Call-Stack Integrity based Buffer Overflow Detection Method

Buffer overflow is one of the most threats to the system security, and a strong emphasis has been laid on the research of detection method. Call-Stack Integrity (CSI) based detection method is different from any existing detection technology. CSI performs the task of buffer overflow detection using general call-stack integrity rules, whose implementation is transparent to existing application. The test on CSI prototype system, implemented in Linux kernel, indicates that the method itself is efficient with low overhead caused and is effective to detect various buffer overflow attack, including shellcode based attack and more advanced attack, such as return into libc. Hence, the detection ability of CSI is better than other known detection methods.