JP2005151492A - Method and apparatus for generating rule to deal with unauthorized access, method and apparatus for dealing with unauthorized access, and system for taking measure to stack-smashing attack - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To enable a defense against a stack-smashing attack that changes an attack code for each attack, when a buffer overflow occurs. <P>SOLUTION: A packet filtering rule (to deal unauthorized access) generator 1 detects a buffer overflow and extracts, as a mark of a stack-smashing attack, a frame pointer and a return address which are written when the buffer overflow occurs, and in accordance with an operating system, extracts a value of a pointer to an except handler, compares the value thereof with the byte sequence of an input packet log, and generates rules to deal unauthorized access. A packet filtering apparatus 2 receives the rules to deal unauthorized access from the packet filtering rule generator 1, registers the received rules and shuts off a packet of the stack-smashing attack transmitted from the outside on the basis of the registered rules to deal unauthorized access. <P>COPYRIGHT: (C)2005,JPO&NCIPI

Description

  The present invention relates to a defense technique against a stack smashing attack that exploits a buffer overflow vulnerability, and in particular, an unauthorized access countermeasure rule generation method and an unauthorized access countermeasure method that realize a defense against a stack smashing attack that changes an attack code for each attack. , An unauthorized access countermeasure rule generation device, an unauthorized access countermeasure device, and a stack smashing attack countermeasure system.

Terms used to describe the present invention in this specification will be briefly described.
“Stack”: A stack is a data structure in which the last stored object is retrieved first.
“Stack smashing attack”: The stack memory stores a return address for returning to the caller when a subroutine is called, and a local variable (local variable) used only within the subroutine. Therefore, when a write occurs across a buffer boundary in a buffer declared as a local variable used only within a subroutine, the return address is rewritten. A stack smashing attack is an attack that uses this property to change the processing flow of a program and execute an arbitrary program.
“DoS (Denial Of Service) attack”: A DoS attack refers to an attack that causes a service to become unusable.
-"Hook": Intercepting control when a function is called is called hooking a function. For example, in order to check whether a certain function is called accurately for debugging purposes, there is a usage method in which control is temporarily intercepted and a log is output.

  On the stack memory, the return address and frame pointer for returning to the caller when a subroutine is called, local variables used only within the subroutine, and exception handlers (subroutines executed when an exception occurs) depending on the operating system. Stores addresses and the like. By using this, if a write occurs beyond the buffer boundary for a buffer declared as a local variable used only within a subroutine, the return address and the like are rewritten.

  The stack smashing attack is an attack in which an arbitrary program is executed by changing the processing flow of the program by this rewriting. As a conventional technique for protecting against this stack smashing attack, the standard memory copy function call is hooked during program execution (control interception when the function is called) to check the size of the copy destination buffer in advance. However, there is a technique for detecting a buffer overflow (see, for example, Non-Patent Document 1).

In addition, a guard variable that is a special value for protection such as a return address is inserted into the protection target program at the time of compilation, and the validity of the guard variable is confirmed immediately before the return processing of the function. There is a method that inserts a process of abnormally terminating the process when the device is destroyed (see, for example, Patent Document 1). As a result, the host can be protected from unauthorized intrusion such as server hijacking and data tampering by a stack smashing attack.
White Paper, "Libsafe: Protecting critical elements of stacks.", "Http://www.research.avayalabs.com/project/libsafe/", A. Baratloo, N. Singh, and T. Tsai, December 1999. JP 2001-216161 A

  Further, when the inventors detect that the return address has been rewritten in Japanese Patent Application No. 2003-130950 (unpublished), the present inventors determine the position of the illegal return address written by the attack, and We have proposed a technique for deriving rules for dealing with unauthorized access from the position indicated by a return address and blocking similar stack smashing attacks on the network.

  This makes it possible to eliminate vulnerabilities to stack smashing DoS attacks (Denial Of Service), and in addition, by preventing stack smashing attacks in the network, Other hosts connected to the network can be protected from stack smashing attacks.

  However, in order to realize a more complete defense against the stack smashing attack using the technology for generating the illegal access countermeasure rule against the stack smashing attack as described above, it is necessary to solve the following problems.

