Dynamic emulation based modeling and detection of polymorphic shellcode at the network level

来源 :Science in China(Series F:Information Sciences) | 被引量 : 0次 | 上传用户:SANTACRUZ1
下载到本地 , 更方便阅读
声明 : 本文档内容版权归属内容提供方 , 如果您对本文有版权争议 , 可与客服联系进行内容授权或下架
论文部分内容阅读
It is a promising way to detect polymorphic shellcode using emulation method. However,previous emulation-based approaches are limited in their performance and resilience against evasions. A new enhanced emulation-based detection approach is proposed,including an automaton-based model of the dynamic behavior of polymorphic shellcode and a detection algorithm,the detection criterion of which is derived from that model and ensures high detection accuracy. The algorithm also contains several optimization techniques,highly improving the running performance and the resilience against detection evasion shellcode. We have implemented a prototype system for our approach. The advantages of our algorithm are validated by the experiments with real network data,polymorphic shellcode samples generated by available polymorphic engines and hand-crafted detection evasion shellcode. It is a promising way to detect polymorphic shellcode using emulation method. However, previous emulation-based approaches are limited in their performance and resilience against evasions. A new enhanced emulation-based detection approach is proposed, including an automaton-based model of the dynamic behavior of polymorphic shellcode and a detection algorithm, the detection criterion of which is derived from that model and ensures high detection accuracy. The algorithm also contains several optimization techniques, highly improving the running performance and the resilience against detection evasion shellcode. We have implemented a prototype systems for our approach. The advantages of our algorithm are validated by the experiments with real network data, polymorphic shellcode samples generated by available polymorphic engines and hand-crafted detection evasion shellcode.
其他文献
梅毒不仅累及外生殖器,也可累及外生殖器以外的部位,其中口咽部黏膜是较多见的一个部位.既往由于病例相对少见,诊治经验有限,再加上患者就诊时常隐匿有关病史,因此,多数病例在初诊时,往往难以就地确诊,治疗也常常难以及时到位。
毕业意味着一个阶段学习的结束,同时,它还是“开始”的象征。怎样的毕业典礼,怎样的活动设计,能够简单可行地触动孩子的心灵,拨动孩子的心弦,能给他们的小学生活画上一个圆满
在素质教育背景之下,小学音乐学科作为一门基础性学科,除了培养学生感受音乐的能力之外,更要通过音乐提高学生的综合素养,从而构建学生美好的情操与健全的人格。当前,一部分
信息时代的到来,给教学带来了全新的体验。对于小学数学课堂,利用信息技术,可以有效地改变沉闷的教学课堂氛围,同时还能提高教学效果。因此,具有积极的实践意义。本文将对信
The disposition of most drugs is highly dependent on specialized transporters.OAT1 and OAT3 are two organic anion transporters expressed in the basolateral memb
据8月20日由湖南省委农办、省农业委员会召开的“推进全省新型职业农民培育工程”新闻发布会信息,湖南将培育一支“数量充足、结构合理、素质优良”的新型职业农民队伍,破解
Objective: To assess if arachnoid cells have the capability to present antigen and activate T-lymphocytes after stimulation by bloody cerebrospinal fluid (CSF),
目的为难治性癫(IE)患者的外科治疗制定循证方案。方法针对1例IE患者诊治中的临床问题,检索临床指南、系统评价、m eta分析及随机对照试验,并评价其质量,判断其真实性、适
网络的发展和技术的提高给网络安全带来了很大的冲击,Internet的安全成了新信息安全热点,本文主要从网络安全的方面考虑,叙述了网络安全与防护、黑客技术、防火墙技术的作用
啊哈!又在“淘宝网”上寻到宝贝了!快用“支付宝”买下来。到网上银行看看这个月的工资发了没有,赶紧把信用卡的欠款给还了……使用方便快捷的网上银行已经成了我们日常生活中再平常不过的一件事,可是不少人仍然担心安全问题。怎么办?别再杞人忧天了,赶紧申请一个“数字证书”吧。    数字证书,  你的互联网“身份证”    你到银行柜台开户和取款时,银行一般都会要求你出示身份证,这是为了识别你的身份而保证款项