• International journal of advanced smart convergence
• /
• v.5 no.4
• /
• pp.54-56
• /
• 2016

Code-reuse attacks are very dangerous in various systems. This is because they do not inject malicious codes into target systems, but reuse the instruction sequences in executable files or libraries of target systems. Moreover, code-reuse attacks could be more harmful to IoT systems in the sense that it may not be easy to devise efficient and effective mechanism for code-reuse attack detection in resource-restricted IoT devices. In this paper, we propose a detection scheme with using Kullback-Leibler (KL) divergence to combat against code-reuse attacks in IoT. Specifically, we detect code-reuse attacks by calculating KL divergence between the probability distributions of the packets that generate from IoT devices and contain code region addresses in memory system and the probability distributions of the packets that come to IoT devices and contain code region addresses in memory system, checking if the computed KL divergence is abnormal.

• Journal of Internet Computing and Services
• /
• v.19 no.3
• /
• pp.15-23
• /
• 2018

A code reuse attack is an attack technique that can execute arbitrary code without injecting code directly into the stack by combining executable code fragments existing in program memory and executing them continuously. ROP(Return-Oriented Programming) attack is typical type of code reuse attack and serveral defense techniques have been proposed to deal with this. However, since existing methods use Rule-based method to detect attacks based on specific rules, there is a limitation that ROP attacks that do not correspond to previously defined rules can not be detected. In this paper, we introduce a method to detect ROP attack by learning command pattern used in ROP attack code using RNN(Recurrent Neural Network). We also show that the proposed method effectively detects ROP attacks by measuring False Positive Ratio, False Negative Ratio, and Accuracy for normal code and ROP attack code discrimination.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2014.04a
• /
• pp.502-505
• /
• 2014

최근 들어, 모바일 기기의 시스템을 장악하여 중요 정보를 빼내는 등의 악성 행위를 위해 Code Reuse Attack (CRA) 이 널리 사용되고 있다. 이러한 CRA 를 막기 위한 방법으로 branch 의 trace 를 분석하여 CRA 고유의 특성을 찾아내는 Signature 기반 탐지 기술이 있다. 이러한 탐지 기술을 효율적으로 지원하기 위하여, 본 논문에서는 ARM 프로세서용 바이너리를 분석하여, signature 분석을 위해 필수적으로 분석되어야 하는 gadget 의 크기를 빠르게 접근할 수 있는 meta-data 를 생성하는 기술을 제안한다. 이러한 meta-data 를 활용하는 방식은 gadget 의 크기를 계산하는 추가적인 코드의 수행을 제거해 주므로, 더욱 효율적으로 CRA 를 탐지할 수 있도록 도와준다. 실험 결과, 이러한 meta-data 는 본래의 바이너리 코드 대비 9% 만의 크기 증가를 일으키는 것으로 나타났다.

• International Journal of Internet, Broadcasting and Communication
• /
• v.9 no.1
• /
• pp.24-28
• /
• 2017

In the Internet of Things (IoT), resource-limited smart devices communicate with each other while performing sensing and computation tasks. Thus, these devices can be exposed to various attacks being launched and spread through network. For instance, attacker can reuse the codes of IoT devices for malicious activity executions. In the sense that attacker can craft malicious codes by skillfully reusing codes stored in IoT devices, code-reuse attacks are generally considered to be dangerous. Although a variety of schemes have been proposed to defend against code-reuse attacks, code randomization is regarded as a representative defense technique against code-reuse attacks. Indeed, many research have been done on code randomization technique, however, there are little work on analysis of the interactions between code randomization defenses and code-reuse attacks although it is imperative problem to be explored. To provide the better understanding of these interactions in IoT, we analyze how code randomization defends against code-reuse attacks in IoT and perform simulation on it. Both analysis and simulation results show that the more frequently code randomizations occur, the less frequently code-reuse attacks succeed.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2014.11a
• /
• pp.443-446
• /
• 2014

Code reuse attack (CRA)는 기존의 코드 내에서 필요한 코드 조각들 (gadgets)을 모아 indirect branch 명령어들로 잇는 방식으로 공격자가 원하는 악성 프로그램을 구성할 수 있는 강력한 공격 방법이다. 공격자는 자신의 코드를 대상 시스템에 심는 대신 기존의 코드를 이용하기 때문에, 대부분의 범용 운영체제 (OS)가 강제하는 W^X protection 을 무력화할 수 있다. 이러한 CRA 에 대응하기 위하여 다수의 연구들에서 branch 의 trace 를 분석하여 CRA 고유의 특성을 찾아내는 Signature 기반 탐지 기술을 제안하였다. 본 논문에서는 ARM 프로세서 상에서의 CRA 를 대응하기 위한 Signature 기반 탐지 기술을 효율적으로 도울 수 있는 binary 분석 및 meta-data 생성 기술을 제안한다. 특히, 본 논문은 우리의 이전 논문에서 고려 되지 못했던 ARM 의 두 가지 명령어 세트의 특성을 고려하여, 공격자가 어느 명령어 세트를 이용하여 CRA 를 시도하더라도 막아낼 수 있도록 meta-data 를 두 가지 mode 에 대해서 생성하였다. 실험 결과, meta-data 는 본래 바이너리 코드 대비 20.8% 정도의 크기 증가를 일으키는 것으로 나타났다.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2015.04a
• /
• pp.424-427
• /
• 2015

