Detection method and system for buffer overflow

Abstract

The invention provides a detection method for buffer overflow, and belongs to the field of information safety. The method comprises the steps as follows: when buffer overflow happens, a malicious code calls a system API (application program interface) function; a return address of the system API function is checked according to the system API function called by the HOOK malicious code; and whether overflow of a buffer region happens is judged according to the feedback address. According to the technical scheme of the detection method and system, effective detection of buffer overflow is realized.

Description

technical field [0001] The invention belongs to the field of information security, in particular to a buffer overflow detection method and system. Background technique [0002] In November 1988, many organizations had to cut off their Internet connections because of the "Morris Worm," a program written by 23-year-old programmer Robert Tappan Morris to attack VAX and Sun machines. According to estimates, this program crashes about 10% of the entire Internet. In July 2001, another worm called "Code Red" eventually led to an attack on more than 300,000 computers worldwide running Microsoft's IIS Web Server. In January 2003, the "Slammer" (also known as "Sapphire") worm took advantage of a flaw in Microsoft SQL Server 2000 to crash parts of the Internet in South Korea and Japan, interrupted telephone services in Finland, and made the American Airlines reservation system, The credit card network and ATMs were slow. All of these attacks, and many others, exploit a programming f...

AI Technical Summary

Problems solved by technology

In January 2003, the "Slammer" (also known as "Sapphire") worm took advantage of a flaw in Microsoft SQL Server 2000 to crash parts of the Internet in South Korea and Japan, interrupted telephone services in Finland, and made the American Airlines reservation system, Credit card

Images