Overflow vulnerability detection method and system for advanced persistent threat

Abstract

The invention discloses an overflow vulnerability detection method and system for advanced persistent threat. Firstly, a basic version of software to be detected is selected, and branch version information containing patch files is recorded; the basic version is one or more important versions of the software to be detected; a suspicious file type sample in a network is captured and input into a virtual machine; according to corresponding relations of the patch files and branch versions, branch version environment is constructed in the virtual machine; the suspicious file type sample is loaded and opened in the branch version environment; API calling situations of the suspicious file type sample are monitored to judge whether overflow behaviors exist, and whether the branch versions are updated versions, and accordingly whether a 0day loophole capable of being used by the advanced persistent threat exists. Besides, known loopholes of the software to be detected can be effectively detected, and whether the 0day loopholes exist in the software to be detected can be found.

Description

technical field [0001] The invention relates to the technical field of computer network security, in particular to an overflow vulnerability detection method and system for advanced sustainable threats. Background technique [0002] An advanced persistent threat (APT) refers to an attacker launching a long-term, sophisticated attack on a target. Its attacks are targeted and launched after long-term preparations. Its main characteristics are: attackers have more professional technical capabilities, can fully exploit the vulnerabilities of the target, including the ability to exploit unknown vulnerabilities; APT usually lasts for a long time, and attackers may use all kinds of opportunities to attack the target, which may last for a long time Collect security holes and finally achieve your own goals. [0003] Facing the complex Internet security situation and the growing number of Advanced Persistent Threats (APTs), it is becoming more and more common to use document format ...

AI Technical Summary

Problems solved by technology

[0004] Traditional known vulnerability threats are mainly obtained by parsing the format of known vulnerabilities. This method does not fully identify known vulnerabilities, and cannot effectively detect 0day vulnerabilities that can be exploited by advanced sustainable threats.

Images