Finding Diversity in Remote Code Injection Exploits
File Size:
KB
Developer:
Description:
We present a methodology for in-ferring the phylogeny, or evolutionary tree, of such exploits. Wehave applied this methodology to traffic captured at several vantagepoints, and we demonstrate that our methodology is robust to theobserved polymorphism. Our techniques revealed non-trivial codesharing among different exploit families, and the resulting phyloge-nies accurately captured the subtle variations among exploits withineach family. Thus, we believe our methodology and results are ahelpful step to better understanding the evolution of remote codeinjection exploits on the Internet.
