Data flow monitoring-based code reuse attack defending method and system

Abstract

The invention discloses a data flow monitoring-based code reuse attack defending method and system, and belongs to the technical field of system security. The method comprises the steps of firstly extracting function and data information through source codes of a target program and a shared library; then analyzing intermediate language codes; identifying a memory access instruction in the target program and the shared library; and performing instrumentation on the instruction and generating a function jumping table and instruction relocating information. During target program loading, segments, stacks and heaps of the target program and the shared library are mapped to corresponding regions of a memory address space, and an isolation environment is set. During target program operation, ina mode of monitoring abnormal data flow, an attacker is prevented from performing a search in an isolation region, so that code reuse attack is prevented. The invention furthermore discloses a data flow monitoring-based code reuse attack defending system. The method and the system are suitable for code reuse attack defending in an X86_64 platform, so that huge loss caused by attack can be avoided.

Description

technical field [0001] The invention belongs to the technical field of system security, and more specifically relates to a code reuse attack defense method and system based on data flow monitoring. Background technique [0002] When developers write programs, they often inevitably produce many loopholes. Code reuse attack refers to exploiting vulnerabilities to search for exploitable code fragments in the memory address space of the program when the program is running, and linking them into code sequences that can be executed continuously by modifying function pointers or return addresses (including function sequence, instruction sequence), and make the program execute these code sequences instead. Through code reuse attacks, attackers can hijack programs, obtain system privileges, and execute malicious code, which brings great hidden dangers to the security of applications and operating systems. Code reuse attacks take advantage of the following characteristics of program...

AI Technical Summary

Problems solved by technology

However, there are certain deficiencies and limitations in the above method: (1) With the page as the protection granularity, since the code page contains some data, it is necessary to separate the data and code in the code page

(2) All control flow transfers need to be inserted, and the overhead is large

(3) Only the code is protected, but the data is not protected, such as some sensitive data: pointers and return addresses. New code reuse attacks use the contents of the data (encrypted function pointers and return addresses on the stack) ), still able to guess the location of the code fragment

Images