The border gateway protocol (BGP) is the default inter domain routing protocol used on the internet for exchanging information between autonomous systems. Available literature suggests that BGP is vulnerable to sessio...The border gateway protocol (BGP) is the default inter domain routing protocol used on the internet for exchanging information between autonomous systems. Available literature suggests that BGP is vulnerable to session hijacking attacks. There are a number of proposals aimed at improving BGP security which have not been fully implemented. This paper examines a number of approaches for securing BGP through a comparative study and identifies the reasons why these proposals have not been implemented commercially. This paper analyses the architecture of internet routing and the design of BGP while focusing on the problem of BGP session hijacking attacks. Using Graphical Network Simulator 3 (GNS-3), a session hijack is demonstrated and a solution which involves the implementation of route filtering, policy-maps and route-maps on CISCO routers representing ASes is carried out. In the end, a workable industry standard framework for securing and protecting BGP sessions and border routers from exploitation with little or no modification to the existing routing infrastructure is demonstrated.展开更多
Traffic hijacking is a common attack perpetrated on networked systems, where attackers eavesdrop on user transactions, manipulate packet data, and divert traffic to illegitimate locations. Similar attacks can also be ...Traffic hijacking is a common attack perpetrated on networked systems, where attackers eavesdrop on user transactions, manipulate packet data, and divert traffic to illegitimate locations. Similar attacks can also be unleashed in a NoC (Network on Chip) based system where the NoC comes from a third-party vendor and can be engrafted with hardware Trojans. Unlike the attackers on a traditional network, those Trojans are usually small and have limited capacity. This paper targets such a hardware Trojan;Specifically, the Trojan aims to divert traffic packets to unauthorized locations on the NoC. To detect this kind of traffic hijacking, we propose an authentication scheme in which the source and destination addresses are tagged. We develop a custom design for the packet tagging and authentication such that the implementation costs can be greatly reduced. Our experiments on a set of applications show that on average the detection circuitry incurs about 3.37% overhead in area, 2.61% in power, and 0.097% in performance when compared to the baseline design.展开更多
With the rapid development of operating systems,attacks on system vulnerabilities are increasing.Dynamic link library(DLL)hijacking is prevalent in installers on freeware platforms and is highly susceptible to exploit...With the rapid development of operating systems,attacks on system vulnerabilities are increasing.Dynamic link library(DLL)hijacking is prevalent in installers on freeware platforms and is highly susceptible to exploitation by malware attackers.However,existing studies are based solely on the load paths of DLLs,ignoring the attributes of installers and invocation modes,resulting in low accuracy and weak generality of vulnerability detection.In this paper,we propose a novel model,AB-DHD,which is based on an attention mechanism and a bi-directional gated recurrent unit(BiGRU)neural network for DLL hijacking vulnerability discovery.While BiGRU is an enhancement of GRU and has been widely applied in sequence data processing,a double-layer BiGRU network is introduced to analyze the internal features of installers with DLL hijacking vulnerabilities.Additionally,an attention mechanism is incorporated to dynamically adjust feature weights,significantly enhancing the ability of our model to detect vulnerabilities in new installers.A comprehensive“List of Easily Hijacked DLLs”is developed to serve a reference for future studies.We construct an EXEFul dataset and a DLLVul dataset,using data from two publicly available authoritative vulnerability databases,Common Vulnerabilities&Exposures(CVE)and China National Vulnerability Database(CNVD),and mainstream installer distribution platforms.Experimental results show that our model outperforms popular automated tools like Rattler and DLLHSC,achieving an accuracy of 97.79%and a recall of 94.72%.Moreover,17 previously unknown vulnerabilities have been identified,and corresponding vulnerability certifications have been assigned.展开更多
缓冲区溢出漏洞广泛存在于由不安全的高级语言所编写的程序中.利用缓冲区溢出漏洞,攻击者可以实现控制流劫持等危险攻击方式.基于Canary的栈保护技术是处理缓冲区溢出漏洞的一种简单有效且广泛部署的防御手段,然而位置固定和取值相同的...缓冲区溢出漏洞广泛存在于由不安全的高级语言所编写的程序中.利用缓冲区溢出漏洞,攻击者可以实现控制流劫持等危险攻击方式.基于Canary的栈保护技术是处理缓冲区溢出漏洞的一种简单有效且广泛部署的防御手段,然而位置固定和取值相同的特点使其容易被攻击者分析和破解.本文提出一种基于软件多样性的栈保护技术,它以拥有随机化大小和偏移的异构Canary为核心,不仅能直接抵御常规Canary无法处理的泄漏类和覆盖类攻击,而且能构造出各种更加安全的多样性软件系统.实验结果表明,异构Canary在有效提升安全性的同时仅为SPEC CPU 2017基准程序集额外引入了不高于2%的编译开销和平均3.22%的运行开销.展开更多
发现目前安全性得到广泛认可的BGP源自治系统验证机制(如S-BGP)会受到一种上层ISP(Internet Service Provider,Internet服务提供商)前缀劫持攻击.这些机制基于前缀的分配路径,仅能保证前缀被分配路径上的ISP授权自治系统发起,不能保证...发现目前安全性得到广泛认可的BGP源自治系统验证机制(如S-BGP)会受到一种上层ISP(Internet Service Provider,Internet服务提供商)前缀劫持攻击.这些机制基于前缀的分配路径,仅能保证前缀被分配路径上的ISP授权自治系统发起,不能保证被分配路径上最后一个ISP(即前缀的拥有ISP)授权自治系统发起.只有获得前缀拥有ISP授权的自治系统才是该前缀的合法源自治系统.本文提出了一种基于前缀分配路径长度的源自治系统验证机制---LAP(the Length of Assignment Path,分配路径长度).基本思想是任一发出前缀可达路由通告的自治系统都必须提供该前缀的分配路径及证明,只有提供前缀最长有效分配路径的自治系统才是该前缀的合法源自治系统.LAP可保护域间路由系统免受有效前缀劫持、子前缀劫持、未使用前缀劫持,特别是上层ISP前缀劫持攻击,可无缝应用于BGP安全方案和一些下一代域间路由协议中.展开更多
文摘The border gateway protocol (BGP) is the default inter domain routing protocol used on the internet for exchanging information between autonomous systems. Available literature suggests that BGP is vulnerable to session hijacking attacks. There are a number of proposals aimed at improving BGP security which have not been fully implemented. This paper examines a number of approaches for securing BGP through a comparative study and identifies the reasons why these proposals have not been implemented commercially. This paper analyses the architecture of internet routing and the design of BGP while focusing on the problem of BGP session hijacking attacks. Using Graphical Network Simulator 3 (GNS-3), a session hijack is demonstrated and a solution which involves the implementation of route filtering, policy-maps and route-maps on CISCO routers representing ASes is carried out. In the end, a workable industry standard framework for securing and protecting BGP sessions and border routers from exploitation with little or no modification to the existing routing infrastructure is demonstrated.
