Automatic Semantic Aware Attribution Analysis of Remote Exploits

19 Pages·2011·0.27 MB·English

3
SA : Automatic Semantic Aware Attribution Analysis of
Remote Exploits
DeguangKong,1,2DonghaiTian,1PengLiu,1andDinghaoWu1
1CollegeofInformationSciencesandTechnology,PennsylvaniaStateUniversity,University
Park,PA16802,Email:{dkong,dtian,pliu,dwu}@ist.psu.edu
2Dept.ofComputerScienceandEngineering,UniversityofTexasatArlington,TX,76013
Abstract. Webserviceshavebeengreatlythreatenedbyremoteexploitcodeat-
tacks,wheremaliciouslycraftedHTTPrequestsareusedtoinjectbinarycodeto
compromisewebserversandwebapplications.Inpractice,besidesdetectionof
suchattacks,attackattributionanalysis,i.e.,toautomaticallycategorizeexploits
ortodeterminewhetheranexploitisavariantofanattackfromthepast,isalso
veryimportant.Inthispaper,wepresentSA3,anexploitcodeattributionanalysis
whichcombinessemanticanalysisandstatisticalanalysistoautomaticallycate-
gorizeagivenexploitcode.SA3extractssemanticfeaturesfromanexploitcode
throughdataanomalyanalysis,andthenattributestheexploittoanappropriate
classbasedonourstatisticalmodelderivedfromaMarkovmodel.Weevaluate
SA3 overacomprehensivesetofshellcodecollectedfromMetasploitandother
polymorphicengines.ExperimentalresultsshowthatSA3 iseffectiveandeffi-
cient.Theattributionanalysisaccuracycanbeover90%indifferentparameter
settingswithfalsepositiveratenomorethan4.5%.Toourknowledge,SA3isthe
firstworkcombiningsemanticanalysiswithstatisticalanalysisforexploitcode
attributionanalysis.
Keywords:RemoteExploit,Shellcode,Attribution,MixtureofMarkovModel
1 Introduction
Agreatnumberofcodeinjectionattacks(e.g.,bufferoverflowattacks,formatstringat-
tacks)areusedbycraftedHTTPrequeststocompromisedifferentkindsofwebservices
or web applications. From the CERT [1] and SecurityFocus [2] statistics, the remote
codeinjectionattackisstilloneofthemajorattacksthesedays.In(remote)codeinjec-
tionattacks,maliciousHTTPrequests/repliescanbeforgedtoinjectmaliciouscodeby
masquerading as normal requests/replies. Different kinds of shellcode are representa-
tivesofexploitcode,whichcanbeinjectedintotargetservicesorapplicationsthrough
network connections. Worms can take advantage of these exploit code for infections
andpropagations.Inthispaper,theexploitcodewefocusonisremoteshellcodewhich
can be used as the payload of a packet to spread via HTTP requests. Throughout the
paper,weusethetermsremoteexploitcodeandshellcodeinterchangeably.
There are mainly two types of techniques used for shellcode analysis and detec-
tion:theemulation-basedapproachandstatistics-basedapproach.Theemulationbased
approach(e.g., [3,4])emulatestheexecutionsofinstructionsequences,andthusshell-
code’sbehaviorsareexposedinthevirtualrunningenvironment.However,itisantag-
1
onized by many kinds of anti-emulation techniques [5]. For example, drive-by down-
loadswebattacks[6],whichtargetmemorycorruptionvulnerabilities,havetoprepare
the environment before their successful launch. Improper emulations of the execution
contextwillleadtoincorrectexecutionsofinstructionsequences,andthusfailtoexpose
specificspecificbehaviors.
Statisticalanalysisisanotherpromisingmethodusedinnetworkintrusiondetection
systemsincludingtheremoteshellcodedetectionandanalysis[7,8].Thebasicideaof
thestatisticalapproachistoextractthedistinguishedfeaturestodifferentiatebetween
the normal packets and various malicious packets. The payload of a packet and the
payload header information (e.g., port number, protocol field) can be used as features
for classification. The disadvantage of the statistical approach is that it usually lacks
clear semantic information correlated with the packets whose contents may result in
malicious behaviors, and therefore it can also be evaded by different kinds of anti-
statisticapproaches[7,8].
From the analysis above, we can see current exploit code detection and analysis
approachesarestillquitelimited.Meanwhile,lotsofshellcodevariantsappearedinthe
past several years according to AV-test’s statistics [9]. Thus in this paper we present
an automatic semantic aware attribution analysis of remote exploits. The significance
of such analysis is that it provides more information about an attack in addition to
detecting the attack. The attribution analysis can be used in, for example, a shellcode
scannertoidentifydifferenttypesofshellcodevariants.Asfarasweknow,suchshell-
codeattributionanalysisisstilllackingintheliterature.NotethatHuetal[10]present
a function-call graph based approach to index the large malware repositories, which
can be viewed as a kind of malware attribution analysis. Our motivation is similar to
theirs,butourworkismorespecificforshellcodeattributionanalysis.Comparedwith
shellcodedetection,ourworkfocusesmoreonautomaticallycategorizingexploitsand
determiningwhetheranexploitisavariantofanattackfromthepast.Webelievethis
isalsoimportantbesidestellingwhetherapieceofcodeismaliciousornot.
