Data flow analysis based hostile attack detecting method

Abstract

The invention relates to an attack detection method of computer security vulnerability. A detection system is composed of a dummy executing component, a data marking component, a data tracking component, a misuse detection component and a vulnerability analyzing component. The method comprises starting a program to be monitored by the dummy executing component, generating tainted data structure by the data marking component when an external input data is present, marking the propagated tainted data by the data tracking component, determining by the misuse detection component whether the use of the tainted data breaks the security rule and configuration, and collecting and analyzing information associated with the security vulnerability by the vulnerability analyzing component. The invention is suitable for hostile attack detection and analysis of security vulnerability during program running, thereby preventing the hostile attack behavior and providing the detailed information of the security vulnerability. The invention can detect most of the overflow security vulnerabilities without the need of source codes and with a zero misreport rate, and can provide sufficient information for automatically generating patches for the security vulnerability.

Description

technical field [0001] The invention relates to a malicious attack detection method based on data flow analysis, and belongs to the related fields of system security and network security. The invention is used for the detection and protection of the dynamic safety loophole of the running program. Background technique [0002] The current intrusion detection methods can be mainly divided into three categories, namely misuse detection and anomaly detection. Misuse detection detects intrusions by analyzing and expressing intrusion behaviors. This method generally expresses intrusion behaviors as a pattern or feature, and establishes an intrusion pattern feature library based on known intrusion behaviors and system defects. The actual behavior pattern of the monitored system or user is matched with the intrusion pattern, and whether there is an intrusion is judged according to the matching result. Misuse detection has a strong ability to detect known intrusions, but its disadv...

AI Technical Summary

Problems solved by technology

The advantage of anomaly detection is that it does not require too much knowledge about system defects, has strong adaptability, and can detect unknown intrusions or new intrusion patterns, but this method has the disadvantage of high false positive probability

Images