Intelligent detection method and device for return programming attack

Abstract

The invention relates to the field of security detection, discloses an intelligent detection method and device for a return programming attack, belongs to the field of system underlying security detection, and aims to detect binary executable files of a program and process commercial software without a source code of a detected software program. According to the main scheme, the method comprises the steps that instrumentation is conducted on a tested program, the execution process of the tested program is output in the form of assembly codes through the disassembling technology, and then a program execution stream is obtained; performing real-time monitoring by utilizing the execution streams, and screening out suspicious program execution streams; according to the method, a suspicious program execution flow is subjected to secondary screening, an artificial intelligence model is utilized to accurately judge a suspicious ROP attack, whether ROP defense is started or not is determined according to a judgment result, and a time-limited alarm and active crash strategy is adopted for a program judged to be the ROP attack, so that the detected program is prevented from suffering from greater loss.

Description

technical field [0001] The invention belongs to the field of system bottom security detection, in particular to an intelligent detection method for return-oriented programming attacks. Background technique [0002] Today, cloud computing and mobile Internet technologies have become new trends, which on the one hand promote the development of informatization, and on the other hand bring new challenges to traditional system security models and protection technologies. The use of software security vulnerabilities is a common and critical technology. Attackers invade networks and systems through vulnerabilities, and then conduct further attacks such as stealing data and running malware. Program security plays a crucial role in the development and application of computers. With the development of security protection technology, attackers keep trying to exploit various vulnerabilities to attack programs. At first, the attacker tried to attack the control flow of the program, by i...

AI Technical Summary

Problems solved by technology

[0011] Although defenses against ROP itself have been continuously proposed in recent years, and a variety of fine-grained randomization schemes have been proposed for the shortcomings of ASLR, these defenses such as DEP and Canary cannot directly and effectively solve the variant ROP. attack

Images