The distributed denial of service (DDoS) attack is one of the dangers in intrusion modes. It's difficult to defense and can cause serious damage to the system. Based on a careful study of the attack principles and...The distributed denial of service (DDoS) attack is one of the dangers in intrusion modes. It's difficult to defense and can cause serious damage to the system. Based on a careful study of the attack principles and characteristics, an object-oriented formalized description is presented, which contains a three-level framework and offers full specifications of all kinds of DDoS modes and their features and the relations between one another. Its greatest merit lies in that it contributes to analyzing, checking and judging DDoS. Now this formalized description has been used in a special IDS and it works very effectively.(展开更多
目前有关堆的取证研究主要是针对Windows系统的堆和NT堆,然而怎样从转储文件中提取出Linux系统Glibc堆信息并没有得到充分的研究。为了重现Linux系统中Glibc堆的内部信息,采用内存对象vtype描述信息中字段偏移定位结合在内存中Glibc堆...目前有关堆的取证研究主要是针对Windows系统的堆和NT堆,然而怎样从转储文件中提取出Linux系统Glibc堆信息并没有得到充分的研究。为了重现Linux系统中Glibc堆的内部信息,采用内存对象vtype描述信息中字段偏移定位结合在内存中Glibc堆实现的方法提取Glibc堆内部信息。并基于此方法研发了基于Rekall框架的3个堆信息提取插件。还研究了house of spirit类型的堆攻击,建立了攻击模型并提取其攻击特征。基于提取的攻击特征设计出针对house of spirit攻击的检测算法。在堆信息提取插件的基础上研发了攻击检测插件。实验结果表明本方法可以有效地提取Linux系统进程中堆在内存中的信息,并且基于这些信息结合攻击检测算法成功检测内存中的house of spirit类型攻击。展开更多
文摘The distributed denial of service (DDoS) attack is one of the dangers in intrusion modes. It's difficult to defense and can cause serious damage to the system. Based on a careful study of the attack principles and characteristics, an object-oriented formalized description is presented, which contains a three-level framework and offers full specifications of all kinds of DDoS modes and their features and the relations between one another. Its greatest merit lies in that it contributes to analyzing, checking and judging DDoS. Now this formalized description has been used in a special IDS and it works very effectively.(
文摘目前有关堆的取证研究主要是针对Windows系统的堆和NT堆,然而怎样从转储文件中提取出Linux系统Glibc堆信息并没有得到充分的研究。为了重现Linux系统中Glibc堆的内部信息,采用内存对象vtype描述信息中字段偏移定位结合在内存中Glibc堆实现的方法提取Glibc堆内部信息。并基于此方法研发了基于Rekall框架的3个堆信息提取插件。还研究了house of spirit类型的堆攻击,建立了攻击模型并提取其攻击特征。基于提取的攻击特征设计出针对house of spirit攻击的检测算法。在堆信息提取插件的基础上研发了攻击检测插件。实验结果表明本方法可以有效地提取Linux系统进程中堆在内存中的信息,并且基于这些信息结合攻击检测算法成功检测内存中的house of spirit类型攻击。
