Method and apparatus for preventing overflow attack of buffer area

Abstract

The embodiment of the invention provides a method and a device for defending buffer overflow attack, and an environment block establishing device. The method for defending the buffer overflow attack comprises the steps that when a new process or thread is created, a base address of the environment block of the process or the thread is obtained; the base address of the environment block of the process or the thread is randomized. The embodiment of the invention causes the data of the environment block of the process or the thread to be changed by randomizing the pointer of the base address of the process or the thread, therefore, jump address thereof is changed into invalid data so as to achieve the aim of preventing hostile attack when the process or the thread can not carry out jump, thus improving the safety of the system further.

Description

technical field [0001] The invention relates to the field of network security, in particular to a method and device for defending against buffer overflow attacks. Background technique [0002] The increasing access to the Internet has brought opportunities for remote attacks of malicious codes, and the attacks in the network are also increasing exponentially. Attacks based on buffer overflows have become one of the most common and most threatening attack methods in network attacks. Buffer overflow refers to the overflow caused by the number of data bits input by a computer program in the buffer beyond the boundary of the buffer. Buffer overflow attacks include various types, including: heap-based overflow attacks, stack-based overflow attacks, etc. Because the overflowed data may overwrite the legal data in the adjacent memory of the buffer, destroying data integrity, the overflowed data may also overwrite the function pointer or the function return address in the stack, d...

AI Technical Summary

Problems solved by technology

[0005] Before checking the return address of the function, there is a case where the return address or page attributes are maliciously modified. This malicious modification can effectively bypass the above scheme and still achieve the purpose of malicious attacks. It is difficult to effectively prevent buffer overflow through the above-mentioned related technologies. attack

Images