GECISM中“缓冲溢出类非我”的识别

Detection of Buffer-OverFlow Based on GECISM

缓冲区溢出攻击技术目前是一项广泛而基础的攻击技术,也是目前攻击技术的主要发展方向。缓冲溢出攻击常用手段就是通过改变程序的执行流程,转而去执行其植入的入侵代码,进而获得系统的root权限,对系统安全构成了巨大的威胁。该文在模仿生物免疫系统设计的计算机安全系统模型GECISM基础上构建了DAE Agent。通过RC4.5算法实对入侵训练集的系统调用序列进行规则提取,从而此代理实现了对缓冲溢出类入侵的检测。

Buffer-Overflow attacks has been the common and basic attack technology,and nowadays it is also the main direction of attack technology.The common method of buffer-overflow is to change the order of program execution in order to execute the code which is written by intruder.By this way,intruder can get the root access,and it willtake great threat to the system. The article constructs the DAE(Detecting and Eliminating)on the GECISM.The agent can detect intrusion with the rule which is formed by the RC4.5 Algorithm.