计算机应用 ›› 2010, Vol. 30 ›› Issue (12): 3349-3353.
• 信息安全 • 上一篇 下一篇
卢家兴1,郭帆2,余敏1
收稿日期:
修回日期:
发布日期:
出版日期:
通讯作者:
基金资助:
Received:
Revised:
Online:
Published:
摘要： 设计并实现了一套静态检测多态溢出攻击代码的方法，首先应用抽象执行思想构造控制流图，使用符号执行方法并结合Taint分析来检测攻击载荷，最后识别指定长度的填充字段来辅助检测。实验结果表明，该方法可准确识别网络数据中的多态溢出攻击代码。
关键词: 溢出攻击代码, 多态, 抽象执行, 符号执行, 无操作指令序列
Abstract: A new approach using static analysis was proposed to discover the polymorphic attack codes hidden in network data flows. The idea of abstract execution was firstly adopted to construct control flow graph, then both symbolic execution and taint analysis were used to detect attack codes, at last, predefined length of NOOP instruction sequence was recognized to help detection. The experimental results show that the approach is capable of correctly distinguishing the attack codes from regular network flows.
Key words: exploit code, polymorphic, abstract execution, symbolic execution, NOOP instruction sequence
卢家兴 郭帆 余敏. 静态检测多态溢出攻击代码的方法[J]. 计算机应用, 2010, 30(12): 3349-3353.
0 / 推荐
导出引用管理器 EndNote|Ris|BibTeX
链接本文: http://www.joca.cn/CN/
http://www.joca.cn/CN/Y2010/V30/I12/3349
