HACKING CODE SENSING DEVICE, HACKING CODE SENSING METHOD, AND HACKING CODE SENSING PROGRAM

摘要

An attack code detection apparatus (10) includes a preprocessing unit (11) that analyzes in advance a library file for learning used in an ROP (Return Oriented Programming) chain, and obtains sets including the addresses of ROP gadgets, which represent pieces of code in the library file, and increment values of the stack pointer at the time of execution of the ROP gadgets; and a detecting unit (124) that refers to the obtaining result of the preprocessing unit, that verifies, regarding an unknown data series representing the examination target, whether or not the ROP chain is valid in which the ROP gadgets are correctly linked, and that detects whether or not the unknown data series representing the examination target is a malicious data series.