Exploit code attribution poses several challenges. First, the emulation based ap-
proachcannotbedirectlyappliedtothisproblembecauseweneedquantitativemetrics
tomeasurethedistancesofdifferentexploitcode.Second,wecannotfullyrelyonthe
statisticalapproachbecauseitisdeceptiveoncethestatisticalfeatures(e.g.,thenumber
of specific instructions or system calls) fail to reflect the security-critical operations,
which are probably highly related with the shellcode behaviors. Third, how to extract
thesemanticswhichdeterminetheshellcodeattributionremainsanopenquestion.The
emulationbasedapproachseemsagoodcandidateforextractingthebehaviorsofdif-
ferent shellcode. However, it can miss trivial differences existed in the behaviors of
different classes of shellcode. For example, self-contained exploit code [4] often ex-
hibitssamebehaviorsbyfollowingtheroutineof“decrypt-loop”mode.Furthermore,if
specificbehaviorsareabsentintheemulationenvironment,itcouldproducemorefalse
negatives. Also, the time cost for the emulation based approach is usually very high
comparedwithstaticanalysis.
Our approach. We present SA3, a novel automatic Semantic Aware Attribution
Analysis of remote exploit code. SA3 first makes semantic analysis on the payload
of packets, and then a Markov-based model is used to model each type of shellcode.
2
Specifically, for semantic analysis, we use static data anomaly analysis on the packet
payload;forstatisticanalysis,weuseatwo-wayofMixtureMarkovmodel.Thestatis-
ticalmodelisbasedontherefinedexploitcodesequences,whichareprunedfromthe
wholecodesequencesintheframeworkofstaticanalysis.Oncethemodelisbuilt,any
newcodecanbefedintothemodeltogetanattributionanalysisresult.
Oneimportantcharacteristicofourworkisthatweusethe“features”acquiredfrom
semantic analysis for attribution analysis. We present SA3 based on an observation
that the attribution for a piece of exploit code has great correlations with the exploit
code’s semantic characteristics (e.g., the opcode sequence, the instruction sequence)
andalsoitsstatisticalcharacteristics(e.g.,thenumberofinstructions,theout-degreeof
controlflowgraph).Thechangesofthesemanticsalsocausethechangesofthestatistic
exposureinshellcodeinstructions.Thisobservationmotivatesustoconsideraboutthe
integration of semantic analysis with statistical analysis by taking advantages of both
ofthem.
Our work stands between the semantic analysis and statistical analysis. Instead of
using dynamic emulation techniques introduced before, our work uses the static data
anomalyanalysisbymakingstaticanalysisontheinstructionsequences.Theadvantage
of this approach is to capture the semantics of the exploit code with moderate time
cost. Also, it will not be attacked by anti-emulation techniques [5]. Compared with
only emulation based approach, our work can also overcome some inherent defects
(e.g., different shellcode may expose similar behaviors) by introducing the statistical
analysis.Comparedwithonlystatisticalbasedapproach,ouranalysisismorerobustby
incorporatingthesemanticstoavoid“black-box”learning.
Contributions. The main merits of SA3 are listed as follows. To our knowledge,
our approach is the first work to make exploit code attribution analysis by combin-
ingsemanticanalysiswithstatisticalanalysis.Semanticanalysisisusedforextracting
the semantic-binding code with certain malicious intent. Statistical features can help
to capture the “whole” view of a packet from macroscopic point. These two different
views complement each other. Our evaluation shows that our analysis result is better
thanpurelystatisticalapproach,whichalsorefutestheconclusionof“impossibilityof
modelingpolymorphicshellcode [11]”insomedegree.
Therestofthispaperisorganizedasfollows.Firstofall,weformalizetheproblem
inSection2.NextweshowourapproachSA3 inSection3,followedbyevaluationin
Section 4. Then we introduce the related work in Section 5. Finally, we conclude the
paperinSection6.
2 ProblemStatementandAnalysis
2.1 ProblemFormalization
Let I(i ∈ I) be a set of different classes of exploit code; and D(1 ≤ j ≤ D) be the
totalnumberofinstances(variants)generatedfromacertainclass.WeuseSij todenote
the jth exploit code instance generated from class wi, i.e., Sij ∈ wi. For example, in
reality,asetofdifferenttypesofexploitcodecanbegeneratedfromdifferentpolymor-
phicshellcodeenginesI = {Clet,CountDown,Pex,Tapion,...}.Differentinstances
3
Fig.1:Ademonstrationofpolymorphicshellcodeinstance
ofthesametypeofexploitcodecanbegeneratedusingcomplicatedobfuscationtech-
niqueslikepolymorphismandmetamorphism[12].
Definition1.ExploitCodeAttributionProblem
(1)ForlotsofexploitcodeinstancesSij,howtogenerateaprofilingforeachcate-
gorywi;
(2)Foranunknownexploitcodes,whatistheattributionofs?Thatis,findisuch
thats∈wi.
2.2 TheChallengeoftheProblem
Accordingtothedefinitionofexploitcodeattributionproblem,Problem(1)isatraining
problem in shellcode classification and Problem (2) is an recognition problem after a
profiling for each category of exploit code is built. Problem (1) is the key step while
Problem(2)canbeeasilysolvedafterthelearningmodelisbuiltinProblem(1).These
two problems match well with the standard machine learning problem. Naturally, we
refertomachinelearningtechniquesforasolution.
