Κατανεμημένο σύστημα εντοπισμού σύγχρονου shellcode
Distributed advanced shellcode detection system
View/
Keywords
Polymorphic shellcodes ; Network intrusion detection systems ; Windows OS innerworkings ; Network securityAbstract
The Network Intrusion Detection Systems (NIDS) are specialized systems which may be either
hardware devices or software programs that are designed and built for detecting malicious
traffic in the networks. The techniques used when inspecting the packets of a network traffic,
are able to detect any potential threat. For this reason, these techniques are the most critical
part for a NIDS system to be effective. The attackers by their side to circumvent those systems,
started to craft undetectable payloads. These payloads, so-called polymorphic shellcodes, are
able to either hide or mutate themselves and may bypass these security mechanisms. As such,
in this thesis a new Engine is introduced which is capable of detecting this kind of shellcodes
specifically for 32-bit Windows operating systems in a network environment. By emulating
components of a Windows operating system, this engine improves its resilience and
effectiveness in comparison to alternative solutions. Additionally, this Engine is integrated in
SEDUCE, a distributed shellcode detection system using CPU emulation for inspecting the
network traffic.
Postgraduate Studies Programme
Κατανεμημένα Συστήματα, Ασφάλεια και Αναδυόμενες Τεχνολογίες ΠληροφορίαςDepartment
Σχολή Τεχνολογιών Πληροφορικής και Επικοινωνιών. Τμήμα ΠληροφορικήςNumber of pages
56Language
EnglishCollections
Except where otherwise noted, this item's license is described as
Αναφορά Δημιουργού 3.0 Ελλάδα
Αναφορά Δημιουργού 3.0 Ελλάδα