摘要
近年来,随着计算机网络的广泛应用,基于文件格式的软件漏洞检测技术成为软件安全领域的一个研究热点。文章首先对MS Office和Adobe PDF的文件格式进行分析,在对传统漏洞检测技术研究的基础上,提出了3种文档类漏洞检测技术,分别为基于污点数据结构的静态检测技术、基于污点数据流的动态检测技术和基于行为的启发式检测技术;接着完成了典型文档类CVE漏洞检测工具的设计与实现;最后在仿真平台上对工具进行测试,测试结果表明,文章提出的漏洞检测工具与同类工具相比,具有更高的检测率。
Recently, with the wide development of computer network, file format-based software vulnerability detection technology has become one of the research hotspots of information security. This paper ifrstly analyzes the ifle formats of Microsoft Ofifce and Adobe PDF. On the basis of the study on traditional vulnerability detection techniques, three document vulnerability detection methods are put forward：static detection method based on tainted data structure, dynamic detection method based on tainted data lfow, heuristic detection method based on behavior. Then the typical document class CVE vulnerability detection tool is realized and is experimented in the simulation platform. The results show that comparing with similar tools, the tool proposed in this paper has a higher detection rate.
出处
《信息网络安全》
2014年第6期18-22,共5页
Netinfo Security
基金
国家自然科学基金[61170282]