Fromaboveanalysis,itseemsanystatisticalapproachcanworkinthecontextofex-
ploitcodeattributionanalysis.However,thestatistics-basedapproachmaynotproduce
promisingresults.Songetal.[11]concludethatitisimpossibletomodelthepolymor-
phicshellcode(SeeFig.1foranexample).Polymorphicshellcodeaccountsthelargest
part of the exploit code, and therefore, modeling all of the exploit code (e.g., for at-
tributionanalysis)ismuchmoredifficult.Next,wewillbrieflyexplainwhymodeling
polymorphicshellcodeinstancesisdifficult.Thecontentsofthepolymorphicshellcode
instancesusuallyconsistofseveralparts:NOPpart(sled),decoderpart,encryptedpay-
load part, return address part and padding part (Fig. 1). Modeling the NOP part may
amount to modeling random instructions because many instructions are semantically
equivalentto“NOP.”Forexample,fortheshellcodegeneratedbyCLET[13],thereare
55kindsofsledusedinthe“NOP”part.Inthereturnaddresspart,therearealsomany
variationsofthetargetaddressbyaddingpaddingbytesbeforeit.Inthepaddingpart,
the binary code can be filled in, without influencing the execution results. For obfus-
cation purpose, the padding bytes may have similar distribution to the normal traffic
distribution. In the decoding part, different encryption keys can generate different en-
cryptedexploitcode.Clearly,duetogreatvarietiesineachpartofpolymorphicexploit
code,thevariationsforawholeexploitcodepacketcanbeevenlarger.Thesegreatvari-
ationsmayresultin,(R1)nofixpatternsexposedinawholepacket;(R2)theattribution
analysisprocessmisguidedbypaddingbytesandnoisybytes.
Fig.2showstwoexamplesofshellcodevarieties.Fig.2(a)showsaspectralimage,
whereeachpixelrepresentsabytefromashellcodesequencegeneratedfrompolymor-
phicenginePex[14].Eachrowiscorrespondingtoashellcodesequencewith344bytes
4
(cid:2)
(cid:2) (cid:2)
(cid:2)
(cid:2)
(cid:2)
(cid:2) (cid:2)
inlength,andtotally100instancesformtheimage.Similarly,Fig.2(b)showsthespec-
(cid:2)
tral image formed by 100 sequences generated from polymorphic engine CLET [13],
(cid:2)
where each row is a shellcode sequence of 168-byte in length. Clearly, these images
(cid:2) demonstrategreatvarietiesofdifferentbytesinexploitcode,whichimplythattheshell-
(cid:2) codeattributionanalysisisachallengingproblem. (cid:2)
(cid:2) (cid:2) (cid:2)
(cid:2) (cid:2)
(cid:2)
(cid:2) (cid:2)
(cid:2)
(cid:2) (cid:2)
(cid:2)
(cid:2) (cid:2)
(cid:2) (cid:2) (cid:2)
(cid:2) (cid:2) (cid:2)
(cid:2) (cid:2)
(a)
(cid:2)
(b) (c) (d)
Fig. 2: Varieties of shellcode instances. (a) Pex (each of 100 instances is 344 bytes);
(cid:2) (cid:2)
(b)CLET(eachof100instancesis168bytes);(c)Pexrefinedshellcodeafterseman-
(cid:2) (cid:2)
tic analysis (corresponding to (a), each is 60 bytes); (d) CLET refined shellcode after
(cid:2)
semantic analysis (corresponding to (b), each is 60 bytes). Each pixel of the image
(cid:2)
representsabyteobtainedfromashellcodeinstance
(cid:2)
(cid:2)
3 Approach
In Fig. 3, we describe the framework of SA3 . The core modules of SA3 are Seman-
tic Analysis Module, and Statistical Analysis Module. More detailedly, we use Data
AnomalyAnalysisintheSemanticAnalysisModuleandaTwo-wayMixtureofMarkov
ModelintheStatisticalAnalysisModule.
ThewholeworkflowofSA3 canbedividedintotrainingstage(withtherealline)
and the recognition stage (with the dashed line). First of all, the same type of exploit
code instances are fed into the semantic analysis module, and data anomaly analysis
are conducted on them. We get the refined exploit code instances, which are actually
the instruction sequences pruned of useless instructions. Next, a two-way Mixture of
MarkovModelisbuiltontherefinedinputinstructionsequences.Weconstructamix-
ture of Markov Model corresponding to each category of exploit code. When a new
exploitcodeinstancecomes,itwillbefirstanalyzedthroughthedataanomalyanalysis
5
module.Thustherefinedcodesequencesaredistilledastheinputtothetwo-waymix-
ture of Markov Model. The decision result is obtained by attributing the exploit code
sequencetotheonewiththemostfittingvalue.
