The Shield Project

Shield: First-Line Malware Defense

Software patching has not been an effective first-line defense preventing large-scale worm attacks, even when patches had long been available for their corresponding vulnerabilities. Generally, people have been reluctant to patch their systems immediately, because patches are perceived to be unreliable and disruptive to apply. To address this problem, we propose a first-line worm defense in the network stack, using shields -- vulnerability-specific, exploit-generic network filters installed in end systems once a vulnerability is discovered, and before the patch is applied. These filters examine the incoming or outgoing traffic of vulnerable applications, and drop traffic that exploits vulnerabilities. Shields are less disruptive to install and uninstall, easier to test for bad side effects, and hence more reliable than traditional software patches. Further, shields are resilient to polymorphic or metamorphic variations of exploits.

In this work, we're showing that this concept is feasible by implementing a prototype Shield framework that filters traffic at the transport layer. We have designed a safe and restrictive language to describe vulnerabilities as partial state machines of the vulnerable application. The expressiveness of the language has been verified by encoding the signatures of a number of known vulnerabilities. Our evaluation provides evidence of Shield's low false positive rate and impact on application throughput. An examination of a sample set of known vulnerabilities suggests that Shield could be used to prevent exploitation of a substantial fraction of the most dangerous ones.

Today's desktop PCs rely on security software such as anti-virus products and personal firewalls for protection. Unfortunately, malware authors have adapted by specifically targeting and disabling these defenses, a practice exacerbated by the rise in zero-day exploits. In this paper, we present the design, implementation, and evaluation of a secure execution platform, called SAV-V, for anti-virus software. Our platform leverages virtualization to make AV software resilient to zero-day malware attempting to tamper with it. SAV-V also uses secure logging, a split file system, and fake shutdowns to allow AV software to detect past infections by zero-day malware once signatures become available.

Oakland 2006 submission. [pdf]
Presentation at MSR Brownbag with the AV team . [ppt]

In this work, we tackle the problem of automatic data patch or vulnerability signature generation for an unknown vulnerability, given a zero-day attack instance. Unlike previous approaches that employ program analysis, we leverage the knowledge of the data format to generate new potential attack instances and use a zero-day detector as our oracle. With such informed probing and feedback loop, we construct vulnerability signatures. We have implemented a prototype called ShieldGen and experimented with three known vulnerabilities. The generated signatures have no false positives, but may admit a small amount of false negatives largely due to the imprecision of the data format specification. By comparing with the vulnerability signatures generated by the existing schemes, our signatures are noticeably superior. We also conducted a detailed vulnerability study on 40 vulnerabilities over the past three years, and estimate ShieldGen to have a significant coverage with superior signatures to those generated by existing schemes.

Oakland 2006 submission. [pdf]

Subspace: Secure Cross-Domain Communication for Web Mashups (Submission to WWW 2007) [pdf]

MashupOS: Operating System Abstractions for Client Mashups (position paper submission to HotOS 2007) [pdf]

XSS-Shield powerpoint: [ppt]

People

Summer Interns 2004

Summer Interns 2005

Summer Interns 2006

BrowserShield ISA Counterparts

Alumni

Talks

Shield project overview, Jan 4, 2005 "The Shield Project" [ ppt ]

MSR TAB Presentation, October 24, 2005 "The Shield Project Update" [ ppt ]

Microsoft Faculty Summit 2005 "Shield and Friends Troubleshooting Network" [ ppt ]

An internal GAPA talk [ ppt ]

MSR TAB Presentation, October 25, 2004 "Shield: First-Line Worm Defense" [ ppt ]

ACM SIGCOMM 2004 presentation [ pdf ]

MSR Cool Talk Series: "Shield: First-Line Worm Defense" [pdf] [ Recording ] March 25, 2004.

UCSD system and networking seminar: "Shield: First-Line Worm Defense" [pdf] Feb 25, 2004.