Source: https://patents.google.com/patent/US10305919B2/en
Timestamp: 2019-11-15 23:51:14
Document Index: 258118787

Matched Legal Cases: ['§ 371', 'art-1', 'Application No. 12832510', 'Application No. 12832510', 'Application No. 12832510', 'Application No. 12832510']

US10305919B2 - Systems and methods for inhibiting attacks on applications - Google Patents
US10305919B2
US10305919B2 US15/149,821 US201615149821A US10305919B2 US 10305919 B2 US10305919 B2 US 10305919B2 US 201615149821 A US201615149821 A US 201615149821A US 10305919 B2 US10305919 B2 US 10305919B2
US15/149,821
US20170070514A1 (en
2006-04-21 Priority to PCT/US2006/015080 priority Critical patent/WO2007133178A2/en
2009-12-04 Priority to US29773009A priority
2014-05-07 Priority to US14/272,187 priority patent/US9338174B2/en
2016-05-09 Application filed by Columbia University of New York filed Critical Columbia University of New York
2016-05-09 Priority to US15/149,821 priority patent/US10305919B2/en
2017-03-09 Publication of US20170070514A1 publication Critical patent/US20170070514A1/en
2019-05-28 Publication of US10305919B2 publication Critical patent/US10305919B2/en
238000001914 filtration Methods 0 abstract description 41
This application is a continuation of U.S. patent application Ser. No. 14/272,187, filed May 7, 2014, which is a continuation of U.S. patent application Ser. No. 12/297,730, filed Dec. 4, 2009, which is the U.S. National Phase Application under 35 U.S.C. § 371 of International Application No. PCT/US2006/015080, filed Apr. 21, 2006, each of which is hereby incorporated by reference herein in its entirety.
This invention was made with government support under Grant No. W911-NF-04-1-0442 awarded by the Army Research Office. The government has certain rights in this invention.
receiving, using a hardware processor, an input that is attempting to reach an application;
transmitting, using the hardware processor, the received input to an instruction-level emulator that selectively emulates at least a part of the application in which the emulated portions of the application are executed with non-emulated portions of the application with the received input, wherein a reversible transformation is performed on at least a portion of an instruction set, wherein an encoding key is used to perform the reversible transformation, and wherein binary code of the application is decoded during runtime with a decoding key;
receiving, using the hardware processor, an indication from the instruction-level emulator that the received input is an attack based on the emulation, wherein the indication correlates a portion of the binary code and the input; and
in response to receiving the indication, inhibiting, using the hardware processor, the received input from being transmitted to the application.
2. The method of claim 1, wherein the input is from one of a plurality of input sources.
3. The method of claim 1, further comprising transmitting the received input to a supervision framework that detects an attack on the application.
4. The method of claim 1, further comprising transmitting the received input to a supervision framework that provides feedback relating to an attack to a filter, wherein the feedback includes instructions relating to the attack that updates the filter.
5. The method of claim 4, wherein the filter is a signature-based filter and wherein the updates to the filter further comprises updates to at least one signature associated with the filter.
6. The method of claim 4, wherein the filter is an anomaly-based filter and wherein the updates to the filter further comprises updates to at least one model, predictor, or classifier associated with the filter.
7. The method of claim 1, further comprising transmitting an instruction relating to the attack, wherein the instruction comprises an association between the attack detected in the application and the received input.
8. A system for protecting applications from attacks, the system comprising:
a hardware processor that, when executing computer-executable instructions stored in the memory, is configured to:
receive an input that is attempting to reach an application;
transmit the received input to an instruction-level emulator that selectively emulates at least a part of the application in which the emulated portions of the application are executed with non-emulated portions of the application with the received input, wherein a reversible transformation is performed on at least a portion of an instruction set, wherein an encoding key is used to perform the reversible transformation, and wherein binary code of the application is decoded during runtime with a decoding key;
receiving an indication from the instruction-level emulator that the received input is an attack based on the emulation, wherein the indication correlates a portion of the binary code and the input; and
in response to receiving the indication, inhibiting the received input from being transmitted to the application.