(cid:16)(cid:9)(cid:14)(cid:17)(cid:14)(cid:4)(cid:12)(cid:10)(cid:8)(cid:12)(cid:11)(cid:9)(cid:12)(cid:3)(cid:4)(cid:5)(cid:6)(cid:7)(cid:8)(cid:9)
(cid:16)(cid:8)(cid:8)(cid:24)(cid:7)(cid:27)(cid:17)(cid:8)(cid:7)(cid:6)(cid:13)(cid:9)
(cid:10)(cid:6)(cid:11)(cid:12)(cid:9)(cid:7)(cid:13)(cid:14)(cid:8)(cid:15)(cid:13)(cid:10)(cid:12)
(cid:24)(cid:12)(cid:14)(cid:17)(cid:5)(cid:8)
(cid:2)(cid:2)(cid:2)(cid:3)(cid:3)(cid:3)(cid:4)(cid:4)(cid:4)(cid:5)(cid:5)(cid:6)(cid:5)(cid:6)(cid:6)(cid:7)(cid:7)(cid:8)(cid:7)(cid:8)(cid:9)(cid:8)(cid:9)(cid:10)(cid:9)(cid:10)(cid:10)(cid:6)(cid:6)(cid:6)(cid:11)(cid:11)(cid:11)(cid:12)(cid:12)(cid:12)(cid:9)(cid:9)(cid:9) (cid:18)(cid:15)(cid:8)(cid:15)(cid:9)(cid:15)(cid:13)(cid:6)(cid:19)(cid:15)(cid:5)(cid:20)(cid:9) (cid:21)(cid:21)(cid:21)(cid:12)(cid:12)(cid:12)(cid:22)(cid:22)(cid:7)(cid:22)(cid:7)(cid:13)(cid:7)(cid:13)(cid:13)(cid:12)(cid:12)(cid:12)(cid:11)(cid:11)(cid:11)(cid:9)(cid:9)(cid:12)(cid:9)(cid:12)(cid:12)(cid:3)(cid:3)(cid:3)(cid:4)(cid:4)(cid:4)(cid:5)(cid:5)(cid:6)(cid:5)(cid:6)(cid:6)(cid:7)(cid:7)(cid:8)(cid:7)(cid:8)(cid:9)(cid:8)(cid:9)(cid:9) (cid:23)(cid:7)(cid:3)(cid:8)(cid:17)(cid:24)(cid:12)(cid:9)(cid:23)(cid:15)(cid:24)(cid:25)(cid:6)(cid:26)(cid:9)
(cid:7)(cid:7)(cid:13)(cid:7)(cid:13)(cid:13)(cid:14)(cid:14)(cid:14)(cid:8)(cid:8)(cid:15)(cid:8)(cid:15)(cid:15)(cid:13)(cid:13)(cid:13)(cid:10)(cid:10)(cid:10)(cid:12)(cid:12)(cid:12)(cid:14)(cid:14)(cid:14) (cid:15)(cid:13)(cid:15)(cid:5)(cid:20)(cid:14)(cid:7)(cid:14) (cid:10)(cid:10)(cid:10)(cid:6)(cid:6)(cid:6)(cid:11)(cid:11)(cid:11)(cid:12)(cid:12)(cid:12)(cid:9)(cid:9)(cid:7)(cid:9)(cid:7)(cid:13)(cid:7)(cid:13)(cid:13)(cid:14)(cid:14)(cid:14)(cid:8)(cid:8)(cid:15)(cid:8)(cid:15)(cid:15)(cid:13)(cid:13)(cid:13)(cid:10)(cid:10)(cid:10)(cid:12)(cid:12)(cid:12)(cid:14)(cid:14)(cid:14) (cid:23)(cid:6)(cid:11)(cid:12)(cid:5)
Fig.3:SA3flowgraph(reallinefortrainingstage,dashedlineforrecognitionstage)
SemanticModule.Foreachcategoryoftheinputinstructionsequences,weprune
semantic-unrelatedcodeexistedinthecodesequences.Dataanomalyanalysisisused
tocapturethe“semantics”oftheexploitcodethroughpreservingtheusefulinstructions
whilepruningtheuselessoneswhichareprobablycontainingpaddingandnoisybytes
inthepackets.ThismoduleisusedforsolutionofR2presentedinSection§2.2.
Statistical Module. For the pruned instruction sequences, a two-way Mixture of
MarkovModelisbuiltforthesolutionofR1(Section§2.2).Ononehand,itisnotvery
clear what kind of relationship exists in the instruction sequences. On the other hand,
Markov model is very suitable to model the uncertainty existed in different context.
Thus, we refer to a two-way Mixture Markov model, to model relationships between
the instruction sequences. The property of “two-way mixture model” makes it more
robustandpowerfultorepresentthevarietiesofdifferentcategoriesofcode.
3.1 WhatIstheSemanticsUsedinExploitCode?
Data Anomaly Analysis. We observe that certain control and data flow information
remain invariable to implement certain functions in the exploit code. We call those
controlanddataflowinformationas“semantic.”Thedataanomalyanalysisisusedto
capturethosesemantics,becauseitcanpreservetheusefulinstructionsbypruningthe
uselessoneswhichcontainpaddingandnoisybytes.
Firstofall,weusedisassembleanalysistoanalyzetheinputbinaryinstructionse-
quences.Inthispaper,whatwefocusonisHTTPmessageflows.InanHTTPrequest
message,maliciouspayloadonlyexistsinRequest-URIandRequest-Bodyofthewhole
flow [15]. We extract these two parts from the HTTP flows for further semantic anal-
ysis.Thenwemakedisassembleanalysisontheseinputsequences.Ifthedisassemble
module finds consecutive instructions in the input sequences, it generates the disas-
sembleinstructionsequencesasoutput.AninstructionsequenceisasequenceofCPU
instructionswhichhasonlyoneentrypoint.Avalidinstructionsequenceshouldhave
at least one execution path from the entry point to another instruction within the se-
quence.Sincewedonotknowtheentrypointofthecodewhenthecodeispresentin
6
thebytesequences,weexploreanimprovedrecursivetraversaldisassemblealgorithm
introduced by Wang et al. [15] to disassemble the input instruction sequences. For an
N-bytesequence,thetimecomplexityofdisassemblealgorithmisO(N).
