基于XML的面向二进制漏洞模式形式化描述研究

Research on Formal Description of Binary-Executable-Oriented Vulnerability Pattern based on XML

研究人员通过深入分析大量已公开漏洞的触发成因,将存在安全缺陷的代码抽象为漏洞模式。二进制静态漏洞挖掘技术的核心思想,就是在对二进制程序反汇编得到汇编代码的基础上,以漏洞模式为指导进行安全缺陷检测。文章对缓冲区溢出漏洞、数组越界漏洞、写污点值到污点地址漏洞模式进行了总结,并使用XML对漏洞模式作了形式化描述。

Researchers define as vulnerability pattern is a general feature of codes that contain security defect through deeply analyzing a mass of public known vulnerabilities＇underlying cause.The essence of static detection of vulnerability in binary program is detecting the security defects under the guidance of vulnerability pattern on the basis of disassembling.This paper summerise the pattern of buffer overflow vulnerability,arry overrun vulnerability and writing tainted value to tainted address vulnerability,then makes a description of every vulnerability pattern in XML.