摘要
针对大部分Web应用在反序列化漏洞防护措施上存在不足,只能在漏洞公开后实行应急措施,无法应对未公开的漏洞攻击的问题,文章通过对PHP反序列化机制的研究,将PHP的敏感函数调用栈作为研究出发点,以Web应用正常运行时的函数调用栈作为判定依据,实现了一个基于敏感函数调用栈的未知反序列化漏洞动态检测与拦截系统。通过对4个PHPWeb应用的6个反序列化漏洞的实验测试可知,该系统可成功拦截当前所有PHP反序列化漏洞攻击,并能够提取或回溯漏洞攻击所构造的POP攻击链,实现零误报。系统平均性能消耗为3.67%。
Most Web applications could not be able to defend the unknown PHP deserialization vulnerabilities attack. The common solution is making some emergency measures after the vulnerabilities have been disclosed. This article studies the PHP deserialization mechanism and takes the sensitive function call stack as a starting point for research. Taking the function call stack of Web application in normal running as the basis of judgment, this article implements an unknown PHP deserialization vulnerabilities dynamic detection and interception system based on the sensitive function call stack. Experimental tests of 6 deserialization vulnerabilities in 4 PHP Web applications show that the system can successfully intercept all current PHP deserialization vulnerabilities attacks and can extract or trace the POP attack chains constructed by the attacks. The system achieves zero false positives with an average performance cost of 3.67%.
作者
陈震杭
王张宜
彭国军
夏志坚
CHEN Zhenhang;WANG Zhangyi;PENG Guojun;XIA Zhijian(Key Laboratory of Aerospace Information Security and Trusted Computing, Ministry of Education, School of Cyber Science and Engineering, Wuhan University, Wuhan Hubei 430072, China;Baidu Inc., Beijing 100085, China)
出处
《信息网络安全》
CSCD
北大核心
2018年第4期47-55,共9页
Netinfo Security
基金
国家自然科学基金[61332019
61202387
61373168]
国家重点基础研究发展计划(973计划)[2014CB340600]
NSFC-通用技术基础研究联合基金[U1636107]