After disassemble analysis, it may generate zero, one, or multiple instruction se-
quences, which do not necessarily correspond to real code. Next, we distill use-
ful instructions by pruning useless instructions using the technique introduced in
SigFree [15]. Useless instructions are those illegal and redundant byte sequences. By
usingthecodeabstraction,astaticanalysistechnique,wecanemulatetheexecutionsof
instructionsequences.Therearepossibly6statesinthestatetransitiongraphgenerated
from the code sequences. State U represents undefined variable state; state D repre-
sentsdefinedbutnotreferencedvariablestateandstateRrepresentsdefinedandrefer-
enced variable state. The other three abnormal states are defined as follows: state DD
represents abnormal state define-define, state UR represents abnormal state undefine-
reference,andstateDUrepresentsabnormalstatedefine-undefine.Basically,thepruned
uselessbytesequencescorrespondtothreekindsofdataflowanomalies:UR,DD,DU.
Whenthereisanundefine-referenceanomaly(i.e.,avariableisreferencedbeforeitis
everassignedwithavalue)inanexecutionpath,theinstructionwhichcausesthe“ref-
erence”isauselessinstruction.Whenthereisadefine-defineanomaly(i.e.,avariable
is assigned a value twice) or define-undefine anomaly (i.e., a defined variable is later
set by an undefined variable), the instruction that caused the former “define” is also
considered as a useless instruction. Since crafted noisy bytes in the packets typically
do not contain useful instructions, such irrelevant bytes in the packets are filtered out
aftertheusefulinstructionextractionphase.Theremaininginstructionsarelikelytobe
relatedtothesemanticsofthecodekeptintheexploitcodesequences.
Here,wefurtherexplainourmotivationforusefulinstructionextraction.Fromour
observations,lotsof“usefulinstructoins”areleftinvariantacrossdifferentshellcodein-
stancesevenaftercomplicatedobfuscations(e.g.,“junkinsertion,”“instructionreplace-
ment”).Forpaddingandnoisybytes,theystillcanbeassembledintocodesequences.
However,usuallyitlacksclearmeaningsandcorrelatedrelationsforthosecoincidental
instructionsequences.Thus,theywillbeprunedafterrigorousdataflowanomalyanal-
ysis.Moreover,wenotethattheremainingusefulcodesequencesaremorelikelytobe
similartothosefromthesamecategoryinsteadofthosefromtheothercategories.
MotivatingExample.AnexampleofpolymorphiccodeanalysisisshowninFig.
4. Here the leftmost part is the original packet content in binary, the middle part and
therightpartarethedisassemblecodeanditscorrespondingbinarycodeoftheuseful
instructions after removing useless ones, respectively. For example, the disassembly
codeincecxappearedinaddress42isprunedbecauseecxisdefinedagaininaddress
4ctoproduceadefine-defineanomaly.Inaddress44,thecontentsinthememorycell
with address ecx-4A is referenced without being defined beforehand. Thus we prune
thisinstructionbecauseitproducesanundefine-referenceanomaly.
Figs. 2(c) and 2(d) show two other examples. Fig. 2(c) gives the spectral image
formedbytheremaininginstructionsof100instancescorrespondingtoFig.2(a).Sim-
ilarly, Fig. 2(d) gives the spectral image formed by the remaining instructions of 100
instancescorrespondingtoFig.2(b).Inbothimages,eachpixelrepresentsabytefrom
the remaining instructions. Clearly, the lengths of the preserved code sequences are
7
(cid:2)
(cid:2)
(cid:2)
(cid:2)(cid:3)(cid:15)(cid:19)(cid:4)(cid:5)(cid:12)(cid:9)(cid:6)(cid:22)(cid:9)5(cid:13)(cid:4)(cid:17)(cid:8)(cid:9)(cid:4)(cid:15)(cid:10)(cid:25)(cid:12)(cid:8)(cid:9)(cid:10)(cid:6)(cid:13)(cid:8)(cid:12)(cid:13)(cid:8) (cid:28)(cid:6)(cid:11)(cid:12)(cid:9)(cid:22)(cid:24)(cid:15)(cid:29)(cid:19)(cid:12)(cid:13)(cid:8)(cid:15)(cid:22)(cid:8)(cid:12)(cid:24)(cid:9)(cid:17)(cid:14)(cid:12)(cid:22)(cid:17)(cid:5)(cid:9) (cid:23)(cid:20)(cid:8)(cid:12)(cid:9)(cid:10)(cid:6)(cid:11)(cid:12)(cid:9)(cid:6)(cid:22)(cid:9)(cid:8)(cid:24)(cid:12)(cid:9)
(cid:7)(cid:13)(cid:14)(cid:8)(cid:24)(cid:17)(cid:10)(cid:8)(cid:7)(cid:6)(cid:13)(cid:9)(cid:12)(cid:3)(cid:8)(cid:24)(cid:15)(cid:10)(cid:8)(cid:7)(cid:6)(cid:13) (cid:10)(cid:6)(cid:11)(cid:12)(cid:9)(cid:22)(cid:24)(cid:15)(cid:29)(cid:19)(cid:12)(cid:13)(cid:8)
(cid:30)(cid:30)(cid:30)(cid:31)(cid:9)(cid:9)(cid:9)(cid:9)(cid:9)(cid:9)(cid:9)(cid:9)
(cid:30)(cid:30)(cid:30)(cid:31)(cid:9)(cid:9) !(cid:2)(cid:3)(cid:4)(cid:9)(cid:9)"(cid:5)(cid:6)(cid:7)#"(cid:5)(cid:6)(cid:7) !(cid:9)$.(cid:15)’
$. (cid:15)’ +/(cid:14)’(cid:9)(cid:9). (cid:14)+(cid:9)44(cid:9)44(cid:9)44(cid:9)44(cid:9)(cid:15) (cid:9)&(cid:14)+,(cid:9)-1(cid:9)(cid:9) (cid:14)(cid:9)(cid:9)(cid:9)+$ $!(cid:9)(cid:2)(cid:3)(cid:4)(cid:9)"(cid:5)(cid:6)(cid:7)#(cid:9)%& (cid:9) $!(cid:9)+/(cid:14)’(cid:9).
