Function call based dynamic detection method for buffer overflow vulnerability

Abstract

The invention discloses a function cell based dynamic detection method for buffer overflow vulnerability. The method comprises the steps of acquiring a function call instruction address and a return instruction address of a detected program; building input parameters, and operating the detection program; in case of function call occurs, acquiring the value EBP_B in a base register; acquiring the value EBP_A of the base register when the function call is finished; if EBP_B is not equal to EBP_A, recording the vulnerability and alarming; if EBP_B is equal to EBP_A, determining that no vulnerability occurs; repeating the process until the detection program finishes the operation; continuously acquiring the function call information of the current operation; matching with an abnormal software behavior model; if matching, recording the possible vulnerability; if not matching, determining that the behavior of the program under the current input is free of the feature showing the buffer overflow vulnerability. The method is that a large number of inputs are built for repeated detection. The method can perform dynamic detection and improve the detection efficiency.

Description

technical field [0001] The invention belongs to the invention and relates to a detection method for a buffer overflow loophole, and belongs to the technical field of information security. Background technique [0002] With the rapid development of computer technology, the degree of informatization of human society is getting higher and higher, and the political, economic, military, cultural and other fields of the whole society rely more and more on computer information systems. In this case, the security of computer system has been paid more and more attention by people. However, the writing of large-scale software and systems requires many programmers to work together. They divide a software or system into several sections, divide the work into writing, then summarize and test; finally patch and release, so there are almost no security holes in the software. It is inevitable. Software security vulnerabilities refer to defects in data access or behavioral logic introduced...

AI Technical Summary

Problems solved by technology

The disadvantage is that the generated abstract syntax tree and other information contain a lot of messy information, which is not conducive to analysis. Moreover, for a small compilation unit, it can generate about 1000 times the abstract syntax tree text, and the final abstract syntax tree will occupy entire memory

But its obvious shortcoming is the dependence of dynamic detection technology on input. Only when the specific input is the program execution to the dangerous point, the vulnerability will be discovered. Therefore, the positioning is inaccurate and the false negative rate is high.

Images