9. The system of claim 8, wherein the input is from one of a plurality of input sources.
10. The system of claim 8, wherein the hardware processor is further configured to transmit the received input to a supervision framework that detects an attack on the application.
11. The system of claim 8, wherein the hardware processor is further configured to transmit the received input to a supervision framework that provides feedback relating to an attack to a filter, wherein the feedback includes instructions relating to the attack that updates the filter.
12. The system of claim 11, wherein the filter is a signature-based filter and wherein the updates to the filter further comprises updates to at least one signature associated with the filter.
13. The system of claim 11, wherein the filter is an anomaly-based filter and wherein the updates to the filter further comprises updates to at least one model, predictor, or classifier associated with the filter.
14. The system of claim 8, wherein the hardware processor is further configured to transmit an instruction relating to the attack and wherein the instruction comprises an association between the attack detected in the application and the received input.
15. A non-transitory computer-readable medium containing computer executable instructions that, when executed by a processor, cause the processor to perform a method for protecting applications from attacks, the method comprising:
receiving an input that is attempting to reach an application;
transmitting the received input to an instruction-level emulator that selectively emulates at least a part of the application in which the emulated portions of the application are executed with non-emulated portions of the application with the received input, wherein a reversible transformation is performed on at least a portion of an instruction set, wherein an encoding key is used to perform the reversible transformation, and wherein binary code of the application is decoded during runtime with a decoding key;
16. The non-transitory computer-readable medium of claim 15, wherein the input is from one of a plurality of input sources.
17. The non-transitory computer-readable medium of claim 15, wherein the method further comprises transmitting the received input to a supervision framework that detects an attack on the application.
18. The non-transitory computer-readable medium of claim 15, wherein the method further comprises transmitting the received input to a supervision framework that provides feedback relating to an attack to a filter, wherein the feedback includes instructions relating to the attack that updates the filter.
19. The non-transitory computer-readable medium of claim 18, wherein the filter is a signature-based filter and wherein the updates to the filter further comprises updates to at least one signature associated with the filter.
20. The non-transitory computer-readable medium of claim 18, wherein the filter is an anomaly-based filter and wherein the updates to the filter further comprises updates to at least one model, predictor, or classifier associated with the filter.
21. The non-transitory computer-readable medium of claim 15, wherein the method further comprises transmitting an instruction relating to the attack and wherein the instruction comprises an association between the attack detected in the application and the received input.
US15/149,821 2006-04-21 2016-05-09 Systems and methods for inhibiting attacks on applications Active US10305919B2 (en)
PCT/US2006/015080 WO2007133178A2 (en) 2006-04-21 2006-04-21 Systems and methods for inhibiting attacks on applications
US29773009A true 2009-12-04 2009-12-04
US14/272,187 US9338174B2 (en) 2006-04-21 2014-05-07 Systems and methods for inhibiting attacks on applications
US15/149,821 US10305919B2 (en) 2006-04-21 2016-05-09 Systems and methods for inhibiting attacks on applications
US14/272,187 Continuation US9338174B2 (en) 2006-04-21 2014-05-07 Systems and methods for inhibiting attacks on applications
