start	end	text
20700	34870	Quick announcement, I'm gonna use laser pointer and I'm gonna use this screen.
35250	43050	So those people sitting here, please move either to the center of the room or to the right side.
65620	67440	You prefer to stay there?
75370	79950	Well I think it depends on how close I am to the mic rather than...
96690	98430	Okay, so let's start.
98530	100130	Thank you for coming for my talk.
100130	106110	It's the first talk in the morning, so it might be pretty difficult for you to get up early and
106110	108830	come here, so thank you for showing up.
110310	115610	The title of my talk is JIRA, which is a tool for automatic detection, identification and
115610	118750	repair of control hijacking attacks.
118990	123490	I am Alexey Smirnov and this is a joint work with Tricker Chair, who is my advisor.
123550	125630	We are from Stony Brook University.
127510	129390	Here is the outline of my talk.
129390	134250	First I'm gonna give a brief introduction on control hijacking attacks.
134450	140170	Then I'm gonna talk about the related work in the areas of attack detection, identification and repair.
140230	145970	Then I'll present our architecture, JIRA, which has these three components.
145970	151250	The attack detection component, the attack identification and attack repair component.
151250	156230	The purpose of attack detection component is to detect a buffer overflow or control hijacking attack.
156230	163150	So it's similar to the goal of the tools like StackGuard and Propolis.
163470	169390	The attack identification component builds up the signature that can be supplied to intrusion detection system
169390	172370	so that these attack packets can be filtered out in the future.
172590	180050	The attack repair component repairs the program and allows it to continue its execution as if the attack never happened.
180050	188050	In the performance evaluation part we're gonna talk about the overheads, the runtime overhead and the compile time overheads of our compiler.
188230	192630	And we'll conclude with a summary of research contributions and with the direction of future work.
194290	198150	Buffer overflow attacks are the most common type of attacks.
198870	204370	Computer warms use buffer overflow attacks as a basic building block for the propagation.
204690	209170	So as soon as they arrive to a new host, they perform a buffer overflow attack,
209170	212390	hijack control of the underlying program or of the host,
212810	218310	and then scan for more vulnerable machines by performing random IP scanning.
218550	226790	Once they find a new vulnerable machine, they send their body to the new machine and perform the control hijacking attack on that new host.
227410	231670	A comprehensive protection strategy should include the following three components.
231670	238870	The attack detection component, which will detect the control hijacking attack when it happens.
238870	242810	That is, when the worm tries to get control of the underlying computer.
242890	248150	The attack identification component is responsible for building the signature of the attack.
248150	254010	That is, for identifying malicious packets and representing them in the most general form
254010	260670	so that polymorphic worms or polymorphic attacks can be detected by the same signature.
260990	268510	The attack repair component allows the compromised program to continue its execution as if the attack never happened.
268510	277490	That is, it should restore the memory image or the environment of the program as it was in the pre-attack time
278230	283130	so that the program will think that it has never received any attack packets.
283330	290370	We propose a compiler, Jira is a compiler, that instruments programs, source code of a program
290370	298130	so that the instrumented program can identify, detect, and repair itself after a control hijacking attack.
298870	301010	What is a buffer overflow attack?
301170	309590	Well, the idea behind control hijacking attacks is to operate a control sensitive data structure
309590	314730	such as a return address, function pointer, or any other control sensitive data structure.
314730	317930	By the way, I've got some t-shirts here and books and I'm going to give them away
317930	323750	and I'm going to ask you questions and who answers first gets a t-shirt or a book.
323750	325510	So here's the first question.
326150	331330	The return address and the function pointer are two possible types of control sensitive data structure.
331330	336530	What are other data structures that a worm or a virus can override?
339560	341440	That's what I said, function pointer.
343320	344600	What else?
345220	346020	Okay.
347340	348480	What about HIP?
349860	351200	What do you mean by HIP?
353500	355040	Well, okay, I got a t-shirt.
361260	362240	What else?
365600	367460	That's what he said probably, HIP.
367580	369100	Okay, that was what I...
379100	384260	So the name of the control sensitive data structure is...
384940	386080	just word.
388000	389860	Okay, any other ideas?
390360	391200	Okay.
395160	398840	Well, for example, GOT, which is global offsets table.
400380	407640	Anyway, buffer overflows are possible when the length of the destination buffer is shorter than the length of the data that's been written into it.
407680	415100	So whenever you write something that is longer, it can override something that is behind this buffer, such as a return address.
415100	417520	And that's when the buffer overflow happens.
417520	424760	Standard libc functions, such as stringcpy or sprintf, are responsible for most buffer overflow attacks.
425820	430240	So we're going to review related work in the areas of attack detection, identification, and repair.
430240	433800	StackGuard is the first tool for buffer overflow attack detection.
433800	441000	It works by placing a canRevert in the stack frame in the function prologue, and it checks this canRevert at function epilogue.
441000	446500	If the values are different, then the attack has happened, and the application is terminated.
446500	451960	RADint is another tool that protects programs from buffer overflow attacks.
451960	457420	It works by saving the original return address in a special well-protected buffer at function prologue,
457420	462260	and compares it with the values stored in the stack at function epilogue.
462260	472700	If the values stored in the protected buffer end in the function frame when the function returns are different, then an attack is dejected.
472700	478040	Can anyone think of any other tools for attack detection?
479800	482340	Nah, Snore is content filter engine.
485000	486720	Okay, I got it.
487380	489800	You got a T-shirt? Who was that?
498280	501300	So, let's move to attack identification.
503120	510620	We need automatic ways for attack identification, because it's very important to generate signatures fast.
510620	514780	Computer warms infect vulnerable machines very fast.
514780	518620	It's a rate of thousands per minute, or maybe tens of thousands per minute.
518660	524120	Therefore, if we wait for a human expert to come up with a signature, which is going to take a few hours,
524120	528500	then the warm is going to hijack the most vulnerable host on the Internet.
528680	539620	Recent epidemics propagate at a very, very high speed, so it's very difficult for a human expert to come up with a signature quickly.
539620	548500	Previous systems for automatic signature generation either produced signatures that consisted of only one packet,
548500	553360	or required a large pool of malicious network data to come up with a comprehensive signature.
553360	557200	Signature that consists of one packet is sometimes insufficient,
557200	563080	because a complex attack can involve multiple packets, such as, let's say, FTP server attack,
563080	569160	it involves sending out authentication packets, and only then sending out the final attack packet.
569160	574140	A comprehensive signature should include all attack packets, not just the last one.
574140	576400	So here are some relevant projects.
576460	580020	TaintCheck is a tool for...
580020	586420	It uses the taint analysis to generate attack signature,
586420	593860	and it reports the value of the return address, the form used to hijack control as a signature.
593860	595940	So it's only a four-byte signature.