  An attack program prepared by the attacker is arranged at the position indicated by the return address, but this attack program can be changed by the attacker. For this reason, if the attack program is changed for each attack, a packet with a payload different from the payload of the unauthorized access countermeasure rule is sent, and thus the unauthorized access countermeasure apparatus cannot cope with it. Furthermore, an unauthorized access countermeasure rule is generated for each attack. If this attack is continuously performed, the number of unauthorized access countermeasure rules increases, and the packet processing performance of the unauthorized access countermeasure device decreases.

  The present invention has been made in view of such circumstances, and an object of the present invention is to find a common attack trace related to a stack smashing attack in which an attack program changes each time an attack is performed. It is to take countermeasures.

  In order to achieve this object, a stack smashing attack countermeasure system according to the present invention includes an unauthorized access countermeasure rule generation device that generates an unauthorized access countermeasure rule used to filter unauthorized packets transmitted from outside, It is composed of an unauthorized access countermeasure device that filters unauthorized packets transmitted from the outside using the generated unauthorized access countermeasure rules, and performs the following processes respectively.

  The unauthorized access countermeasure rule generation device detects a buffer overflow by a conventional technique. Specifically, by checking the buffer size of the copy destination of the standard memory copy function in advance and detecting a buffer overflow, or by checking whether the guard variable has been destroyed or not to detect a buffer overflow Detect stack smashing attacks.

  The characteristics of these two detection methods are as follows. The former cannot detect a buffer overflow other than the standard memory copy function, but does not require compilation work, so it can be applied even if the executable program is distributed in a compiled state. The latter can detect most buffer overflows, but requires compilation so the program must be provided in source code.

  The present invention is characterized in that these detection methods are selectively used depending on the program distribution format. This makes it possible to add a buffer overflow detection mechanism suitable for various applications.

  Next, attack traces are extracted according to the buffer overflow detection method. First, a standard memory copy function's copy destination buffer size is checked in advance, and the buffer overflow detection method checks whether the copy destination buffer exists on the stack. If it exists on the stack, the frame pointer is traced starting from the current frame pointer, and the function frame to which the copy destination buffer belongs is searched. The length from the beginning of the copy destination buffer to the position before the next frame pointer is stored is defined as the buffer size. The buffer size obtained here is compared with the buffer size to be copied, and a buffer overflow is detected.

  Therefore, in the present invention, a frame pointer, a return address, and a pointer to an exception handler depending on the operating system are calculated from the position of the function frame obtained here when a buffer overflow occurs. It is extracted as an attack trace.

  Next, the method of detecting buffer overflows with guard variables is to change the placement of local variables or insert guard variables so that no other variables are placed between the buffer and guard variables. Change the stack layout.

  Therefore, in the present invention, in consideration of such a change in the stack layout, the frame pointer and return address that are overwritten when a similar overflow occurs before the layout is changed, and an exception handler depending on the operating system. It is characterized in that a pointer to is extracted and each value is extracted as an attack trace.

  In addition, the present invention is characterized in that in the unauthorized access countermeasure rule generation device, an input to a program via a network is stored in advance as a packet log. Subsequently, the attack trace obtained by the above processing is compared with the input packet log for the program via the network, and the header information (IP header, TCP header, UDP header) of the packet including the matched byte sequence is compared. Information). Then, an illegal access countermeasure rule is generated using the byte sequence of the stack smashing attack obtained as described above and the header information of the packet including the byte sequence as rule elements.

  In order to succeed in the stack smashing attack, it is necessary to overwrite the return address, the frame pointer, or the pointer to the exception handler with a limited value depending on the operating system. Therefore, in the present invention, by utilizing the nature of this stack smashing attack, the return address, the frame pointer, or the pointer to the exception handler depending on the operating system is extracted as a trace of the stack smashing attack, and then compared with the input packet log to obtain unauthorized access. By generating countermeasure rules, it is possible to take countermeasures against advanced stack smashing attacks that change the attack program at each attack.

