ROP attack detection method and system based on virtual machine

Abstract

Belonging to the technical field of system safety, the invention discloses an ROP attack detection method and an ROP attack detection system based on a virtual machine. The method comprises: 1) running a to-be-protected operating system in a virtual domain environment; 2) positioning a set target process, and acquiring the process information of the target process; 3) monitoring the running of the process in the system, and marking the stack of the current target process as read only when a context switches to the target process; 4) intercepting the write operation occurred after a page error is caused by marking a writable stack memory region as read only, and marking the corresponding stack page as writable; 5) positioning the next place with stack checking need in the implementation of the current target process, and setting a breakpoint; and 6) intercepting the breakpoint and detecting whether the ROP attack exists, stopping the current target process if the ROP attack is detected, continuing to running the target process if the ROP attack is not detected, and marking the stack of the target process as read only. The method has the advantages of a high detection rate, a low rate of false alarm, etc.

Description

technical field [0001] The invention belongs to the technical field of system security, and in particular relates to a virtual machine-based ROP attack detection method and system. Background technique [0002] With the continuous deepening of the application of computer systems in various fields of society, its security issues have become the focus of both industry and academia. Malicious code has always been one of the main threats and hidden dangers of computer system security, and its harmfulness continues to increase with the increase of society's dependence on computer systems. With the continuous development of computer technology, malicious code technology has also been continuously upgraded. The emergence of new attack technologies and the improvement of countermeasures have brought severe challenges to traditional detection and prevention technologies. [0003] The malicious code attack constructed by Return Oriented Programming (ROP) has become one of the difficu...

AI Technical Summary

Problems solved by technology

For these ROP attack construction methods, the current detection and prevention methods have revealed shortcomings

In addition, since the current prevention methods are all implemented on the operating system and rely on the security of the operating system itself, when the credibility of the attacked system itself cannot be guaranteed, the protection against ROP attacks will fail

Images