|
|
- 2016
基于污点分析和符号执行的漏洞签名生成方法
|
Abstract:
漏洞签名是指触发程序漏洞的输入的集合, 利用漏洞签名对程序输入进行过滤是一种有效的保护漏洞程序的方法。该文主要研究漏洞签名的生成技术, 提出了一种有效的基于污点分析和符号执行的漏洞签名生成方法, 它通过污点信息传播定位输入中的与触发漏洞相关的字节, 然后, 通过符号执行得到路径约束, 并通过约束求解得到最终的漏洞签名。基于开源项目Pin和Z3, 该文构建了基于污点分析和符号执行的漏洞签名生成原型系统TASEVS, 并对漏洞程序进行了验证。实验结果表明, TASEVS能有效地生成漏洞签名。
Abstract：A vulnerability signature matches a set of inputs which trigger software vulnerability. Application of vulnerability signature to input filtering is one of the most popular and effective defense mechanisms for protecting vulnerable programs against exploits. A method for generating vulnerability signature was developed using taint analysis and symbolic execution. The method locates bytes in input that direct execution to vulnerable points using taint analysis. Path constraints are generated via dynamic symbolic execution with the final vulnerability signature obtained through constraint solving.A proof-of-concept system, TASEVS, was implemented based on instrumentation tool Pin and constraint solver Z3. Experimental results show that the TASEVS can effectively generate vulnerability signature.
| [1] | Borisov N, Brumley D. Ageneric application-level protocol parser analyzer and its language [C]//Proceedings of the 14th Annual Network and Distributed System Security Symposium. San Diego, USA: The Internet Society, 2007: 89-95. |
| [2] | Costa M, Crowcroft J, Castro M. Vigilante: End-to-end containment of internet worms [C]//Proceedings of the 20th ACM Symposium on Operating System Principles. Chicago, USA: ACM, 2005: 133-147. |
| [3] | King J. Symbolic execution and program testing [J]. Communications of the ACM, 1976, 19(7): 385-394. |
| [4] | Moore D, Paxson V, Savage S, et al. Inside the slammer worm [C]//Proceedings of IEEE Security and Privacy. New York, USA: IEEE Press, 2003: 33-39. |
| [5] | 严俊, 郭涛, 阮辉, 等. JUTA: 一个Java 自动化单元测试工具 [J]. 计算机研究与发展, 2010, 47(10): 1840-1848.YAN Jun, GUO Tao, RUAN Hui, et al. JUTA: An automated unit testing framework for Java [J]. Journal of Computer Research and Development, 2010, 47(10): 1840-1848. (in Chinese) |
| [6] | Song D, Brumley D, Yin M, et al. BitBlaze: A new approach to computer security via binary analysis [C]//Proceedings of the 4th International Conference on Information Systems Security. New York, USA: ACM Press, 2008: 147-162. |
| [7] | Wang H, Guo C, Simon D. Shield: Vulnerability-driven network filters for preventing known vulnerability exploits [C]//Proceedings of the 2004 ACM SIGCOMM Conference. Chicago, USA: ACM, 2004: 193-204. |
| [8] | Brumley D, Wang H, Song D. Creating vulnerability signatures using weakest pre-conditions [C]//Proceedings of IEEE Computer Security Foundations. Venice, Italy: IEEE Press, 2007: 311-325. |
| [9] | Costa M, Castro M, Zhou L. Bouncer: Securing software by blocking bad input [C]//Proceedings of ACM Symposium on Operating Systems Principles. Chicago, USA: ACM, 2007: 117-130. |
| [10] | Cui W, Peinado M, Wang H. Shieldgen: Automatic data patch generation for unknown vulnerabilities with informed probing [C]//Proceedings of IEEE Symposium on Security and Privacy. Berkeley, USA: IEEE Press, 2007: 252-266. |
| [11] | Paxson V. Bro: A system for detecting network intruders in real-time [C]//Proceedings of the 7th USENIX Security Symposium. San Antonio, Texas, 1998. |
| [12] | Schear N, Albrecht D, Borisov N. High-speed matching of vulnerability signatures [C]//Proceedings of the 11th International Symposium on Recent Advances in Intrusion Detection. Berlin, Germany: Springer, 2008: 155-174. |
| [13] | Li Z, Xia G, Gao H, et al. NetShield: Massive semantics-based vulnerability signature matching for high-speed networks [J]. ACM Sigcomm Computer Communication Review, 2010, 40(4): 279-290. |
| [14] | Denning D. Alattice model of secure information flow [C]//Proceedings of Communications of the ACM. Chicago, USA: ACM, 1976: 236-243. |
| [15] | Schwartz E, Avgerinos T, Brumley D. All you ever wanted to know about dynamic taint analysis and forward symbolic execution [C]//Proceedings of IEEE Symposium on Security and Privacy. New York, USA: IEEE Press, 2010: 317-331. |
| [16] | Lam M, Martin M, Livshits B. Securing web applications with static and dynamic information flow tracking [C]//Proceedings of the 2008 ACM SIGPLANSymposium on Partial Evaluation and Semantics-based Program Manipulation. Chicago, USA: ACM, 2008: 3-12. |
| [17] | Newsome J, Song D. Dynamic taint analysis for automatic detection, analysis, and signature generation of exploits on commodity software [C]//Proceedings of the 2007 International Symposium on Software Testing and Analysis. New York, USA: ACM, 2005: 104-123. |
| [18] | Drewry W, Ormandy T. Flayer: Exposing application internals [C]//Proceedings of USENIX Workshop on Offensive Technologies. Berkeley, USA: ACM, 2007: 1-9. |
| [19] | Barrett C, Sebastiani R, Seshia S, et al. Handbook of Satisfiability [M]. Amsterdam: IOS Press, 2009.Vijay G. STP[EB/OL]. (2014-10-10). http://people.csail.mit.edu/Vganesh/STP_files/stp.html. |
| [20] | Vijay G. STP[EB/OL]. (2014-10-10). http://people.csail.mit.edu/Vganesh/STP_files/stp.html. |
| [21] | 吴世忠, 刘晖, 郭涛, 等. 信息安全漏洞分析基础 [M]. 北京: 科学出版社, 2013.WU Shizhong, LIU Hui, GUO Tao, et al. Fundamentals of information security vulnerability analysis [M]. Beijing: Science Press, 2013. (in Chinese) |
| [22] | Déjà vu Security. Peach[Z/OL]. (2014-10-10). http://peachfuzzer.com/. |
| [23] | Pedram A. Sulley[Z/OL].(2014-10-10). http://code.google.com/p/sulley/. |
| [24] | Song D, Brumley D, Yin M, et al. BitBlaze: A new approach to computer security via binary analysis [C]//Proceedings of the 4th International Conference on Information Systems Security. New York, USA: ACM Press, 2008: 147-162. |
| [25] | Newsome J, Dawn S. Vulnerability-specific execution filtering for exploit prevention on commodity software [C]//Proceedings of the 13th Annual Network and Distributed System Security Symposium. San Diego, USA: The Internet Society, 2006: 1-14. |
| [26] | Gallaire H. Logic programming: Future developments [C]//IEEE Symposium on Logic Programming. Boston, USA: IEEE Press, 1985: 88-96. |
| [27] | Moura L, Bjorner N. Z3: An efficient SMT solver [M]//Tools and Algorithms for the Construction and Analysis of Systems. Berlin, Germany: Springer, 2008: 337-340. |