That is, the unauthorized access countermeasure rule generation device of the present invention is an apparatus for generating unauthorized access countermeasure rules used for filtering unauthorized packets transmitted from the outside, and stores packets transmitted from an external network. Means for detecting the buffer overflow by checking the buffer size of the copy destination of the memory copy function and the position of the function frame to which the copy destination buffer belongs, and is written when the buffer overflow occurs , The frame pointer, return address, and depending on the operating system, a means to determine the pointer to the exception handler,
Means for searching for the stored packet as a search target, searching for a byte string that matches the value of the determined frame pointer, return address or pointer to an exception handler depending on the operating system, and the searched byte string Means for acquiring information in a header of the packet; and means for generating and recording an illegal access countermeasure rule describing a packet to be filtered from the byte string and the information in the header.

  The unauthorized access countermeasure rule generation apparatus of the present invention is an apparatus for generating an unauthorized access countermeasure rule used for filtering unauthorized packets transmitted from outside, and stores packets transmitted from an external network. Means for changing the layout of the stack memory by inserting a guard variable between the buffer of the stack memory and the frame pointer, and a guard variable inserted between the buffer of the stack memory and the frame pointer. A frame pointer, a return address, an operating system to be written when the buffer overflow occurs, from a means for detecting whether the buffer overflow has occurred by checking whether it has been destroyed, and the layout of the stack memory before the layout is changed. system Therefore, the means for determining the pointer to the exception handler and the stored packet as a search target, search for a byte string that matches the value of the determined frame pointer, return address or the pointer to the exception handler depending on the operating system. A means for acquiring information in a header of a packet including the retrieved byte sequence, and generating and recording an illegal access countermeasure rule describing the packet to be filtered from the byte sequence and the information in the header And means for performing.

  The unauthorized access countermeasure device according to the present invention may be configured to receive an unauthorized access countermeasure rule from the unauthorized access countermeasure rule generation device and register the unauthorized access countermeasure rule in a storage device based on the registered unauthorized access countermeasure rule. The information and byte string in the header in the access handling rule is compared with the information and byte string in the header in the received packet. If they match, the received packet is an illegal packet sent from the outside as an invalid packet. Means for filtering packets.

  Also, the stack smashing attack countermeasure system of the present invention is characterized by comprising the unauthorized access countermeasure rule generation device and the unauthorized access countermeasure device.

  The most different point of the present invention from the method previously proposed by the present inventors in Japanese Patent Application No. 2003-130950 is the method of extracting the byte string registered in the illegal access countermeasure rule. That is, in the previously proposed method, the byte position of the trace is extracted with the position indicated by the illegal return address as the start position of the trace of the stack smash attack, whereas in the present invention, the return address and the frame pointer are extracted. Depending on the operating system, the value of the pointer to the exception handler itself is extracted as an attack trace.

  The effect obtained by the present invention is that an appropriate illegal access countermeasure rule can be generated even for a stack smashing attack in which an attack code is changed at each attack.

  In the conventional illegal access countermeasure rule generation method, the attack code can be changed at each attack, so that the packet cannot be blocked, or the illegal access countermeasure rules are generated at each attack, and the number increases. The packet processing performance of the unauthorized access countermeasure device was degraded.

  On the other hand, in the present invention, the return address, the frame pointer, or the pointer to the exception handler depending on the operating system needs to be overwritten with a certain limited value. The return address, the frame pointer, or the value of the pointer to the exception handler depending on the operating system itself is extracted as an attack trace, and an illegal access countermeasure rule generated by comparing with the input packet log is used to make a more advanced stack. With regard to smashing attacks, it is possible to take measures against the network and protect the entire network from stack smashing attacks.

  Next, embodiments of the present invention will be described in detail with reference to the drawings. FIG. 1 shows a system configuration example of a stack smashing attack countermeasure system realized by the present invention.

  As shown in this figure, the stack smashing attack countermeasure system realized by the present invention includes a packet filtering rule generation apparatus 1 which is an example of the above-described unauthorized access countermeasure rule generation apparatus of the present invention, and a packet filtering rule obtained there. And the packet filtering device 2 which is an example of the unauthorized access countermeasure device of the present invention described above.

  Here, the packet filtering rule generation device 1 is constructed on, for example, a specific host, while the packet filtering device 2 is constructed on a network gateway or an arbitrary host existing on the network.

