Experiments with deceptive software responses to buffer-overflow attacks

Modern intrusion detection systems have become good at identifying many kinds of malicious users on computer systems. Systems could use deception to fool the attacker about the results of their actions so that the attacker would waste time on fruitless endeavors. Deceptive software could also provide autonomous protective software responses to identified intrusions for a "second line of defense" when access controls have been subverted or destroyed. We examined three methods of responding to a malicious attempt to overflow the input buffer. All were done by modifying an image-browser Web portal (interface program) that was implemented with the Java "servlet" package.