Physical Sciences and Mathematics Commons^™

Context Sensitive Anomaly Monitoring Of Process Control Flow To Detect Mimicry Attacks And Impossible Paths, Haizhi Xu, Wenliang Du, Steve J. Chapin

Electrical Engineering and Computer Science - All Scholarship

Many intrusions amplify rights or circumvent defenses by issuing system calls in ways that the original process did not. Defense against these attacks emphasizes preventing attacking code from being introduced to the system and detecting or preventing execution of the injected code. Another approach, where this paper fits in, is to assume that both injection and execution have occurred, and to detect and prevent the executing code from subverting the target system. We propose a method using waypoints: marks along the normal execution path that a process must follow to successfully access operating system services. Waypoints actively log trustworthy context …