Abstract: Combining with the principles of the produce to buffer overflow attack, this paper analyzes the structure of buffer overflow attack codes, and describes the Snort rules used for buffer overflow attack inspection. It constructs a state-graph-based analysis model of buffer overflow attack, which has theoretical and practical meaning to buffer overflow attack analysis and prevention.

Key words: buffer overflow attack, state graph, Snort rule

摘要： 结合缓冲区溢出攻击产生的原理，分析缓冲区溢出攻击代码的结构，论述Snort规则对缓冲区溢出攻击的检测，在此基础上构建一个基于状态图的缓冲区溢出攻击的分析模型。该模型对于进一步明确缓冲区溢出攻击过程和完善缓冲区溢出攻击的检测和防御有很大的理论和实际意义。

关键词: 缓冲区溢出攻击, 状态图, Snort规则

CLC Number: 

• TP309