Micro-Virtualization Memory Tracing to Detect and Prevent Spraying Attacks
summary
Graffiti framework implements a hypervisor-based memory tracer using Intel EPT and per-process micro-virtualization to sandbox paging structures; prototype runs on Linux and Windows and ships as open source. Memory tracer alone adds ~24–25% overhead in worst-case benchmarks; monitoring one app costs 22% but jumps to 63% when sharing occurs, so the system uses tunable activation thresholds (100–400 MB, default 150 MB). Six real exploits are detected and blocked; 1,000 benign and 1,000 malicious PDFs yield no false positives/negatives; two-user week trial visits 400 sites, 50 activations and 12 initial false positives that are reduced by improving the data-spray plugin.
AI-written summary · about
chapters (9)
- 0:00Start
- 2:38Stack Pivoting
- 9:56Memory Tracer
- 13:34Micro Virtualization
- 14:50The Attack Detector
- 15:22The Malicious Code Detector
- 18:57Experiments To Measure the Effectiveness
- 22:39Conclusion
- 25:23Tune the Threshold
related talks
15mMemoryTrap: Booby Trapping Memory to Counter Memory Disclosure Attacks with...
40mEvils in the Sparse Texture Memory: Exploit Kernel Based on Undefined Behaviors of Graphic APIs
26mFrom Finding New Type of Logical Flaw at Linux Kernel To Developing New Heap Exploitation Technique
01h 00mIntroduction to memory exploitation
53mXenpwn: Breaking Paravirtualized Devices
37mDynamic Image Scanning Through System Tracing
48mCapturing 0Day Exploits With Perfectly Placed Hardware Traps
33mMemory Forensics Using Virtual Machine Introspection for Cloud Computing