-.(cid:9)(cid:9)+,(cid:9)(cid:9)(cid:15)$+/(cid:9)(cid:9)(cid:14)(cid:14)(cid:9)4(cid:15)(cid:9)(cid:14)$(cid:9)40-(cid:14)(cid:9),, 1(cid:21)(cid:9)+41(cid:21)(cid:9)+$ -(cid:14)(cid:9)(cid:9)(cid:9)/(cid:17) & (cid:6)(cid:8)(cid:9)(cid:9)(cid:9) ’ &!(cid:9)(cid:14)+(cid:9)44444444
-(cid:17)(cid:9),. (cid:17)(cid:9) (cid:21)(cid:9)(cid:21)(cid:14)(cid:9)(cid:21)1(cid:9)&4(cid:9) (cid:17)(cid:9) (cid:21)(cid:9)(cid:9)+-(cid:9)(cid:9).(cid:14)(cid:9)4 (cid:9)4(cid:17)(cid:9)(cid:15)-(cid:9)4(cid:21)(cid:9)(cid:9)-(cid:21) (cid:4)!(cid:9)(cid:10)(cid:11)(cid:10)(cid:9)"(cid:5)(cid:2)(cid:12) (cid:4)!(cid:9)&(cid:14)
1(cid:14)(cid:9)(cid:9)0’(cid:9)(cid:9)(cid:15)(cid:17)(cid:9)1/(cid:9)(cid:9) (cid:17)(cid:9) (cid:21)(cid:9)’(cid:17)(cid:9)(cid:21)$(cid:9)-(cid:21)(cid:9)(cid:9)1(cid:21)(cid:9)+.(cid:9) ’(cid:9)(cid:9)04(cid:9) (cid:17)(cid:9) (cid:21)(cid:9)(cid:9)(cid:15)/ (cid:6)! (cid:7)(cid:11)(cid:13)(cid:9)("(cid:5)(cid:2)(cid:12))(cid:14)*#(cid:15)$+,-.+$ (cid:6)!(cid:9)+,-1(cid:9) (cid:14)(cid:9)+$-.+,(cid:15)$
1(cid:15)(cid:9)(cid:9)0(cid:21) 0,(cid:9)&.(cid:9)(cid:9)$(cid:14)(cid:9)44(cid:9)0,(cid:9)(cid:9).1(cid:9)+&(cid:9)(cid:9).(cid:21)(cid:9)0.(cid:9)(cid:15)4(cid:9)+/(cid:9)(cid:9).’(cid:9)(cid:9)1(cid:21)(cid:9)/1 ,/!(cid:9)(cid:2)(cid:3)(cid:4)(cid:9)"(cid:5)(cid:2)(cid:12)#%0 ,/!(cid:9)+/(cid:14)(cid:14)(cid:9)4(cid:15)
.’(cid:9)(cid:9)$4(cid:9)(cid:9)(cid:21)&(cid:9)(cid:14)(cid:21)(cid:9)(cid:9)4-’(cid:14)(cid:9) (cid:17)(cid:9) (cid:21)(cid:9)(cid:9)’(cid:17)(cid:9)(cid:21)1(cid:9)-(cid:21)(cid:9)1(cid:21)(cid:9)(cid:21)0(cid:9) ’(cid:9)(cid:9)(cid:9)--(cid:9)(cid:15)(cid:21)(cid:9) ,1!(cid:9)(cid:9)(cid:11)(cid:11)(cid:10)(cid:16)(cid:9) (cid:15) ,1!(cid:9)(cid:14)$(cid:9)40
,+!(cid:9)2(cid:9)(cid:5)(cid:9) $. ,+!(cid:9)-(cid:14)(cid:9),,
,(cid:6)!(cid:9)(cid:10)(cid:3)(cid:2)3(cid:9)%-(cid:14) ,(cid:6)!(cid:9)1(cid:21)(cid:9)+$
,(cid:5)!(cid:9)(cid:9)2(cid:9)(cid:5)(cid:9)(cid:9) &(cid:17) ,(cid:5)!(cid:9)-(cid:14)(cid:9)/(cid:17)
(cid:12)(cid:22)(cid:6)(cid:9)(cid:5)(cid:6)(cid:7)6(cid:9)70,8 $ !(cid:9)(cid:9)2(cid:18)(cid:5)(cid:9) /(cid:17) $ !(cid:9)-(cid:17)(cid:9),.
