操作系统行为理论模型及典型应用研究  

Research on the theory and typical applications of operating system behavior

作　　者：祝林 邬江 刘克斌 钟杰 Zhu Lin;Wu Jiang;Liu Kebin;Zhong Jie(CLP Great Wall Internet Security Technology Research Institute(Beijing)Co.,Ltd.,Beijing 100097,China)

机构地区：[1]中电长城网际安全技术研究院(北京)有限公司,北京100097

出　　处：《网络安全与数据治理》2024年第12期27-32,共6页CYBER SECURITY AND DATA GOVERNANCE

摘　　要：针对当前终端网络安全攻防对抗中未知攻击“防不住”、已知攻击“测不准”的问题,现用“封堵管控”安全机制可被攻击方屏蔽规避,为扭转当前终端安全防护的被动落后现状,亟需在终端安全检测理论、安全检测分析模型与实际应用上实现创新突破。文章将操作系统行为进行了形式化定义,并基于形式化定义设计了操作系统行为分析模型,然后以缓冲区溢出攻击与终端数据泄露攻击为典型示例验证其方法正确性。In response to the problem of unknown attacks being"undetectable"and known attacks being"unpredictable"in current terminal network security attacks and defenses,the current"blocking and control"security mechanism can be blocked or avoided by attackers.In order to reverse the passive backwardness of terminal security protection,it is needful to achieve innovative breakthroughs in terminal security detection theory,security detection analysis models,and practical applications.This study formalized the behavior of the operating system and designed an operating system behavior analysis model based on the formal definition.Then,buffer overflow attacks and terminal data leakage attacks were used as typical examples to verify the correctness of the method.

关 键 词：行为测量 操作系统行为 安全检测 终端防护 

分 类 号：TP309[自动化与计算机技术—计算机系统结构] TP391[自动化与计算机技术—计算机科学与技术]