Looking for breakthrough ideas for innovation challenges? Try Patsnap Eureka!

A software security detection method for code reuse programming

A detection method and code reuse technology, applied in the field of software security detection, can solve problems such as code injection attacks are no longer effective, computer system security threats, etc., to achieve the effect of improving software security quality, increasing the success rate of generation, and eliminating side effects

Active Publication Date: 2018-02-16
NANJING UNIV
View PDF1 Cites 0 Cited by
  • Summary
  • Abstract
  • Description
  • Claims
  • Application Information

AI Technical Summary

Problems solved by technology

With the deployment of defenses such as data execution prevention and address randomization on the operating system, traditional code injection attacks are no longer effective
However, code reuse programming does not need to inject attack codes. By reusing the code fragments existing in the target program to implement attacks, these security defense technologies can be bypassed, which poses a serious threat to the security of computer systems.

Method used

the structure of the environmentally friendly knitted fabric provided by the present invention; figure 2 Flow chart of the yarn wrapping machine for environmentally friendly knitted fabrics and storage devices; image 3 Is the parameter map of the yarn covering machine
View more

Image

Smart Image Click on the blue labels to locate them in the text.
Viewing Examples
Smart Image
  • A software security detection method for code reuse programming
  • A software security detection method for code reuse programming
  • A software security detection method for code reuse programming

Examples

Experimental program
Comparison scheme
Effect test

Embodiment Construction

[0030] figure 1 It is an overall flow chart of the software security detection method. The input of the method is the program to be detected, and the output is the potential attack code in the program to be detected that can be utilized by an attacker. First, collect the code fragments of each basic function in the executable segment of the program to be detected; then combine the collected basic function code fragments according to the predefined attack template to generate the attack code; , so after the attack code is generated, it is necessary to use the side effect elimination strategy for the side effect code fragment in the attack code to eliminate side effects; if the side effect of the code fragment in the attack code is successfully eliminated, the attack code is available and recorded in the corresponding test result file; finally output The attack code in each test result file reports the potential security risks of reuse code programming in the program to be test...

the structure of the environmentally friendly knitted fabric provided by the present invention; figure 2 Flow chart of the yarn wrapping machine for environmentally friendly knitted fabrics and storage devices; image 3 Is the parameter map of the yarn covering machine
Login to View More

PUM

No PUM Login to View More

Abstract

The present invention provides a software security detection method for code reuse programming. The method comprises five stages: instruction sequence disassembling, basic functional code snippet collecting, attack code generation, attack code recording and software security reporting. In the instruction sequence disassembling stage, a byte sequence before returning an instruction is disassembled. In the basic functional code snippet collecting stage, an instruction sequence collected in the previous stage is input; it is determined whether the instruction sequence belongs to a basic function; and the instruction sequence, if belonging to the basic function, is collected as a code snippet of the basic function. In the attack code generation stage, code snippets of all basic functions are combined according to a predefined attack template to generate an attack code; for a code snippet that has a side effect and that is contained in the attack code, the side effect of the code snippet is eliminated by using a side effect elimination policy, so as to ensure normal implementation of the function of the attack code. In the attack code recording stage, the attack code, from which the side effect is removed successfully, is recorded in a corresponding test result file.

Description

technical field [0001] The invention relates to software safety detection, in particular to a software safety detection method for detecting whether software is vulnerable to code reuse programming attacks. Background technique [0002] At present, the attacks on software are characterized by diversification and automation, which poses serious challenges to system and software security. With the deployment of defenses such as data execution prevention and address randomization on operating systems, traditional code injection attacks are no longer effective. However, code reuse programming does not need to inject attack codes. By reusing code fragments in the target program to implement attacks, these security defense technologies can be bypassed, which poses a serious threat to computer system security. Therefore, it is of great practical significance to carry out security detection for code reuse programming on software, which can effectively alleviate the attack of code r...

Claims

the structure of the environmentally friendly knitted fabric provided by the present invention; figure 2 Flow chart of the yarn wrapping machine for environmentally friendly knitted fabrics and storage devices; image 3 Is the parameter map of the yarn covering machine
Login to View More

Application Information

Patent Timeline
no application Login to View More
Patent Type & Authority Patents(China)
IPC IPC(8): G06F21/56
CPCG06F21/563
Inventor 曾庆凯朱晨晖
Owner NANJING UNIV
Who we serve
  • R&D Engineer
  • R&D Manager
  • IP Professional
Why Patsnap Eureka
  • Industry Leading Data Capabilities
  • Powerful AI technology
  • Patent DNA Extraction
Social media
Patsnap Eureka Blog
Learn More
PatSnap group products