595940	608000	Autograph uses so-called Rabin fingerprints to find common subsequences in a large pool of malicious network data.
608000	611320	Polygraph and naming also use a large pool of malicious data,
611320	615120	and to use machine learning algorithms to construct a multi-packet signature.
618700	622600	AttackRepair relies on checkpointing.
622600	625540	That is, one first checkpoints the program state,
625540	631280	and then jumps to a previous point in the past to restore program's execution.
632460	636440	So two approaches here are either keeping complete execution history,
636440	638860	or do periodic stack checkpointing.
638860	645020	That is, to take a snapshot of the memory image of the program.
645140	647300	And the second approach relies on a fork system call,
647300	651440	which is available under Linux, but might not be available under other operating systems.
651440	655600	And Shadow Honeypot project runs two versions of the application,
655600	658500	instrumented, that is protected and non-protected,
658500	662240	and switches between them dynamically when it detects an attack.
662240	664580	Now we move on to DIRA architecture.
664580	667660	DIRA is a compiler that provides all these three components.
667960	671840	AttackDetectionComponent, AttackIdentification, and AttackRepairComponent.
674930	682090	As I said, DIRA is an extension to GCC, version 3.4.1 currently,
682090	684310	but it can be used with other versions as well.
684310	688310	The idea behind DIRA is memory updates logging,
688310	692730	and this approach solves all these three problems at the same time.
692770	698730	So the idea is to maintain a run-time log of all changes that the program performs.
700110	704030	Assignments such as A equals B, or ellipsis functions call,
704030	706730	such as memcpy, change memory state of the program,
706730	709130	and therefore their effects should be saved.
709130	711150	For example...
711150	713570	Okay, we will see some examples later.
713570	716590	For each memory update, DIRA stores its source address,
716590	720010	its destination address, its length, and the preimage.
720290	725790	So in the case of the assignment A equals B...
725790	727150	Where's my pointer?
729270	730030	Here.
730550	734970	The source is the address of variable B,
734970	738150	because that's where the new data comes from.
738150	740870	The right address is the address of A,
740870	743410	because that's the address that has been written into.
743410	747290	The length of the data is the size of type of variable B.
747290	749270	So if it's integer, it's 4-byte.
749270	752530	The preimage is the old value of A,
752530	755050	and it's used to restore memory image to the program.
755410	763250	So the DIRA compiler instruments the source code of the program in compile-time.
763250	768490	It adds the log-in code for variable assignments and for standard library functions.
768530	772170	At run-time, this log-in code, this memory update log, is generated,
772170	778950	and it's used at repair time to detect, to identify, and to repair the attack.
779450	783510	So how can we detect, identify, and repair an attack if we have this memory update log?
783510	787350	To detect an attack, we need to compare the current value of the return pointer,
787350	792210	or the return address, saved in the stack frame with the value saved in the memory update log.
792210	795810	When we invoke a function, we lay out a new stack frame,
795810	801350	we save the old return address, we save any registers that are used in this function,
801910	806330	and therefore, this is a changed memory state of the program,
806330	809770	which should be saved in the memory update log according to our concept.
810050	815530	Therefore, the old value of the return address will be saved in the memory update log when the function is invoked.
815530	820590	When the function is returning, this saved value should be compared with the value
820590	824750	that is currently on the stack. If these two values are different, then there is an attack.
824890	827970	To identify an attack using the memory update log,
827970	833830	we can trace back the data that overrode the control-sensitive data structure
833830	836910	to the point where it was first received in the program.
837770	840330	For example, through a receive call.
841390	845390	To repair an attack, we need to restore the memory image of the program
845390	849270	by using the pre-images that are also saved in the memory update log.
849270	854950	This idea of keeping the memory update log of program memory state changes
854950	857810	is the essential idea behind our tool.
857890	861910	It allows us to solve all these three problems of attack detection, identification, and repair
861910	864010	in the same uniform way.
865450	867850	Memory update log is a circle buffer.
867910	870470	Each record of this buffer has four fields.
870470	872670	Read address, write address, length, and data.
873150	876670	Dero saves the effect of each assignment operation,
878130	879870	such as x equals y,
879870	883110	where x and y are either directly referenced variables,
883110	886210	array references, or dereferenced variables.
886430	889390	As I said previously, the read address is set to the address of the right-hand side,
889390	892810	the write address is set to the address of the left-hand side,
892810	898010	the length is set to the size of the memory update,
898010	899330	and the data is set to the pre-image
900210	902690	that stores the data that they're going to overwrite,
902690	904690	that is, the old value of x.
905770	908270	If the right-hand side is a complex expression,
908270	913170	then a log record is created for each variable in the right-hand side.
913170	917530	To handle memory change performed by standard library functions,
917530	919390	Dero proxies a few of them,
919390	922970	such as string manipulation functions, format string functions, file network IO functions,
922970	926210	and other functions that change memory state of the program.
927490	934270	So the proxy function constructs a new memory update log record
935650	940450	that summarizes the changes performed by the corresponding ellipsis function.
940830	943330	And the memory update log is also used to store tags,
943330	947310	which are special records that indicate change to memory to the state of the program.
947310	950550	For example, when the function is invoked, function enter tag is inserted,
950550	953090	and when the function returns, function exit tag is inserted.
953090	955670	These tags are used at repair and identification time
955670	959970	to build up signature and to repair program after an attack.
961870	963730	So here are a few examples.
963730	969830	At compile time, let's say there is a statement x equals y plus z.
970690	975230	So the compiler adds two logging codes.
975310	980030	The first code logs the effect of variable y,
980810	983130	sorry, of variable z.
983170	985870	The other of the variable y.
986150	988390	And finally, there is this original statement.
988510	992770	At run time, these two logging codes produce these two log records
993570	997470	with the read and write addresses set as I described previously.
998250	1002590	Suppose there is the string CPY code in the source code of the program.
1003210	1006950	The debug compiler replaces this code with a proxy function.
1007530	1010770	And at run time, this proxy function inserts a log record
1010770	1016190	with the read address of b, because that's where the data is coming from,
1016190	1019710	with the write address of a, because that's where the write data enter.
1019750	1022830	With the length, strlen of b plus one,
1022830	1029250	because they're going to write strlen of b bytes plus non-terminating character.
1029430	1036030	And with the preimage is a, which is the old value of a,
1036750	1039010	Now let's talk about attack detection.
1039270	1040810	Jira uses a RAD-like approach.
1040810	1044410	That is, it saves the original return address when the function is invoked
1044410	1048310	and compares the saved value with the value that is currently on stack
1048310	1049810	at function epilogue.
1049810	1052830	If these two values are different, then an attack is detected.
1053490	1055790	Jira can protect other control-sensitive data structures,
1055790	1059210	such as function pointers, GOT, signal-handling variables, and a similar function,
1059210	1060770	but it's not implemented yet.
