Exploit nonspecific host intrusion prevention/detection methods and systems and smart filters therefor
View Patent ↗Exploit nonspecific host intrusion prevention/detection methods, systems and smart filters are described. Portion of network traffic is captured and searched for a network traffic pattern, comprising: searching for a branch instruction transferring control to a first address in the memory; provided the first instruction is found, searching for a subroutine call instruction within a first predetermined interval in the memory starting from the first address and pointing to a second address in the memory; provided the second instruction is found, searching for a third instruction at a third address in the memory, located at a second predetermined interval from the second address; provided the third instruction is a fetch instruction, indicating the presence of the exploit; provided the third instruction is a branch instruction, transferring control to a fourth address in the memory, and provided a fetch instruction is located at the fourth address, indicating the presence of the exploit.
1. A method for identifying a network traffic pattern indicative of a presence of an exploit in a network traffic, comprising:
(a) capturing a portion of the network traffic;
(b) searching the captured portion of the network traffic for the network traffic pattern, comprising:
(b1) searching for a first instruction pointing to a first address in a memory, the first instruction being a branch instruction transferring control to the first address in the memory;
(b2) provided the first instruction is found, searching for a second instruction within a first predetermined interval in the memory starting from the first address onward, the second instruction being a subroutine call instruction pointing to a second address in the memory;
(b3) provided the second instruction is found, searching for a third instruction at a third address in the memory, which is located at a second predetermined interval from the second address onward;
(b4) provided the third instruction is a fetch instruction, indicating the presence of the exploit; and
(b5) provided the third instruction is a branch instruction, transferring control to a fourth address in the memory, and provided a fetch instruction is located at the fourth address, indicating the presence of the exploit.
2. The method of claim 1 , wherein the exploit comprises a buffer overflow attack, and wherein the first, second, third and fourth instructions are machine code instructions.
3. The method of claim 2 , wherein the branch, subroutine call and fetch instructions are respectively “Jump”, “Call” and “Pop” instructions in assembly language.
4. The method of claim 3 , wherein the first predetermined interval is about 80 bytes.
5. The method of claim 4 , wherein the step (b3) comprises determining a sign of a first offset produced by a logical AND operation between the second address and “0x80000000” hexadecimal value.
6. The method of claim 5 , further comprising:
provided the sign of the first offset is positive, adding a first predetermined number of bytes to the second address to produce a second offset;
provided the second offset is smaller than a predetermined value, determining the second predetermined interval equal to said first predetermined number of bytes.
7. The method of claim 6 , wherein the first predetermined number of bytes is equal to 5 bytes, and the predetermined value is equal to “90” bytes.
8. The method of claim 7 , further comprising:
provided the sign of the first offset is negative, subtracting the second address from “0xfffffff” hexadecimal value producing a third offset;
provided the third offset is smaller than a predetermined value, adjusting the second address by subtracting a second predetermined number of bytes, and negating the adjusted second address; and
determining the third address as the negated adjusted second address.
9. The method of claim 8 , wherein the second predetermined number of bytes is equal to 4 bytes, and the predetermined value is equal to “90” bytes.
10. The method of claim 1 , comprising:
(b0) searching for a chain of successive “no operation” (NOP) instructions within a third predetermined number of bytes starting from the beginning of the captured portion of the traffic, the step (b0) being performed before the step (b1); and
wherein the step (b1) comprises searching for the first instruction within a fourth predetermined number of bytes from the last NOP instruction in the chain.
11. The method of claim 10 , wherein the third predetermined number of bytes is about 3,000 bytes, and the fourth predetermined number of bytes is about 100 bytes.
