| 15 | 0 | 7 |
| 下载次数 | 被引频次 | 阅读次数 |
缓冲区溢出攻击技术目前是一项广泛而基础的攻击技术,也是目前攻击技术的主要发展方向。缓冲溢出攻击常用手段就是通过改变程序的执行流程,转而去执行其植入的入侵代码,进而获得系统的root权限,对系统安全构成了巨大的威胁。该文在模仿生物免疫系统设计的计算机安全系统模型GECISM基础上构建了DAE Agent。通过RC4.5算法实对入侵训练集的系统调用序列进行规则提取,从而此代理实现了对缓冲溢出类入侵的检测。
Abstract：Buffer-Overflow attacks has been the common and basic attack technology,and nowadays it is also the main direction of attack technology.The common method of buffer-overflow is to change the order of program execution in order to execute the code which is written by intruder.By this way,intruder can get the root access,and it willtake great threat to the system. The article constructs the DAE(Detecting and Eliminating)on the GECISM.The agent can detect intrusion with the rule which is formed by the RC4.5 Algorithm.
[1]张晓磊,张晓明.基于堆栈的缓冲区溢出攻击原理[J].广州大学学报.2004,3(4):329-331.
[2]王凤先,刘振鹏,余小雅.一种计算机免疫系统的总体模型[J].小型微型计算机系统,2003,24(4):698-701.
[3]杨向荣,沈钧毅,罗浩.人工免疫原理在网络入侵检测中的应用[J].计算机工程.2003,29(6):30-31.
[4]刘圣卓.Linux下的缓冲溢出攻击技术研究[D].郑州:中国人民解放军信息工程大学,2003.
[5]陈莉君.深入分析Linux内核源码[M].北京:人民邮电出版社,2002.
[6]张威.Linux信号机制解析[J].现代电子技术,2006,(11):115-117.
[7]Provos N,Improving Host Security with System Call Policies[C]//Proceedings of the12th USENIX Security Symposium,August 2003:257-272.
[8]XU Ming+,CHEN Chun,YING Jing.Anomaly Detection Based on System Call Classification[J].Journal of Software,2004,15(3):393.
[9]张雅静,侯朝桢.一种基于生物免疫原理的计算机抗病毒策略[J].计算机工程.2003,29(6):30-31.
[10]李珍,王凤先,余小雅.GECISM中沙盒主机的“非我”检测与分类[J].计算机工程与应用.2005,35:130-131.
基本信息:
中图分类号:TP393.08
引用信息:
[1]崔静,李宁,李方.GECISM中“缓冲溢出类非我”的识别[J].微型电脑应用,2009,25(08):47-49+6.
2009-08-20
2009-08-20