A VM-Based Detection Framework against Remote Code Execution Attacks for Closed Source Network Devices
Source abstract
Abstract
Remote code execution attacks against network devices become major challenges in securing networking environments. In this paper, we propose a detection framework against remote code execution attacks for closed source network devices using virtualization technologies. Without disturbing a target device in any way, our solution deploys an emulated device as a virtual machine (VM) instance running the same firmware image as the target in a way that ingress packets are mirrored to the emulated device. By doing so, remote code execution attacks mounted by maliciously crafted packets will be captured in memory of the VM. This way, our solution enables successful detection of any kind of intrusions that leaves memory footprints.
Source: crossref · Quality: baseline
Research context
OpenAlex topics: Network Security and Intrusion Detection · Software-Defined Networks and 5G · Security and Verification in Computing
SciVX discovery tags are terminology-based. OpenAlex topics are source-provided classifications.
Affiliations
School of Computer and Information Engineering, Kwangwoon University, 20 Kwangwoon-ro, Nowon-gu, Seoul 01897, Korea
References (22)
Show source-provided references
1. Veeraraghavan, M., Sato, T., Buchanan, M., Rahimi, R., Okamoto, S., and Yamanaka, N. (2017). Network function virtualization: A survey. IEICE Trans. Commun., E100B.10.1587/transcom.2016NNI0001 ↗
2. Network Function Virtualization10.1109/MIC.2016.112 ↗
3. Transport Network Function Virtualization10.1109/JLT.2015.2390655 ↗
4. Software-defined network function virtualization: A survey10.1109/ACCESS.2015.2499271 ↗
5. Martins, J., Ahmed, M., Raiciu, C., Olteanu, V., Honda, M., Huici, R., and Felipe, B. (2014, January 2–4). ClickOS and the Art of Network Function Virtualization. Proceedings of the 11th USENIX Symposium on Networked Systems Design and Implementation (NSDI 14), Boston, MA, USA.
6. Egi, N., Greenhalgh, A., Handley, M., Iannaccone, G., Manesh, M., Mathy, L., and Ratnasamy, S. (2009, January 19–21). Improved forwarding architecture and resource management for multi-core software routers. Proceedings of the NPC 2009—6th International Conference on Network and Parallel Computing, Gold Coast, QLD, Australia.10.1109/NPC.2009.39 ↗
7. Survey of Security in Software Defined Networks10.1109/COMST.2015.2453114 ↗
8. Towards Understanding Bugs in Open Source Router Software10.1145/1823844.1823849 ↗
9. Don’t Trust Your Router: Detecting Compromised Routers
10. Hau, B., Lee, T., and Homan, J. (2015). SYNful Knock—A Cisco Router Implant. Fire Eye Threat Res. Adv. Malware, Available online: https://www.fireeye.com/blog/threat-research/2015/09/synful_knock_-_acis.html.
11. Li, F., Zhang, L., and Chen, D. (2014, January 15–17). Vulnerability mining of Cisco router based on fuzzing. Proceedings of the 2014 2nd International Conference on Systems and Informatics, ICSAI 2014, Shanghai, China.10.1109/ICSAI.2014.7009366 ↗
12. Mem-Shot: Design and Implementation of API-Trigger Driven Memory Dump System for Obfuscated Malware Analysis
13. Patil, R., and Modi, C. (2016, January 3–5). A Novel Approach to Detect Extraneous Network Traffic from the Compromised Router. Proceedings of the 3rd International Conference on Recent Advances in Information Technology (RAIT), Dhanbad, India.10.1109/RAIT.2016.7507930 ↗
14. Detecting compromised routers via packet forwardåing behavior10.1109/MNET.2008.4476069 ↗
15. Cui, A., and Stolfo, S.J. (2019, March 27). Defending Embedded Systems with Software Symbiotes. Available online: https://doi.org/10.1007/978-3-642-23644-0_19.10.1007/978-3-642-23644-0_19 ↗
16. Cui, A., Kataria, J., and Stolfo, S.J. (2011, January 5–9). From prey to hunter. Proceedings of the 27th Annual Computer Security Applications Conference on—ACSAC’11, Orlando, FL, USA.10.1145/2076732.2076788 ↗
17. Desai, V., Natarajan, S., and Wolf, T. (2012, January 10–15). Packet forwarding misbehavior detection in next-generation networks. Proceedings of the IEEE International Conference on Communications, Ottawa, ON, Canada.10.1109/ICC.2012.6364319 ↗
18. Detecting network-wide and router-specific misconfigurations through data mining10.1109/TNET.2008.925631 ↗
19. Le, F., Lee, S., Wong, T., Kim, H., and Newcomb, D. (2006, January 11–15). Minerals: Using Data Mining to Detect Router Misconfigurations. Proceedings of the 2006 SIGCOMM Workshop on Mining Network Data, Pisa, Italy.10.1145/1162678.1162681 ↗
20. LibVMI-Project (2019, March 27). Libvmi, a Virtual Machine Introspection Library. Available online: http://libvmi.com/.
21. Cisco PSIRT (2007). Multiple Vulnerabilities in the IOS FTP Server, Technical Report.
22. Cisco PSIRT (2007). Crafted IP Option Vulnerability in Cisco IOS, Technical Report.