一种抗地址淹没的缓冲区栈溢出算法

Anti-address flooding algorithm for buffer stack overflow

缓冲区溢出是常见的网络漏洞攻击,其中最重要的是栈溢出攻击。通过分析缓冲区溢出攻击的方法和特点,提出一种基于Stack Shield改进的Ret Protect算法。首先利用IDA Pro对源程序反汇编分析,然后建立新的库函数,并通过修改GCC源代码来实现程序执行时对函数返回地址的备份的方法来检测缓冲区溢出攻击的发生。与其他栈溢出攻击检测方法相比,Ret Protect算法可有效地阻止对返回地址进行淹没的栈溢出攻击,对用户透明,系统兼容性好。

Buffer overflow is common network vulnerability,and the most important one is the stack overflow attack. By analyzing the methods and characteristics of buffer overflow attacks,this paper proposed an improved Ret Protect algorithm based on Stack Shield. This algorithm used IDA Pro for the disassembly analysis of the source program,and then established a new library function. It detected the occurrence of buffer overflow attacks by modifying the GCC source code to realize the backup of the function return address when the program executed. Compared with other stack overflow attack detection methods,the Ret Protect algorithm can effectively prevent the stack overflow attacks on the return address overlay,which is transparent to the user and good compatibility.