一种Cisco IOS内存溢出攻击检测方法  

Memory overflow attack detection method for Cisco IOS

作　　者：彭飞 武东英 刘胜利 肖达 王东霞 

机构地区：[1]数学工程与先进计算国家重点实验室,郑州450000 [2]信息保障技术重点实验室,北京100101 [3]信息系统安全技术重点实验室,北京100101

出　　处：《计算机应用研究》2016年第6期1785-1790,共6页Application Research of Computers

基　　金：国家科技支撑计划基金资助项目(2012BAH47B01);国家自然科学基金资助项目(61271252);信息保障技术重点实验室开放基金资助项目(KJ-14-105)

摘　　要："棱镜门"事件的曝出,使得Cisco路由器的安全性问题越来越受到重视。从提升网络环境安全性的角度出发,提出了一种基于动态污点分析的Cisco IOS内存溢出攻击检测方法。首先,通过分析Cisco IOS的指令格式,根据指令的特点制定相应的污点传播规则,实现了对Cisco IOS的动态污点分析;其次,通过定位Cisco IOS中的安全库函数来确定安全性检测点,并通过检查安全库函数参数的污点属性来判定攻击。实验结果证明,该方法可以有效地检测针对Cisco IOS的内存溢出攻击,并可以追踪攻击的来源,有利于网络安全性的提升。The exposure of ＂prism＂,making the Cisco router＇s security issues receive more and more attention. From the point of enhancing the cyper security,this paper proposed a memory overflow attack detection method based on dynamic taint analysis for Cisco IOS. Firstly,by analyzing the command format of Cisco IOS,it made different taint propagation rules for appropriate instructions and realizes the dynamic tainted analysis of Cisco IOS. Secondly,by positioning the security library functions in Cisco IOS to detectmine the safety detection points,it determined attack based on the taint property checking of parameters of security library functions. Experiment results demonstrate that the method can effectively detect the memory overflow attack to Cisoc IOS,trace the source of attack and is helpful to enhance the security of network.

关 键 词：CISCO IOS 内存溢出 动态污点分析 网络安全 攻击检测 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]