12. A method for identifying a network traffic pattern indicative of a presence of an exploit in a network traffic, comprising:
(a) capturing a portion of the network traffic;
(b) searching the captured portion of the network traffic for the network traffic pattern, comprising:
(i) searching for a chain of successive “no operation” (NOP) instructions within a predetermined number of bytes starting from the beginning of the captured portion of the traffic;
(ii) searching for a subroutine call instruction within another predetermined number of bytes from the last NOP instruction in the chain onward, the subroutine call instruction pointing to an address in a memory;
(iii) provided the subroutine call instruction is found, searching for a fetch instruction at another address in the memory, which is located at a predetermined interval from said address; and
(iv) provided the fetch instruction is found, indicating the presence of the exploit.
13. The method of claim 12 , wherein the subroutine call and fetch instructions are respectively “CALL” and “POP” instructions in assembly language.
14. The method of claim 13 , wherein the step (iii) comprises:
determining a sign of a first offset produced by a logical AND operation between said address and “0x80000000” hexadecimal value;
provided the sign of the first offset is positive, adding a first predetermined number of bytes to said address to produce a second offset;
provided the second offset is smaller than a predetermined value, determining the predetermined interval equal to said first predetermined number of bytes;
provided the sign of the first offset is negative, subtracting said address from “0xfffffff” hexadecimal value producing a third offset;
provided the third offset is smaller than the predetermined, adjusting said address by subtracting a second predetermined number of bytes, and negating the adjusted address; and
determining said another address as the negated adjusted address.
15. The method of claim 14 , wherein:
the first predetermined number of bytes is equal to 5 bytes, and the second predetermined number of bytes is equal to 4 bytes, and the predetermined value is equal to “90” bytes; and
the predetermined number of bytes is about 3,000 bytes, and said another predetermined number of bytes is about 100 bytes.
16. A non-transitory computer readable storage medium, comprising computer readable instructions stored thereon, which, when executed by a processor, perform the steps of the method of claim 1 .
17. A system for identifying a network traffic pattern indicative of a presence of an exploit in a network traffic, comprising:
a processor, and a computer readable storage medium having computer, readable instructions stored thereon for execution by the processor, forming the following modules:
(a) a network traffic capture module, capturing a portion of the network traffic;
(b) a search module, searching the captured portion of the network traffic for the network traffic pattern, comprising:
(b1) a first module, searching for a first instruction pointing to a first address in a memory, the first instruction being a branch instruction transferring control to the first address in the memory;
(b2) a second module, searching for a second instruction within a first predetermined interval in the memory starting from the first address onward, the second instruction being a subroutine call instruction pointing to a second address in the memory;
(b3) a third module, searching for a third instruction at a third address in the memory, which is located at a second predetermined interval from the second address onward, the third instruction transferring control to a fourth address in the memory provided the third instruction is a branch instruction;
(b4) a fourth module, searching for a fourth instruction at the fourth address in the memory; and
(c) a reporting module, indicating the presence of the exploit provided the third instruction is a fetch instruction, or indicating the presence of the exploit, provided the third instruction is a branch instruction, and a fetch instruction is located at the fourth address.
18. The system of claim 17 , further comprising a NOP sled module, searching for a chain of successive “no operation” (NOP) instructions within a predetermined number of bytes starting from the beginning of the captured portion of the traffic.
19. The system of claim 18 , wherein the third module comprises processing means for:
determining a sign of a first offset produced by a logical AND operation between said address and “0x80000000” hexadecimal value;
provided the sign of the first offset is positive, adding a first predetermined number of bytes to said address to produce a second offset;
provided the second offset is smaller than a predetermined value, determining the predetermined interval equal to said first predetermined number of bytes;
provided the sign of the first offset is negative, subtracting said address from “0xfffffff” hexadecimal value producing a third offset;
provided the third offset is smaller than the predetermined, adjusting said address by subtracting a second predetermined number of bytes, and negating the adjusted address; and
determining said another address as the negated adjusted address.
20. The system of claim 17 , further comprising a configuration module, comprising a computer readable storage medium having computer readable instructions stored thereon for execution by the processor, storing values for the first predetermined interval, the second predetermined interval, the predetermined number of bytes, the first predetermined number of bytes, the second predetermined number of bytes, and the predetermined value.