1066380	1068600	Now let's talk about attack identification.
1068600	1072060	So here are the desired properties of an ideal signature.
1072200	1073700	A signature should be context-aware,
1073700	1076500	which means that it should include all the attack packets
1076500	1078460	that participate in a given attack.
1078880	1081360	And this allows to reduce the rate of false positives.
1081600	1082980	It should be also semantics-aware,
1082980	1086160	that it ideally should incorporate the knowledge about the protocol.
1086160	1089060	For example, if this is an HTTP attack,
1089060	1091920	and the attack request is a GET request,
1091920	1094160	then the signature should specify that this is GET,
1094160	1096400	so that the intrusion detection system can filter out,
1096400	1100520	keep all the requests of other types, of other protocols,
1100520	1103840	and even if it's HTTP, but not GET,
1103840	1105740	it should also discard those packets.
1105740	1108300	It should check the signature only against packets
1108300	1111940	that are HTTP GET kind of packets.
1112780	1115340	And this also allows to reduce the rate of false positives.
1115640	1117620	And the signature should provide a certain degree of flexibility
1117620	1119360	within each packet,
1119360	1122600	so that polymorphic warnings that change their body as they propagate
1122600	1125540	can be matched using the same signature.
1126820	1130720	The attack packets should be represented as regular expressions,
1130720	1135380	and that's the desired flexibility that a signature should have.
1136760	1141280	So, as I said, these three properties are the desired properties,
1141280	1145480	and now let's see how JIRA satisfies all those properties.
1145480	1148080	JIRA signatures are kind of severe,
1148080	1149780	because they consist of multiple packets.
1150100	1155420	They consist of all packets that an attack consists of.
1155420	1159060	And each of those packets is represented as a regular expression.
1159780	1161900	And there's a feature called length constraint
1162420	1166380	that allows to limit the attack in part of the packet.
1166640	1170100	That is, it allows to specify that a terminating character,
1170100	1171320	such as null character,
1171320	1176720	should occur between offset A and offset B.
1176820	1179720	If the terminating sequence occurs within this offset,
1179720	1181320	this is not an attack packet.
1181320	1185880	If there is no such a terminating character in the packet,
1185880	1187460	then this is an attack packet.
1188140	1192220	So, in some sense, this is equivalent to semantics awareness,
1192220	1195900	because it allows to narrow down the part of the packet
1197420	1200080	that the intrusion detection system searches.
1200080	1203960	So it doesn't search the specified sequence in the whole packet,
1203960	1207320	but rather this length constraint allows to limit the...
1207320	1210380	or narrow down the scope where we search for the...
1212720	1214420	required terminating constraint.
1214420	1215880	For example, if this is a...
1215880	1218660	same example, if this is a GET attack,
1218660	1221080	and there's an overly long URL,
1221080	1223180	which is terminated by a null character,
1223180	1225260	here it allows to specify that this null character
1225260	1228820	should occur between the fourth and, let's say,
1228820	1231160	twentieth-bit byte of the packet.
1231180	1234400	Because the first three characters are GET characters,
1234400	1237620	and then the remaining part of the packet is the URL.
1237720	1239120	If the terminating character is found
1239120	1242640	in the first twenty-four bytes of the packet,
1242640	1244720	then this is not an attacking packet.
1244780	1247020	If the null terminating character is not found
1247020	1248780	in the first twenty-four bytes,
1248780	1251700	then this is an attack packet, because the URL is too long.
1252740	1256260	Memory update slog allows us to construct signatures
1256260	1258160	that consist of multiple packets,
1258160	1260660	to represent each packet as a regular expression,
1260660	1262440	and to generate a length constraint.
1262440	1264440	And we're going to give an example,
1265160	1270260	and we will show how all this functionality is implemented.
1271920	1275340	Two types of dependencies exist in the program,
1275340	1276920	data and control dependency.
1280740	1283940	Data dependency is created when one variable is assigned to another,
1283940	1286040	for example, A equals B, same example.
1286040	1288960	In this case, A depends on B.
1289180	1291700	A control dependency is created whenever variable X
1291700	1297700	and variable Y is used...
1299600	1303000	I'm sorry, variable X is used in conditional expressions,
1303000	1306160	such as if, and Y is in this conditional body.
1306220	1307400	So here's an example.
1307980	1310740	In this case, even though there is no direct assignment
1310740	1314260	between X and Y, Y depends on X,
1314260	1318800	because the value that Y will take depends on the value of X.
1318920	1321340	This type of dependency is called control dependency.
1321340	1323960	No direct assignment, but dependency is there,
1323960	1327380	because value of Y depends on value of X.
1328700	1330320	Why do we need control dependencies?
1330740	1331780	So here's an example.
1331780	1334240	FTP server attack involvement authentication.
1335000	1337700	Here's an example of vulnerable FTP server.
1338180	1340120	Here's the vulnerable buffer.
1340300	1342180	The program has two state variables,
1342180	1343900	isAuthentication, isUser.
1345540	1348640	And here is the main loop of this server.
1348640	1351140	First, it receives a packet.
1351140	1354360	Then it compares the four bytes of the packet.
1354400	1356300	If it's QuickCommand, the loop breaks.
1356400	1360100	If it's UserCommand, then isUser variable is set to 1.
1360100	1364160	If it's PasswordCommand, then isUser and isUser has been set.
1364160	1367100	Then authentication has been completed,
1367100	1370220	and isAuthenticated variable is set to 1.
1370480	1373440	If authentication was not performed previously,
1373440	1374740	then the program continues.
1375180	1377900	The client requests are handled only in the case
1377900	1381660	if the authentication has been completed previously.
1381740	1384160	So if the user is authenticated,
1384160	1390060	then the program checks the first three bytes of the packet.
1390060	1392460	If it's a GET packet, then there's a GET request,
1392460	1395320	and it returns the file that the user requested.
1395540	1396940	But this request is only processed
1396940	1399040	if the user has previously authenticated.
1401120	1403960	So these are the three packets used in the attack.
1406820	1411140	There is a file name that is too long
1411140	1413920	and that overrides the buffer,
1415480	1417640	that overrides this buffer,
1417640	1420120	which is only 16 characters bytes long.
1421020	1423720	Let's look at lock records generated at run time.
1424020	1426200	First, there is a lock record here at receive
1426200	1429660	for the receive function.
1429820	1433880	For the proxy function, proxy is standard receive call,
1433880	1435800	and it has this tag.
1435800	1437100	Here's the tag.
1437100	1438380	This is the write address.
1438660	1441240	That's the destination,
1441240	1445280	where the network data is written into 11 different things.
1445280	1448680	And here's also the image of the data
1448680	1450140	that varies from network.
1450340	1454800	Then there is a proxy function for SDR and CMP,
1455720	1458760	which also has the write address...
1458760	1462740	I'm sorry, it's read address of the variable.