  With reference to FIG. 1, a rough flow of processing for the countermeasure against the stack smashing attack according to the present invention will be described. First, a packet due to a stack smashing attack is transmitted from the external network to the packet filtering rule generation device 1. In response to this, the packet filtering rule generation device 1 automatically generates a packet filtering rule for coping with the stack smashing attack, and notifies the packet filtering device 2 of the automatically generated packet filtering rule.

  The packet filtering device 2 receives the packet filtering rule notified from the packet filtering rule generating device 1, and thereafter blocks packets that come in from the external network and match the stack smashing attack included in the packet filtering rule. To block stack smashing attacks.

  FIG. 2 shows an example of the configuration of the packet filtering rule generation device 1 prepared for realizing the processing for the countermeasure against the stack smashing attack according to the present invention. FIG. 3 shows the countermeasure against the stack smashing attack countermeasure according to the present invention. An example of the configuration of a packet filtering device 2 prepared to realize processing is illustrated.

  As shown in FIG. 2, the packet filtering rule generation device 1 logs an input packet storage unit 10 that stores an input packet for each program and an input packet transmitted from an external network to the input packet storage unit 10 as a log. An input packet logging unit 11, a server program 12 for executing a predetermined server process, a buffer overflow detection unit 13 that is preliminarily incorporated in a server program or the like and detects a buffer overflow (that is, whether or not a stack smashing attack has occurred), and a stack A stack smashing attack trace extraction unit 14 that extracts a trace of a smashing attack, a packet filtering rule generation unit 15 that generates a packet filtering rule for blocking the stack smashing attack, Against Taringu device 2, and a packet filtering rule notification unit 16 for notifying the generated packet filtering rules.

  Here, the input packet storage unit 10 is prepared for identifying the trace of the stack smashing attack, and as shown in FIG. Information (protocol type, source IP address, source port number, destination IP address, destination port number, etc.) and the payload of the packet are stored.

  On the other hand, as shown in FIG. 3, the packet filtering device 2 includes a packet filtering rule table 20 for storing packet filtering rules for blocking a stack smashing attack, and a packet filtering rule transmitted from the packet filtering rule generating device 1. Based on the packet filtering rule receiving unit 21 that receives the packet filtering rule, the packet filtering rule registration unit 22 that registers the received packet filtering rule in the packet filtering rule table 20, and the packet filtering rule stored in the packet filtering rule table 20 And a packet filtering unit 23 for blocking a packet of a stack smashing attack transmitted from the outside.

  Next, the trace smashing attack extraction process executed by the packet filtering rule generation device 1 will be described. In FIGS. 5 and 6, the standard memory copy function call is hooked at the time of program execution, so that the size of the copy destination buffer is checked in advance and the trace of the stack smashing attack is detected by detecting the buffer overflow. Processing to be performed will be described.

  In FIGS. 7 and 8, a guard variable that is a special value for protection such as a return address is inserted into the protection target program at the time of compilation, and the guard variable is activated immediately before the return processing of the function. A process for extracting traces of a stack smashing attack by detecting buffer overflow by confirming the characteristics will be described.

  In FIG. 5, reference numeral 100 denotes a stack memory of the attack target program, and reference numeral 200 denotes a copy source buffer that can be input by the attacker. In order to pass control to the prepared attack program, the attacker of the stack smashing attack stores data larger than the copy destination buffer size in the copy source buffer 200 and sends it to the exception handler depending on the frame pointer, return address, or operating system. Is overwritten on the stack memory 100 to execute an attack.

  In order to detect the presence or absence of this stack smashing attack, the packet filtering rule generation device 1 hooks a standard memory copy function and traces the frame pointer from the current frame pointer to determine which function the copy destination buffer has. Determine if it belongs to a frame. The length from the beginning of the copy destination buffer to the position before the next frame pointer is stored as the size of the copy destination buffer. When this size is smaller than the size of the copy source buffer 200, a stack smashing attack is performed. Is determined to have been performed.

