Memory address adjustment method and device of operating system, equipment, storage medium and program product

Abstract

The invention discloses a memory address adjustment method and device for an operating system, equipment, a storage medium and a program product. The method comprises the following steps: acquiring running data of the operating system; inputting the operation data into a preset neural network model, and obtaining an adjustment strategy output by the neural network model; wherein the neural network model comprises an input layer, a data processing layer and an output layer, the input layer is used for receiving the operation data, the data processing layer is used for performing memory analysis and attack recognition on the operation data to obtain a feature analysis result, and the output layer generates an adjustment strategy according with a memory optimization target according to the feature analysis result; and adjusting the memory address of the operating system according to the adjustment strategy. By adopting the embodiment of the invention, the memory address space layout of the operating system can be adjusted in real time, the randomness and unpredictability of the address space layout are improved, and different operating environments and attack modes are effectively coped with, so that the protection capability of the system is enhanced.

Description

Technical Field

[0001] This invention relates to the field of computer technology, and in particular to a method, apparatus, device, storage medium, and program product for adjusting memory addresses in an operating system. Background Technology

[0002] With the rapid development of information technology, the security of computer operating systems has become increasingly important. As the core of a computer system, the security of the operating system directly affects the stability and security of the entire system. Among numerous attack methods, Address Space Layout Randomization (ASLR) bypass techniques are common and highly dangerous. Traditional ASLR methods typically use a fixed randomization algorithm to randomize the memory address space layout each time the system starts, thus increasing the difficulty for attackers to guess memory addresses. Even though memory addresses change with each startup, the fixed randomization pattern allows attackers to deduce the randomized memory addresses through repeated trials or analysis of the memory layout, enabling successful attacks. This is especially true when attackers possess knowledge of memory distribution, making existing ASLR techniques easier to bypass. Furthermore, fixed randomization strategies cannot be dynamically adjusted according to the specific circumstances of system operation, making it difficult to effectively cope with different operating environments and attack patterns. Summary of the Invention

[0003] The purpose of this invention is to provide a method, apparatus, device, storage medium, and program product for adjusting the memory address space of an operating system, which can adjust the memory address space layout of the operating system in real time, improve the randomness and unpredictability of the address space layout, effectively cope with different operating environments and attack modes, and thus enhance the system's protection capabilities.

[0004] To achieve the above objectives, embodiments of the present invention provide a method for adjusting the memory address of an operating system, comprising: Obtain operating system runtime data; The running data is input into a preset neural network model, and the adjustment strategy output by the neural network model is obtained; wherein, the neural network model includes an input layer, a data processing layer and an output layer, the input layer is used to receive the running data, the data processing layer is used to perform memory analysis and attack identification on the running data to obtain feature analysis results, and the output layer generates an adjustment strategy that meets the memory optimization target based on the feature analysis results; The memory addresses of the operating system are adjusted according to the adjustment strategy described above.

[0005] As an improvement to the above scheme, the runtime data includes at least one of memory usage, process behavior data, system call frequency, and memory access mode.

[0006] As an improvement to the above scheme, the data processing layer includes: A kernel-mode feature extraction layer is used to extract features from the memory usage and process behavior data to obtain feature data related to memory allocation and process execution. The memory pattern analysis layer is used to perform correlation analysis on the memory access patterns to obtain characteristic data of memory address distribution; An attack pattern identification layer is used to identify the memory regions exploited by attackers and determine potential attack paths based on the process behavior data and system call frequency.

[0007] As an improvement to the above scheme, the output layer is used for: Based on the feature analysis results obtained from the data processing layer, the entropy value of the memory address distribution, the address space coverage, and potential attack paths are determined. Based on the entropy value of the memory address distribution, the address space coverage, and the potential attack paths, a memory optimization objective function is constructed. Solve the memory optimization objective function to obtain the adjustment strategy.

[0008] As an improvement to the above scheme, the adjustment strategy includes at least one of reallocating memory addresses, adjusting stack addresses, and adjusting the loading address of dynamic link libraries.

