Security defense method and device of Android privilege escalation attack based on integrity verification

Abstract

The invention relates to a security defense method and device of the Android privilege escalation attacks based on integrity verifications. The method comprises the steps that the case that whether or not an application program is executing the system calls associated with sensitive kernel functions is detected in real time; integrity verifications are conducted on the sensitive kernel functions to be executed by the system calls; the accuracy and reliability of the kernel function pointer corresponding to the sensitive kernel functions are examined; the case that whether or not the internal storage pointed by the kernel function pointers has the commands for the privilege escalation attack features is evaluated; the detected application privilege escalation attacks are given warnings and blocked. According to the security defense method and device of the Android privilege escalation attacks based on integrity verifications, the privilege escalation attack behaviors of malicious programs are detected in real time and are given warnings and blocked, and the damages caused by attacks on the Android system are prevented, and the securities of the application and data are effectively protected. The security defense method and device of the Android privilege escalation attacks based on integrity verifications reduce security threats brought to the Android system by the privilege escalation vulnerabilities, and enhance the security of the Android system.

Description

technical field [0001] The present invention relates to the technical field of information security, in particular to a security defense method and device for Android privilege escalation attacks based on integrity verification. Background technique [0002] This section introduces readers to background technologies that may be related to various aspects of the present invention, and it is believed that useful background information can be provided to readers, thereby helping readers to better understand various aspects of the present invention. Accordingly, it is to be understood that the descriptions in this section are for the purposes stated above and do not constitute admissions of prior art. [0003] Privilege escalation attack is an attack method that exploits Android system vulnerabilities to illegally elevate the running privileges of applications. Taking advantage of the privilege escalation vulnerability in the Android system, malicious programs can bypass the pr...

AI Technical Summary

Problems solved by technology

This restricts malicious processes that illegally obtain Root privileges from accessing protected system resources, thereby constraining other malicious behaviors of the process

The above method is to defend when the malicious process has illegally obtained Root permission and tries to access key resources, rather than to defend when the process is trying to obtain Root permission. Therefore, the defense effect has a certain lag and is not timely enough.

Images