Method and system for monitoring program execution path on basis of deep learning

Abstract

The invention discloses a method and system for monitoring a program execution path on the basis of deep learning, and relates to the technical field of computer security. The method includes the steps of firstly, inserting detecting points for functions in a program, obtaining the return addresses of the functions during running, and tracing back to find function addresses of the functions through a stacker pointer; secondly, obtaining function address intervals of all functions in a user layer and / or a system layer, comparing the function addresses with a function address space, and obtaining function names corresponding to the function addresses; thirdly, obtaining the calling path of the functions in the program in the user layer and / or the system layer according to the return addresses, the function address space and the function names; fourthly, deeply learning the program, obtaining the calling features of the functions in the program, generating a calling feature library, and comparing the calling path with the calling feature library so as to complete the monitoring of the program execution path.

Description

technical field [0001] The invention relates to malicious behavior monitoring during program running, and to the technical field of computer security, in particular to a method and system for monitoring program execution paths based on deep learning. Background technique [0002] In recent years, because of its clear business model, cloud computing has been widely concerned and generally recognized by the industry and academia, and has become one of the most concerned IT technologies. With the rapid development of cloud computing, the rapid growth and diversification of requirements has become an inevitable trend, which also makes the scale of data centers larger and larger, and the infrastructure is increasingly complex and diverse. The complexity of the current underlying platform has increased dramatically. While bringing convenience and efficiency, it also poses a great challenge to the security of cloud platform infrastructure including system software. [0003] Althou...

AI Technical Summary

Problems solved by technology

[0005] Under the background of the increasing complexity of the underlying system today, the calling relationship between various platforms and the platform itself is intricate, and under the guidance of the modular programming idea, the high cohesion and low coupling between each functional module make the inter-module The combination method is a combination explosion, which makes the growth. Manual analysis requires a lot of time and energy. It is almost impossible to complete the comprehensive analysis of large-scale systems.

Images