A program anomaly analysis method based on dynamic taint propagation

Abstract

The present invention provides a program abnormal analysis method based on dynamic taint propagation. The steps include: dynamically running a target program in a virtualized environment, monitoring the target process of the target program and recording execution sequence information; The input data is marked as a taint source, and the taint propagation analysis is performed according to the instruction semantics of the instructions executed by the target process, and the taint state information of the memory is obtained; the memory access exception during the running process of the target program is identified, and the exception of the abnormal instruction is extracted. location, according to the taint state information of the memory, detect the taint state of the operand and register at the abnormal position; if the operand and register are polluted, locate the error point through taint backtracking; otherwise, perform reverse engineering on the register Slice analysis to find out the relevant data link, and perform heap overflow detection and UAF detection on each node on the data link, and locate the error point through comparative analysis.

Description

technical field [0001] The invention belongs to the technical field of network security, and specifically relates to a method for analyzing abnormalities or loopholes of binary programs and locating error points on a virtualization platform based on data flow analysis of dynamic stain propagation. Background technique [0002] With the continuous improvement of program functions, scale, and complexity and the intensification of update iteration speed, as well as the lack of security awareness of software developers, software vulnerabilities have seriously threatened the security of cyberspace, and the damage caused by them has become increasingly serious. The harm of the vulnerability is initially manifested in the crash and exception of the program, and most of these crashes and exceptions are caused by memory access exceptions. Currently, memory access exceptions include memory read exceptions, write exceptions, and execution exceptions. Common causes include null pointer ...

AI Technical Summary

Problems solved by technology

[0012] To sum up, the main drawbacks of the current program exception analysis method are: relying on debuggers and a large number of analysts, unable to deal with target software with packer obfuscation and anti-debugging capabilities, the depth of analysis is not enough, it stays at the surface, and cannot effectively analyze the abnormality caused by it deeply. root cause, has certain dependencies on the source code

Images