一种基于虚拟执行与判定覆盖结合的Flash漏洞检测方法  

Flash vulnerability detection based on virtual execution and branch coverage

作　　者：彭程[1] 段桂华[1] 王湘新[2] 董苹苹[1] 郭克华[1] 

机构地区：[1]中南大学信息科学与工程学院,湖南长沙410083 [2]湖南省公安消防总队,湖南长沙410205

出　　处：《中南大学学报（自然科学版）》2013年第12期4910-4915,共6页Journal of Central South University:Science and Technology

基　　金：国家自然科学基金资助项目(61202494;61202341);湖南省科技计划重点项目(2011GK2008);新世纪优秀人才支持计划项目(NCET-10-0798);金属矿山安全技术国家重点实验室开放基金资助项目(2012KFJJ02)

摘　　要：基于Flash在网络上应用十分广泛,但一直以来不断出现许多严重的安全问题,提出并实现一种基于虚拟执行与判定覆盖相结合的Flash漏洞检测方法。对于待检测的Flash文件,通过对其进行反编译得到ActionScript代码;然后,分析其类结构,根据分析的结果生成多个虚拟执行流程,每个虚拟流程是对某一段代码的虚拟执行;最后,将虚拟流程的执行结果与漏洞规则进行匹配以判断是否包含漏洞。测试结果表明:所提出的漏洞检测方法具有误判率低、执行效率高的特点。Based on the fact that Flash has many serious security problems through widely used in the Intemet, a detection method for Flash vulnerability based on virtual execution and branch coverage was proposed. Firstly, Flash file was decompiled and scanned to get the ActionScript code. Secondly, the class structure was analyzed and multiple virtual execution processes were generated according to the analysis. Finally it was determined whether the Flash file contained vulnerabilities after each virtual execution process. The results indicate that the method has advantages of low false positives and high execution efficiency.

关 键 词：FLASH 漏洞检测 虚拟执行 网络安全 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]