Patrol: Revealing zero-day attack paths through network-wide system object dependencies

Identifying attack paths in enterprise network is strategically necessary and critical for security defense. However, there has been insufficient efforts in studying how to identify an attack path that goes through unknown security holes. In this paper, we define such attack paths as zero-day attack paths, and propose a prototype system named Patrol to identify them at runtime. Using system calls, Patrol builds a network-wide system object dependency graph that captures dependency relations between OS objects, and identifies suspicious intrusion propagation paths in it as candidate zero-day attack paths through forward and backward tracking from intrusion symptoms. Patrol further identifies highly suspicious candidates among these paths, by recognizing indicators of unknown vulnerability exploitations along the paths through rule-based checking. Our evaluation shows that Patrol can work accurately and effectively at runtime with an acceptable performance overhead.