【作者】 王斌；

【导师】 孙建伟；

【作者基本信息】 北京理工大学 ， 软件工程， 2016， 硕士

【摘要】 隐通道问题被提出已经有三十余年,经过国内外专家学者的研究,目前已经有了一定的检测方法和防止手段。在安全信息系统中隐通道已经成为安全问题的首要危害,为确保信息的机密性和完整性,在一定级别安全信息系统中必须进行隐通道的分析和检测。静态分析技术在安全审计方面有着举足轻重的地位,目前已经有了很多商用和开源的静态检测工具,对信息系统的安全作出很大的贡献,本文采用Fortify静态检测技术将隐通道的检测规则特征映射到Fortify的自定义规则库中,通过该自定义规则库和Fortify源代码分析工具检测出信息系统中存在的隐通道。首先,本文在综述隐通道分析方法和目前研究现状的基础上,解决了自动检测信息系统中的隐通道问题,并提出扩展的信息流规则、信息流树和信息流图,在信息流图的基础上研究了隐痛的的特点并根据该特点提出了隐通道的一般性检测规则。然后,根据隐通道产生的背景与定义以及隐通道研究的国内外现状和存在的问题,分析得出本文的研究目标——构建自动化的隐通道检测工具。该工具主要以Fortify为载体,通过Fortify SCA强大的静态检测引擎和良好的可扩展性,构建出自己的隐通道检测方法。本文采用语义信息流法作为基础,构建了扩展的信息流规则并生成了函数的信息流图。根据该信息流图分析隐通道的一般特性,并给出检测隐通道的一般性规则。最后将该一般性规则映射到Fortify SCA的自定义规则库中,构建自定义的检测规则,选取已存在的的隐通道源码作为输入,分析一般性规则和Fortify自定义规则的正确性和可用性,最后得出结论和展望。更多还原

【Abstract】 Covert channels is proposed has been more than 30 years.Through domestic and international experts and scholars research. At present, there has been a certain detection methods and prevention measures. In large information system, Covert channel has become a primary security problem. In order to ensure information confidentiality and integrity, security information system must analyse nd detection.Static analysis technology has a pivotal position in security audit. At present, there has been a many commercial and open source tool for static testing, make a great contribution to the security of information system. In this paper, we use Fortify SCA to detect covert channel, and create a custom rule for covert channels.Through the custom rule and Fortify SCA dynamic detecting convert channels in information System.This article solve the problem that analyse information flow automatically,on the basis of the current research. And put forward expanded information flow, information flow tree and information flow graph, Constructing a automatic covert channel detection system based on Fortify SCA.This paper gives the covert channel background, definition and research status at home and abroad, according to analysis of covert channels, building automatic covert channel detection tools. The tool rely Fortify SCA, through the powerful static detection engine of Fortify and good scalability, constructing covert channel detection system. First, analysing covert channel detection method already exists, and select the appropriate method as the rules of our system. This paper uses semantic information flow method as the foundation, constructing the rules of information flow and generating the information flow graph of function. According to this information flow graph to build custom information flow rules. Finally, through experiment verificate this rule. In this progess, we select already exists and does not detected covert channel source code as the input. Analysis of the correctness and availability of custom rules, finally giving the conclusion and analysis of the custom of the rule.更多还原