采用控制流监控的Cisco IOS指针攻击检测方法  

A Method for Detecting Cisco IOS Pointer Attack Using Control Flow Monitoring

作　　者：刘胜利[1] 邹睿[1] 彭飞[1] 武东英[1] 肖达[1] 

机构地区：[1]中国人民解放军信息工程大学数学工程与先进计算国家重点实验室,郑州450000

出　　处：《西安交通大学学报》2015年第12期65-70,111,共7页Journal of Xi'an Jiaotong University

基　　金：国家科技支撑计划资助项目(2012BAH47B01);国家自然科学基金资助项目(61271252)

摘　　要：针对当前Cisco IOS(internetwork operating system)漏洞攻击检测方法检测效率低的问题,提出了一种采用控制流监控来判定Cisco IOS指针攻击的方法。该方法通过静态分析和动态跟踪相结合的方式对Cisco IOS中不同类别的控制流分别构造合法转移地址集合(legal transfer address collection,LTAC),并在发生控制流转移时将转移地址在LTAC之外的控制流判定为攻击,同时捕获异常控制流转移的详细信息。实验结果表明:该方法可以准确地捕获针对Cisco IOS的指针攻击,支持对攻击过程的分析,与现有的Cisco IOS漏洞攻击检测方法相比,具有较高的检测效率,能够为网络安全性的提升提供帮助。A method to detect Cisco IOS（internetwork operating system）pointer attacks using control flow monitoring is proposed to solve the problem that current methods for detecting exploit attacks have low detection efficiency.Legal transfer address collection（LTAC）is constructed for different categories of control flows through a combination of static analysis and dynamic tracking.When an event of control flow transfer occurs,the control flow with jump address out of LTAC will be determined to be an attack and the details of the exception control flow transfer can be captured.Experimental results show that the proposed method can accurately capture pointer attacks against Cisco IOS,and support the analysis of attack process.Comparisons with the current detection methods show that the proposed method has higher detection efficiency,and can help to enhance network security.

关 键 词：CISCO IOS 指针攻击 控制流监控 网络安全 攻击检测 

分 类 号：TP309.08[自动化与计算机技术—计算机系统结构]