  When the packet filtering rule generation device 1 detects that a stack smashing attack has been performed, the frame pointer or return address that will be overwritten in the stack memory 100 or the pointer to the exception handler depending on the operating system. The value is extracted as a trace of a stack smashing attack.

  FIG. 6 is a trace extraction process flow of a stack smashing attack executed by the packet filtering rule generation device 1. The packet filtering rule generation device 1 hooks the execution of a standard memory copy function. As shown in the processing flow of FIG. 6, first, in step S10, whether the size of the copy destination buffer is smaller than the size of the copy source buffer 200 or not. If it is greater or equal, it is determined that the stack smashing attack has not been performed, and the process is terminated.

  On the other hand, if it is determined in step S10 that the size of the copy destination buffer is smaller than the size of the copy source buffer 200 and it is determined that a stack smashing attack has been performed, the process proceeds to step S11 and the return address or frame set by the stack smashing attack is determined. The pointer or the value of the pointer to the exception handler depending on the operating system is used as a trace of the stack smashing attack.

  In FIG. 7, 300 is a stack memory of the attack target program, 400 is a stack memory at the time of normal compilation in which no replacement of guard variables and local variables occurs, and 500 is a copy source buffer that can be input by an attacker.

  In order to pass control to the prepared attack program, the attacker of the stack smashing attack stores data larger than the copy destination buffer size in the copy source buffer and sends it to the frame handler, return address, or exception handler depending on the operating system. A stack smashing attack is executed by overwriting the pointer on the stack memory 300.

  In order to detect the presence or absence of this stack smashing attack, the packet filtering rule generation device 1 inserts a guard variable that is a special value between the buffer and the frame pointer. Also, the arrangement of local variables is changed so that no other variable is arranged between the buffer and the guard variable. The validity of this guard variable is confirmed immediately before the function return process. If it is found from this confirmation that the guard variable has been destroyed, it is determined that a stack smashing attack has been performed.

  When the packet filtering rule generation device 1 detects that a stack smashing attack has been performed, it assumes the stack memory 400 before the insertion of the guard variable or the replacement of the local variable from the stack memory usage rule at the time of normal compilation. By doing so, the return address, the frame pointer, or the pointer value to the exception handler depending on the operating system that the attacker tried to overwrite is determined, and those values are used as traces of the stack smashing attack.

  Here, since the attacker of the stack smashing attack does not know that the local variable has been switched or the guard variable has been inserted, the original return address, frame pointer, or pointer to the exception handler depending on the operating system. Try to rewrite a location that is different from the storage location.

  FIG. 8 is a trace extraction process flow of a stack smashing attack executed by the packet filtering rule generation device 1. As shown in the processing flow of FIG. 8, the packet filtering rule generation device 1 first reads the guard variable in step S20 and immediately rewrites the read guard variable in step S21. If the guard variable has not been rewritten, it is determined that the stack smashing attack has not been performed, and the process is terminated.

  On the other hand, when it is determined in step S21 that the stack smashing attack has been performed because the guard variable has been rewritten, the process proceeds to step S22, and the return address or frame pointer set by the stack smashing attack, or an exception handler depending on the operating system. The value of the pointer to is used as a trace of a stack smashing attack.

  Next, packet filtering rule generation processing executed by the packet filtering rule generation device 1 will be described according to the processing flow of FIG. First, when the stack smashing attack trace detection process is completed, in step S30, a return address, a frame pointer, or a packet sent to the attack target program stored in the input packet storage unit 10 is searched. Some operating systems look for a byte sequence that matches the value of the pointer to the exception handler, and use that sequence as a trace of a stack smashing attack.

  Subsequently, in step S31, by referring to the input packet storage unit 10, the header information of the packet including the searched byte sequence is acquired. That is, the protocol type, transmission / reception IP address, transmission / reception port number, and the like are acquired. In step S32, a packet filtering rule that describes a packet to be blocked is generated from the retrieved byte string and the acquired header information. The packet filtering rule generated here is, for example, as shown in FIG. 10, with the protocol type “UDP”, the destination port number “53”, and the payload (byte string) “40 11 b7 a1 c0. Since the packet is a packet of a stack smashing attack, it is data describing that it needs to be blocked. Subsequently, in step S33, the packet filtering device 2 is notified of the generated packet filtering rule, and the process ends.