US20170070514A1 US20170070514A1 (en) 2017-03-09
US10305919B2 true US10305919B2 (en) 2019-05-28
US12/297,730 Active 2029-08-30 US8763103B2 (en) 2006-04-21 2006-04-21 Systems and methods for inhibiting attacks on applications
US14/272,187 Active US9338174B2 (en) 2006-04-21 2014-05-07 Systems and methods for inhibiting attacks on applications
US15/149,821 Active US10305919B2 (en) 2006-04-21 2016-05-09 Systems and methods for inhibiting attacks on applications
WO (1) WO2007133178A2 (en)
WO2012154664A2 (en) * 2011-05-06 2012-11-15 University Of North Carolina At Chapel Hill Methods, systems, and computer readable media for detecting injected machine code
EP2756366A4 (en) * 2011-09-15 2015-05-27 Univ Columbia Systems, methods, and media for detecting return-oriented programming payloads
US10402563B2 (en) 2016-02-11 2019-09-03 Morphisec Information Security Ltd. Automated classification of exploits based on runtime environmental features
US20040128543A1 (en) 2002-12-31 2004-07-01 International Business Machines Corporation Method and system for morphing honeypot with computer security incident correlation
US20050071655A1 (en) 2003-09-25 2005-03-31 Sun Microsystems, Inc., A Delaware Corporation Permutation of opcode values for application program obfuscation
US20080313734A1 (en) 2007-05-24 2008-12-18 Deutsche Telekom Ag DISTRIBUTED SYSTEM AND METHOD FOR THE DETECTION OF eTHREATS
US20140344932A1 (en) 2011-09-15 2014-11-20 The Trustees Of Columbia University In The City Of New York Systems, methods, and media for detecting return-oriented programming payloads
2006-04-21 US US12/297,730 patent/US8763103B2/en active Active
2006-04-21 WO PCT/US2006/015080 patent/WO2007133178A2/en active Application Filing
2014-05-07 US US14/272,187 patent/US9338174B2/en active Active
2016-05-09 US US15/149,821 patent/US10305919B2/en active Active
Baecher, P. et al., "libemu", Jul. 22, 2011, pp. 1-6, available at: http://libemu.carnivore.it/.
Baumgartner, K., "The ROP Pack", In Proceedings of the 20th Virus Bulletin International Conference, Vancouver, BC, CA, Sep. 29-Oct. 1, 2010, pp. 1-43.
Buchanan, E. et al., "Return-Oriented Programming: Exploits Without Code Injection", Presentation, Black Hat USA, Las Vegas, NV, US, Aug. 2-7, 2008, pp. 1-53.
Checkoway, S. et al., "Return-Oriented Programming Without Returns", In Proceedings of the 17th Association for Computing Machinery Conference on Computer and Communications Security, Chicago, IL, US, Oct. 4-8, 2010, pp. 559-572.
Chen, P. et al., "DROP: Detecting Return-Oriented Programming Malicious Code", In Proceedings of the 5th International Conference on Information Systems Security, Berlin, DE, Dec. 14, 2009, pp. 163-177.
Corelan Team, "Corelan ROPDB", last updated Dec. 18, 2012, pp. 1-10, available at: https://www.corelan.be/index.php/security/corelan-ropdb/.
Cova, M. et al., "Detection and Analysis of Drive-by-Download Attacks and Malicious JavaScript Code", In Proceedings of the 19th International Conference on World Wide Web, Raleigh, NC, US, Apr. 26-30, 2010, pp. 281-290.
Davi, L. et al., "ROPdefender: A Detection Tool to Defend Against Return-Oriented Programming Attacks", last updated Mar. 19, 2010, pp. 1-21, available at: https://www.cs.jhu.edu/˜s/teaching/cs460/2013-fall/ROPdefender.pdf.
Dreger, H. et al., "Enhancing the Accuracy of Network-Based Intrusion Detection with Host-Based Context", In Proceedings of GI SIG Sidar Conference on Detection of Intrusions and Malware and Vulnerability Assessment, Vienna, AT, Jul. 7-8, 2005, pp. 206-221.
Egele, M. et al., "Defending Browsers Against Drive-By Downloads: Mitigating Heap-Spraying Code Injection Attacks", In Proceedings of the 6th International Conference on Detection of Intrusions and Malware, and Vulnerability Assessment, Como, IT, Jul. 9-10, 2009, pp. 88-106.
Erlingsson, U., "Low-Level Software Security: Attack and Defenses", Technical Report, Microsoft Corporation, Nov. 2007, pp. 1-44.
