Hidden Markov model based method for detecting assembler instruction level vulnerability

Abstract

The invention relates to a hidden Markov model based method for detecting assembler instruction level vulnerabilities, belonging to the technical field of information security. The method comprises the following steps of: (1) constructing a vulnerability instruction library (VIL); (2) respectively selecting a plurality of executable programs with the vulnerability as training data of the vulnerability for each vulnerability in the vulnerability instruction library by aiming at all the vulnerabilities in the vulnerability instruction library constructed in the step (1); (3) obtaining assembler instruction segments of the training data of each vulnerability in the vulnerability instruction library; (4) obtaining a numerical code sequence of the training data; (5) sequentially obtaining a parameter lambda r=(Ar, Br, pi r) of the corresponding hidden Markov model of each vulnerability in the vulnerability instruction library; and (6) recognizing the vulnerability of an executable program to be detected. Compared with the prior art, the hidden Markov model based method for detecting the assembler instruction level vulnerability has the following advantages of establishing a model for the assembler instruction with context correlation and recognizing vulnerability characteristics by using the HMM (Hidden Markov Model) for the first time, increasing vulnerability detection efficiency and reducing error report rate and missing report rate.

Description

technical field [0001] The invention relates to a method for detecting a leak at the assembly instruction level, in particular to a method for detecting the leak at the assembly instruction level based on a hidden Markov model, and belongs to the technical field of information security. Background technique [0002] With the rapid development of computer technology, the degree of informatization of human society is getting higher and higher, and the political, economic, military, cultural and other fields of the whole society rely more and more on computer information systems. In this case, the security of computer system has been paid more and more attention by people. However, the writing of large-scale software and systems requires many programmers to work together. They divide a software or system into several sections, divide the work into writing, then summarize and test; finally patch and release, so there are almost no security holes in the software. It is inevitabl...

AI Technical Summary

Problems solved by technology

In this way, from the perspective of the observer, only the observation value can be seen, unlike the one-to-one correspondence between the observation value and the state in the Markov chain model

Images