Vulnerability defense method and electronic device

Abstract

The embodiment of the invention provides a vulnerability defense method and an electronic device, and the method comprises the steps: constructing a mimicry defense architecture which comprises an input agent module, a heterogeneous task pool, a negative feedback control module and a summary judgment module; inputting target program data into the input agent module; enabling the heterogeneous taskpool to compile received target program data based on multiple languages to form multiple program segments, and process the multiple program segments to form multiple independently running executionbody tasks; enabling the summary judgment module to obtain execution results of the plurality of execution body tasks, and determine a target program segment which generates vulnerabilities based on the execution results; and enabling the negative feedback control module to eliminate the target program segment. According to the vulnerability defense method, program data is changed by mimicry transformation on the interior of the program, so that vulnerability can be actively defended, the function base address positioning difficulty can be increased, and the defense capability of the program is improved.

Description

technical field [0001] The embodiments of the present application relate to the field of network defense, and in particular, to a vulnerability defense method and an electronic device. Background technique [0002] In the field of network security, software vulnerability analysis is a very important part. Among the many types of vulnerabilities, buffer overflow vulnerability is the most common type of vulnerability. Buffer overflow, according to the location of the buffer, is divided into stack overflow and heap overflow. Stack buffer overflow refers to the overflow of the buffer by writing content that exceeds its length to the program's buffer, thereby destroying the program's stack and causing the program to execute the data constructed by the attacker in order to achieve the purpose of executing malicious code. . [0003] During the operation of a software system, stack overflow is an important cause of instability of the software system. Due to the occasional characte...

AI Technical Summary

Problems solved by technology

Specifically, when this method is implemented, it usually uses the method of recording the base address of the function call. By comparing whether the base address of the function before and after the call is the same, it is judged whether a stack overflow attack has occurred, and a separate detection module is usually used for stack overflow vulnerability detection. When When the detection module generates a stack overflow vulnerability, it will not be able to defend against stack overflow attacks. In addition, the defense effect will also be invalid when the base address of the recorded function before and after execution is changed.

Images