[0009] As an improvement to the above scheme, the kernel-state feature extraction layer uses an adaptive convolutional neural network, the memory usage pattern analysis layer uses a graph convolutional network, and the attack pattern recognition layer uses a multi-head attention mechanism.

[0010] To achieve the above objectives, embodiments of the present invention also provide a memory address adjustment device for an operating system, comprising: The runtime data acquisition module is used to acquire runtime data of the operating system; The adjustment strategy acquisition module is used to input the running data into a preset neural network model and acquire the adjustment strategy output by the neural network model; wherein, the neural network model includes an input layer, a data processing layer and an output layer, the input layer is used to receive the running data, the data processing layer is used to perform memory analysis and attack identification on the running data to obtain feature analysis results, and the output layer generates an adjustment strategy that meets the memory optimization target based on the feature analysis results; The memory address adjustment module is used to adjust the memory address of the operating system according to the adjustment strategy.

[0011] To achieve the above objectives, embodiments of the present invention also provide a memory address adjustment device for an operating system, including a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor. When the processor executes the computer program, it implements the memory address adjustment method for an operating system as described in any of the above embodiments.

[0012] To achieve the above objectives, embodiments of the present invention also provide a computer-readable storage medium, the computer-readable storage medium including a stored computer program, wherein, when the computer program is executed, it controls the device where the computer-readable storage medium is located to execute a memory address adjustment method of an operating system as described in any of the above embodiments.

[0013] To achieve the above objectives, embodiments of the present invention also provide a computer program product, including computer instructions, which, when executed by a processor, implement the memory address adjustment method of the operating system as described in any of the above embodiments.

[0014] Compared to existing technologies, the memory address adjustment method, apparatus, device, storage medium, and program product for operating systems disclosed in this invention can adjust the memory address space layout of the operating system in real time, improving the randomness and unpredictability of the address space layout, effectively responding to different operating environments and attack modes, thereby enhancing the system's protection capabilities. By acquiring operating data and inputting it into a neural network model containing an input layer, a data processing layer, and an output layer, the data processing layer performs memory analysis and attack identification on the operating data to obtain feature analysis results. The output layer then generates an adjustment strategy based on this and applies it to memory address adjustment. This allows for real-time and accurate perception of operating system memory usage and potential attack conditions, dynamically optimizing the memory address layout, significantly improving the randomness and security of memory address distribution, and effectively resisting attack methods that rely on memory address guessing, such as buffer overflows. Simultaneously, leveraging the adaptive learning capability of the neural network model, it can continuously adapt to system operating modes and new attack variations, ensuring system security while also considering memory resource utilization efficiency. This provides an intelligent and dynamic memory security protection solution for the operating system, significantly enhancing the overall security and stability of the operating system. Attached Figure Description

[0015] Figure 1 This is a schematic diagram of the framework of the neural network model provided in an embodiment of the present invention; Figure 2 This is a schematic diagram illustrating the training and application of the neural network model provided in an embodiment of the present invention; Figure 3 This is a flowchart of a memory address adjustment method for an operating system provided in an embodiment of the present invention; Figure 4This is a flowchart of the output layer generation adjustment strategy in the neural network model provided in this embodiment of the invention; Figure 5 This is a structural block diagram of a memory address adjustment device for an operating system provided in an embodiment of the present invention; Figure 6 This is a structural block diagram of a memory address adjustment device for an operating system provided in an embodiment of the present invention. Detailed Implementation

[0016] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0017] Existing technologies primarily improve memory address space security through the ASLR method using a fixed randomization algorithm, combined with stack protection and memory protection units to defend against buffer overflow attacks. However, these solutions have significant limitations in dealing with complex and ever-changing attack patterns, failing to provide sufficient security guarantees. Therefore, there is an urgent need for a neural network-optimized operating system (such as Linux and Windows) memory address space layout randomization method to improve system security and flexibility, and resist various complex attack methods.

