A control flow hijacking attack detection method and system based on dynamic analysis

Abstract

The invention relates to the technical field of vulnerability attack detection based on binary code flow, in particular to a vulnerability attack detection system under the Windows operating system. This technology uses dynamic binary instrumentation technology to monitor the program at runtime. The specific content includes: detailed analysis of the implementation principle and specific process of the control flow hijacking attack, and summarizing the main abnormal behavior of the application program caused by the control flow hijacking attack; Perform other operations before running the target program, use binary instrumentation technology to extract program runtime information for real-time attack detection; record detailed attack information for program vulnerability analysis; terminate program execution as soon as the attack is determined, and prevent further attacks . The invention provides a new solution for the control flow hijacking attack detection.

Description

technical field [0001] The invention relates to the technical field of vulnerability attack detection based on binary code flow, in particular to a vulnerability attack detection system under the Windows operating system. Background technique [0002] From the Morris worm in 1988 to the Wannacry ransomware in 2017, we can see the severe situation of cyberspace security. According to CNVD's 2017 statistics on the types of vulnerabilities included, application vulnerabilities accounted for as high as 59.2%, and the number of vulnerabilities is increasing year by year. Although major software manufacturers are constantly improving and perfecting software development quality management, the problem of software vulnerabilities cannot be completely eliminated. [0003] Application vulnerabilities can be exploited in a variety of ways, with control flow hijacking attacks being the most common. Control flow hijacking attacks allow an attacker to corrupt a program's control data, o...

AI Technical Summary

Problems solved by technology

Although the traditional control flow integrity policy CFI can effectively defend against control flow hijacking attacks, it is difficult to deploy in the actual environment

There are two main reasons for this: First, the construction of CFG is difficult. The complete CFG construction needs to rely on the source code of the program, which is even more difficult to implement for complex programs.

Second, it is necessary to check every indirect control transfer in the program, fine-grained detection will cause very large overhead

Dynamic stain analysis technology has problems such as over-pollution and under-pollution in actual detection, so the efficiency is low and the accuracy is not high

Images