跨主机动态污点跟踪技术研究  

Research on Cross-host Dynamic Taint Tracking Technology

作　　者：任飞飞[1] 庄洪林[2] 吴礼发[2] 潘璠[2] 

机构地区：[1]中国人民解放军61660部队 [2]解放军理工大学指挥信息系统学院

出　　处：《计算机工程》2013年第3期162-166,共5页Computer Engineering

基　　金：江苏省自然科学基金资助项目(BK2011115)

摘　　要：为解决动态污点跟踪系统不能跨主机跟踪污点的问题,在Temu系统的基础上,提出基于应用程序编程接口Hook的污点跟踪方法。通过Hook插件完成对网络I/O函数的拦截,发送端Hook插件将污点数据和污染信息进行封装,接收端Hook插件解析数据包并根据污染信息对污点数据进行标记,由此实现跨主机动态污点跟踪。实验结果表明,基于该方法的原型系统可以实现跨主机污染传播,为动态污点跟踪技术在分布式环境中的应用提供支持。In order to solve the problem that taint tracking system can not realize cross-host dynamic taint tracking, based on Temu system, a taint tracking method based on Application Programming Interface（API） Hook is presented. It fulfills the interception of network I/O related system calls by Hook plug-ins, which embeds Hook services into API function calls to accomplish cross-host taint propagation. Taint data and information are encapsulated by Hook plug-in at sender. Hook plug-in analyzes data packets and marks taint data tainted according to taint information at receiver, so that cross-host dynamic taint tracking is realized. Experimental result indicates that the prototype system can implement cross-host taint propagation, which is helpful to application with dynamic taint tracking in distributed environment.

关 键 词：动态污点跟踪 Temu系统 数据流 动态二进制分析 应用程序编程接口Hook 

分 类 号：TP309.2[自动化与计算机技术—计算机系统结构]