A self‐checking signature scheme for checking backdoor security attacks in Internet

Article type: Research Article

Authors: Abdulla, M.F. | Ravikumar, C.P.

Affiliations: Department of Computer Science, University of Yemen, Yemen E‐mail: [email protected] | Texas Instruments India, Bagmane Tech Park, Opposite LRDE, C.V. Raman Nagar Post, Bangalore 560093, India E‐mail: [email protected]

Abstract: It is very common for people across the globe to collaborate on the Internet and intellectual property amongst each other. A serious threat to this form of collaboration can come from “backdoor” attacks from hackers, who can distort the information content. For example, a backdoor attack may replace common operating system functions with malicious ones. A possible precaution against such an attack is to generate a signature database and compare the signature of a system functionality with its golden signature before using the functionality. We present an alternate and novel method to detect Trojan activity. Called time fingerprinting, the method relies on observing a finite number of fingerprints during signature generation and tracing the Trojan fingerprints in system files. We have verified the desired properties using common semi trusted operating system files.

Keywords: Internet security, signature, fingerprint, Trojan, testing

Journal: Journal of High Speed Networks, vol. 13, no. 4, pp. 309-317, 2004