Exploit Database, "Offensive Security Exploit Database Archive", last updated Jul. 28, 2016, pp. 1-11, available at: http://www.exploit-db.com/.
Hensing, R., "Understanding DEP as a Mitigation Technology", last updated Jun. 12, 2009, pp. 1-5, available at: http://blogs.technet.com/b/srd/archive/2009/06/12/understanding-dep-as-a-mitigation-technology-part-1.aspx.
International Preliminary Report on Patentability dated Mar. 18, 2014 in International Patent Application No. PCT/US2012/055824.
International Preliminary Report on Patentability dated Mar. 19, 2009 in International Patent Application No. PCT/US2006/015080.
International Search Report dated Dec. 7, 2012 in International Patent Application No. PCT/US2012/055824.
International Search Report dated Jul. 7, 2008 in International Patent Application No. PCT/US2006/015080.
Kruegel, C. et al., "Polymorphic Worm Detection Using Structural Information of Executables", In Proceedings of the 8th International Symposium on Recent Advances in Intrusion Detection, Seattle, WA, US, Sep. 7-9, 2005, pp. 207-226.
Liang, Z. et al., "Automatic Generation of Buffer Overflow Attack Signatures: An Approach Based on Program Behavior Models", In Proceedings of the 21st Annual Computer Security Applications Conference, Tucson, AZ, US, Dec. 5-9, 2005, pp. 215-224.
Locasto, M. et al., "FLIPS: Hybrid Adaptive Intrusion Prevention", In Proceedings of the 8th International Symposium on Recent Advances in Intrusion Detection, Seattle, WA, US, Sep. 7-9, 2005, pp. 82-101.
Notice of Allowance dated Apr. 25, 2018 in U.S. Appl. No. 15/349,445.
Notice of Allowance dated Feb. 5, 2014 in U.S. Appl. No. 12/297,730.
Notice of Allowance dated Jul. 1, 2016 in U.S. Appl. No. 14/344,458.
Notice of Allowance dated Jun. 8, 2015 in U.S. Appl. No. 14/272,187.
Notice of Allowance dated Sep. 6, 2018 in U.S. Appl. No. 15/349,445.
Office Action dated Apr. 27, 2015 in U.S. Appl. No. 14/344,458.
Office Action dated Dec. 31, 2015 in U.S. Appl. No. 14/344,458.
Office Action dated Feb. 15, 2017 in European Patent Application No. 12832510.7.
Office Action dated Jun. 13, 2018 in European Patent Application No. 12832510.7.
Office Action dated Jun. 15, 2012 in U.S. Appl. No. 12/297,730.
Office Action dated Jun. 17, 2015 in European Patent Application No. 12832510.7.
Office Action dated Nov. 7, 2011 in U.S. Appl. No. 12/297,730.
Office Action dated Sep. 14, 2017 in U.S. Appl. No. 15/349,445.
Polychronakis, M. et al., "Comprehensive Shellcode Detection Using Runtime Heuristics", In Proceedings of the 26th Annual Computer Security Applications Conference, Austin, TX, US, Dec. 6-10, 2010, pp. 287-296.
Polychronakis, M. et al., "Emulation-Based Detection of Non-Self-Contained Polymorphic Shellcode", In Proceedings of the 10th International Conference on Recent Advances in Intrusion Detection, Gold Coast, AU, Sep. 5-7, 2007, pp. 87-106.
Polychronakis, M. et al., "Network-Level Polymorphic Shellcode Detection Using Emulation", In Proceedings of the Third Conference on Detection of Intrusions and Malware & Vulnerability Assessment, Berlin, DE, Jul. 13-14, 2006, pp. 54-73.
Ratanaworabhan, P. et al., "NOZZLE: A Defense Against Heap-Spraying Code Injection Attacks", In Proceedings of the 18th USENIX Security Symposium, Montreal, CA, Aug. 10-14, 2009, pp. 169-186.
