You are here
Automatic Generation of Robust Network Intrusion Detection Signatures
Title: Managing Engineer
Phone: (212) 780-0527
Email: stever@reservoir.com
Title: Business Manager
Phone: (212) 780-0527
Email: peters@reservoir.com
Contact: A. J Abels
Address:
Phone: (412) 268-4912
Type: Nonprofit College or University
In this Phase II STTR project, we propose to develop a system that autonomously and rapidly (1) detects exploitation of application software vulnerabilities (including previously unknown vulnerabilities) via dynamic taint analysis; (2) generates vulnerability signatures identifying nearly all traffic that exploits those same vulnerabilitieseven traffic with no superficial similarities to the observed exploit, and with no false positivesvia semantic analysis of program paths leading to each vulnerability; and (3) deploys these signatures to a network-based intrusion prevention system to prevent further exploits of the same vulnerability on other systems within the protected network. Our unique advantages over competitors stem from several factors. Our semantics-based approach enables broad coverage, even against polymorphic attacks, while fundamentally eliminating the possibility of false positives. Our advanced network intrusion prevention platform enables traffic to be checked against complex signature patterns at line rate up to 10 Gbps. Our system's end-to-end automation will provide effective defense even against rapidly spreading worms spreading via previously unknown (zero-day) exploits.
* Information listed above is at the time of submission. *