Hybrid Defense - How to Protect Yourself From Polymorphic 0-days

Explore a comprehensive presentation from Black Hat EU 2013 on hybrid defense strategies against polymorphic zero-day exploits. Delve into an innovative approach and shellcode detection method designed for early identification and filtering of unknown threats at the network level. Learn how this technique combines a decade's worth of shellcode detection algorithms into an optimal classifier, significantly reducing false positives and enhancing overall detection capabilities. Discover how the hybrid data-flow classifier boosts analysis throughput for benign data up to 45 times faster than traditional methods. Gain insights into shellcode classes, static and dynamic features, and the process of building an effective classifier. Witness a tool demonstration and understand the practical applications of this cutting-edge cybersecurity approach.

Intro
Nowdays... CONS
Nowdays... PROS
Types of shelleode detection
Virtues and shortcomings
Shellcode schema
Shellcode static features Generatures
Shellcode dynamic features
Shellcode classes. Main idea
Example. Multibyte NOP- equivalent sled
List of.decryptor/RET-based classes
Shellcode detection library
Hybritt shellcode detector
Building classifier
Selecting classifiers for the next layer
Evaluation: 'numbers
Visualization of evaluatiort