Shieldgen: Automatic data patch generation for unknown vulnerabilities with informed probing

In this paper, we present ShieldGen, a system for au-tomatically generating a data patch or a vulnerability signature for an unknown vulnerability, given a zero-day attack instance. The key novelty in our work is that we leverage knowledge of the data format to generate new potential attack instances, which we call probes, and use a zero-day detector as an oracle to determine if an in-stance can still exploit the vulnerability; the feedback of the oracle guides our search for the vulnerability signa-ture. We have implemented a ShieldGen prototype and experimented with three known vulnerabilities. The gen-erated signatures have no false positives and a low rate of false negatives due to imperfect data format specifi-cations and the sampling technique used in our probe generation. Overall, they are significantly more precise than the signatures generated by existing schemes. We have also conducted a detailed study of 25 vulnerabil-ities for which Microsoft has issued security bulletins between 2003 and 2006. We estimate that ShieldGen can produce high quality signatures for a large portion of those vulnerabilities and that the signatures are su-perior to the signatures generated by existing schemes. 1