Shacham, H., "The Geometry of Innocent Flesh on the Bone: Return-into-libc Without Function Calls (On the x86)", In Proceedings of the 14th Assosciation for Computing Machinery Conference on Computer and Communications Security, Alexandria, VA, US, Oct. 29-Nov. 2, 2007, pp. 552-561.
Snow, K. et al., "ShellOS: Enabling Fast Detection and Forensic Analysis of Code Injection Attacks", In Proceedings of the 20th USENIX Security Symposium, San Francisco, CA, US, Aug. 8-12, 2011, pp. 1-16.
Solar Designer, "Getting Around Non-Executable Stack (and Fix)", last updated Aug. 10, 1997, pp. 1-7, available at: http://seclists.org/bugtraq/1997/Aug/63.
Sole, P., "Hanging on a ROPe", last updated Sep. 20, 2010, pp. 1-41, available at: http://www.immunitysec.com/downloads/DEPLIB20_ekoparty.pdf.
Supplementary European Search Report dated Apr. 16, 2015 in European Patent Application No. 12832510.7.
Toth, T. et al., "Accurate Buffer Overflow Detection via Abstract Payload Execution", In Proceedings of the 5th Symposium on Recent Advances in Intrusion Detection, Zurich, CH, Oct. 16-18, 2002, pp. 274-291.
Tzermias, Z. et al, "Combining Static and Dynamic Analysis for the Detection of Malicious Documents", In Proceedings of the Fourth European Workshop on System Security, Salzburg, AT, Apr. 2011, pp. 1-6.
Wang, X. et al., "SigFree: A Signature-free Buffer Overflow Attack Blocker", In Proceedings of the 15th USENIX Security Symposium, Vancouver, BC, CA, Jul. 31-Aug. 4, 2006, pp. 225-240.
Wicherski, G., "libscizzle", last updated Aug. 13, 2011, pp. 1, available at: http://code.mwcollect.org/projects/libscizzle.
Written Opinion dated Dec. 7, 2012 in International Patent Application No. PCT/US2012/055824.
Written Opinion dated Jul. 7, 2008 in International Patent Application No. PCT/US2006/015080.
Xu et al., Polymorphic Malicious Executable Scanner by API Sequence Analysis, Dec. 2004, Fourth International Conference on Hybrid Intelligent Systems, pp. 378-383 (Year: 2004). *
Younan, Y. et al., "A Methodology for Designing Countermeasures Against Current and Future Code Injection Attacks", In Proceedings of the 3rd IEEE International Workshop on Information Assurance, College Park, MD, US, Mar. 23-24, 2005, pp. 3-20.
Yuan, L. et al., "Security Breaches as PMU Deviation: Detecting and Identifying Security Attacks Using Performance Counters", In Proceedings of the Second Asia-Pacific Workshop on Systems, Jul. 11, 2011, New York, NY, US, pp. 1-5.
Zhang, Q. et al., "Analyzing Network Traffic to Detect Self-Decrypting Exploit Code", In Proceedings of the 2nd Assosciation for Computing Machinery Symposium on Information, Computer and Communications Security, Singapore, Mar. 20-22, 2007, pp. 4-12.
Zhou, P. et al., "AccMon: Automatically Detecting Memory-Related Bugs Via Program Counter-Based Invariants", In Proceedings of the 37th International Symposium on Mircoarchitecture, Portland, OR, US, Dec. 4-8, 2004, pp. 269-280.
Zovi, D., "Practical Return-Oriented Programming", last updated Mar. 17, 2010, pp. 1-41, available at: http://365.rsaconference.com/servlet/JiveServlet/previewBody/2573-102-3-3232/RR-304.pdf.
WO2007133178A3 (en) 2009-04-16
US20150264058A1 (en) 2015-09-17
US20100146615A1 (en) 2010-06-10
US20170070514A1 (en) 2017-03-09
WO2007133178A2 (en) 2007-11-22
US9338174B2 (en) 2016-05-10
US8763103B2 (en) 2014-06-24