A control flow hijacking attack detection technology and system based on dynamic analysis

Abstract

The invention relates to the technical field of vulnerability attack detection based on binary code streams, in particular to a vulnerability attack detection system under a Windows operating system.According to the technology, a dynamic binary instrumentation technology is adopted to monitor a program during running, and the specific content comprises the steps that the implementation principleand the specific process of a control flow hijacking attack are analyzed in detail, and main abnormal behaviors, caused by the control flow hijacking attack, of an application program are summarized;other operations do not need to be carried out before the target program runs, and the binary instrumentation technology is used for extracting program running information to carry out real-time attack detection; the detailed information of the attack is recorded for program vulnerability analysis; and the program operation is ended at the first time of determining the attack, thereby preventing further behavior of the attack. The invention provides a new solution for the detection of the control flow hijacking attack.

Description

technical field [0001] The invention relates to the technical field of vulnerability attack detection based on binary code flow, in particular to a vulnerability attack detection system under the Windows operating system. Background technique [0002] From the Morris worm in 1988 to the Wannacry ransomware in 2017, we can see the severe situation of cyberspace security. According to CNVD's 2017 statistics on the types of vulnerabilities included, application vulnerabilities accounted for as high as 59.2%, and the number of vulnerabilities is increasing year by year. Although major software manufacturers are constantly improving and perfecting software development quality management, the problem of software vulnerabilities cannot be completely eliminated. [0003] Application vulnerabilities can be exploited in a variety of ways, with control flow hijacking attacks being the most common. Control flow hijacking attacks allow an attacker to corrupt a program's control data, o...

AI Technical Summary

Problems solved by technology

Although the traditional control flow integrity policy CFI can effectively defend against control flow hijacking attacks, it is difficult to deploy in the actual environment

There are two main reasons for this: first, the construction of CFG is difficult, and the complete CFG construction needs to rely on the source code of the program, which is even more difficult to implement for complex programs.

Second, it is necessary to check every indirect control transfer in the program, fine-grained detection will cause very large overhead

Dynamic stain analysis technology has problems such as over-pollution and under-pollution in actual detection, so the efficiency is low and the accuracy is not high

Images