基于代码执行模拟的远程缓冲区攻击检测方法

A new approach of network buffer overflow detection based on code execution simulation

分析了缓冲区溢出攻击的原理和方法,提出了一种新的通用网络缓冲区溢出的检测方法,此检测方法通过代码执行模拟计算网络报文中含有的可执行代码序列的最大长度来进行缓冲区溢出的网络检测.实验证明,该检测方法不仅能快速有效地检测传统的远程缓冲区溢出的攻击,而且还可以检测变形的shellcode.

After the analysis of the principles and methods of buffer overflow, we presented a new approach that is Code Execution Simulation （CES） to detect network remote buffer overflow. This approach was based on the calculation of the maximum executive length in packets by code execution simulation. The experiment result shows that this approach is effective and quick to detect classical network buffer overflow as well as polymephic shellcode.