防范入侵的静态分析技术比较  

A Comparison of Static Analysis Technology for Intrusion Prevention

作　　者：吴春梅[1] 夏耐[1] 茅兵[1] 

机构地区：[1]南京大学软件新技术国家重点实验室

出　　处：《计算机工程》2006年第3期174-176,253,共4页Computer Engineering

基　　金：国家"863"计划基金资助项目(2003AA144010)

摘　　要：建立了一个具有常见漏洞的测试代码,然后通过扫描测试代码来比较3个典型应用静态分析技术来防范入侵的常用工具。比较结果揭示了检查漏洞库函数的工具漏报率较低,但误报率较高;基于约束分析的工具误报率较低,但漏报率较高;利用软件模型来检测漏洞的工具在检测违背指定安全规则的漏洞时漏报率较低,但在检测具有许多安全漏洞类型的程序时漏报率却非常低。A testbed which includes the common vulnerabilities is built. The paper compares three typical and publicly available tools by applying them to the testbed individually for sake of preventing intrusion. The result reveals that the tools building on finding vulnerable library functions have low false negatives rates but high false positives rates, the constrained based tools have low false positives rates but high false negatives rates, and the module checkers have high true positives rates when finding attacks against given security rules, but have high false negatives rates when finding many kinds of vulnerabilities.

关 键 词：防范入侵 静态分析 缓冲区溢出 格式化串溢出 竞争条件 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]