基于Libsafe库的缓冲区溢出检测算法改进

Improved Algorithm for Buffer Overflow Detection Based on Libsafe Library

C/C++提供了很多高效的诸如strcpy等字符串操作库函数,但由于缺乏相应安全边界检查机制,存在着一些容易被攻击者利用的缓冲区溢出漏洞与威胁。讨论已有的Libsafe安全库增强机制并分析了其依赖于栈帧指针回溯栈活动记录的局限性。提出基于程序指令特征码匹配来回溯函数栈活动记录的Libsafe安全库增强方法。逐条匹配函数体指令与已知候选集指令来获取栈信息。并在追溯栈活动记录时,将已回溯到的栈活动记录用哈希函数保存,以返回地址作为关键字用链地址法进行检索。对改进版Libsafe安全库检测方法做了算法可行性和复杂度分析。从灵敏性、完整性、准确性、性能等几个方面做了实验与分析,表明该机制的高效性与可用性。

Due to the lack of boundary checking mechanism of C/C++,buffer overflow is one of the most serious attacks caused by the unsafe functions,such as strcpy.This paper firstly discussed the current mechanism of libsafe library and analyzed the drawbacks using stack frame pointer to look back upon the stack information.We proposed a method through matching the attribute code of instruction's opcode to look back upon the stack information.By matching each opcode with the candidate opcode,we could get the stack information.We also introduced hash function to store the stack information that have been computed and the return address is used as key of the hash function.We analyzed the feasibility and complexity of our improvement algorithm.Experiments were done from different perspectives of cushion,integrity,accuracy.Performance shows the effectiveness of the algorithm.