A Framework for Safeguarding System against Code Injection Attacks

摘要：

A framework based on Native API is proposed to prevent code injection attacks. This framework is implemented in a two-tier framework by adopting the idea of diversity. The first tier rearranges the Native API dispatch ID number so that only the Native API calls from legitimate sources are executed. The second tier provides an authentication process in case an attacker guesses the first-tier permutation order. The function call stack is back-traced to verify whether the original callers return address resides within the legitimate process. When an attack is suspected, the process is terminated and an alert is generated. The experiments show that the approach has no significant overhead.

关键词： Native API Code Injection Attacks Filter driver

作者: Feng Yao

作者单位: Hubei Province Key Laboratory of Intelligent Robot, Wuhan Institute of Technology School of Computer Science and Engineering, Wuhan Institute of Technology, Wuhan Hubei, China

会议类型: 国际会议

会议名称: 2010 International Conference on Information Technology and Industrial Engineering(2010年信息技术与工业工程国际学术会议 ITIE 2010)

会议地点: 武汉

会议语种:英文

页码: 814-817

在线出版日期: 2010-06-06（万方平台首次上网日期，不代表论文的发表时间）