근래 들어 모바일 기기의 시스템을 장악하여 사용자의 기밀 정보를 빼내는 악성 행위의 한 방법으로 Code Reuse Attack (CRA)이 널리 사용되고 있다. 이와 같은 CRA를 막기 위하여 call-return이 일어날 때마다 이들 address를 비교해 보는 shadow stack과 branch에 대한 몇 가지 규칙을 두어 CRA 를 탐지하는 branch regulation과 같은 방식이 연구되었다. 우리는 shadow stack과 branch regulation을 종합하여 여러 종류의 CRA를 적은 성능 오버헤드로 탐지할 수 있는 CRA Detection System을 만들고자 한다. 이를 위하여 반드시 선행 되어야 할 연구인 바이너리 파일 분석과 meta-data 생성 및 압축 기술을 제안한다. 실험 결과 생성된 meta-data는 압축 기술을 적용하기 전보다 1/2에서 1/3 가량으로 그 크기가 줄어들었으며 CRA Detection System의 탐지가 정상적으로 동작하는 것 또한 확인할 수 있었다.

• KSII Transactions on Internet and Information Systems (TIIS)
• /
• v.14 no.6
• /
• pp.2576-2590
• /
• 2020

The fundamental reason why most SQL injection detection methods are difficult to use in practice is the low reusability of the implementation code. This paper presents a reusable SQL injection detection method for Java Web applications based on AOP (Aspect-Oriented Programming) and dynamic taint analysis, which encapsulates the dynamic taint analysis processes into different aspects and establishes aspect library to realize the large-grained reuse of the code for detecting SQL injection attacks. A metamodel of aspect library is proposed, and a management tool for the aspect library is implemented. Experiments show that this method can effectively detect 7 known types of SQL injection attack such as tautologies, logically incorrect queries, union query, piggy-backed queries, stored procedures, inference query, alternate encodings and so on, and support the large-grained reuse of the code for detecting SQL injection attacks.

• KSII Transactions on Internet and Information Systems (TIIS)
• /
• v.13 no.3
• /
• pp.1611-1625
• /
• 2019

The emergence of new technologies and devices brings a new environment in the field of cyber security. It is not easy to predict possible security threats about new environment every time without special criteria. In other words, most malicious codes often reuse malicious code that has occurred in the past, such as bypassing detection from anti-virus or including additional functions. Therefore, we are predicting the security threats that can arise in a new environment based on the history of repeated malicious code. In this paper, we classify and define not only the internal information obtained from malicious code analysis but also the features that occur during infection and attack. We propose a method to predict and manage security threats in new environment by continuously managing and extending.

• Journal of KIISE
• /
• v.41 no.12
• /
• pp.1018-1025
• /
• 2014

An ROP attack creates gadget sequences which consist of existing code snippets in a program, and hijacks the control flow of a program by chaining and executing gadget sequences consecutively. Existing defense schemes have limitations in that they cause high execution overhead, an increase in the binary size overhead, and a low applicability. In this paper, we solve these problems by introducing zero-sum defender, which is a fast and space-efficient mitigation scheme against ROP attacks. We find a fundamental property of gadget execution in which control flow starts in the middle of a function without a call instruction and ends with a return instruction. So, we exploit this property by monitoring whether the execution is abused by ROP attacks. We achieve a very low runtime overhead with a very small increase in the binary size. In our experimental results, we verified that our defense scheme prevents real world ROP attacks, and we showed that there is only a 2% performance overhead and a 1% binary size increase overhead in several benchmarks.

• KIPS Transactions on Computer and Communication Systems
• /
• v.2 no.5
• /
• pp.217-222
• /
• 2013

Return-Oriented Programming(ROP) is an advanced code-reuse attack like a return-to-libc attack. ROP attacks combine gadgets in program code area and make functions like a Turing-complete language. Some of previous defense methods against ROP attacks show high performance overhead because of dynamic execution flow analysis and can defend against only certain types of ROP attacks. In this paper, we propose Indirect Branch Target Address Verification (IBTAV). IBTAV detects ROP attacks by checking if target addresses of indirect branches are valid. IBTAV can defends against almost all ROP attacks because it verifies a target address of every indirect branch instruction. Since IBTAV does not require dynamic execution flow analysis, the performance overhead of IBTAV is relatively low. Our evaluation of IBTAV on SPEC CPU 2006 shows less than 15% performance overhead.