1462740	1464560	4 is the length of the argument.
1464560	1467400	This record specifies...
1467400	1470840	indicates that we search buffer P
1470840	1474560	and we look at first four bytes of this buffer.
1474720	1477280	Then this record is created for conditional expression
1477280	1480940	and it means that variable P participates in the if expression.
1480940	1482640	So for every variable in the if expression,
1482640	1485560	we save this variable into memory and this log.
1486060	1487840	And this is also...
1487840	1491680	this is the record for the statement
1491680	1493920	that updates each user variable.
1493920	1496340	So in this case, the read address is set now
1496340	1497720	because we don't know where the data
1497720	1501320	that is written into isUser comes from.
1501320	1503340	And it's just a constant.
1503720	1505240	So the write address is isUser.
1505240	1507980	The length is 4 and isUser is preimage.
1507980	1510260	Similarly, for the second packet,
1510260	1512380	we have the receive record here.
1512380	1513940	We have the string comparison record
1513940	1518880	that checks the first four bytes of the packet.
1518880	1520540	We have two conditional variables now
1520540	1522860	because two variables are checked,
1522860	1524520	P and isUser.
1524560	1526300	And finally, this is the record
1527060	1531380	that updates the isAuthentication variable.
1532660	1535520	So finally, let's look at the third packet.
1535760	1537320	So we also have a record
1540040	1542040	when the packet is received.
1542060	1544900	Then we also have the conditional record
1544900	1546600	for variable isAuthenticated.
1546600	1549180	Then there is the record for string comparison
1549180	1552820	that checks the first three bytes of the packet.
1552820	1556860	Then there is the conditional record for P.
1556860	1558540	And finally, this is the record
1558540	1562240	that was created by string.cpyProxy function.
1562420	1566180	And it describes the fact that the data from buffer
1566960	1568660	here, I'm sorry,
1568660	1570580	the data from buffer P plus 4
1570580	1572420	was written into buffer.
1573180	1575660	And the length of the update is
1575660	1578500	the length of P minus 4 plus 1
1578500	1580620	because all bytes of P
1580620	1581840	except the first four bytes
1581840	1583920	were copied into buffer buff.
1584280	1587040	And we also save the preimage of P.
1592060	1594000	So this is the summary.
1594000	1595520	These are all log records
1595520	1596460	that are generated at runtime
1596460	1599200	when this server attack is executed.
1599740	1602500	And suppose that the return address
1602500	1606380	is located after the buff variable.
1606380	1608260	That is, the return address is saved
1608260	1610880	at the offset buff plus 17.
1610920	1613400	Buffer is a buffer of 16 bytes.
1613660	1614840	So the return address is saved
1614840	1616320	at the offset 17.
1617180	1618800	Now let's see how we can detect
1618800	1620400	the control hijacking attack
1620400	1622400	using this memory on this log.
1627160	1628900	So we start with log record,
1628900	1629820	with the last log record
1629820	1632520	that overrode this buffer.
1634100	1636360	And here is its write address.
1636360	1639460	So we look for the source of this data.
1639720	1640880	That is, we try to find out
1640880	1642480	where the data came from.
1642840	1644460	And this log record allows us to conclude
1644460	1646660	that this data came from P.
1647660	1648760	Return address was saved
1648760	1650540	at the offset buff plus 17.
1650540	1652280	Therefore, the data was read
1652280	1655740	from the offset P plus 4 plus 17,
1655740	1657240	which is P plus 21.
1657340	1658820	That is, the return address value
1658820	1662960	came from memory address P plus 4 plus 17,
1662960	1664320	which is P plus 21.
1664340	1665680	So this is the new address
1665680	1666600	that we look for.
1666600	1668100	Now we search memory on this log
1668100	1670580	for the address P plus 21.
1670900	1673440	And if we traverse this log record,
1673440	1675420	this memory on this log upward,
1675420	1676340	we can find that there is
1676340	1677800	this receive record
1678500	1681880	that read data from network
1681880	1683040	into buffer P
1683040	1685120	and the length was 62.
1685120	1688000	And we look for memory...
1689320	1690380	memory location
1690380	1692260	with the address P plus 21.
1692600	1695140	And this is the record
1695140	1699340	that has written data from network
1699340	1701060	into that memory location.
1701140	1702280	So we conclude that
1702280	1706020	here is the read operation
1706020	1707600	that read data from network
1707600	1710520	and wrote it into address P plus 21.
1711040	1713400	And because this is the operation
1713400	1714860	that reads data from network,
1714860	1715720	we conclude that
1715720	1718800	this is the attack in packet.
1719040	1720340	So this way we identify
1720720	1722460	the first attack in packet.
1722720	1725080	Is it the only packet in the attack
1725080	1725320	in packet?
1725700	1726600	Probably not,
1726600	1728720	because the user is only processed
1728720	1731400	if the user has authenticated.
1731400	1732640	So we need to continue our search
1732640	1734780	and try to find more attack in packets.
1736080	1736820	Sure.
1763870	1765350	Well, debugging is not automatic.
1765350	1766570	Our tool is completely automatic.
1766570	1768690	It doesn't require any user involvement at all.
1768830	1770250	So the process that I described here
1770250	1772430	is completely automatic.
1772430	1773670	It's performed by our program,
1773670	1774590	not by a user.
1774590	1775690	Not manually.
1775830	1776790	It's not log analysis
1776790	1778190	performed by a human expert.
1778190	1778870	It's log analysis
1778870	1780230	performed automatically.
1791700	1792580	Well,
1794400	1795800	you are right.
1806410	1808230	Well, that's the question
1808230	1809370	of our performance evaluation.
1809370	1811410	We will get to this question later.
1811890	1813730	And if I don't give a clear answer,
1813730	1815450	I'd like to talk to you offline.
1817010	1818490	So as I said previously,
1818490	1819470	we were able to identify
1819470	1820850	the first attack in packet.
1820850	1822830	And now we look for more attack in packets.
1822830	1823830	And here's where we use
1823830	1825390	conditional dependencies.
1825390	1828850	Let's look at the first memory update statement.
1828850	1830710	If we go upward,
1830710	1831950	we can see that this statement
1831950	1834150	depends on two conditions.
1834150	1834670	That is,
1834670	1838170	it's inside two outer if statements.
1838170	1839750	The first if statement checks
1839750	1841710	p variable,
1841710	1842870	and the second checks
1842870	1844850	is authenticate variable.
1845290	1846250	Therefore,
1846250	1847010	this memory update
1847010	1847950	was only possible
1847950	1849970	because of these two checks
1849970	1851750	that involve these two variables.
1852130	1853710	Variable p is,
1854310	1854970	has been found
1854970	1855670	before.
1855910	1856610	So,
1856610	1858570	this record should be discarded.
