Detecting method and device of loophole triggering threats in PDF

Abstract

The invention discloses a detecting method and device of loophole triggering threats in PDF and relates to the field of information safety. By analysis and detection on PDF files, the threats by which loopholes are possibly triggered are found in time, and alarm reminding is carried out on the files. According to the main technical scheme, a dictionary object with a PDF file identification entry as a first feature value is analyzed; the dictionary object is analyzed, and whether a second feature value exists in the dictionary object is checked; if yes, whether a stack-based buffer overflows is determined according to the second feature value; and if yes, warning information is given out, and a user is warned about the fact that the loophole triggering threats exist in the PDF files. The detecting method and device are mainly used for detecting loopholes in PDF.

Description

technical field [0001] The invention relates to the field of information security, in particular to a detection method and device for triggering vulnerability threats in PDF. Background technique [0002] With the development of information technology and the powerful software functions, the resulting huge amount of source code makes it more and more difficult to eliminate the design loopholes in the source code or implement loopholes, so that hackers can use the loopholes to damage the system or even Hack the system. [0003] Vulnerabilities are weaknesses or defects that exist in a system, and these weaknesses or defects make the system sensitive to a specific threat attack or dangerous event, or have the possibility of attack threat. Vulnerabilities are generally divided into functional logic loopholes and security logic loopholes. Functional logic loopholes affect the normal functions of the software, such as execution result errors, execution process errors, etc., whil...

AI Technical Summary

Problems solved by technology

At present, the commonly used detection method is to achieve the purpose of detection by analyzing the source code according to certain rules. Therefore, this method needs to establish a feature library and a rule library of the source code. However, as the number of vulnerabilities increases, the feature library will also continue to expand. The detection efficiency is continuously reduced. At the same time, because the content of the signature database needs to be continuously updated, false positives and missed negatives often occur due to untimely updates.

Images