REDT: Remote exploitation detection technology for network infrastructure

Abstract

An attacker exploits a remote vulnerability to execute arbitrary code on network infrastructure. It seriously threatens the security of network infrastructure. To detect the exploitation attack in a timely and effective way, in this paper, we present REDT, a remote exploitation detection technology based on the effect of exploitation attack. This method determines whether there is an authentication bypass exploitation by detecting the remote authentication process and saves attack traffic to the anomalous traffic database. With the database, we can replay the attack and analyze the exploitation. In the experiment, the detection accuracy rate reached 97.67%. In addition, this method does not rely on the signatures of the vulnerability and shellcode, so it can detect undisclosed vulnerabilities exploitation and provide abnormal traffic for the study of unknown vulnerabilities.