二进制程序动态污点分析技术研究综述

摘要

With the network security situation becoming increasingly worsening, detection technology that can timely and effectivly discover exploits and related advanced persistent threat(APT) attacks is of vital importance for network security. Dynamic taint analysis, which is one of the reliable exploit detection solutions, is a method that marks the non-trusted input source as tainted data, and tracks its spread with the execution of program to get the key position and data associated with the input. This paper ifrstly introduces the principle of dynamic taint analysis of binary programs and its development status in several typical systems, then analyzes existing problems with dynamic taint analysis of binary programs, and ifnally introduces the application of dynamic taint analysis. In this paper, the dynamic taint analysis technology of binary program is introduced in details, which is helpful to improve the network security protection level for important information system.%随着网络安全形势日趋严峻，针对基于漏洞利用的高级可持续威胁攻击，采用相应的攻击检测技术，及时有效地发现漏洞，进而保障网络基础设施及重要应用安全显得愈发重要。动态污点分析技术通过将非信任来源的数据标记为污点数据的方法，追踪其在程序执行过程中的传播路径，以达到获取关键位置与输入数据之间关联信息的目的，是检测漏洞利用攻击的有效技术方案之一。文章首先介绍了二进制程序动态污点分析技术的相关原理及在几种典型系统中的发展现状，随后分析了二进制程序动态污点分析技术现有的突出问题，最后介绍动态污点分析技术的应用情况。文章对二进制程序动态污点分析技术进行了系统介绍，有助于提升重要信息系统网络安全保护水平。