Anti-vulnerability-exploitation method and system

Abstract

The invention relates to an anti-vulnerability-exploitation method and system, belongs to the technical field of network security and aims to solve the problems of high maintenance cost and incapability of detecting new overflow vulnerabilities in time in the conventional vulnerability scanning scheme. The method comprises the following steps: injecting a vulnerability protection module into a process to be protected; detecting vulnerabilities by using the vulnerability protection module; intercepting vulnerabilities when running of the vulnerabilities is detected. By adopting the method and the system disclosed by the invention, the vulnerabilities can be detected in time during running of the vulnerabilities, and the vulnerabilities are prevented from running continually.

Description

technical field [0001] The invention belongs to the technical field of network security, and in particular relates to a method and system for preventing exploitation of loopholes. Background technique [0002] As Microsoft stops technical support for the XP system, XP system users will also face attacks from various vulnerabilities, among which there are many office software vulnerabilities, and they are extremely harmful. An overflow vulnerability is a correctable defect of a computer program. The full name of an overflow vulnerability is a buffer overflow vulnerability, because it is an error code that is executed in the buffer when the program is executed, so it is called a buffer overflow vulnerability. Hackers mainly use some overflow vulnerabilities in office word to attack users. Since this kind of attack is launched through clever overflow vulnerabilities constructed in word documents, and point-to-point attacks are realized by transmitting word files, it is difficul...

AI Technical Summary

Problems solved by technology

Hackers mainly use some overflow vulnerabilities in office word to attack users. Since this kind of attack is launched through clever overflow vulnerabilities constructed in word documents, and point-to-point attacks are realized by transmitting word files, it is difficult to kill software by scanning such vulnerabilities Once the vulnerability is detected, it will pose a great threat to the user's property security once it is successfully executed.

[0003] Some existing antivirus software such as Kaspersky have some static scanning schemes about vulnerabilities, which are designed for specific vulnerabilities. They can detect the characteristics in word documents to determine whether vulnerabilities are being exploited. Although this method is aimed at However, due to the variability of vulnerabilities, the maintenance cost is relatively high, and new overflow vulnerabilities cannot be detected in time.

Images