1858870	1859710	Whereas,
1859710	1860770	this variable
1860770	1861650	is authenticated
1861650	1862150	should be used
1862150	1863470	for later search.
1864730	1865710	So we continue
1865710	1867270	with variable is authenticated.
1867270	1868130	And we try to find out
1868130	1868930	whether this variable
1868930	1870130	depends on network packet
1870130	1871350	or not.
1871530	1871910	So,
1871910	1872830	if we continue traversing
1872830	1873970	the block upward,
1873970	1875130	we can see this memory update
1875130	1876690	block operation.
1876950	1877850	And the read address
1877850	1878610	of this operation
1878610	1879230	is unknown
1879230	1880650	because this variable
1880650	1882130	was assigned to a constant.
1882230	1882770	Therefore,
1882770	1883450	we should again use
1883450	1884550	condition dependencies
1884550	1884990	to
1884990	1886450	find out
1887090	1888010	what our
1888010	1888950	variable
1888950	1889650	is authenticated
1889650	1889950	depends
1889950	1891570	on.
1891830	1892590	And we can see
1892590	1893310	two conditional
1893310	1894370	lock records
1894370	1895410	isUser and p
1895410	1896350	here.
1897070	1897930	Which means
1897930	1898650	that variable
1898650	1899450	is authenticated
1900370	1900710	depends
1900710	1901130	conditionally
1901130	1902810	on isUser and p.
1903610	1904310	So,
1904310	1904930	we now look for
1904930	1906330	p and isUser.
1906330	1906890	We can find
1906890	1908070	p here.
1909030	1909410	Therefore,
1909410	1909830	we conclude
1909830	1910410	that variable
1910410	1911550	isUser depends
1911550	1912470	on network packet
1912470	1913810	that contains
1913810	1914830	password.
1914830	1915990	And this turns out
1915990	1916410	to be true
1916410	1916850	because
1918650	1919250	variable
1919250	1919650	p
1920390	1921230	is set
1921230	1921550	only
1921550	1922730	if the
1922730	1923350	attacker sends
1923350	1924570	password packet.
1925110	1925630	That variable
1925630	1926270	isUser also
1926270	1926730	depends
1927690	1928390	sorry,
1928390	1928590	variable
1928590	1929190	isAuthenticated
1929190	1929790	also depends
1929790	1930510	on isUser.
1930510	1931090	So, we continue
1931090	1931390	with this
1931390	1931630	variable
1931630	1932070	isUser
1932070	1933050	and we can
1933050	1933330	find it
1933330	1934170	here.
1934690	1935070	This is the
1935070	1935670	memory update
1935670	1936570	long operation
1936570	1937110	that sets
1937110	1937450	variable
1937450	1938210	isUser.
1938210	1938830	Its readers
1938830	1939410	is also
1939410	1939710	unknown
1939710	1940510	because it's
1940510	1940790	set to
1940790	1941630	constant.
1941630	1942010	Therefore,
1942010	1942170	we should
1942170	1942630	use
1942630	1943110	control
1943110	1944050	dependencies
1944050	1945310	to find
1945310	1945530	out
1945530	1945770	whether
1945770	1946130	variable
1946130	1946550	isUser
1946550	1946970	depends
1946970	1947830	on any
1947830	1948130	network
1948130	1949170	packets.
1950370	1951650	And once
1951650	1951930	again,
1951930	1952070	we can
1952070	1952550	see this
1952550	1953050	conditional
1953050	1953850	string expression
1953850	1954410	that uses
1954410	1954730	variable
1954730	1955590	P.
1955830	1956390	Therefore,
1956390	1956750	we now
1956750	1957730	search for
1957730	1958010	variable
1958010	1958750	P and
1958750	1958970	try to
1958970	1959350	find out
1959350	1959570	whether
1959570	1959950	it depends
1959950	1960250	on any
1960250	1960530	network
1960530	1961390	data.
1961690	1962550	And it
1962550	1962870	turns out
1962870	1963050	to be
1963050	1963650	true.
1963650	1963910	Variable
1963910	1964230	P
1964230	1964790	contains
1964790	1965230	the
1965230	1965670	packet
1965670	1966090	payload
1966090	1966750	of the
1966750	1966910	user
1966910	1967790	command.
1967790	1968630	So what we can
1968630	1969110	see now,
1969110	1969350	we have
1969350	1969630	found
1969630	1970090	three
1970090	1970470	attack
1970470	1971390	packets.
1972570	1973590	And so
1973590	1974010	the get
1974010	1974790	packet,
1974790	1975150	the pass
1975150	1975450	packet,
1975450	1975650	the user
1975650	1976450	packet.
1976990	1977610	The first
1977610	1978010	packet was
1978010	1978670	found using
1978670	1979070	direct
1979070	1979730	dependencies.
1979730	1980130	The remaining
1980130	1980590	two packets
1980590	1981350	were found
1981350	1981750	using
1981750	1982130	control
1982130	1983090	dependencies.
1983610	1984090	So the
1984090	1984350	control
1984350	1984650	dependencies
1984650	1985430	are really
1985430	1986430	important to
1986430	1987470	link the
1987470	1987970	first attack
1987970	1988930	packet to
1988930	1989670	all the
1989670	1989990	remaining
1989990	1990330	attack
1990330	1991370	packets.
1992110	1993070	Because of
1993070	1993570	this state
1993570	1993970	variables
1993970	1994210	that are
1994210	1994930	used in
1994930	1995210	network
1995210	1996250	daemons.
2007160	2007880	Well, this is
2007880	2008200	just our
2008200	2009220	assumption.
2009460	2010140	Well, the
2010140	2010800	real value
2010800	2011420	of the
2011420	2011820	return
2011820	2013160	errors is
2013160	2013860	returned by
2013860	2014160	the attack
2014160	2014460	detection
2014460	2015540	component.
2019300	2020120	Well, this
2020120	2020380	attack
2020380	2020860	detection
2021440	2021960	component
2021960	2022560	tells you
2022560	2023120	which
2023120	2023480	data
2023480	2023760	structure
2023760	2023940	was
2023940	2024820	damaged.
2025060	2025860	So it
2025860	2026220	tells you
2026220	2026980	the return
2026980	2028060	address of
2028060	2028280	the
2028280	2028640	compromised
2028640	2028900	data
2028900	2029640	structure,
2029640	2029880	which in
2029880	2030000	our
2030000	2030600	case is
2030600	2030740	the
2030740	2030960	return
2030960	2031740	address.
2031900	2032400	So this
2032400	2032700	assumption
2032700	2033500	I just
2033500	2033780	made it
2033780	2034480	up.
2034840	2035220	But this
2035220	2035580	address is
2035580	2035740	always
2035740	2036600	known at
2036600	2037300	runtime.
