4

Recently I came across a paper titled Host-based code injection attacks: A popular technique used by malware.

Another paper titled "Bee Master: Detecting Host-Based Code Injection Attacks", suggests a defense mechanism against HBCIA's.

From what I understand:

  1. Virus injects their code into a victim process to execute it.
  2. Antivirus software is able to defend against these attacks.

My query is how will "Bee Master" or any other defense mechanism against HBCIA be different from generally used antivirus software?

  • The paper states Bee Master, a novel approach for detecting host-based code injection attacks. Bee Master applies the honeypot paradigm to OS processes. Isn't the use of OS processes that are honeypots an answer to your question? – Neil Smithline Sep 4 '15 at 20:26
  • @NeilSmithline I understand that. But other than using different technique, the overall functionality of any defense mechanism will be same as antivirus? How can I explain difference if any, to someone? – Anurag Sep 4 '15 at 21:01
6

This is based on information found here 1, 2

Bee Master is a research project that describes a mechanism for determining if a host-based code injection attack has occurred. It does this by running "honeypot" processes that have well-known behavior and then monitoring those processes to see if their behavior pattern changes.

While Bee Master seems to do an excellent job (see page 17) of identifying that an attack has occurred, it has no mechanism whatsoever for responding to such an attack. As Bee Master only indirectly detects attacks due to a change in behavior in one of its honeypot processes, it cannot always (perhaps never) what the attack vector was; it just knows that a honeypot process was tampered with.

It is far from clear what the appropriate response should be when an injection is detected.

While Bee Master only focuses on this indirect detection of viruses, more typical anti-virus applications focus on direct detection of malicious code (eg: via code examination or suspicious process activity), terminating the errant processes, and sanitizing the computer.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.