[0018] To overcome the shortcomings of traditional ASLR technology and improve system security and protection capabilities, this invention proposes an operating system memory address adjustment method that can dynamically adapt to changes in system operating states and attack patterns, providing a more efficient and flexible randomization strategy. The neural network-optimized ASLR method, by introducing a neural network model, can dynamically adjust based on real-time system operating data, thereby significantly improving the randomness and unpredictability of the memory address space layout. This dynamic and adaptive randomization strategy can respond to different system operating states and attack patterns in real time, enhancing the system's protection capabilities. Furthermore, traditional ASLR methods, due to their use of fixed randomization algorithms, struggle to effectively cope with different operating environments and complex attack patterns, exhibiting limitations in randomization effectiveness and security. This invention, by introducing a dynamic and adaptive randomization strategy, can adjust the memory address space layout in real time, significantly improving the randomness and unpredictability of the address space layout, thereby enhancing the system's protection capabilities, particularly in preventing buffer overflow attacks.

[0019] See Figure 1 , Figure 1This is a schematic diagram of the neural network model framework provided in this embodiment of the invention. The neural network model includes an input layer, a data processing layer, and an output layer. The input layer receives runtime data from the operating system as the raw input for model analysis. The data processing layer contains three sub-layers that jointly perform feature analysis on the runtime data. Based on the feature analysis results obtained from the data processing layer, the output layer generates a memory address adjustment strategy and finally outputs a strategy to optimize the system memory layout. The entire framework achieves intelligent conversion from system data to security adjustment strategies through layered collaboration.

[0020] See Figure 2 , Figure 2 This is a schematic diagram of the training and application of a neural network model provided in an embodiment of the present invention. The training process of the neural network model includes the following steps S101 to S104.

[0021] S101. Collect historical operating system data through the memory monitoring module. This data includes at least one of the following: memory usage, process behavior data, system call frequency, and memory access patterns. The specific meanings and acquisition methods of the operating data are as follows: 1) Memory usage M(t) refers to the allocation, use, and release status of memory by the operating system or processes. This can be collected through a memory monitoring module; for example, memory usage includes the memory block size, allocation time, and release time for each process. 2) Process behavior data P(t) is information about various activities of a process during its execution. It can be collected through a memory monitoring module; for example, process behavior data includes the process's creation time, termination time, and runtime. 3) System call frequency S(t) represents the number of times various system calls are triggered within a certain period of time. This can be obtained by collecting system call logs through the memory monitoring module. The system call logs include the type, frequency, and time of each system call. 4) Memory access pattern A(t) describes the pattern of memory address access. It can be collected by the memory monitoring module. For example, the memory access pattern includes the frequency of memory access, the range of accessed addresses, and the timestamp of the access.

[0022] The collected memory usage M(t), process behavior data P(t), system call frequency S(t), and memory access pattern A(t) are integrated to construct a historical runtime dataset D(t), which satisfies the following formula: D(t)={M(t),P(t),S(t),A(t)}(1).

[0023] S102. Preprocess the collected historical running dataset to generate a feature dataset.

[0024] For example, the collected historical dataset D(t) is cleaned to remove noise and outliers. Then, the cleaned data is standardized to give different data types a uniform scale. The standardized data is denoted as... For standardized datasets Feature extraction is performed to extract features related to memory allocation, process behavior, system calls, and memory access patterns, generating a feature matrix. It satisfies the following formula: (2); (3); in, Indicates the first One characteristic, , This represents the total number of features in the feature matrix; Weights for feature extraction For the first extracted from the standardized dataset Nonlinear transformation function of each characteristic , For feature bias terms, This represents the total number of features in the standardized dataset.

[0025] Then, for the characteristic matrix Dimensionality reduction is performed using Principal Component Analysis (PCA), which reduces the dimensionality of features while preserving key features, generating a dimensionality-reduced feature dataset. It satisfies the following formula: (4); in, It is the dimensionality reduction matrix of PCA. It is the mean vector of the characteristic matrix.

[0026] Finally, the dimensionality-reduced feature dataset Perform time series segmentation to generate a subset of feature data for training and validation, denoted as . and : (5); (6); in, and These represent the time ranges for the training and test sets, respectively.

[0027] S103. The generated training set and test set are used to train the neural network model. During the training process, a supervised learning algorithm is used to optimize the parameters of the neural network model. The kernel state feature extraction layer uses an adaptive convolutional neural network, the memory usage pattern analysis layer uses a graph convolutional network, and the attack pattern recognition layer uses a multi-head attention mechanism.

