基于k循环随机序列的动态缓冲区溢出防御

Dynamic Buffer Overflow Prevention Based on k Circular Random Sequence

面向Intel 80×86体系结构和C/C++语言,介绍了栈缓冲区溢出攻击的基本原理及攻击模式,分析了现有的动态防御典型方案的优点与不足.结合基于随机地址空间与签名完整性的防御思想,提出了一种基于k循环随机序列的动态缓冲区溢出防御方案.该方案能够在极大概率下防御多种模式的缓冲区溢出攻击,解决了"连续猜测攻击"的问题,并使软件具有一定的容侵能力.

The paper presents an analysis of the principle of stack buffer overflow attacks and basic attack patterns for Intel 80×86 architecture and C/C＋＋.Then,the merits and drawbacks of the existing dynamic buffer overflow prevention methods are discussed.On the basis of the address obfuscation and integrity checking,this paper presents a new dynamic buffer overflow prevention method based on k circular random sequence.This improved prevention method can defend attacks of multiple patterns with high probability and enhance the intrusion-tolerance capability of the vulnerable software.