Using Static Program Analysis to Aid Intrusion Detection M. Egele - PowerPoint PPT Presentation

Motivation Analysis Evaluation Summary Using Static Program Analysis to Aid Intrusion Detection M. Egele M. Szydlowski E. Kirda C. Kruegel Secure Systems Lab Vienna University of Technology SIG SIDAR Conference on Detection of Intrusions and Malware & Vulnerability Assessment, 2006 M. Egele, M. Szydlowski, E. Kirda, C. Kruegel Using Static Program Analysis to Aid Intrusion Detection

Motivation Analysis Evaluation Summary outline Motivation 1 Analysis 2 Mode of Operation Parse Application Sourcecode Find Parameter Entry Points Parameter Name Extraction Type Inference Value Extraction Evaluation 3 How We Evaluated Our Results Results Analysis Results Comparison with Log Data M. Egele, M. Szydlowski, E. Kirda, C. Kruegel Using Static Program Analysis to Aid Intrusion Detection

Motivation Analysis Evaluation Summary what we want to do and why PHP is arguably the most prominent language to develop web-based applications Many exploits for vulnerabilities in PHP-applications exist User/attacker can influence the application mainly via its parameters We employ interprocedural dataflow analysis to gain knowledge about used parameters Especially types and possible values of parameters are interesting M. Egele, M. Szydlowski, E. Kirda, C. Kruegel Using Static Program Analysis to Aid Intrusion Detection

Motivation Analysis Evaluation Summary what we want to do and why PHP is arguably the most prominent language to develop web-based applications Many exploits for vulnerabilities in PHP-applications exist User/attacker can influence the application mainly via its parameters We employ interprocedural dataflow analysis to gain knowledge about used parameters Especially types and possible values of parameters are interesting M. Egele, M. Szydlowski, E. Kirda, C. Kruegel Using Static Program Analysis to Aid Intrusion Detection

Motivation Analysis Evaluation Summary what we want to do and why PHP is arguably the most prominent language to develop web-based applications Many exploits for vulnerabilities in PHP-applications exist User/attacker can influence the application mainly via its parameters We employ interprocedural dataflow analysis to gain knowledge about used parameters Especially types and possible values of parameters are interesting M. Egele, M. Szydlowski, E. Kirda, C. Kruegel Using Static Program Analysis to Aid Intrusion Detection

Motivation Analysis Evaluation Summary what we want to do and why PHP is arguably the most prominent language to develop web-based applications Many exploits for vulnerabilities in PHP-applications exist User/attacker can influence the application mainly via its parameters We employ interprocedural dataflow analysis to gain knowledge about used parameters Especially types and possible values of parameters are interesting M. Egele, M. Szydlowski, E. Kirda, C. Kruegel Using Static Program Analysis to Aid Intrusion Detection

Motivation Analysis Evaluation Summary what we want to do and why PHP is arguably the most prominent language to develop web-based applications Many exploits for vulnerabilities in PHP-applications exist User/attacker can influence the application mainly via its parameters We employ interprocedural dataflow analysis to gain knowledge about used parameters Especially types and possible values of parameters are interesting M. Egele, M. Szydlowski, E. Kirda, C. Kruegel Using Static Program Analysis to Aid Intrusion Detection

Motivation Analysis Evaluation Summary existing intrusion detection system MAID tries to characterize web-requests through different models: Learning based intrusion detection system developed at the Secure Systems Lab TU Vienna. models include parameter presence/absence model, structural inference, token finder models . . . No a priori knowledge of applications it protects learning is basically done via logfile analysis In some cases unnecessary imprecision leads to many false positives → this is what we want to improve M. Egele, M. Szydlowski, E. Kirda, C. Kruegel Using Static Program Analysis to Aid Intrusion Detection

Motivation Analysis Evaluation Summary existing intrusion detection system MAID tries to characterize web-requests through different models: Learning based intrusion detection system developed at the Secure Systems Lab TU Vienna. models include parameter presence/absence model, structural inference, token finder models . . . No a priori knowledge of applications it protects learning is basically done via logfile analysis In some cases unnecessary imprecision leads to many false positives → this is what we want to improve M. Egele, M. Szydlowski, E. Kirda, C. Kruegel Using Static Program Analysis to Aid Intrusion Detection

