STILL: Exploit code detection via static taint and initialization analyses

Xinran Wang, Yoon Chan Jhi, Sencun Zhu, Peng Liu

Research output: Contribution to journalConference articlepeer-review

49 Scopus citations


We propose STILL, a generic defense based on Static Taint and InitiaLization anaLyses, to detect exploit code embedded in data streams/requests targeting at various Internet services such as Web services. STILL first blindly disassembles each request, generates a (probably partial) control flow graph, and then uses novel static taint and initialization analysis algorithms to determine if strong evidence of self-modifying (including polymorphism) and/or indirect jump code obfuscation behavior can be collected. If such evidence exists, STILL will raise an alarm and block the request; otherwise, STILL will perform another form of static taint analysis to check whether unobfuscated or other types of obfuscated exploit code (e.g., metamorphism, etc) is embedded in the request. To the best of our knowledge, compared with existing static analysis approaches developed for the same purpose, STILL is (a) the first one that can detect self-modifying code and indirect jump, and (b) a more comprehensive static analysis solution in defending against anti-signature, anti-static-analysis and anti-emulation code obfuscation (for all the code obfuscation techniques we are aware of, STILL is robust to all but one).

Original languageEnglish (US)
Article number4721566
Pages (from-to)289-298
Number of pages10
JournalProceedings - Annual Computer Security Applications Conference, ACSAC
StatePublished - 2008
Event24th Annual Computer Security Applications Conference, ACSAC 2008 - Anaheim, CA, United States
Duration: Dec 8 2008Dec 12 2008

All Science Journal Classification (ASJC) codes

  • Computer Networks and Communications
  • Software
  • Safety, Risk, Reliability and Quality


Dive into the research topics of 'STILL: Exploit code detection via static taint and initialization analyses'. Together they form a unique fingerprint.

Cite this