Kernel-level code reuse type attack detection method based on QEMU

Abstract

The invention discloses a kernel-level code reuse type attack detection method based on QEMU. The method mainly solves the problem of relying on hardware or need of modifying kernel source code in the prior art. According to the method, a function module of a QEMU virtual machine manager is expanded; each instruction which operates on the function module and in an operating system kernel is traversed and detected; jumping instructions relevant to the control flow process are recognized from the instructions, wherein the jumping instructions include ret and indirect call instructions; the jumping target addresses of the instructions are recorded; then, the target addresses are compared with legal target addresses in the system normal execution flow process for detecting whether a system is normally executed or not; and meanwhile, the interruption return addresses pushed into a stack during the interruption occurrence and the return addresses used during interruption actual return are subjected to comparison verification, so that whether attack occurs or not is judged. The kernel-level code reuse type attack detection method has the advantages that by aiming at the characteristic that the system original execution flow process needs to be changed for the code reuse type attack, the attack can be effectively discovered by monitoring the kernel execution flow process change instructions (and positions), and the kernel-level code reuse type attack detection method can be used for protecting the security of an operating system.

Description

technical field [0001] The invention belongs to the field of computer science and technology, relates to the protection of malicious software, in particular to a QEMU-based kernel-level code reuse type attack detection method. Background technique [0002] As a new contemporary attack method, the kernel-level code reuse attack does not need to inject any new code, and only uses (or reuses) the existing (legal) code in the kernel to construct a complete attack and fundamentally subvert the entire operation. system, it can escape the protection of the kernel code integrity protection mechanism, which brings a huge threat to the security of the user's computer system. [0003] Code reuse attacks need two steps to complete: (1) The attacker carefully selects available instruction fragments and connects them through specific instructions (such as ret); (2) Changes the original execution flow of the system (by tampering Some control data in the kernel execution, such as function ...

AI Technical Summary

Problems solved by technology

Moreover, none of the existing detection methods provide detection of the kernel interrupt process, and attackers can also implement attacks by changing the process of kernel interrupt processing

Images