2040580	2041260	Let's now
2041260	2041880	give a
2041880	2042280	precise
2042280	2042440	definition
2042440	2042620	of
2042620	2042880	control
2042880	2045360	dependencies.
2045360	2046220	We say
2046220	2047080	that
2047240	2047440	whenever a
2047440	2047720	variable
2047720	2048100	x can
2048100	2048380	prevent
2048380	2048600	control
2048600	2048840	flow
2048840	2049020	from
2049020	2049300	reaching
2049300	2049680	variable
2049680	2050080	y, a
2050080	2050320	control
2050320	2050500	dependency
2050500	2051060	is created
2051060	2051300	between
2051300	2051640	x and
2051640	2067520	y.
2065620	2066620	Let's
2067520	2067920	look at
2067920	2068040	the
2068040	2068400	value of
2068400	2068640	variable
2068640	2068960	cond
2068960	2069620	is.
2069620	2070220	However,
2070220	2070500	if you
2070500	2070720	look at
2070720	2070820	the
2070820	2071060	right-hand
2071060	2072900	side,
2072900	2073780	then one
2073780	2073980	of these
2073980	2074300	branches
2074300	2074960	here,
2074960	2075180	this
2075180	2076780	branch,
2076780	2077420	has a
2077420	2079060	return.
2079060	2079400	And
2079400	2079780	therefore,
2079780	2080220	if
2080220	2081240	condition
2081240	2081900	is
2081900	2082100	takes
2091820	2092340	such
2095520	2096520	a
2093620	2094300	value
2094300	2094640	from
2095280	2095440	x
2097960	2098640	to
2098640	2099580	then
2099580	2099780	value
2104040	2104720	is
2104720	2104820	returned
2104820	2104980	y.
2110180	2110860	And
2116980	2117660	therefore,
2117660	2117680	the
2117680	2117900	value
2117900	2118000	of
2118000	2118340	condition
2120060	2120740	is
2120740	2120760	returned
2120760	2120780	from
2121240	2121580	x
2122300	2122820	to
2122820	2122860	y.
2125600	2126280	So
2126960	2127620	this
2127620	2127820	the
2127820	2128940	value
2138280	2138940	of
2138940	2140360	condition.
2140660	2142600	therefore,
2143900	2144560	the
2144560	2145160	value
2145160	2145260	of
2145260	2145280	condition
2145280	2145560	is
2145560	2145940	returned
2147720	2148380	from
2148380	2148880	x
2150400	2151060	to
2151060	2151080	y.
2154240	2154900	And
2154900	2154940	therefore,
2154940	2154960	the
2154960	2154980	value
2154980	2155000	of
2155000	2155020	condition
2155020	2155040	is
2155040	2155060	returned
2155060	2155080	from
2155080	2156240	x
2156240	2156260	to
2158220	2159340	y.
2163840	2164400	therefore,
2164400	2164720	the
2164720	2165280	of
2166160	2166720	condition
2166720	2167000	is
2167000	2167420	returned
2167420	2167560	from
2167560	2167580	x
2167580	2168040	y.
2168300	2168860	And
2168860	2169440	therefore,
2169440	2169560	value
2169560	2169640	of
2169640	2169840	condition
2169840	2170020	is
2170020	2170200	returned
2172080	2172640	from
2172640	2173080	x
2173080	2173220	to
2174580	2175440	y.
2185120	2185680	And
2185680	2185980	therefore,
2185980	2186140	the
2186140	2186160	value
2186160	2186780	of
2187480	2187980	condition
2191080	2191580	returned
2191580	2191620	from
2191620	2191860	y.
2198900	2199400	And
2199400	2205760	therefore,
2206860	2207360	the
2212760	2213260	value
2213260	2213280	is
2213280	2213740	returned
2213740	2213880	from
2213880	2214080	y.
2214080	2214580	And
2214580	2215060	therefore,
2215060	2215160	the
2215160	2215340	value
2215340	2215780	of
2215780	2215800	is
2215800	2216580	returned
2216580	2216860	from
2216860	2217300	x
2227220	2228020	And
2228020	2228660	therefore,
2228660	2229620	the
2233380	2234180	value
2241000	2241800	of
2241800	2242060	condition
2243600	2244400	is
2244400	2244860	returned
2244860	2244880	from
2244880	2245100	x
2245100	2245120	to
2245120	2245420	y.
2245420	2245780	And
2245780	2246180	therefore,
2246180	2246320	the
2246320	2246560	value
2248620	2249140	of
2249140	2249540	condition
2249540	2249880	is
2249880	2250800	from
2250800	2251020	x
2251920	2252440	to
2252440	2252540	y.
2265960	2266480	And
2266480	2267020	therefore,
2267020	2267040	the
2267040	2267300	value
2267300	2267540	of
2268260	2268780	condition
2268780	2268940	is
2268940	2269300	returned
2269300	2269560	from
2272120	2272640	x
2272640	2273200	y.
2273340	2273380	And
2273380	2273880	therefore,
2273880	2273900	the
2273900	2273960	value
2275140	2275660	condition
2275660	2276380	is
2285040	2286240	returned
2297780	2298980	from
2300260	2301460	And
2301460	2302340	therefore,
2302340	2302820	the
2302820	2302840	is
2302840	2304400	returned
2304400	2304700	from
2304700	2304720	x
2304720	2304740	to
2304740	2304780	y.
2304780	2305640	And
2319540	2321260	therefore,
2321260	2321500	value
2321500	2321600	of
2321600	2322180	condition
2322180	2322400	is
2322400	2322860	returned
2324420	2325280	from
2325280	2325420	y.
2325420	2325840	And
2325840	2326500	therefore,
2326500	2326600	the
2326600	2326900	value
2326900	2326920	of
2326920	2328640	condition
2328640	2329100	is
2329100	2329500	returned
2329500	2330600	from
2332720	2333580	x
2333580	2334020	to
2334020	2334900	y.
2335340	2335620	And
2347140	2348660	therefore,
2348660	2349180	the
2349180	2349440	value
2349440	2349620	of
2349620	2349860	condition
2352300	2353340	from
2353340	2353960	y.
2353960	2353980	And
2353980	2355900	therefore,
2355900	2355920	of
2355920	2357240	condition
2357240	2358920	is
2358920	2359060	returned
2359060	2359140	from
2360740	2361780	x
2364680	2366760	therefore,
2366760	2366780	the
2366780	2367380	value
2367380	2367420	of
2367420	2367520	condition
2367520	2367680	is
2367680	2368460	from
2369640	2370200	x
2370200	2370260	to
2377720	2378280	And
2378280	2378540	therefore,
2378540	2378560	the
2378560	2379640	value
2379640	2380580	of
2384100	2384660	condition
2384660	2385380	is
2385380	2385980	y.
2386580	2387140	And
2387140	2387480	therefore,
2387480	2387760	condition
2387760	2387920	is
2387920	2388280	returned
2388280	2388460	from
2396920	2397480	x
2397480	2397500	to
2399600	2400320	y.
