论文部分内容阅读
根据shellcode的API函数及系统调用对栈帧的影响,定义了EBP异常、Ret异常和长度异常,并在此基础上提出了基于栈异常的shellcode检测方法——S-Tracker.该方法遍历特定敏感API函数的栈帧链、检测异常、定位漏洞函数和Shellcode代码,并采用栈帧重构解决了栈帧中的EBP缺失或破坏的问题.实验结果表明:S-Tracker能有效检测到基于普通shellcode、混合型shellcode以及纯ROP shellcode的攻击行为,具备追踪shellcode分布区域和EIP跳转函数的功能,且其性能开销较小、没有误报;与微软EMET工具相比,STracker在内核层实现,更加难以被攻击者绕过.
Based on the shellcode API function and the system call’s impact on the stack frame, EBP anomaly, Ret anomaly and length anomaly are defined, and based on this, a shellcode detection method based on stack anomaly is proposed-S-Tracker. This method traverses the specific sensitive API function stack frame chain, detection anomaly, positioning vulnerability function and Shellcode code, and the use of stack frame reconstruction to solve the problem of EBP missing or damaged stack frame.Experimental results show that: S-Tracker can effectively detect based on ordinary shellcode , Hybrid shellcode, and pure ROP shellcode, with the ability to track shellcode distribution areas and EIP jump functions with low performance overhead and no false positives; compared to Microsoft EMET tools, STracker is implemented at the kernel level and more Difficult to be attacked bypassed.