STRIDE : POLYMORPHIC SLED DETECTION THROUGH INSTRUCTION SEQUENCE

Despite considerable effort, buffer overflow attacks remain a major security threat today, especially when coupled with self-propagation mechanisms as in worms and viruses. This paper considers the problem o f designing networklevel mechanisms for detecting polymorphic instances o f such attacks. The starting point for our work is the observation that many buffer overflow attacks require a "sled" component to transfer control o f the system to the exploit code. While previous work has shown that it is possible to detect certain types o f sleds, including obfuscated instances, this paper demonstrates that the proposed detection heuristics can be thwarted by more elaborate sled obfuscation techniques. To address this problem, we have designed a new sled detection heuristic, called STRIDE, that offers three main improvements over previous work: it detects several types o f sleds that other techniques are blind to, has a lower rate o f false positives, and is significantly more computationally efficient, and hence more suitable for use at the networklevel.