Shield: vulnerability-driven network filters for preventing known vulnerability exploits

By Helen J. Wang, Chuanxiong Guo, Daniel R. Simon, Alf Zugenmaier. Conference on Applications, Technologies, Architectures, and Protocols for Computer Communication, 2004

343 citations recorded by the source corpus.

Subfields: Computer Networks and Communications, Information Systems, Signal Processing

View Paper: https://www.semanticscholar.org/paper/81558cf209b39ffd0d4f2a2c97e58efcbb4bf679

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Computer Networks and Communications

In Information Systems

In Signal Processing

Citations in the corpus

On the infeasibility of modeling polymorphic shellcode (2007, background): “COUNTERINGPOLYMORPHISM Recent work [39] calls into question the ultimate utility of exploitbased signatures, and research on vul erability–specificprotection techniques [11, 7, 18] explores methods for defeating explo its de-”
Anagram: A Content Anomaly Detector Resistant to Mimicry Attack (2006, background): “Shield [34] provides vulnerability signatures instead of string-oriented content signatures, and blocks attacks that exploit that vulnerability.”
A survey of coordinated attacks and collaborative intrusion detection (2010, background): “Then the collected intrusion logs are centrally processed and analyzed in the DShield database.”
Limits of Learning-based Signature Generation with Adversaries (2008, background): “Signature generation algorithms that use semantic information have taken many different directions; some examples to point at directions are [4, 8, 12, 19, 31].”
RiskRanker: scalable and accurate zero-day android malware detection (2012, background): “specific signature [52] to capture its essential characteristics, which will be exhibited when the vulnerability is being exploited.”
Vigilante: end-to-end containment of internet worms (2005, methodology): “Shield [45] uses host-based filters to block vulnerabilities but these filters are generated manually.”
Dynamic Taint Analysis for Automatic Detection, Analysis, and SignatureGeneration of Exploits on Commodity Software (2005, methodology): “Shield [46] presents an alternative approach to contentbased filtering.”
Towards automatic generation of vulnerability-based signatures (2006, background): “property of the vulnerability, instead of an exploit (this observation has been made by others as well [56]).”
Automated Worm Fingerprinting (2004, background): “One approach is to create a priori vulnerability signatures that match known exploitable vulnerabilities in deployed software [44, 45].”
When Virtual Is Harder than Real: Security Challenges in Virtual Machine Based Computing Environments (2005, background): “For example, vulnerability specific firewall rules, such as Shields [13], can allow users to run unpatched versions of applications and operating systems while still accessing as much network functionality as is safely possible.”