需要金幣： 1000 個金幣 |
資料包括：完整論文 |  |
 |
| 轉(zhuǎn)換比率：金額 X 10=金幣數(shù)量， 例100元=1000金幣 | 論文字數(shù)：21856 |  | |
| 折扣與優(yōu)惠：團購最低可5折優(yōu)惠 - 了解詳情 | 論文格式：Word格式(*.doc) |  |
摘要：隨著計算機技術(shù)的飛速發(fā)展，信息技術(shù)的廣泛使用，軟件安全問題成為了人們關(guān)注的焦點。許多的軟件系統(tǒng)因為自身存在安全漏洞，成為了惡意攻擊者的攻擊對象。軟件安全測試為此應(yīng)運而生，近年來越來越多的軟件安全研究人員把工作的重心轉(zhuǎn)移到了軟件安全測試上。 首先，本文針對研究課題軟件安全問題，系統(tǒng)而詳細地講述了軟件的安全漏洞，同時通過簡短的代碼或者簡單的程序具體說明各式漏洞，特別地區(qū)分了安全漏洞和系統(tǒng)Bug的問題。結(jié)合安全漏洞，簡明扼要的闡述了利用漏洞發(fā)起攻擊的防護技術(shù)，并且對防護技術(shù)進行了代價、性能、效率等多方面的分析。 其次，本文著重介紹了安全漏洞的靜態(tài)檢測方法和動態(tài)檢測方法，與此同時把動態(tài)檢測和靜態(tài)檢測進行了對比分析。明確地指出了各項安全檢測方法所需要的代價以及應(yīng)用前景。 最后，針對安全檢測的Fuzz技術(shù)進行了具體的闡述說明。在對Fuzz技術(shù)有全面理解的基礎(chǔ)上，通過MFC實現(xiàn)了原型系統(tǒng)MyFuzz的編寫。 關(guān)鍵詞：軟件安全；安全漏洞；攻擊防護；漏洞檢測；Fuzz技術(shù)
Abstract：Along with the rapid development of computer technology, the widespread use of information technology, software security issues became the focus of attention. Many software systems became the target of malicious attackers because of its own security vulnerabilities. Software security testing therefore emerged, in recent years, more and more software security researchers put focus on to software security testing. Firstly, according to the software security issues, security vulnerabilities have been explained systematically and detailedly in this paper. Meanwhile, this paper points the differences between security vulnerabilities and systems bugs, through some short codes or simple programs. The protection technology which is based using the vulnerability attack, and its price, performance, efficiency and other aspects of analysis are discussed briefly in the paper. Secondly, this paper mainly introduces static detection method and dynamic testing method of the security vulnerabilities and the comparative analysis between the two methods are explained as well. The paper explicitly pointed out the cost and application prospect of various safety testing methods. Finally, this paper makes a concrete explanation of the Fuzz technology for safety testing method. On the basis of a comprehensive understanding of the Fuzz technology, the prototype system which is called "MyFuzz" has been implemented through the MFC framework. keywords: software security, security vulnerabilities, attack protection, vulnerability detection, Fuzz technology
系統(tǒng)的安全漏洞，又可以稱之為系統(tǒng)脆弱性（Vulnerability），是計算機系統(tǒng)在硬件、軟件、協(xié)議的設(shè)計與實現(xiàn)過程中存在的不足和缺陷。非法用戶可以利用漏洞提升用戶權(quán)限（因為系統(tǒng)分為四級權(quán)限，最高權(quán)限是Ring0，在這個權(quán)限下，可以訪問系統(tǒng)的一切資源，將對系統(tǒng)造成極大的威脅）、修改或刪除用戶數(shù)據(jù)、竊取用戶信息、破壞計算機系統(tǒng)等一系列危害計算機安全的操作。 根據(jù)科學研究的一般規(guī)律，建立科學合理的軟件漏洞發(fā)掘模型和發(fā)掘流程，對安全漏洞的本質(zhì)有進一步的理解，有助于程序開發(fā)人員在編寫軟件程序時盡可能減少安全漏洞，也有助于軟件的測試人員及時的發(fā)現(xiàn)軟件程序中存在的安全漏洞，從而降低由于安全漏洞引起的危害和損失。 此外，自動化程度高的漏洞發(fā)掘理論和實現(xiàn)已經(jīng)成為了漏洞發(fā)掘發(fā)展的重要方向。這樣就可以擺脫早期只能通過閱讀源代碼、了解程序流程等費時費工漏洞檢測方法，很大程度上提高了漏洞發(fā)現(xiàn)效率，對軟件安全有著巨大的推動作用。
|
