软件漏洞自动利用研究综述

Summary of research on software vulnerability auto exploit

近年来,软件漏洞已成为系统安全与攻防对抗的核心要素,随着软件数量的增加和规模的复杂化,漏洞数量逐年增加,而依赖于人工的漏洞分析与利用生成已难以满足现实需求,漏洞的自动分析和利用生成是亟待解决的难点问题.现有研究已经取得了相关的成果,文章从控制流劫持漏洞自动利用、面向堆漏洞的自动分析与利用、安全机制自动化对抗方法和综合性的漏洞自动利用框架等四个方面介绍当前软件漏洞自动利用研究进展,进而分析未来软件漏洞自动利用发展趋势.

With the complexity of software increasing year by year, software security vulnerability has become one of the root factors of cyber-security threats. However, it is hard to meet the needs of vulnerability analysis and exploitation on labor. To analyze and exploit the vulnerabilities automatically in time, researchers have proposed several techniques, some of which can get good results. This paper presents a summary of the recent advances in four aspects, which include: control flow hijacking vulnerabilities automatic exploitation, heap-oriented vulnerabilities automatic analysis and exploitation, security mechanism automatic countermeasure, and the comprehensive framework of vulnerability automatic exploitation. Finally, we conclude the tendency of software vulnerability automatic exploitation to shed lights on potential future directions.