Sans Signature Buffer Overflow Blocker

Abstract

The objective of Sans Signature buffer overflow blocker mainly is to intercept communications between a server and client, analyse the contents for the presence of executable code and prevent the code reaching the server. In this project, Sans Signature is a signature free approach, which can identify and block new and unknown buffer overflow attacks. The system can intercept the data coming via various channels before the server receives the packets. Typically, the data exchanged with a standard application is the data related to the transaction. Therefore, the presence of executable code along with data is something unwarranted. This system will analyze the incoming of the data, check is it contains any executable code. If the executable code is found, the packet is dropped. If the data packet is found to be safe, it is allowed to pass through. The payload or data is analyzed at the application layer called Proxy based Sans Signature. The system has been designed to identify certain executable pattern that is considered harmful.  It also has a thresh hold limit beyond which, the packet will be considered to be discarded. Given the intelligence of the algorithm, it prevents most of the buffer overflow attacks. The system can handle the packet analysis in a transparent manner, thus making it suitable for deployment at Firewall/Application Gateway level. Hence, it is quite powerful and efficient with very low deployment and maintenance cost.

Keywords: buffer overflow attacks, code-injection attacks, Defense-side obfuscation