Motivation Analysis Evaluation Summary existing intrusion detection system MAID tries to characterize web-requests through different models: Learning based intrusion detection system developed at the Secure Systems Lab TU Vienna. models include parameter presence/absence model, structural inference, token finder models . . . No a priori knowledge of applications it protects learning is basically done via logfile analysis In some cases unnecessary imprecision leads to many false positives → this is what we want to improve M. Egele, M. Szydlowski, E. Kirda, C. Kruegel Using Static Program Analysis to Aid Intrusion Detection

Motivation Analysis Evaluation Summary existing intrusion detection system MAID tries to characterize web-requests through different models: Learning based intrusion detection system developed at the Secure Systems Lab TU Vienna. models include parameter presence/absence model, structural inference, token finder models . . . No a priori knowledge of applications it protects learning is basically done via logfile analysis In some cases unnecessary imprecision leads to many false positives → this is what we want to improve M. Egele, M. Szydlowski, E. Kirda, C. Kruegel Using Static Program Analysis to Aid Intrusion Detection

Mode of Operation Motivation Parse Application Sourcecode Analysis Find Parameter Entry Points Evaluation Parameter Name Extraction Summary Type Inference Value Extraction mode of operation Input: Parse Abstract Identify PHP File and Represen− Interesting Action performed Source File Includes tation Parameters parse the application Output: Link Track Variable source code Parameter Parameters Variable Type Info and Usage Values Inference M. Egele, M. Szydlowski, E. Kirda, C. Kruegel Using Static Program Analysis to Aid Intrusion Detection

Mode of Operation Motivation Parse Application Sourcecode Analysis Find Parameter Entry Points Evaluation Parameter Name Extraction Summary Type Inference Value Extraction mode of operation Input: Parse Abstract Identify PHP File and Represen− Interesting Action performed Source File Includes tation Parameters identify the parameters the application Output: Link Track Variable accepts Parameter Parameters Variable Type Info and Usage Values Inference M. Egele, M. Szydlowski, E. Kirda, C. Kruegel Using Static Program Analysis to Aid Intrusion Detection

Mode of Operation Motivation Parse Application Sourcecode Analysis Find Parameter Entry Points Evaluation Parameter Name Extraction Summary Type Inference Value Extraction mode of operation Input: Parse Abstract Identify PHP File and Represen− Interesting Source File Includes tation Parameters Action performed type inference on variables Output: Link Track Variable Parameter Parameters Variable Type Info and Usage Values Inference M. Egele, M. Szydlowski, E. Kirda, C. Kruegel Using Static Program Analysis to Aid Intrusion Detection

Mode of Operation Motivation Parse Application Sourcecode Analysis Find Parameter Entry Points Evaluation Parameter Name Extraction Summary Type Inference Value Extraction mode of operation Input: Parse Abstract Identify PHP File and Represen− Interesting Source File Includes tation Parameters Action performed variables values are tracked Output: Link Track Variable Parameter Parameters Variable Type Info and Usage Values Inference M. Egele, M. Szydlowski, E. Kirda, C. Kruegel Using Static Program Analysis to Aid Intrusion Detection

Mode of Operation Motivation Parse Application Sourcecode Analysis Find Parameter Entry Points Evaluation Parameter Name Extraction Summary Type Inference Value Extraction mode of operation Input: Parse Abstract Identify PHP File and Represen− Interesting Source File Includes tation Parameters Action performed parameter usage is examined Output: Link Track Variable Parameter Parameters Variable Type Info and Usage Values Inference M. Egele, M. Szydlowski, E. Kirda, C. Kruegel Using Static Program Analysis to Aid Intrusion Detection

Mode of Operation Motivation Parse Application Sourcecode Analysis Find Parameter Entry Points Evaluation Parameter Name Extraction Summary Type Inference Value Extraction parsing Original Zend language parser was used Includes are resolved (constant expressions) Variables and functions are identified M. Egele, M. Szydlowski, E. Kirda, C. Kruegel Using Static Program Analysis to Aid Intrusion Detection