(cid:10)(cid:11)(cid:10)(cid:9)(cid:5)(cid:4)(cid:7)6(cid:9)7&.8 0(cid:8)!(cid:9)(cid:9)(cid:10)(cid:3)(cid:2)3(cid:9)/1 0(cid:8)!(cid:9)1(cid:21)(cid:9)/1
(cid:12)(cid:22)(cid:6)(cid:9)((cid:16)9(cid:11)(cid:13)(cid:16)(cid:9)(cid:6)(cid:2)!(cid:5)(cid:6)(cid:7)%0(cid:21)*6(cid:9)7$(cid:14)(cid:9)440,(cid:9).18 0(cid:6)!(cid:9)(cid:19)(cid:11)(cid:20)(cid:9)"(cid:5)(cid:6)(cid:7)#4-(cid:14)(cid:21)(cid:21)&$4 0(cid:6)!(cid:9).’(cid:9)$4(cid:21)&(cid:14)(cid:21)4-
(cid:30)(cid:30)(cid:30)(cid:31)(cid:31)(cid:9)(cid:9)
(cid:2)
Fig.4:Amotivatingexampletoshowtheprocedureofsemanticanalysisontheinput
codesequence
decreased.Moreimportantly,thefixedpatternsintheoriginalcodesequencesarepre-
servedwhilethebyteslocatedindifferentpositionswithlargevarietiesarecutoff.
Fromtheabovepolymorphicshellcodeexample(Fig.4)andotherinstances,wefind
thattheremainingcodesequencesusuallyconsistofthefollowingfeatures:(F1)getPC:
thecodetogetthecurrentprogramcounter,usuallycontainsopcode“call”or“fstenv”;
(F2) Iteration: a polymorphic exploit code usually performs iterations over encrypted
shellcodeusingtheoperationslikeloop,repandthevariantsofsuchinstructions(e.g.,
loopz, loope, loopnz); (F3) Jump: a polymorphic exploit code is probable to contain
conditional/unconditional branch statements (e.g., jmp, jnz, je); (F4) Decryption: for
the encrypted shellcode, certain machine instructions (e.g., or, xor) are more often to
befoundindecryptionroutinessincedecryptionneedstodecrypttheshellcodebefore
execution. These features are preserved after semantic analysis, which can be further
usedforstatisticalmodeling.Webelievethesefeatureshelptocapturethecategoryof
shellcode,andtheymayexistinmostoftheself-containedexploitcode.
Itmaybeattemptingtouse(F2,F4)astheonlyfeatureforcategoryanalysis.For-
tunately, we also have other useful instructions preserved except for the features (F1,
F2, F3, F4). This motivates us to use the statistical model for capturing the differ-
ences across various exploit codes as much as possible. For non self-contained code,
not all features (e.g., F2, F1) exist in the shellcode (e.g, code generated from Avoid
UTF8/tolower [4]) because of the absence of GetPC and self-reference operations. In
these cases, the remaining instruction sequences still can be taken as good indicators
forshellcodecategoryanalysissincenoisybytesarefiltered.Theprunedbytesaremore
likelytomisleadthestate-of-the-artstatistics-basedlearningapproaches(e.g.,N-gram
basedlearning[16],MarkovChain[8],SupportVectorMachine[6])forcategoryanal-
ysis or detection. Note the length of code sequence can be viewed as the dimensions
forthetrainingcodesequences.Topruneuselessinstructionalsomeanstoreducethe
dimension of training data This makes the machine learning module much easier and
moreaccuratebyalleviatingthedifficultyof“curseofdimensionality[17]”.
8
(cid:22)(cid:6)(cid:24) (cid:15)(cid:24)(cid:11)(cid:9)(cid:4)!(cid:11)(cid:12)(cid:4)(cid:12)(cid:13)(cid:11)(cid:12)(cid:13)(cid:10)(cid:12) (cid:27)(cid:15)(cid:10)(cid:25) (cid:15)(cid:24)(cid:11)(cid:9):!(cid:11)(cid:12)(cid:4)(cid:12)(cid:13)(cid:11)(cid:12)(cid:13)(cid:10)(cid:12)
(cid:25)(cid:26)(cid:28)(cid:27) (cid:28)(cid:29) (cid:30)(cid:27) (cid:31)(cid:28) (cid:30)(cid:27) (cid:31)(cid:27)
