Method for preventing illegal transferring of interruption procedures of operating system

Abstract

The invention discloses a method for preventing illegal transferring of interruption procedures of an operating system, which mainly solves the problem that illegal transferring of the interruption procedures of the operating system by attackers cannot be prevented in the prior art. The method for preventing illegal transferring includes steps of modifying the interruption procedures of the operating system, transmitting specific information to a virtual machine manager when the interruption starts and stops; and modifying the virtual machine manager. When the virtual machine manager receives information of interruption starting, values of a CS (client / server) and an IP (internet protocol) register on current stacks of the operating system can be stored into an FILO (first in later out) array; when the virtual machine manager receives information of interruption stopping, the values of the CS and the IP register stored at the head of the FILO array can be extracted to be compared with the values on the current stacks of the operating system, if the values of the CS and the IP register are different from those of the current stacks of the operating system, execution of the operating system is stopped so as to prevent illegal transferring of the attackers. By the aid of the virtual machine manager, control data in interruption context are protected, so that the attackers cannot transfer the executive procedures of the operating system by distorting the control data, and the method can be used for protecting safety of the operating system.

Description

technical field [0001] The invention belongs to the field of computer science and technology, and relates to the protection of malicious software, in particular to a method based on a virtual machine manager to prevent illegal transfer of an operating system interruption process, which can be used to protect the safety of the operating system. Background technique [0002] The attack based on the execution process is a typical attack method adopted by contemporary hackers. It illegally transfers the original execution flow of the program at a certain key point, jumps to the attacker's own malicious code, or "abuses" the original code fragments according to the order carefully selected by the attacker, to achieve malicious The purpose of the attack. [0003] In order to divert the original execution process, the attacker needs to rewrite certain control data in the system. The so-called control data refers to the data loaded into the CPU program counter at a certain point i...

AI Technical Summary

Problems solved by technology

Therefore, the protection of the operating system interrupt process is a very difficult problem

Images