溢出攻击的攻击元与攻击模板构建研究  

Research on Attack Element and Attack Template of the Overflow Attacks

作　　者：祝宁[1,2] 陈性元[1,2] 张永福[1,2] 

机构地区：[1]解放军信息工程大学电子技术学院,郑州450004 [2]河南省信息安全重点实验室,郑州450004

出　　处：《小型微型计算机系统》2013年第2期417-422,共6页Journal of Chinese Computer Systems

基　　金：国家"九七三"重点基础研究发展计划项目(2011CB311801)资助;河南省科技创新人才计划项目(114200510001)资助

摘　　要：面向抗攻击测试对溢出攻击的需求,以构建溢出攻击可重用功能结构和统一描述框架为目标,分析溢出攻击样本不同阶段的攻击过程特点,提取组织溢出攻击的攻击元;总结溢出攻击过程一般描述,搭建溢出攻击构造过程通用攻击模板,从而建立起溢出攻击实现的规范组织架构.在AASL脚本语言支持下,实现利用攻击元,解析重构模板建立溢出攻击脚本.实验证明,该方法在确保溢出攻击的有效、可控和代码质量基础上,大幅降低了代码编写数量,有效提高了开发效率.研究成果为抗攻击测试攻击用例的使用提供了有力保障.Considering the need of the Attack Resistance Test for overflow attacks, setting the construction of overflow attacks reusable function structure and unified description framework as target, the attack dements of overflow attacks are extracted by analyzing the characteristics of overflow attack samples at different stages; and the attack template of overflow attack is constructed by summarizing and descripting the overflow attack process. And then a standardizing architecture is built for overflow attacks. Supporting by AASL script language, it has been realized that using attack element functions and template to build overflow attack scripts. The experiment shows, this method could ensure attacks effective and controllable, lower the complexity of development, reduce the amount of code to write, and increase the efficiency of development. The research could provide powerful support for Attack Resistance Test.

关 键 词：抗攻击测试 溢出攻击 原子攻击 攻击元 攻击模板 AASL语言 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]