Buffer overﬂow attacks continue to be a major security problem and detecting attacks of this nature is therefore crucial to network security. Signature based network based intrusion detection systems (NIDS) compare network trafﬁc to signatures modelling suspicious or attack trafﬁc to detect network attacks. Since detection is based on pattern matching, a signature modelling the attack must exist for the NIDS to detect it, and it is therefore only capable of detecting known attacks. This paper proposes a method to detect buffer overﬂow attacks by parsing the payload of network packets in search of shellcode which is the remotely executable component of a buffer overﬂow attack. By analysing the shellcode it is possible to determine which system calls the exploit uses, and hence the operation of the exploit. Current NIDS-based buffer overﬂow detection techniques mainly rely upon speciﬁc signatures for each new attack. Our approach is able to detect previously unseen buffer overﬂow attacks, in addition to existing ones, without the need for speciﬁc signatures for each new attack. The method has been implemented and tested for buffer overﬂow attacks on Linux on the Intel x86 architecture using the Snort NIDS
To submit an update or takedown request for this paper, please submit an Update/Correction/Removal Request.