[0028] For example, the generated training set and test set Input into the neural network model to initialize the model parameters. Define operating system-specific memory-optimized neural network model architectures, including: 1) Input layer, which receives the feature dataset used for training. ; 2) Kernel-mode feature extraction layer: Uses an adaptive convolutional neural network to extract local features of memory allocation and process behavior data, and adaptively adjusts the convolutional kernel to adapt to different memory patterns; 3) Memory usage pattern analysis layer: This layer uses a graph convolutional network based on memory access patterns to learn the correlation between memory addresses and maps memory usage patterns into a graph structure for analysis. 4) Attack pattern recognition layer: This layer uses a multi-head attention mechanism to identify potential attack patterns and focuses on features related to known attack behaviors. 5) Output layer, randomization strategy generation layer, used to generate optimized address space layout randomization strategies.

[0029] Then, define the cross-entropy loss function in the supervised learning algorithm. This is used to measure the error between the model's predicted results and the true labels. The backpropagation algorithm is used, based on the loss function... Model parameters of neural network models Optimize and update the model parameters. The update process satisfies the following formula: (7); in, For learning rate, This is the gradient of the loss function with respect to the model parameters.

[0030] During training, batch gradient descent is used to batch the training set. The model is trained and its parameters are updated in batches, divided into multiple smaller batches. Based on the collected memory allocation data M(t) and process behavior data P(t), a mapping relationship between memory usage patterns and attack patterns is established, generating an optimized address space layout randomization strategy. After each training round, a test set is used... The neural network model is validated to evaluate its performance. Based on the validation results, the hyperparameters of the model are adjusted, including the learning rate, adaptive convolutional kernel size, and the number of heads in the multi-head attention mechanism. Additionally, in each training epoch, the weights of some neurons are randomly mutated to increase the randomness and robustness of the neural network model and prevent it from getting trapped in local optima. Repeat the above training steps until the validation error of the neural network model converges to a predetermined threshold or the maximum number of training epochs is reached, ultimately obtaining the optimized neural network model. The optimized neural network model As a core module for memory address space layout randomization, it is used in operating system memory for real-time optimization and dynamic adjustment.

[0031] S104. During the training process, based on the collected memory allocation and process behavior data, a mapping relationship between memory usage patterns and attack patterns is established, and an optimized address space layout randomization strategy is generated.

[0032] In this embodiment of the invention, traditional ASLR strategies do not utilize historical data for optimization and training, resulting in limited randomization effects and an inability to generate efficient randomization strategies. This invention constructs a historical runtime dataset and generates a feature dataset by collecting and preprocessing historical memory allocation data, process behavior data, system call logs, and memory access pattern data from the operating system. A supervised learning algorithm is then used to train the neural network model and optimize its parameters. During training, cross-entropy loss and backpropagation algorithms are employed to optimize the neural network model parameters. Batch gradient descent and random weight mutation are used to prevent the model from getting trapped in local optima, increasing the model's randomness and robustness. Through this optimization and training process, the neural network model can generate more effective address space layout randomization strategies, significantly improving the system's protection capabilities.

[0033] Furthermore, after obtaining the trained neural network model Then, the neural network model is deployed into the operating system's memory as a memory address space layout randomization module.

[0034] For example, the trained neural network model The process involves converting the data into an executable format suitable for the operating system's memory, generating a corresponding memory module, signing and verifying the generated memory module, and then using the `insmod` and `modprobe` commands to transfer the neural network model. Deployed to the operating system memory. Initialize the deployed neural network model. Allocate corresponding memory resources for it. Configure the memory address space layout randomization module so that it can call the neural network model in real time during memory startup and operation. .

[0035] This completes the deployment of the neural network model in the operating system. The operating system will then use this neural network model to dynamically adjust memory addresses.

[0036] See Figure 3 , Figure 3 This is a flowchart of a memory address adjustment method for an operating system provided in an embodiment of the present invention. The memory address adjustment method for the operating system includes steps S1 to S3.

