DIRA: Automatic detection, identification, and repair of control-hijacking attacks

Buffer overflow attacks are known to be the most com-mon type of attacks that allow attackers to hijack a re-mote system by sending a specially crafted packet to a vulnerable network application running on it. A compre-hensive defense strategy against such attacks should in-clude (1) an attack detection component that determines the fact that a program is compromised and prevents the attack from further propagation, (2) an attack identifica-tion component that identifies attack packets so that one can block such packets in the future, and (3) an attack repair component that restores the compromised applica-tion’s state to that before the attack and allows it to con-tinue running normally. Over the last decade, a significant amount of research has been vested in the systems that can detect buffer overflow attacks either statically at com-pile time or dynamically at run time. However, not much effort is spent on automated attack packet identification or attack repair. In this paper we present a unified solu-tion to the three problems mentioned above. We imple-mented this solution as a GCC compiler extension called DIRA that transforms a program’s source code so that the resulting program can automatically detect any buffer overflow attack against it, repair the memory damage left by the attack, and identify the actual attack packet(s). We used DIRA to compile several network applications with known vulnerabilities and tested DIRA’s effectiveness by attacking the transformed programs with publicly avail-able exploit code. The DIRA-compiled programs were always able to detect the attacks, identify the attack pack-ets and most often repair themselves to continue normal execution. The average run-time performance overhead for attack detection and attack repair/identification is 4% and 25 % respectively. 1