1. Community Awareness Initial Results
Sam Larsen
Determina

2. Overview Can we automatically detect anomalous program behavior?
Security attacks
Applications are large, complex, and hard to characterize
Can we employ an application community to gain visibility into application behavior?
We expect data to vary among machines
What about control?
Determina product has unique ability to monitor precise control-flow

3. Initial Study
Is it possible to identify an attack by comparing the behavior of multiple machines running the same server application?
Simple first step: compare basic blocks placed in the code cache
Measure of code coverage

4. Step 1
How much does the code cache vary on different runs of the same input?
Approximate an application community
IIS serving a simple ASP
Different runs vary by less than 1%
Guestbook web application
IIS processes vary by less than 1%
SQL processes vary by 4-7%
Loadsim (exchange benchmark)
All processes vary by less than 1%

5. Step 2 Execute an attack and observe the effect on the code cache
IIS serving a simple ASP + CodeRed worm
Normal and attack runs differ by about 12%
But how do different ASPs compare?
i.e., does an attack look like we’re simply serving a different page?

6. Attack Results

7. Next Steps More realistic testbed
See if we can detect the same behavior with coarser grain information
Many attacks execute an obscure piece of code
Track function calls
Track DLLs loaded and unloaded
Efficient data gathering and analysis
Particularly problematic for basic blocks
What other anomalous behavior can we detect?