期刊文献+

针对未知PHP反序列化漏洞利用的检测拦截系统研究 被引量:3

Research on Detection and Interception System for Unknown PHP Object Injection Exploit
下载PDF
导出
摘要 针对大部分Web应用在反序列化漏洞防护措施上存在不足,只能在漏洞公开后实行应急措施,无法应对未公开的漏洞攻击的问题,文章通过对PHP反序列化机制的研究,将PHP的敏感函数调用栈作为研究出发点,以Web应用正常运行时的函数调用栈作为判定依据,实现了一个基于敏感函数调用栈的未知反序列化漏洞动态检测与拦截系统。通过对4个PHPWeb应用的6个反序列化漏洞的实验测试可知,该系统可成功拦截当前所有PHP反序列化漏洞攻击,并能够提取或回溯漏洞攻击所构造的POP攻击链,实现零误报。系统平均性能消耗为3.67%。 Most Web applications could not be able to defend the unknown PHP deserialization vulnerabilities attack. The common solution is making some emergency measures after the vulnerabilities have been disclosed. This article studies the PHP deserialization mechanism and takes the sensitive function call stack as a starting point for research. Taking the function call stack of Web application in normal running as the basis of judgment, this article implements an unknown PHP deserialization vulnerabilities dynamic detection and interception system based on the sensitive function call stack. Experimental tests of 6 deserialization vulnerabilities in 4 PHP Web applications show that the system can successfully intercept all current PHP deserialization vulnerabilities attacks and can extract or trace the POP attack chains constructed by the attacks. The system achieves zero false positives with an average performance cost of 3.67%.
作者 陈震杭 王张宜 彭国军 夏志坚 CHEN Zhenhang;WANG Zhangyi;PENG Guojun;XIA Zhijian(Key Laboratory of Aerospace Information Security and Trusted Computing, Ministry of Education, School of Cyber Science and Engineering, Wuhan University, Wuhan Hubei 430072, China;Baidu Inc., Beijing 100085, China)
出处 《信息网络安全》 CSCD 北大核心 2018年第4期47-55,共9页 Netinfo Security
基金 国家自然科学基金[61332019 61202387 61373168] 国家重点基础研究发展计划(973计划)[2014CB340600] NSFC-通用技术基础研究联合基金[U1636107]
关键词 PHP反序列化漏洞 函数调用栈 安全防护 PHP object injection function call stack security protection
  • 相关文献

参考文献4

二级参考文献41

共引文献22

同被引文献14

引证文献3

二级引证文献16

相关作者

内容加载中请稍等...

相关机构

内容加载中请稍等...

相关主题

内容加载中请稍等...

浏览历史

内容加载中请稍等...
;
使用帮助 返回顶部