期刊文献+
任意字段
题名或关键词
题名
关键词
文摘
作者
第一作者
机构
刊名
分类号
参考文献
作者简介
基金资助
栏目信息

跨主机动态污点跟踪技术研究

Research on Cross-host Dynamic Taint Tracking Technology
下载PDF
导出
摘要 为解决动态污点跟踪系统不能跨主机跟踪污点的问题,在Temu系统的基础上,提出基于应用程序编程接口Hook的污点跟踪方法。通过Hook插件完成对网络I/O函数的拦截,发送端Hook插件将污点数据和污染信息进行封装,接收端Hook插件解析数据包并根据污染信息对污点数据进行标记,由此实现跨主机动态污点跟踪。实验结果表明,基于该方法的原型系统可以实现跨主机污染传播,为动态污点跟踪技术在分布式环境中的应用提供支持。 In order to solve the problem that taint tracking system can not realize cross-host dynamic taint tracking, based on Temu system, a taint tracking method based on Application Programming Interface（API） Hook is presented. It fulfills the interception of network I/O related system calls by Hook plug-ins, which embeds Hook services into API function calls to accomplish cross-host taint propagation. Taint data and information are encapsulated by Hook plug-in at sender. Hook plug-in analyzes data packets and marks taint data tainted according to taint information at receiver, so that cross-host dynamic taint tracking is realized. Experimental result indicates that the prototype system can implement cross-host taint propagation, which is helpful to application with dynamic taint tracking in distributed environment.
作者 任飞飞 庄洪林 吴礼发 潘璠
机构地区 中国人民解放军 解放军理工大学指挥信息系统学院
出处 《计算机工程》 CAS CSCD 2013年第3期162-166,共5页 Computer Engineering
基金 江苏省自然科学基金资助项目(BK2011115)
关键词 动态污点跟踪 Temu系统 数据流 动态二进制分析 应用程序编程接口Hook dynamic taint tracking Temu system data flow dynamic binary analysis Application Programming Interface（API）Hook
分类号 TP309.2 [自动化与计算机技术—计算机系统结构]
  • 相关文献

参考文献9

  • 1Newsome J, Song Dawn. Dynamic Taint Analysis for Automatic Detection, Analysis, and Signature Generation of Exploits on Commodity Software[C]//Proc. of the 12th Annual Network and Distributed System Security Symposium. San Diego, USA: [s. n.], 2005.
  • 2Yin Heng, Song Dawn, Egele M, et. al. Panorama: Capturing System-wide Information Flow for Malware Detection and Analysis[C]//Proc. of the 14th ACM Conference on Computer and Communications Security. New York, USA: ACM Press, 2007:116-127.
  • 3何永君,舒辉,熊小兵.基于动态二进制分析的网络协议逆向解析[J].计算机工程,2010,36(9):268-270. 被引量：11
  • 4Crandall J R, Chong Frederic. Minos: Control Data Attack Prevention Orthogonal to Memory Model[C]//Proc. of the 37th International Symposium on Micro Architecture. Oakland, USA: IEEE Press, 2004: 221-232.
  • 5Davis B, Chen Hao. DBTaint: Cross-application Information Flow Tracking via Databases[C]//Proc. of 2010 USENIX Conference on Web Application Development. Boston, USA: [s. n.], 2010.
  • 6Zhang Qing, McCullough J, Ma Justin, et. al. Neon: System Support for Derived Data Management[J]. ACM SIGPLAN Notices, 2010, 45(7): 63-74.
  • 7Yin Heng, Song Dawn. Temu: Binary Code Analysis via Whole-system Layered Annotative Execution[R]. Berkeley, USA: University of California, Tech. Rep.: UCB/EECS- 2010-3, 2010.
  • 8Song Dawn, Brumley D, Yin Heng, et. al. BitBlaze: ANew Approach to Computer Security via Binary Analysis[C]// Proc. of the 4th International Conference on Information Systems Security. Heidelberg, Germany: Springer-Verlag, 2008.
  • 9Bellard F. QEMU: A Fast and Portable Dynamic Translator[C]//Proc. of 2005 USENIX Annual Technical Conference. Berkeley, USA:[s. n.], 2005: 41-46.

二级参考文献7

  • 1Caballero J,Yin Heng,Liang Zhenkai,et al.Polyglot:Automatic Extraction of Protocol Format Using Dynamic Binary Analysis[C]// Proc.of the 14th ACM Conference on Computer and Communications Security.Alexandria,USA:[s.n.],2007.
  • 2Beddoe M.The Protocol Informatics Project[EB/OL].[2009-08-24].http://www.4tphi.net/~awalters/PI/PI.Html.
  • 3Cui Weidong,Kannan J,Wang H J.Discoverer:Automatic Protocol Reverse Engineering from Network Traces[C]//Proc.of the 16th Usenix Security Symposium.Boston,VA:USA:[s.n.],2007.
  • 4Lin Zhiqiang,Jiang Xuxian,Xu Dongyan,et al.Automatic Protocol Format Reverse Engineering Through Context-aware Monitored Execution[C]//Proc.of the 15th Symposium on Network and Distributed System Security.San Diego,California,USA:[s.n.],2008.
  • 5Cui Weidong,Peinado M,Chen K,et al.Tupni:Automatic Reverse Engineering of Input Formats[C]//Proc.of ACM Conference on Computer and Communications Security.Alexandria,VA,USA:[s.n.].2008.
  • 6Wondracek G,Comparetti P M,Kruegel C,et al.Automatic Network Protocol Analysis[C]//Proc.of the 15th Annual Network and Distributed System Security Symposium.San Diego,California,USA:[s.n.],2008.
  • 7Bruening D L.Efficient,Transparent,and Comprehensive Runtime Code Manipulation[D].Cambridge,USA:Massachusetts Institute of Technology,2004.

共引文献10

计算机工程
2013年 第3期

相关作者

内容加载中请稍等...

相关机构

内容加载中请稍等...

相关主题

内容加载中请稍等...

浏览历史

内容加载中请稍等...
;
使用帮助 返回顶部