| 结构化比对算法研究及软件实现 |
| |
| 作者姓名： | 宋杨 张玉清 |
| |
| 作者单位： | 中国科学院研究生院国家计算机网络入侵防范中心, 北京 100049 |
| |
| 基金项目： | 国家自然科学基金项目(60573048,60773135,90718007)和国家"863"计划项目(2007AA01Z427,2007AA01Z450)资助 |
| |
| 摘 要： | 对补丁比对技术中的结构化比对经典算法进行了分析和改进,并在此基础上实现了一个结构化比对工具软件. 与经典算法的区别在于,本文算法通过对签名相似程度的强弱进行量化达到函数配对的目的,从而解决了经典算法中签名一致性和唯一性之间的矛盾问题. 在此基础上,设计并实现了一款结构化比对工具——NBD(NCNIPC binary differ). 实际测试中NBD相对于已有工具软件,在函数配对的准确性方面取得了更好的成绩,从而证明了改进算法的优越性.
|
| 关 键 词： | 补丁比对 安全漏洞 逆向工程 结构化比对 |
| 收稿时间： | 2008-05-28 |
| 修稿时间： | 2009-02-20 |
Algorithm for structural comparison and its software implement |
| |
| Authors: | SONG Yang ZHANG Yu-Qing |
| |
| Institution: | National Computer Network Intrusion Protection Center, Graduate University of the Chinese Academy of Sciences, Beijing 100049, China |
| |
| Abstract: | Structural comparison is one of the core components of patch comparison. This paper improves the classic algorithm of structural comparison. Compared with the classic algorithm, the improved algorithm calculates the value of similarity between functions. Therefore, the problem of contradiction between the consistency and exclusiveness of signature is solved. Furthermore, a structural comparison tool named as NBD (NCNIPC binary differ), which gets a higher score compared with other popular tools during the exam towards some patches of microsoft, is constructed based on the improved algorithm. |
| |
| Keywords: | patches comparison security vulnerability reverse engineering structural comparison |
|
| 点击此处可从《》浏览原始摘要信息 |
| 点击此处可从《》下载免费的PDF全文 |
|
