A detection method, defense method and system for linux kernel data attack

Abstract

The invention discloses a Linux kernel data attack detection method and a defense method and system. The method comprises the following steps that safety key data is extracted from Linux kernel data according to the Linux kernel data and the safety relevancy; static analysis is carried out on the Linux kernel data to obtain data flow of the Linux kernel data; the relation between the safety key data is extracted from the data flow of the Linux kernel data to obtain a data flow of the safety key data; the key data in the operation process of a Linux kernel is monitored and compared with the data flow of the security key data, if the key data is deviated from the data flow of the safety key data in the operation process of the Linux kernel, the output Linux kernel data is attacked, and otherwise, the output Linux kernel data is not attacked. Compared with an existing kernel data attack detection scheme, the indirect branch characteristic of program data flow is fully considered, and thefalse alarm rate of detection results is effectively reduced.

Description

technical field [0001] The invention belongs to the field of kernel attack detection and defense, and more specifically relates to a detection and defense method and system for Linux kernel data attacks. Background technique [0002] The kernel is the most basic part of the operating system, and for a secure and stable system, protecting the kernel from interference from other running programs is paramount. Kernels are becoming a target for attackers today for several reasons: [0003] First, due to the implementation of various user-mode protection mechanisms such as ASLR, Sandbox, CFI, CPI, DEP, etc., attacks against user-mode programs are becoming more and more difficult; [0004] Second, the attack surface of the kernel is large. This is due to the large number of kernel code lines (16.9MLOC, Linuxver4.5.4), many system calls (397), and the new version of the kernel will also bring new vulnerabilities and attack opportunities; [0005] Third, the income obtained by at...

AI Technical Summary

Problems solved by technology

[0012] Aiming at the above defects or improvement needs of the prior art, the present invention provides a detection method and system for Linux kernel data attacks, the purpose of which is to solve the problem that the existing kernel attack defense methods do not take kernel data into account and cannot cope with kernel data attacks problem technical problem

Images