  Upon receiving this notification, the packet filtering device 2 receives the packet filtering rule notified from the packet filtering rule generating device 1 and stores it in the packet filtering rule table 20 according to the configuration shown in FIG. As a result, the packet filtering rule table 20 of the packet filtering device 2 stores packet filtering rules (which may be plural) having a rule structure as shown in FIG.

  Next, packet filtering processing executed by the packet filtering device 2 will be described according to the processing flow of FIG. When receiving a packet transmitted from the external network, the packet filtering device 2 first extracts the payload of the packet received in step S40 as shown in the processing flow of FIG.

  Subsequently, the protocol type and destination port number are acquired from the header information of the packet received in step S41. Subsequently, in step S42, it is determined whether or not a packet filtering rule having a protocol type matching the acquired protocol type as a rule element is registered in the packet filtering rule table 20, and when it is determined that it is not registered, Since the received packet is not a stack smashing attack packet, the process proceeds to step S43, the received packet is transferred to the destination host, and the process ends.

  On the other hand, when it is determined in step S42 that the packet filtering rule having the same protocol type is registered in the packet filtering rule table 20, the process proceeds to step S44, and the transmission destination port number possessed by the packet filtering rule is acquired. It is determined whether or not the port number matches, and if it does not match, the received packet is not a stack smashing attack packet, so the process proceeds to step S45, and the received packet is transferred to the destination host for processing. Exit.

  On the other hand, if it is determined in step S44 that the packet filtering rule having the same protocol type also matches the destination port number, the process proceeds to step S46 to determine whether the payload of the packet filtering rule matches the extracted payload. to decide. If it is determined that they do not match, the packet is not a stack smashing attack packet, so the process proceeds to step S47, the received packet is transferred to the destination host, and the process ends. If it is determined in step S46 that the payloads also match, the received packet is a stack smashing attack packet, so the process proceeds to step S48, where the received packet is blocked and the process ends.

  In this way, when receiving a packet whose protocol, destination port number, and payload match the packet filtering rule, the packet filtering device 2 performs processing so as to block the received packet.

  Here, when it is not desired to provide an external network with a buffer overflow vulnerability, rule elements used as packet filtering rules can be reduced by operation.

  The processes performed by the packet filtering rule generation device 1 and the packet filtering device 2 described above can be realized by a computer and a software program, and the program can be recorded and provided on a computer-readable recording medium. It is also possible to provide.

It is a figure which shows the system configuration example of a stack smashing attack countermeasure system. It is a figure which shows one structural example of a packet filtering rule production | generation apparatus. It is a figure which shows the example of 1 structure of a packet filtering apparatus. It is a figure which shows the example of the data structure preserve | saved at an input packet preservation | save part. It is a figure explaining extraction of the trace of a stack smashing attack. It is a figure which shows the trace extraction process flow of a stack smashing attack. It is a figure explaining extraction of the trace of a stack smashing attack. It is a figure which shows the trace extraction process flow of a stack smashing attack. It is a figure which shows a packet filtering rule production | generation processing flow. It is a figure which shows an example of a packet filtering rule. It is a figure which shows an example of the packet filtering rule stored in a packet filtering rule table. It is a figure which shows a packet filtering process flow.

Explanation of symbols

DESCRIPTION OF SYMBOLS 1 Packet filtering rule production | generation apparatus 2 Packet filtering apparatus 10 Input packet preservation | save part 11 Input packet logging part 12 Server program 13 Buffer overflow detection part 14 Stack smashing attack trace extraction part 15 Packet filtering rule production | generation part 16 Packet filtering rule notification part 20 Packet filtering Rule table 21 Packet filtering rule reception unit 22 Packet filtering rule registration unit 23 Packet filtering unit

Claims (7)

