【作者】 袁江；

【导师】 乔佩利；

【作者基本信息】 哈尔滨理工大学 ， 计算机应用技术， 2008， 硕士

【摘要】 近年来,信息安全技术及相关产品在很多分支领域都已经取得突破性发展,但是软件漏洞研究技术的发展仍然相对被动与滞后。与此同时,随着Windows操作系统在全球范围内的流行,基于该系统的软件漏洞层出不穷,其中以危急级漏洞造成的影响最为严重。因此,牢固掌握Windows危急级漏洞研究技术,正逐步进入安全研究者们的视野。危急级漏洞研究技术包括漏洞挖掘与漏洞分析。漏洞挖掘技术是指对未知漏洞的探索,应用各种技术和工具,尽可能地找出软件中的潜在漏洞;漏洞分析技术是指对已发现漏洞的细节进行深入分析,为漏洞利用、补救等处理措施作铺垫。灵活掌握危急级漏洞研究技术,我们就能对这些漏洞采取更加主动合理的处理方式。然而,传统漏洞研究技术并未体现出其应有的价值和潜力。针对具体漏洞的挖掘或分析,安全研究者所进行的工作中存在大量的重复内容,同时在研究效率、效果上也存在相当的缺陷。本文分析了传统漏洞研究技术的基本原理及存在的缺陷,有针对性地提出了一种新的漏洞挖掘及分析技术,以及该技术在Windows2000/XP/2003平台上工程实现的设计方案,从而较大地提高了漏洞研究技术的实际应用价值。本文首先从Windows危急级漏洞研究的本质出发,全面分析了传统技术的基本原理之后,总结出漏洞研究的技术难点及存在的缺陷。然后从研究效率和效果两方面出发,分别提出对传统漏洞挖掘及分析技术的拓展方法。本文一方面分析了TCP/IP网络通信共性以及漏洞挖掘核心技术,深入研究了基于协议屏蔽的漏洞挖掘技术,并给出了相应的漏洞挖掘器在Windows2000/XP/2003平台上设计方案;另一方面分析了Windows PE文件结构,同时将图形化思想与漏洞分析相结合,深入研究了基于模式比较的漏洞分析技术,同时也给出了相应的漏洞分析器在Windows2000/XP/2003平台上的设计方案。基于协议屏蔽的漏洞挖掘和基于模式比较的漏洞分析技术的提出,使得漏洞研究效率和效果得到较大提高,增强了技术的实际应用价值。本文提出的技术及相应的工程实现设计方案为Windows危急级漏洞研究技术的发展提供了新思路。更多还原

【Abstract】 In recent years, some information security technologies and relevant products have already obtained breakthrough development, but research of technology in software vulnerabilities remains passive and laggard. Meanwhile, with the global prevail of Windows Operation System (OS), vulnerabilities based on this OS are emerging in endlessly, and the effect caused by critical vulnerabilities is the most serious. Therefore, researching technology of Windows critical vulnerability is gradually coming into the eyeshot of the security researchers.A critical vulnerability means its exploitation could allow the propagation of an Internet worm without user action, and it is caused data processing error in a software. The Microsoft severity rating system provides a single rating for any vulnerability, and the word ’critical’ describes the most serious rating. If hackers make use of this vulnerability successfully, they can take an attack without the system user’s attention, and control the OS with the current user’s permission.The researching technology of critical vulnerability includes vulnerability mining and vulnerability analyzing. Vulnerability mining technology means seeking for unknown vulnerabilities, applying various kinds of technologies and tools for potential vulnerabilities in software. Vulnerability analyzing technology means deep analysis on the vulnerabilities discovered, making a good base for the management of the vulnerabilities. Mastering the researching technology of critical vulnerability neatly, we can take more active and reasonable measures on these vulnerabilities.However, traditional vulnerability researching technologies haven’t shown enough value and potential. About a single vulnerability, the work done by security researchers exist much repeat content, and the efficiency or effect also has some limitations. This text analyzes the basic principles and the limitations of traditional vulnerability researching technologies, puts forward a new vulnerability mining and a new analyzing technology, and also gives the designing of the technologies on Windows2000/XP/2003 platform. This has greatly improved the actual using value of vulnerability researching technologies.This text sets out from the essence of studying Windows critical vulnerability, after deep analysis of the basic principles of traditional technologies, has summarized technologic difficult points and limitation existing. In the line with the question of putting forward afterwards, solving the thinking of the question, has respectively proposed an expansion method of traditional vulnerability mining and analyzing technology. On one hand this text analyzes the commonness of communication based on TCP/IP, has deeply researched the vulnerability mining technology based on protocol shielding, and given the designing of the corresponding vulnerability mining apparatus on Windows2000/XP/2003. Studying the structure of Windows PE on the other hand, combines graphic thinking with vulnerability analysis, has deeply researched the vulnerability analyzing technology based on pattern comparing, and also given the designing of the corresponding vulnerability analyzing apparatus on Windows2000/XP/2003. The technologies proposed above have greatly improved the efficiency, effect, and the actual using value of vulnerability researching technologies.The technologies and the corresponding designing provide new ideas for research of Windows critical vulnerability. They are been further researched at present, and will play a more important role in the future applications.更多还原