PolyVaccine: Protecting Web Servers against Zero-Day, Polymorphic and Metamorphic Exploits

• Main Authors: Campo-Giralte, L., Jimenez-Peris, R., Patino-Martinez, M.
• Format: Conference Proceeding
• Language: English
• Subjects: Binary codes; Computer worms; Cryptography; Emulation; exploit; Instruments; Internet; Intrusion detection; metamorphic malware; polymorphic malware; Protection; Search engines; vulnerability; Web server; zero-day malware
• ISSN: 1060-9857; 2575-8462
• DOI: 10.1109/SRDS.2009.15

Today Web servers are ubiquitous having become critical infrastructures of many organizations. However, they are still one of the most vulnerable parts of organizations infrastructure. Exploits are many times used by worms to fast propagate across the full Internet being Web servers one of their main targets. New exploit techniques have arouse in the last few years that have rendered useless traditional IDS techniques based on signature identification. Exploits use polymorphism (code encryption) and metamorphism (code obfuscation) to evade detection from signature-based IDSs. In this paper, we address precisely the topic of how to protect Web servers against zero-day (new), polymorphic, and metamorphic malware embedded in data streams (requests) that target Web servers. We rely on a novel technique to detect harmful binary code injection (i.e., exploits) in HTTP requests that is more efficient than current techniques based on binary code emulation or instrumentation of virtual engines. The detection of exploits is done through sandbox processes. The technique is complemented by another set of techniques such as caching, and pooling, to reduce its cost to neglectable levels.Our technique has little assumptions regarding the exploit unlike previous approaches that assume the existence of sled or getPC code, loops, read of the payload, writes to different addresses, etc. The evaluation shows that caching is highly effective and that the average latency introduced by our system is neglectable.