A vulnerability defense method and electronic device

Abstract

The embodiment of the present application provides a vulnerability defense method and an electronic device. The method includes: constructing a mimic defense framework, including an input agent module, a heterogeneous task pool, a negative feedback control module, and a summary decision module; Input object program data; the heterogeneous task pool compiles the received object program data based on multiple languages ​​to form multiple program segments, and processes the multiple program segments to form multiple independently running executive tasks ; The summary decision module obtains the execution results of the multiple executive tasks, and determines the target program segment that will generate a loophole based on the execution result; the negative feedback control module eliminates the target program segment. The loophole defense method of the present application changes the program data through mimetic transformation inside the program, which not only can actively defend against loopholes, but also increases the difficulty of function base address location and improves the program's own defense capability.

Description

technical field [0001] The embodiments of the present application relate to the field of network defense, and in particular to a vulnerability defense method and electronic equipment. Background technique [0002] In the field of network security, software vulnerability analysis is a very important part. Among many types of vulnerabilities, buffer overflow vulnerability is the most common type of vulnerability. Buffer overflow, according to the location of the buffer, is divided into stack overflow and heap overflow. Stack buffer overflow refers to the overflow of the buffer by writing the content exceeding its length to the buffer of the program, thereby destroying the stack of the program, making the program execute the data constructed by the attacker instead, so as to achieve the purpose of executing malicious code . [0003] During the operation of a software system, stack overflow is an important cause of software system instability. Due to the sporadic nature of sta...

AI Technical Summary

Problems solved by technology

Specifically, when this method is implemented, it usually uses the method of recording the base address of the function call. By comparing whether the base address of the function before and after the call is the same, it is judged whether a stack overflow attack has occurred, and a separate detection module is usually used for stack overflow vulnerability detection. When When the detection module generates a stack overflow vulnerability, it will not be able to defend against stack overflow attacks. In addition, the defense effect will also be invalid when the base address of the recorded function before and after execution is changed.

Images