Defense method for kernel-level return-oriented rootkits

Abstract

The invention discloses a defense method for kernel-level return-oriented rootkits, which mainly solves the problem of incapability of defending the latest kernel-level return-oriented rootkits attack in the prior art. The method comprises the following implementation steps of: distributing an index for each piece of control data by a compiler and converting a related instruction so as not to directly use the control data during program skip but search a certain skip table by using the index distributed by the compiler to obtain a really effective skip address to indirectly perform; and then collecting all effective skip addresses, namely control data, in a system to a function pointer table and returning to an address table for protection. By adopting the method, a second step of conducting attack cannot be finished by the kernel-level return-oriented rootkits, namely the original execution flow of the system is required to be changed by rewriting a certain piece of control data, and the method can be used for protecting safety of an operating system.

Description

technical field [0001] The invention belongs to the field of computer science and technology, and relates to the protection of malicious software, in particular to a compiler-based defense method for kernel-level return-oriented rootkits, which can be used to protect the safety of an operating system. Background technique [0002] As a kind of contemporary malicious software, kernel-level rootkits can hide the traces of attackers and fundamentally subvert the entire operating system, which poses a huge threat to the security of users' computer systems. Rootkits can obtain and maintain unrestricted access rights on compromised computers, including stealing sensitive user information, upgrading system privileges of malicious programs, and opening backdoor access channels. To make matters worse, all of these malicious operations are able to evade detection by antivirus software. [0003] Traditional kernel-level rootkits usually need to execute newly injected code, and users c...

AI Technical Summary

Problems solved by technology

Return-less uses three sub-techniques: return indirection, peephole optimization and register allocation algorithm to remove all return opcode bytes in the operating system kernel, so that attackers cannot choose available instruction fragments to construct attacks

However, the latest return-oriented rootkits variants no longer rely on the return instruction, but instead use return-like instructions to concatenate instruction fragments, such as using the "pop+jump" instruction sequence [Checkoway et al., ACM CCS 2010 ] or indirect jump instructions [Bletsch et al., ACM ASIACCS 2011], very difficult to deal with

Images