采用控制流监控的Cisco IOS指针攻击检测方法

刘胜利; 邹睿; 彭飞; 武东英; 肖达

doi:10.7652/xjtuxb201512011

您当前的位置：

首页 >

文章列表页 >

采用控制流监控的Cisco IOS指针攻击检测方法

更新时间：2025-07-09

- 采用控制流监控的Cisco IOS指针攻击检测方法
- A Method for Detecting Cisco IOS Pointer Attack Using Control Flow Monitoring
- 西安交通大学学报 2015年49卷第12期页码：65-70+111
- 作者机构：
  
  中国人民解放军信息工程大学数学工程与先进计算国家重点实验室,郑州,450000
- 作者简介：
- 基金信息：
  
  : 2015-04-22。作者简介: 刘胜利(1973—),男,副教授。基金项目: 国家科技支撑计划资助项目(2012 BAH47B01);国家自然科学基金资助项目(61271252)
- DOI：10.7652/xjtuxb201512011
  中图分类号： TP309.08
- 网络首发：2015-12-10，
  
  纸质出版：2015
- 稿件说明：
移动端阅览
刘胜利, 邹睿, 彭飞, 等. 采用控制流监控的Cisco IOS指针攻击检测方法[J]. 西安交通大学学报, 2015,49(12):65-70+111.

A Method for Detecting Cisco IOS Pointer Attack Using Control Flow Monitoring[J]. 2015, 49(12): 65-70+111.
刘胜利, 邹睿, 彭飞, 等. 采用控制流监控的Cisco IOS指针攻击检测方法[J]. 西安交通大学学报, 2015,49(12):65-70+111. DOI： 10.7652/xjtuxb201512011.

A Method for Detecting Cisco IOS Pointer Attack Using Control Flow Monitoring[J]. 2015, 49(12): 65-70+111. DOI： 10.7652/xjtuxb201512011.

摘要

针对当前Cisco IOS(internetwork operating system)漏洞攻击检测方法检测效率低的问题

提出了一种采用控制流监控来判定Cisco IOS指针攻击的方法。该方法通过静态分析和动态跟踪相结合的方式对Cisco IOS中不同类别的控制流分别构造合法转移地址集合(legal transfer address collection

LTAC)

并在发生控制流转移时将转移地址在LTAC之外的控制流判定为攻击

同时捕获异常控制流转移的详细信息。实验结果表明:该方法可以准确地捕获针对Cisco IOS的指针攻击

支持对攻击过程的分析

与现有的Cisco IOS漏洞攻击检测方法相比

具有较高的检测效率

能够为网络安全性的提升提供帮助。

Abstract

A method to detect Cisco IOS(internetwork operating system)pointer attacks using control flow monitoring is proposed to solve the problem that current methods for detecting exploit attacks have low detection efficiency. Legal transfer address collection(LTAC)is constructed for different categories of control flows through a combination of static analysis and dynamic tracking. When an event of control flow transfer occurs

the control flow with jump address out of LTAC will be determined to be an attack and the details of the exception control flow transfer can be captured. Experimental results show that the proposed method can accurately capture pointer attacks against Cisco IOS

and support the analysis of attack process. Comparisons with the current detection methods show that the proposed method has higher detection efficiency

and can help to enhance network security.

关键词

Keywords

references

IDC. IDC's worldwide quarterly Ethernet switch and router tracker shows record ethernet switch market size, weaker router market [EB/OL].(2014-12-03)[2015-03-15]. http: ∥www.idc.com/getdoc.jsp?containerId=prUS25266314.[2] LINDER F. Design and software vulnerability in embedded system [EB/OL].(2003-04-25)[2014-08-19]. https: ∥www.blackhat.com/presentation/bh-usa-03/bh-us-03-fx.pdf.

LYNN M. The holy grail: Cisco IOS shellcode and exploitation techniques [EB/OL].(2005-11-12)[2014-10-14]. http: ∥cryptome.org/lynn-cisco.pdf.

MUNIZ S. Killing the myth of Cisco IOS rootkits: DIK(Da IOS rootKit)[EB/OL].(2008-03-26)[2014-06-19]. http: ∥www.coresecurity.com/content/killing-the-myth-cisco-ios.pdf.

LINDER F. Cisco IOS router exploitation [EB/OL].(2009-06-22)[2014-09-02]. http: ∥www.blackhat. com/presentations/bh-usa-09/Linder/BH_US_09_

Linder_RouterExploit_PAPER.pdf.

MUNIZ S, ORTEGA A. Fuzzing and debugging Cisco IOS [EB/OL].(2011-12-21)[2014-07-18]. http: ∥www.pdfpedia.com/download/13758/fuzzing-and-debugging-cisoc-ios-blackhat-europe-2011-pdf.html.