2408440	2409060	therefore,
2409060	2409100	the
2409100	2409360	value
2409360	2409540	of
2410440	2410800	condition
2416860	2417220	is
2417940	2418300	returned
2418300	2418340	from
2418340	2418380	y.
2418740	2419100	And
2419100	2419220	therefore,
2419220	2419680	the
2419680	2419700	value
2419700	2419880	of
2419880	2420060	condition
2420060	2420140	is
2420140	2420160	returned
2420160	2420240	from
2421900	2422260	x
2422260	2422780	to
2423240	2423700	y.
2423700	2423880	And
2424860	2425240	therefore,
2425240	2425260	the
2425260	2425420	value
2425420	2426000	of
2426000	2426460	condition
2426460	2426620	is
2426620	2426860	returned
2426860	2427780	x
2428220	2429000	And
2429000	2429580	therefore,
2432220	2433000	the
2433000	2433200	value
2437920	2438700	of
2438700	2439060	condition
2444120	2444900	returned
2444900	2445540	from
2445540	2445780	x
2445780	2445960	to
2445960	2446420	y.
2446580	2447360	And
2447360	2447500	therefore,
2447500	2447520	the
2449160	2449940	of
2450960	2451740	condition
2451740	2451840	is
2451840	2451860	returned
2451860	2451880	from
2453660	2454220	x
2460160	2460720	to
2460720	2461720	y.
2461840	2462400	And
2462400	2462420	therefore,
2462420	2462640	value
2462640	2462680	of
2462680	2463480	is
2463480	2464040	returned
2465480	2466040	x
2467180	2467740	to
2467740	2468300	y.
2469620	2469900	And
2469900	2470060	therefore,
2470060	2470080	the
2470080	2470380	value
2470380	2470660	of
2470660	2470760	is
2470760	2471000	returned
2475540	2476100	from
2476100	2476340	x
2476340	2476460	to
2476460	2476620	y.
2480380	2480940	And
2480940	2481660	therefore,
2481660	2482020	the
2483540	2483980	value
2483980	2484620	of
2484620	2484840	from
2501900	2502340	And
2502340	2505300	therefore,
2508680	2508820	value
2508820	2508980	of
2508980	2509200	condition
2510360	2510800	is
2510800	2510820	returned
2510820	2511040	from
2511640	2512080	x
2512080	2512180	to
2512180	2513240	y.
2520940	2521380	And
2521380	2521580	therefore,
2521580	2522100	the
2522780	2523220	value
2523220	2523240	of
2523240	2523260	condition
2523260	2523280	is
2527940	2528420	returned
2532580	2533060	from
2534120	2534600	x
2534600	2534820	to
2534820	2534960	y.
2534960	2535140	And
2535140	2535200	therefore,
2535200	2535540	value
2535540	2536220	of
2540980	2541460	condition
2541460	2541640	is
2541640	2542060	returned
2542060	2542180	from
2542180	2542920	x
2542920	2543540	y.
2545700	2546180	And
2546180	2546460	therefore,
2546460	2546520	the
2546520	2546720	value
2551940	2552420	condition
2552420	2552660	is
2552660	2552860	returned
2552860	2553040	from
2553040	2553260	x
2553980	2554540	to
2554540	2555140	y.
2558360	2558920	And
2558920	2559080	therefore,
2559080	2559100	the
2559100	2559380	value
2562300	2562860	of
2562860	2563000	condition
2564360	2564920	is
2565480	2566040	x
2571020	2571580	to
2574360	2575120	y.
2575120	2575640	And
2575640	2576580	therefore,
2576580	2577100	the
2577100	2577120	value
2577120	2577140	of
2577140	2577160	condition
2577160	2577340	is
2577340	2577780	returned
2577780	2577920	from
2577920	2578200	x
2578200	2578480	to
2578940	2579600	y.
2579600	2580140	And
2580140	2580460	therefore,
2580460	2580600	the
2580600	2581000	value
2582260	2582860	returned
2582860	2583260	from
2583260	2583540	to
2583540	2583580	y.
2583580	2584120	And
2588400	2589600	therefore,
2590380	2590980	the
2601000	2601600	value
2601600	2601620	of
2601620	2601640	condition
2601640	2601660	is
2601660	2601880	returned
2601880	2601900	from
2601900	2602000	x
2602000	2602300	y.
2602360	2602960	And
2602960	2603600	therefore,
2604740	2604760	the
2604760	2605560	value
2605560	2605820	of
2605820	2606000	condition
2606920	2607520	is
2607520	2607660	returned
2608380	2609060	from
2616840	2617520	x
2617520	2617680	to
2617680	2618300	y.
2618300	2618620	And
2618620	2619460	therefore,
2619460	2619580	the
2619580	2620160	value
2620160	2621300	condition
2621300	2621320	is
2624960	2625640	returned
2625640	2625720	from
2625720	2626240	x
2626240	2626360	to
2626360	2627080	y.
2627380	2628060	And
2628060	2628220	therefore,
2628220	2628240	the
2628240	2628740	value
2628740	2629060	of
2629060	2629120	is
2629120	2629280	returned
2629280	2629820	from
2632500	2633180	x
2633180	2633520	to
2633520	2634060	y.
2634360	2635040	And
2661740	2662620	therefore,
2662620	2663020	condition
2663020	2663800	is
2663800	2664080	y.
2664080	2664300	And
2664300	2664840	therefore,
2664840	2664880	is
2664880	2665040	returned
2665040	2665260	from
2665260	2665680	x
2665680	2665700	y.
2665700	2665960	And
2665960	2666000	therefore,
2666000	2666020	the
2666020	2666240	value
2666240	2666380	of
2666380	2667020	condition
2669740	2670880	is
2675960	2677100	returned
2677100	2677560	x
2677560	2678540	to
2678540	2679120	And
2679120	2679360	therefore,
2679360	2679600	of
2679600	2680380	is
2681440	2681840	returned
2681840	2681860	from
2682380	2683200	x
2683200	2683760	to
2683760	2684640	y.
2698040	2699180	And
2699180	2699640	therefore,
2699640	2699860	condition
2706460	2707030	x
2707610	2708110	to
2716430	2716930	y
2716930	2717310	is
2722190	2722690	returned
2722690	2723330	to
2723330	2723530	y.
2724810	2725310	And
2729650	2730150	therefore,
2730150	2730410	value
2730410	2730570	of
2730570	2731090	condition
2731090	2731110	is
2733810	2734310	returned
2734310	2734410	from
2734410	2734910	x
2734910	2735090	to
2735090	2735410	y.
2735410	2735710	And
2735710	2735910	therefore,
2735910	2736150	value
2736150	2736170	of
2736170	2736390	condition
2736390	2736910	is
2736910	2737010	returned
2739770	2741170	from
2743910	2745310	x
2764150	2765550	to
2765550	2766850	y.
