基于多阶段网络攻击模型的缓冲区溢出攻击技术分析与实践.docx

中文摘要
摘 要
在过去的十年中,缓冲区溢出是最常见的漏洞形式之一。据CERT对安全漏洞的统计结果显示,缓冲区溢出占了漏洞总数的50%以上。为贯彻落实我国信息安全战略,国信办组织实施了国家电子政务信息安全试点工作,重庆市是此次试点城市之一。根据试点单位核心信息系统漏洞的分析结果,由缓冲区溢出而造成的远程代码执行占整个漏洞数的57%。
网络攻击正向协作式、多层次化发展,一次入侵通常是由一连串有逻辑关系的攻击动作构成,这种日益增加的复杂性迫切需要对网络攻击进行有效的形式化建模。本文使用一阶谓词逻辑对网络系统中各个要素进行形式化的描述,提出基
,
作缓冲区溢出攻击案例建模。为准确分析每个阶段缓冲区溢出攻击成功权值,本文应用层次分析法为缓冲区溢出攻击的各个因素建立层次分析模型,计算出各影响因素所占的权重。然后筛选出最佳攻击路径,为试点单位制定安全防御方案提供科学依据。。该系统较好地体现了多阶段网络攻击模型的思想,并具有良好的扩充性和通用性。最后为试点工作缓冲区溢出攻击案例建立仿真环境,对缓冲区溢出攻击系统的实际效果进行测试。
论文是国务院信息化工作办公室“国家电子政务信息安全试点工作(重庆)”(项目编号:200402008)的系统研究成果之一。
关键词:缓冲区溢出,攻击模型,Mealy机
英文摘要
ABSTRACT
Buffer overflow is the lnon kind of vulnerability in recent ten years. According to the CERT vulnerabilities advisories,it is inferred that buffer overflow vulnerabilities take up more than 50 percent ofvulnerabilities total carry out National Information Security Strategy,the State Council Informationization office has managed to launch the National E-Government Information Security Trial Wbrl(. Chongqing city is one ofthe four experimental analyzed the vulnerabilities summary ofthe experimental unit,we drew a conclusion that remote program execution result from buffer overflow occupy the 53 percent ofvulnerabilities total number.
Ne竹ork attack is evolving with the c0一operative and multi-stage
Ne铆ork invasion constitutes a serieS of actiOIlS which municated with each
plexity work attack requires the formal modeling methodology for made use of first-order predicate calculus to formally model the threats and vulnerabilities in work system and proposed the MB—MSNAM, Mealy machine-B嬲ed Multi—work Attack then we sct叩the buffer overflow attack model with in the order to obtain the accurate ess
probability of every buffer overflow attack,we have applied the Analytic Hierarchy Process to modeling the factors of buffer overflow attack calculated the weight of