LINDER F. Developments in Cisco IOS forensics [EB/OL].(2009-08-14)[2013-03-10]. http: ∥www. blackhat.com/presentions/bn-usa-08/Linder/BH_US_08_Linder_Developments_in_IOS_Froensics.pdf.

Recurity Labs. CIR [EB/OL].(2008-02-16)[2014-01-12]. http: ∥cir. recurity.com.

SU Xiaoyan, WU Dongying, XIAO Da, et al. Research on Cisco IOS security mechanisms [C]∥ Proceedings of the International Conference on Computer Science and Information Technology. Piscataway, NJ, USA: IEEE, 2012, 51: 653.

陈立根, 刘胜利, 高翔, 等. 一种基于动态污点分析的Cisco IOS漏洞攻击检测方法 [J]. 小型微型计算机系统, 2014, 35(8): 1798-1802.

CHEN Ligen, LIU Shengli, GAO Xiang, et al. A vulnerability attack detection method based on dynamic taint analysis for Cisco IOS [J]. Journal of Chinese Computer Systems, 2014, 35(8): 1798-1802.

COWAN C, PU C, MAIER D, et al. StackGuard: automatic adaptive detection and prevention of buffer-overflow attacks [C]∥Proceedings of the 7th Conference on USENIX Security Symposium. Berkeley, CA, USA: USENIX, 1998: 63-78.

WANG Hua, GUO Yao, CHEN Xianqqun. FPValidator: validating type equivalence of function pointers on the fly [C]∥Proceedings of the 2009 Annual Computer Security Applications Conference. Piscataway, NJ, USA: IEEE, 2009: 51-59.

NEWSOME J, SONG D. Dynamic taint analysis for automatic detection, analysis, and signature generation of exploits on commodity software [C]∥Proceedings of the 12th Annual Network and Distributed System Security Symposium. Reston, VA, USA: ISOC, 2005: 1-17.

ABADI M, BUDIU M, ERLINGSSON U, et al. Control-flow integrity [C]∥Proceedings of the 12th ACM Conference on Computer and Communications Security. New York, USA: ACM, 2005: 340-353.

ANUZELLI G, FILES N, EMULATION P I X, et al. Dynamips/Dynagen: tutorial [EB/OL].(2011-10-07)[2013-07-13]. http: ∥materias.fi.uba.ar/7543 /2010-02/download/DynamipsTutorial.doc.

代伟, 刘智, 刘益和. 基于地址完整性检查的函数指针攻击检测 [J]. 计算机应用, 2015, 35(2): 424-429.

DAI Wei, LIU Zhi, LIU Yihe. Function pointer attack detection with address integrity checking [J]. Journal of Computer Applications, 2015, 35(2): 424-429.

EAGLE C. The IDA pro book: the unofficial guide to the world's most popular disassembler [M]. San Francisca, CA, USA: No Starch Press, 2011.[18] PRAKASH A, YIN H, LIANG Z. Enforcing system-wide control flow integrity for exploit detection and diagnosis [C]∥Proceedings of the 8th ACM SIGSAC Symposium on Information, Computer and Communications Security. New York, USA: ACM, 2013: 311-322.

CISCO. Multiple vulnerabilities in the IOS FTP server [EB/OL].(2007-05-09)[2013-11-10]. http: ∥tools. cisco.com/security/center/CiscoSecurityAdvisory/cisco-sa-20070509-iosftp.

CISCO. TFTP long filename vulnerability [EB/OL].(2002-07-20)[2014-04-10]. http: ∥tools.cisco.com/security/center/CiscoSecurityAdvisory/cisco-sa-2002 0730-ios-tftp-lfn.

CISCO. Cisco IOS next hop resolution protocol vulnerability [EB/OL].(2007-08-08)[2014-05-03]. http: ∥tools.cisco.com/security/center/CiscoSecurityAdvisory/cisco-sa-20070808-nhrp.

CISCO. Crafted IP option vulnerability [EB/OL].(2007-01-24)[2014-04-18]. http: ∥tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20070124-crafted-ip-option.

浏览量

下载量

CSCD

文章被引用时，请邮件提醒。

提交

工具集

关联资源

一种面向网络行为因果关联的攻击检测方法

采用机器学习的大规模并行程序I/O性能建模与预测方法

结构-语义-残差协同的图像压缩框架：面向隐私保护与高保真重建

融合物理信息与深度算子网络的变压器绕组热-流场快速计算方法

水蒸气掺混对氨裂解气旋流燃烧与排放特性的影响研究