2766850	2766970	And
2766970	2766990	value
2770230	2770730	of
2793220	2793720	condition
2793720	2794640	returned
2794640	2794660	from
2794660	2794680	x
2794680	2794700	y.
2794700	2794720	And
2794720	2794740	therefore,
2794740	2795440	returned
2795440	2795920	x
2795920	2796160	to
2796800	2797320	y.
2797320	2797580	And
2806930	2807430	therefore,
2807430	2807610	condition
2807610	2807670	is
2807670	2807690	returned
2807690	2808130	from
2808130	2808830	x
2831320	2832720	to
2855780	2857180	y.
2857180	2857260	And
2857260	2857480	therefore,
2857480	2857840	value
2864540	2865340	of
2865340	2865600	condition
2865600	2867140	is
2867140	2867500	returned
2867500	2867540	from
2867540	2867580	y.
2867580	2868360	And
2868360	2872220	therefore,
2872220	2873040	condition
2873040	2873240	is
2873240	2873500	returned
2873500	2873920	to
2873920	2874500	y.
2877620	2878420	And
2878420	2879140	therefore,
2879140	2879800	value
2879800	2880040	condition
2880040	2880580	is
2880580	2880780	returned
2880780	2881340	from
2886660	2887460	x
2887460	2888900	to
2899840	2901600	y.
2902080	2902260	And
2902260	2903880	therefore,
2906500	2907380	value
2907380	2907820	is
2907820	2908580	returned
2908580	2908780	x
2908780	2909260	to
2909260	2909600	y.
2909600	2909980	And
2909980	2910280	therefore,
2910280	2910680	is
2910680	2910880	returned
2910880	2912620	x
2912620	2913320	to
2913320	2914460	y.
2914640	2914960	And
2914960	2915660	therefore,
2915660	2916220	condition
2916220	2916480	is
2917000	2917620	returned
2917880	2918500	from
2918500	2918980	x
2935460	2936700	And
2936700	2945300	therefore,
2945300	2946680	value
2946680	2946920	of
2946920	2947920	condition
2947920	2948160	is
2948160	2948780	returned
2948780	2949220	y.
2949220	2950180	And
2950180	2950240	y.
2950240	2951120	And
2984210	2985370	therefore,
2985370	2985670	condition
2987170	2987750	is
2987750	2988030	returned
2988030	2988270	x
2988270	2988670	to
2988670	2988770	y.
2989450	2990030	And
2990030	2990090	therefore,
2990090	2990130	value
2990130	2990170	returned
2990170	2992690	This is the length of packet, this is the packet that represents the regular expression,
2992690	2996070	this is the length constraint. This is pretty much the same as the signature that we constructed
2996070	3003450	in our example. This is the bind signature, signature for DNS daemon. So one packet, this
3003450	3010450	is the length, this is the length constraint. Remote cat daemon has a signature that consists
3011370	3017250	of three packets because this cat daemon requires user authentication. So here we can see user
3017250	3028510	packet, password packet, the length constraint and the, yes, and the last packet. All the
3028510	3031730	signatures will generate automatically from a single attack instance.
3033350	3038230	Now let's talk about the recovery. Is it really useful? The overhead is pretty high at 70%.
3038230	3044270	Maybe we can do well without recovery. And we think that recovery is really useful because
3044270	3049490	many programs are single-thread and they are, like, event-driven. And if you just terminate
3049490	3054710	the program, then you disconnect all the clients. So you have only one bad client, you have,
3054710	3058650	let's say, a dozen of good clients. You disconnect one bad and disconnect a dozen of good, which
3058650	3064010	is very bad for good clients. And the same attack can be reviewed in the future, and
3064010	3068150	therefore the attacker can implement the denial of service attack if you simply terminate
3068150	3072130	the program instead of recovering. If you recover it, then repair the effect of the
3072130	3076030	bad guy, but you allow good guys to continue their execution.
3077070	3081450	And the same trade-off exists in the case of source code analysis tools. Whenever you
3082590	3088990	have a bug, if you use static code analysis tool, then you first need to find out this
3088990	3093630	bug, and these tools are prone to false positives, so we need to determine whether this is a
3093630	3096990	false positive or a real bug. If it turns out to be a real bug, then you have to come
3096990	3102250	up with a fix. You have to upload this patch to the developer's side. The developer has
3102250	3107330	to verify this patch. So it's also a lengthy process, and it involves a lot of human experience.
3108270	3112510	So there is the same trade-off. You either invest the same amount of runtime as we do,
3112510	3116230	or you invest the same amount of developers' time, which is probably more expensive.
3117790	3122350	Now we arrive at the conclusion. DIRA is the first system that solves the problems of attack
3122350	3127610	detection and identification in a unified way using memory on this log. It can produce
3127610	3131430	accurate multi-packet signatures from a single attack instance, which we believe is a big
3131430	3137050	achievement, because all the previous systems either reported less attack packets, or they
3137050	3141630	required a large pool of network data to generate an accurate multi-packet signature.
3141950	3147810	Dynamic slicing of the memory on this log is the underlying technique behind our tool.
3147810	3152710	And this is a well-known technique from programming languages, but I think we just found some
3152710	3157370	cool applications for this programming languages technique. And we plan to apply the same
3157370	3163270	technique in the future to generate patches for buffer overflow attacks. This is what we're
3163270	3168150	working on. We plan to work in the next few months. Our tool is available for download.
3168150	3174730	Please visit our website and download it and play with it. So if you find bugs or if you
3174730	3180890	have any experiences to share, please mail me and I'll be happy to answer you. Thank you.
3188450	3222110	I have one book, one question. Yes. I'm sorry.
3231160	3238120	Well, our program generates a signature whenever an attack happens. It doesn't use history.
3238120	3243380	It doesn't look for previous packets. It doesn't analyze them. So whenever you perform an
3243380	3246160	attack, a signature will be generated. So the question is whether the signature will be
3246160	3251200	different from previously generated signatures or not. And I think the answer is yes, because
3251200	3256220	if the length is different, then the regular expressions will also be different.
3283590	3289310	Yes, this is the kind of denial-of-service attack that we think is like more lightweight
3289310	3294050	than complete program restart, because a complete program restart disconnects all clients, all
3294050	3298890	benign clients, and recovery doesn't disconnect anybody except attacker. And therefore, the
3298890	3303610	benign clients will be able to perform their requests slower than when the program runs
3303610	3308770	normally, but at least they won't be disconnected, which we believe is pretty good.
3316770	3321390	Remember, AtlasLocker is a circular buffer. Yes, the log records are used constantly and
3321890	3329750	previous records are freed up when the record is about to be used. Yes.
3331130	3332850	Okay, thank you very much.