文摘Traffic hijacking is a common attack perpetrated on networked systems, where attackers eavesdrop on user transactions, manipulate packet data, and divert traffic to illegitimate locations. Similar attacks can also be unleashed in a NoC (Network on Chip) based system where the NoC comes from a third-party vendor and can be engrafted with hardware Trojans. Unlike the attackers on a traditional network, those Trojans are usually small and have limited capacity. This paper targets such a hardware Trojan;Specifically, the Trojan aims to divert traffic packets to unauthorized locations on the NoC. To detect this kind of traffic hijacking, we propose an authentication scheme in which the source and destination addresses are tagged. We develop a custom design for the packet tagging and authentication such that the implementation costs can be greatly reduced. Our experiments on a set of applications show that on average the detection circuitry incurs about 3.37% overhead in area, 2.61% in power, and 0.097% in performance when compared to the baseline design.
基金supported by the National Natural Science Foundation of China under Grant Nos.62072253,62172258,62302238,and 62372245the CCF-Tencent Rhino-Bird Open Research Fund,the Major Science and Technology Demonstration Project of Jiangsu Provincial Key Research and Development Program under Grant No.BE2022798the Postgraduate Research and Practice Innovation Program of Jiangsu Province of China under Grant No.KYCX20_0829.
文摘With the rapid development of operating systems,attacks on system vulnerabilities are increasing.Dynamic link library(DLL)hijacking is prevalent in installers on freeware platforms and is highly susceptible to exploitation by malware attackers.However,existing studies are based solely on the load paths of DLLs,ignoring the attributes of installers and invocation modes,resulting in low accuracy and weak generality of vulnerability detection.In this paper,we propose a novel model,AB-DHD,which is based on an attention mechanism and a bi-directional gated recurrent unit(BiGRU)neural network for DLL hijacking vulnerability discovery.While BiGRU is an enhancement of GRU and has been widely applied in sequence data processing,a double-layer BiGRU network is introduced to analyze the internal features of installers with DLL hijacking vulnerabilities.Additionally,an attention mechanism is incorporated to dynamically adjust feature weights,significantly enhancing the ability of our model to detect vulnerabilities in new installers.A comprehensive“List of Easily Hijacked DLLs”is developed to serve a reference for future studies.We construct an EXEFul dataset and a DLLVul dataset,using data from two publicly available authoritative vulnerability databases,Common Vulnerabilities&Exposures(CVE)and China National Vulnerability Database(CNVD),and mainstream installer distribution platforms.Experimental results show that our model outperforms popular automated tools like Rattler and DLLHSC,achieving an accuracy of 97.79%and a recall of 94.72%.Moreover,17 previously unknown vulnerabilities have been identified,and corresponding vulnerability certifications have been assigned.
文摘缓冲区溢出漏洞广泛存在于由不安全的高级语言所编写的程序中.利用缓冲区溢出漏洞,攻击者可以实现控制流劫持等危险攻击方式.基于Canary的栈保护技术是处理缓冲区溢出漏洞的一种简单有效且广泛部署的防御手段,然而位置固定和取值相同的特点使其容易被攻击者分析和破解.本文提出一种基于软件多样性的栈保护技术,它以拥有随机化大小和偏移的异构Canary为核心,不仅能直接抵御常规Canary无法处理的泄漏类和覆盖类攻击,而且能构造出各种更加安全的多样性软件系统.实验结果表明,异构Canary在有效提升安全性的同时仅为SPEC CPU 2017基准程序集额外引入了不高于2%的编译开销和平均3.22%的运行开销.
文摘发现目前安全性得到广泛认可的BGP源自治系统验证机制(如S-BGP)会受到一种上层ISP(Internet Service Provider,Internet服务提供商)前缀劫持攻击.这些机制基于前缀的分配路径,仅能保证前缀被分配路径上的ISP授权自治系统发起,不能保证被分配路径上最后一个ISP(即前缀的拥有ISP)授权自治系统发起.只有获得前缀拥有ISP授权的自治系统才是该前缀的合法源自治系统.本文提出了一种基于前缀分配路径长度的源自治系统验证机制---LAP(the Length of Assignment Path,分配路径长度).基本思想是任一发出前缀可达路由通告的自治系统都必须提供该前缀的分配路径及证明,只有提供前缀最长有效分配路径的自治系统才是该前缀的合法源自治系统.LAP可保护域间路由系统免受有效前缀劫持、子前缀劫持、未使用前缀劫持,特别是上层ISP前缀劫持攻击,可无缝应用于BGP安全方案和一些下一代域间路由协议中.