A method for generating an illegal access countermeasure rule used for filtering illegal packets transmitted from the outside,
Storing packets sent from an external network;
Checking the buffer size of the copy destination of the memory copy function to detect a buffer overflow;
Determining a frame pointer, a return address, and a pointer to an exception handler depending on the operating system to be written when the buffer overflow occurs, from the position of the function frame to which the copy destination buffer belongs;
Searching the stored packet for a byte string that matches the determined frame pointer, return address or the value of the pointer to the exception handler depending on the operating system;
Obtaining information in a header of a packet including the retrieved byte sequence;
An unauthorized access countermeasure rule generation method comprising: generating and recording an unauthorized access countermeasure rule describing a packet to be filtered using the byte string and the information in the header as rule elements. A method for generating an illegal access countermeasure rule used for filtering illegal packets transmitted from the outside,
Storing packets transmitted from an external network;
Inserting a guard variable between the stack memory buffer and the frame pointer to change the stack memory layout;
Detecting a buffer overflow by checking whether a guard variable inserted between the buffer of the stack memory and a frame pointer is destroyed;
Determining a frame pointer, a return address, and a pointer to an exception handler depending on the operating system, to be written when the buffer overflow occurs, from the layout of the stack memory before the layout is changed;
Searching the stored packet for a byte string that matches the determined frame pointer, return address or the value of the pointer to the exception handler depending on the operating system;
Obtaining information in a header of a packet including the searched byte sequence;
An unauthorized access countermeasure rule generation method comprising: generating and recording an unauthorized access countermeasure rule describing a packet to be filtered using the byte string and the information in the header as rule elements. A method of filtering illegal packets sent from outside,
Receiving an unauthorized access countermeasure rule generated by the unauthorized access countermeasure rule generating method according to claim 1 and registering it in a storage device;
Based on the registered unauthorized access countermeasure rule, the information and byte string in the header in the unauthorized access countermeasure rule is compared with the information and byte string in the header in the received packet, and the packet received if they match And a method of filtering illegal packets transmitted from the outside as illegal packets. An apparatus for generating an illegal access countermeasure rule used for filtering illegal packets transmitted from outside,
Means for storing packets sent from an external network;
A means of detecting buffer overflow by checking the buffer size of the copy destination of the memory copy function;
Means for calculating a frame pointer, a return address, and a pointer to an exception handler depending on the operating system, which are written when the buffer overflow occurs from the position of the function frame to which the copy destination buffer belongs;
Means for searching the stored packet for a byte string that matches the determined frame pointer, return address or the value of the pointer to the exception handler depending on the operating system;
Means for obtaining information in a header of a packet including the searched byte sequence;
An unauthorized access countermeasure rule generation device comprising: means for generating and recording an unauthorized access countermeasure rule describing a packet to be filtered using the byte string and information in the header as rule elements. An apparatus for generating an illegal access countermeasure rule used for filtering illegal packets transmitted from outside,
Means for storing packets sent from an external network;
Means for changing the layout of the stack memory by inserting a guard variable between the buffer of the stack memory and the frame pointer;
Means for detecting a buffer overflow by checking whether a guard variable inserted between the buffer of the stack memory and a frame pointer is destroyed;
Means for determining a frame pointer, a return address, and a pointer to an exception handler depending on an operating system, which are written when the buffer overflow occurs from the layout of the stack memory before the layout is changed;
Means for searching the stored packet for a byte string that matches the determined frame pointer, return address or the value of the pointer to the exception handler depending on the operating system;
Means for obtaining information in a header of a packet including the searched byte sequence;
An unauthorized access countermeasure rule generation device comprising: means for generating and recording an unauthorized access countermeasure rule describing a packet to be filtered using the byte string and information in the header as rule elements. A device that filters illegal packets sent from outside,
Means for receiving the unauthorized access countermeasure rule from the unauthorized access countermeasure rule generating device according to claim 4 and registering it in a storage device;
Based on the registered unauthorized access countermeasure rule, the information and byte string in the header in the unauthorized access countermeasure rule is compared with the information and byte string in the header in the received packet, and the packet received if they match A device for dealing with unauthorized access, comprising means for filtering unauthorized packets transmitted from the outside as unauthorized packets. A stack smashing countermeasure system that filters illegal packets sent from outside,
An unauthorized access countermeasure rule generation device according to claim 4 or 5,
A stack smashing attack countermeasure system comprising the unauthorized access countermeasure device according to claim 6.

Images