A Metric for Identifying System Exploitation using Buffer Overflow

Buffer overflow attacks affect the workings of different processes within any computer. It is hypothesized that the number of processes running on the system will change when a buffer overflow has occurred. This hypothesis is tested by gathering data from a Red Hat Linux 9 system and a Windows XP system both before and after exploitation. By using statistical analysis, the data from both systems are compared. The results from the experiment support the hypothesis. On the Red Hat system, the number of processes running after exploitation increases. On the Windows system, the number of processes running decreases due to the fact that explorer responds to the change by restarting itself. Thus, the results support the hypothesis that the number of processes running on a system change after an exploit occurs. These results indicate that a program that monitors the number of processes running on the system and provides statistical feedback about that data will offer a warning if a system has been compromised