Fig.5:ExplanationofdependenceinMarkovModel
3.2 WhatIstheStatisticsUsedforModeling?
WhyUseMarkovModel? LetY bethesetofsinglebytesandYi denotethesetof
i-byte sequences. X = Y ∪Y2 ∪Y3 ∪Y4 is the token set in our system because a
token in a useful instruction contains at most four bytes (e.g., “AAFFFFFF”), which
corresponds to the word size of 32-bit systems. A Markov chain [18] is a sequence
ofrandomvariablesX1,X2,X3,...,satisfyingtheMarkovproperty:giventhepresent
state,thefutureandpaststatesareindependent.Moreformally,probabilityPr(Xn+1 =
x|X1 = x1,X2 = x2,...,Xn = xn) = Pr(Xn+1 = x|Xn = xn), where xi is the
value for each state Xi, and Pr(Xn+1 = x|Xn = xn) is the conditional probability
fortransitionfromstateXntoXn+1.ThepossiblevaluesofXiformacountablesetS
calledthestatespaceofthechain.Weobservethattherearecloserelationsamongthe
codetokensintherefinedinstructionsequences.MarkovChain[18]isagoodcandidate
tomodeluncertaindependenciesindifferentcontexts.Inthecontextofcodesequence
analysis, each token in a sequence can be viewed as a state in a Markov Chain. We
assume a token in a sequence is dependent on the token in front and also the token
next because of the great dependencies existed in the code sequences of the nearest
neighbors.Tobeexact,thedependencyoftokenxj onxi istheco-occuranceoftoken
xj and xi. If xi appeared in front of xj in the same sequence, we call xj is forward
dependentonxi.Otherwise,ifxiappearedafterxj inthesamesequence,wecallxj is
backwarddependent on xi.1-order Markovchain requires the nth token in a chain is
onlydependentonthe(n−1)thtoken.However,inrealcodesegment,thenthtoken
canbedependentonthe(n−1)th,(n−2)th,...,(n−p)thtokensinasequence,and
alsorelatedto(n+1)th,(n+2)th,...,(n+q)thtokens.Wedonotknowwhatisthe
valueofpandqbeforehand.
In our model we define two kinds of relationships to represent those bidirec-
tionaldependence.WecallourMarkov-derivedmodelasaTwoWayMixtureMarkov
(TWMM)Model.First,wedefinetheforwarddependence,i.e.,nthtokenisdepended
on consecutive p tokens in front. Next, we define the backward dependence, i.e., nth
tokenisdependentonthenextconsecutiveq tokens.Thenparametersπi(i = 1,2)are
usedtomakeabalancebetweenthem,whereπ1 +π2 = 1.Fig.5showsanexample,
wheretoken96isforwarddependentonp(p=2)tokens(83C6,01)infront,andalso
backwarddependentonnextq(q =3)tokens(40,96,46).
Model Construction. First, we construct a TWMM model for each category of
codesequences.Second,afteranewcodesequenceisfedintothemodel,weattribute
ittotheclasswiththehighestfittingvalue.However,ifthehighestfittingvalueisstill
lessthanacertainthreshold,wewillattributeittothenormalsequence.Herethefitting
value is the accumulation of probabilities, which reflects the matching score from a
codesequencetothemodel.
9
Nextweshowhowtocomputetheprobabilityforacodesequence.Theprobabil-
ity of a code sequence can be decomposed into the product of the probability of each
tokeninasequence.Fordifferenttokensappeared,thereisatransitionmatrixtolabel
the probability from one token to another. Hence, p-forward tokens’ transition proba-
bility to a specific token is the probability from front p tokens’ transition probability
to this token. Similarly, q-backward tokens’ transition probability to a specific token
is the probability from next q tokens’ transition to this token. In forward model, the
ithtoken’sprobabilityiscomputedthroughproductofthep-forwardtokens’transition
probability to this token. Similarly, in backward model, the ith token’s probability is
computedthroughtheproductofthe q-backwardtokens’transitionprobabilitytothis
token.Sincetheprobabilityisaproductofp(Ln−p)valuesintheforwardmodel,and
aproductof q(Ln −q) valuesinthebackwardmodel,whereLn isthelengthforthe
nthcodesequence.Therefore,thep(Ln−p)rootisneededforcomputingthesequence
probabilityinforwardmodelandq(Ln−q)rootisneededinbackwardmodel.
Moreformally,letxn,i denotetheithtokeninthenthsequence,A1(xn,i|xn,j;θ1)
denote the transition probability from token xn,j to token xn,i in forward model θ1,
A2(xn,i|xn,j;θ2) denote the transition probability from token xn,j to token xn,i in
backward model θ2. Since the same token can be transferred to different tokens, the
sumofsuchtransitionprobabilityshouldbenormalizedto1,i.e.,
(cid:2)
Ak(xn,i|xn,j;θk)=1(k =1,2). (1)
xn,i
Let g(xn|θ1) and g(xn|θ2) denote the probability for the nth sequence’s matching
scoresintheforwardmodelandbackwardmodel,respectively.Thuswehave
⎛ ⎞
1
(cid:5)Ln L(cid:5)n−p (Ln−p)p
g(xn|θ1)=⎝ A1(xn,i|xn,j;θ1)⎠ (2)
i=p+1j=i−p
⎛ ⎞
1
L(cid:5)n−q i(cid:5)+q (Ln−q)q
g(xn|θ2)=⎝ A2(xn,i|xn,j;θ2)⎠ (3)
i=1 j=i+1
Next,bycombingg(xn|θ1)andg(xn|θ2)inabalancedway,wehaveGntodenote
thematchingscorefornthsequence,i.e.,
(cid:2)2
Gn = πkg(xn|θk), (4)
k=1
where π1 +π2 = 1. To obtain the solution for this model means to estimate the pa-
rameters in Eq. (4). Suppose we have N sequences for each category, thus the object
functionGtobeoptimizedistheproductofthelikelihoodforeachsequenceGn,i.e.,
(cid:5)N (cid:2)2
G= πkg(xn|θk). (5)
n=1k=1
10