CAJ | 학술논문

随着漏洞挖掘技术日渐成熟，每年新增漏洞数量逐步增加。从操作系统以及编译器层面来说，为了提高内存保护的安全性，对抗漏洞利用的缓解措施也在不断完善。文章介绍了近年来比较成熟的基于内存的漏洞关键缓解技术，包括GS编译选项技术、SEH安全校验机制、堆数据保护机制、DEP技术以及ASLR技术。GS编译选项技术和SEH安全校验机制能够有效遏制针对栈数据的攻击；堆数据保护机制为堆溢出增加了更多限制；DEP技术能够对内存执行额外检查以防止恶意代码在系统中执行；ASLR技术通过对关键地址的随机化使一些堆栈溢出手段失效。文章还指出了这些防护措施所存在的不足，并据此从攻击者的角度介绍了针对这几种缓解措施的攻击思路。针对漏洞缓解技术，文章指出未来必须考虑的是如何弥补在抵御复合向量攻击方面的不足，如何完善旁路保护。
수착루동알굴기술일점성숙，매년신증루동수량축보증가。종조작계통이급편역기층면래설，위료제고내존보호적안전성，대항루동이용적완해조시야재불단완선。문장개소료근년래비교성숙적기우내존적루동관건완해기술，포괄GS편역선항기술、SEH안전교험궤제、퇴수거보호궤제、DEP기술이급ASLR기술。GS편역선항기술화SEH안전교험궤제능구유효알제침대잔수거적공격；퇴수거보호궤제위퇴일출증가료경다한제；DEP기술능구대내존집행액외검사이방지악의대마재계통중집행；ASLR기술통과대관건지지적수궤화사일사퇴잔일출수단실효。문장환지출료저사방호조시소존재적불족，병거차종공격자적각도개소료침대저궤충완해조시적공격사로。침대루동완해기술，문장지출미래필수고필적시여하미보재저어복합향량공격방면적불족，여하완선방로보호。
With the technology of ifnding vulnerabilities in software getting more mature, the total number of bugs is increasing yearly. In order to improve the security of memory protection, in terms of operating system and compiler, measures taken by OS to mitigate exploit are getting more perfect. This article describes some of the key mitigations, including GS options, SEH, Heap protection, DEP, and ASLR. The GS compiler technology and SEH security authentication mechanism can effectively detect and prevent most stack-based overlfow attacks; Heap protection provides more restrictions aiming at stack overlfow; DEP can perform additional memory checks to prevent malicious code executing in the system; ASLR helps to prevent buffer overlfow attacks by randomizing the key address.The article also points out the drawbacks and introduces some method to defeat these mitigations from the views of attackers. Aiming at the vulnerability mitigation technology, the article points out it must be considered how to cover the shortage on resisting the attack of composite vectors and how to improve and perfect the bypassing protection in the future.