Abstract:Acquiring and analyzing exploits, which take advantage of vulnerabilities to conduct malicious actions, are crucial for victims (and defenders) when responding to system compromising incidents. However, exploits are sensitive and valuable assets that are not available to victims. The most common resource available for victims to investigate is network traffic, which covers the exploitation period. Thus reconstructing exploits from network traffic is demanded. In practice, the reconstruction process is performed manually, thus inefficient and non-scalable. In this article, we present an automated solution TAICHI to reconstruct exploits from network traffic, able to generate replica exploits and facilitate timely incident analysis. By nature, a working exploit has to satisfy (1) path constraints which ensure the program path same as the original exploit's is explored and the same vulnerability is triggered, and (2) exploit constraints which ensure the same exploitation strategy is applied, e.g., to bypass deployed defenses or to stitch multiple gadgets together. We propose a hybrid solution to this problem by integrating techniques including multi-version execution (MVE), dynamic taint analysis (DTA), and concolic execution. We have implemented a prototype of TAICHI on x86 and x86-64 Linux and tested it on the Cyber Grand Challenge (CGC) dataset, several Capture the Flag (CTF) challenges, and Metasploit exploit modules targeting real world applications. The evaluation results showed that TAICHI could reconstruct exploits efficiently with a high success rate. Moreover, it could be applied to production environments without disrupting running services, and could reconstruct exploits even if only one round of exploitation traffic is available.

Attack Scenario Reconstruction Via Fusing Heterogeneous Threat Intelligence

Hiding and Trapping: A Deceptive Approach for Defending against Network Reconnaissance with Software-Defined Network

CRUcialG: Reconstruct Integrated Attack Scenario Graphs by Cyber Threat Intelligence Reports

Think That Attackers Think: Using First-Order Theory of Mind in Intrusion Response System.

Combination Attacks and Defenses on SDN Topology Discovery.

Towards Automated Threat Intelligence Fusion

Hybrid Intrusion Detection System for Complicated Network

Research on Intrusion Scenarios Building Based on Multiple Hypothesis Tracking

Correlating Multi-Step Attack and Constructing Attack Scenarios Based on Attack Pattern Modeling

TIMFuser: A Multi-granular fusion framework for cyber threat intelligence

IPAttributor: Cyber Attacker Attribution with Threat Intelligence-Enriched Intrusion Data

TAICHI: Transform Your Secret Exploits into Mine from a Victim's Perspective

How hard can it be? Quantifying MITRE attack campaigns with attack trees and cATM logic

Multiple behavior information fusion based quantitative threat evaluation

Towards High Level Attack Scenario Graph Through Honeynet Data Correlation Analysis

A Blackboard Sharing Mechanism for Community Cyber Threat Intelligence Based on Multi-Agent System.

ICSTrace: A Malicious IP Traceback Model for Attacking Data of Industrial Control System

K-CTIAA: Automatic Analysis of Cyber Threat Intelligence Based on a Knowledge Graph

Research on Key Technologies of Network Security Situational Awareness for Attack Tracking Prediction

AttacKG: Constructing Technique Knowledge Graph from Cyber Threat Intelligence Reports

MultiKG: Multi-Source Threat Intelligence Aggregation for High-Quality Knowledge Graph Representation of Attack Techniques