Κατανεμημένο σύστημα εντοπισμού σύγχρονου shellcode
Distributed advanced shellcode detection system
Master Thesis
Author
Tsilis, Dimitrios
Τσίλης, Δημήτριος
Date
2024-03View/ Open
Keywords
Polymorphic shellcodes ; Network intrusion detection systems ; Windows OS innerworkings ; Network securityAbstract
The Network Intrusion Detection Systems (NIDS) are specialized systems which may be either
hardware devices or software programs that are designed and built for detecting malicious
traffic in the networks. The techniques used when inspecting the packets of a network traffic,
are able to detect any potential threat. For this reason, these techniques are the most critical
part for a NIDS system to be effective. The attackers by their side to circumvent those systems,
started to craft undetectable payloads. These payloads, so-called polymorphic shellcodes, are
able to either hide or mutate themselves and may bypass these security mechanisms. As such,
in this thesis a new Engine is introduced which is capable of detecting this kind of shellcodes
specifically for 32-bit Windows operating systems in a network environment. By emulating
components of a Windows operating system, this engine improves its resilience and
effectiveness in comparison to alternative solutions. Additionally, this Engine is integrated in
SEDUCE, a distributed shellcode detection system using CPU emulation for inspecting the
network traffic.