基于代码执行模拟的远程缓冲区攻击网络检测方法研讨.pdf

纪念马祖光院士全国光电子与光电信息技术学术研讨会论文集·哈尔滨2006 基于代码执行模拟的远程缓冲区攻击网络检测方法研究 辛毅t，方滨兴2，云晓春。 要安全威胁之一，特别是网络蠕虫利用其进行攻击传播。所以，目前亟需缓冲区溢出的网络检测方法。本文首先分析了缓冲 区溢出攻击的原理和方法，提出了一种新的通用网络缓冲区溢出的检测方法。此检测方法通过代码执行模拟来计算网络报文 中含有的可执行代码序列的虽丈长度来进行缓冲区溢出的网络检测。实验证明。该检测方法不仅能够快速有效的检测传统的 远程缓冲区溢出的攻击，而且还可以检测变形的sheilcode． 关键词：远程缓冲区溢出；蠕虫；网络检测；代码执行模拟；变形Shellcode DetectionBasedonCode ANew ofNetworkBufferOverflow Approach ExecutionSimulation XIN Xiao-chunl Yil，FANG Bin-xin92，YUN InformationContent Institute Harbin” (1．National SecurityKeyLaboratory,HarbinofTeclmology,Heilongjiang Computer 150001，China；2．National andInformation Administration 100031，China) ComputerNetworkSystemSecurity Center,Beijing Abstract：Withthe situationofInternethasbeen thelastseveral ofInternet’the nlo托complex．In yeats, rapiddevelopment security thebuffer-overflowhas asoncofthe threatstoinformationand worn娼 emerged leading security thebuffer innetworkas as which bufferoverflow．Soitis tObuilda that伽detectoverflow quicHy propagateby nd?,essary system thatCodeExecution the ofthe andmethodsofbuffer anew is overflow,we approach possible．Afteranalysisprinciples present isbased calculationofthemaximumexecutive detectnetworkrc舶aotebufferoverflow．This onthe Simulation(CES)to approach to in