Abstract: The principle of buffer overflow and overflow string are analyzed.Then several typical real-time buffer overflow attacks detectionmethods are analyzed.At last, a real-time buffer overflow attack detection approach based on system calls is presented.This approach adds mandatoryaccess control to original system call function by the means of hijacking system calls.In the way of monitoring illegal system calls,it can detect andprevent various buffer overflow attacks of improving priviledge.

摘要： 分析了缓冲区溢出的原理和溢出字符串,然后对几种典型的缓冲区溢出实时检测技术进行了阐述,最后提出了一种基于系统调用的缓冲区溢出检测方法。该方法通过劫持系统调用的方式为原有的系统调用函数增加了强制访问控制功能,通过监测非法系统调用的方法来检测和阻止各种获取特权的缓冲区溢出攻击。

关键词: 缓冲区溢出, 实时检测, 系统调用

CLC Number: 

• TP393.08