Community Awareness Initial Results Sam Larsen Determina

Overview Can we automatically detect anomalous program behavior? Security attacks Applications are large, complex, and hard to characterize Can we employ an application community to gain visibility into application behavior? We expect data to vary among machines What about control? Determina product has unique ability to monitor precise control-flow

Initial Study Is it possible to identify an attack by comparing the behavior of multiple machines running the same server application? Simple first step: compare basic blocks placed in the code cache Measure of code coverage

Step 1 How much does the code cache vary on different runs of the same input? Approximate an application community IIS serving a simple ASP Different runs vary by less than 1% Guestbook web application IIS processes vary by less than 1% SQL processes vary by 4-7% Loadsim (exchange benchmark) All processes vary by less than 1%

Step 2 Execute an attack and observe the effect on the code cache IIS serving a simple ASP + CodeRed worm Normal and attack runs differ by about 12% But how do different ASPs compare? i.e., does an attack look like we’re simply serving a different page?

Attack Results

Next Steps More realistic testbed See if we can detect the same behavior with coarser grain information Many attacks execute an obscure piece of code Track function calls Track DLLs loaded and unloaded Efficient data gathering and analysis Particularly problematic for basic blocks What other anomalous behavior can we detect?