一种针对C程序缓冲区溢出漏洞的层次式静态检测方法研究

发布时间：2018-03-09 15:41

本文选题：缓冲区溢出漏洞　切入点：静态检测工具　出处：《内蒙古师范大学》2014年硕士论文　论文类型：学位论文

【摘要】：随着缓冲区溢出漏洞问题在信息安全领域引起了越来越多的关注，人们在如何提高缓冲区溢出漏洞检测的精度方面，开展了一系列的方法研究。本文针对C程序缓冲区溢出漏洞，提出一种层次式静态检测方法。该方法分为三个部分：检测模块（第一层次）；筛选模块（第二层次）；输出模块。其中，检测模块属于检测漏洞的第一层次，该模块基于几款经典的词法检测工具，采用可信度工具模型构造具有可扩展性的可信危险函数数据库，并能嵌入检测缓冲区溢出漏洞的静态工具，达到降低检测工具误报和漏报的目的；筛选模块属于检测漏洞的第二层次，该模块利用检测模块的输出结果中的警告信息，采用静态后向切片技术，进一步降低误报，基于输出结果的警告信息提取警告程序切片，并将其形式化成布尔公式通过SAT求解器验证警告程序切片的真假性；输出模块是对前两个模块的汇总，，用于综合第一层次检测模块和第二层次筛选模块的分析结果作为检测工具最终的输出结果进而提高检测工具的精确度。实验结果表明，本文提出的针对C程序缓冲区溢出漏洞的层次式静态检测方法，能够从一定程度上解决轻量级静态检测工具的高误报和高漏报问题。与原工具的检测结果相比，能够从一定程度上提高检测工具的精确度和可信度，进而大大减少安全审查人员的工作量。
[Abstract]:As buffer overflow vulnerability has attracted more and more attention in the field of information security, a series of research methods have been carried out on how to improve the accuracy of buffer overflow vulnerability detection. This paper presents a hierarchical static detection method for buffer overflow vulnerability in C program. The method is divided into three parts: detection module (first layer), filter module (second layer), output module. The detection module belongs to the first level of vulnerability detection. Based on several classical lexical detection tools, the credibility tool model is used to construct the extensible trusted risk function database. The static tool for detecting buffer overflow vulnerability can be embedded to reduce the false positives and omissions of detection tools, and the filter module belongs to the second level of vulnerability detection, and the module uses the warning information in the output result of the detection module. The static backward slicing technique is used to further reduce the false positives, and the warning program slices are extracted based on the warning information of the output results, and its form is transformed into Boolean formula to verify the truthfulness and falsity of the warning program slices through the SAT solver. The output module is a summary of the first two modules, which is used to synthesize the analysis results of the first level detection module and the second level screening module as the final output result of the detection tool and improve the accuracy of the detection tool. The experimental results show that the hierarchical static detection method for C program buffer overflow vulnerability is proposed in this paper. It can solve the problems of high false positives and high false positives of lightweight static detection tools to a certain extent. Compared with the detection results of the original tools, it can improve the accuracy and credibility of the detection tools to a certain extent. This greatly reduces the workload of the security censors.
【学位授予单位】：内蒙古师范大学
【学位级别】：硕士
【学位授予年份】：2014
【分类号】：TP393.08

【共引文献】