Code reuse attack detection system based on dynamic binary translation framework

Abstract

The invention belongs to the field of computer security, and discloses a code reuse attack detection system based on a dynamic binary translation framework. The detection system comprises a translator, a detector, a cache and transition platforms. The translator is used for decoding binary data of a program item by item by using basic blocks as unit. The detector is used for processing commands after decoding, normal operation is guaranteed on the basis of conventional detection, and behaviors of the commands are acquired and detected by centering on attack detection. Mapping relation between sources and translation addresses of the basic blocks are established by the cache, and target codes of the basic blocks, which are generated by translation, are cached. Control flows of the program are managed through the transition platforms, program translation and ordered execution are guaranteed, and a detection and optimization mechanism is provided for commands of the same type. The system can be used for processing non-open source programs, and guaranteeing safe execution of the programs.

Description

technical field [0001] The invention belongs to the field of computer security, in particular to a code reuse attack detection system based on a dynamic binary translation framework. Background technique [0002] The continuous expansion of software scale has led to an increasing number of vulnerabilities, and the popularity of the Internet has made attacks based on software vulnerabilities feature a wide range, multiple methods, and rapid spread, posing a serious threat to user security. The main attack method against buffer overflow vulnerabilities in the early days is code injection. The attacker injects executable binary code into the process address space locally or remotely, changes the control flow of the program and makes the process execute this code. At present, there are a large number of code injection attacks. defense mechanism. [0003] Code reuse attack (Code Reuse Attack) is a relatively common attack method at present. It is the evolution of code injection ...

AI Technical Summary

Problems solved by technology

[0006] Existing defense mechanisms or detection systems have various deficiencies, such as needing source code support, high performance overhead, etc.

Images