claim 16 , wherein determining, responsive to the times of occurrence, whether the action correlates with the possible buffer overflow attack initiation event comprises:
comparing the time of occurrence of the action with the time of occurrence of the possible buffer overflow attack initiation event; and
declaring a positive correlation if the times of occurrence are within a predetermined time interval.
22. The computer-readable storage medium of claim 16 , wherein determining whether the action correlates with the possible buffer overflow attack initiation event comprises:
determining whether the possible buffer overflow attack initiation event and the action possibly performed as a result of the buffer overflow attack were performed by a same process executing on the computer.
23. The computer-readable storage medium of claim 16 , wherein determining whether the action correlates with the possible buffer overflow attack initiation event comprises:
determining whether the possible buffer overflow attack initiation event and the action possibly performed as a result of the buffer overflow attack were performed by threads of a same process executing on the computer.