Vulnerability testing method in attack and system thereof

Abstract

The invention discloses a vulnerability testing method in attack and a system thereof, belonging to the field of network security. The method comprises: after programs which are analyzed is loaded into a virtual machine, whether the current running process of the virtual machine belongs to the analyzed program is recognized; if yes, whether the current code is in circulation is judged, the current status information is recorded when in circulation; if not, whether the current program is in attack is judged; if being in attack, the state s before variable which is depended by the last time program pointer can be looked for from the current recorded status information; the status information saved in the s is restored, and the program starts to run again from the state s; the concrete command which modifies the variable depended by the program pointer is found out, and the position of the command is returned; the system of the invention comprises a virtual environment module, a state selection module, a system monitoring module, a vulnerability-analysis module and a status record module. The invention has good maneuverability and high detection efficiency, and solves the problem that business software lacks a source code and can not be analyzed.

Description

technical field [0001] The present invention mainly relates to a method and system for detecting a loophole, in particular to a method and system for detecting a loophole during an attack, and belongs to the field of network security. Background technique [0002] Unknown vulnerabilities are the first-hand information that hackers and software developers hope to be the first to know. For hackers, if they obtain a certain number of unknown vulnerabilities, they can enter computers with corresponding vulnerabilities at will, carry out privilege escalation, and even further cause greater damage. With the continuous development of the network and the continuous increase of the number and types of various software, the harm caused by unknown vulnerabilities is more obvious. Most harmful worms are almost always the product of unknown vulnerabilities. For example, the well-known Shockwave utilizes Microsoft's MS03-026 vulnerability, Sasser utilizes Microsoft's MS04-011 vulnerabil...

AI Technical Summary

Problems solved by technology

However, the uncertainty of the executable program itself greatly reduces the accuracy of the analysis results, such as indirect jumps, pointer aliases, etc., which are currently difficult to solve in static analysis

Software protection technology also increases the difficulty of analysis, such as polymorphism, deformation, encryption, etc., forcing static analysis or even decompiling effective code

Images