[0037] S1. Obtain the operating system's runtime data.

[0038] For example, during operating system runtime, real-time monitoring of operating system data is performed. This data includes memory usage, process behavior data, system call frequency, and memory access patterns.

[0039] For example, during operating system runtime, memory usage is collected in real time through a memory monitoring module. Memory usage includes memory allocation and deallocation, memory block size, allocation time, and deallocation time; Real-time monitoring of process behavior data via memory monitoring module. Process behavior data includes process creation time, termination time, runtime, and inter-process communication; the memory monitoring module records system call frequency in real time. System call frequency data includes the type of system call, the call frequency of each type, and a timestamp; memory access pattern data is collected in real time through the memory monitoring module. Memory access pattern data includes the frequency, address range, timestamp, and type of memory access, such as read or write. Then, the real-time collected memory usage data will be used. Process behavior data System call frequency and memory access mode data Integrate and generate a real-time running dataset. : (8).

[0040] S2. Input the running data into a preset neural network model and obtain the adjustment strategy output by the neural network model; wherein, the neural network model includes an input layer, a data processing layer and an output layer, the input layer is used to receive the running data, the data processing layer is used to perform memory analysis and attack identification on the running data to obtain feature analysis results, and the output layer generates an adjustment strategy that meets the memory optimization target based on the feature analysis results.

[0041] Furthermore, the data processing layer includes a kernel-mode feature extraction layer, a memory pattern analysis layer, and an attack pattern identification layer. The kernel-mode feature extraction layer extracts features from the memory usage and process behavior data to obtain feature data related to memory allocation and process execution. The memory pattern analysis layer performs correlation analysis on the memory access patterns to obtain feature data on memory address distribution. The attack pattern identification layer identifies the memory regions exploited by attackers and determines potential attack paths based on the process behavior data and system call frequency.

[0042] For example, a dataset will be run in real time. Input to a pre-deployed neural network model In China, neural network models are used. For real-time running datasets The analysis process involves kernel-mode feature extraction, memory pattern analysis, and attack pattern identification. After feature analysis at the kernel-mode feature extraction layer, memory pattern analysis layer, and attack pattern identification layer, feature analysis results related to memory usage patterns, process behavior, and system calls are extracted. The analysis process satisfies the following formula: (9); in, and These are the weight matrices for different network layers. and These are the bias vectors for different network layers. This is the activation function.

[0043] Further, see Figure 4 , Figure 4 This is a flowchart of the output layer generation adjustment strategy in the neural network model provided in the embodiment of the present invention, wherein the output layer is used to execute steps S21 to S23.

[0044] S21. Based on the feature analysis results obtained from the data processing layer, determine the entropy value of the memory address distribution, the address space coverage, and potential attack paths.

[0045] For example, the output layer evaluates the randomness and security of the current memory address space layout, generating an evaluation metric E(t). The evaluation metric includes the entropy of the memory address distribution, address space coverage, and the impact of potential attack paths, satisfying the following formula: (10); Where H(t) represents the entropy value of memory address distribution, which measures the randomness of memory address distribution; C(t) represents the address space coverage, which represents the ratio of current memory address usage to the entire address space; and G(t) represents the impact of potential attack paths, which assesses the memory regions that may be exploited by attackers based on memory access patterns and process behavior data.

[0046] S22 constructs a memory optimization objective function based on the entropy value of the memory address distribution, the address space coverage, and the potential attack paths.

[0047] For example, based on the evaluation index E(t) and the extracted feature analysis results Construct the memory optimization objective function Y(t): (11); in, This represents the first weighting parameter, used to balance the influence of the entropy value of the memory address distribution on the objective function; This represents the second weighting parameter, used to balance the impact of address space coverage on the objective function; This represents the third weighting parameter, used to balance the impact of potential attack paths on the objective function.

[0048] It should be noted that the feature analysis results It is the data source for evaluating the metric E(t). For example, when calculating the entropy value H(t) of a memory address, it is necessary to know which memory addresses are used and how frequently they are used. This information comes from... The memory usage pattern characteristics are derived from this; when calculating the address space coverage C(t), it is necessary to know which memory regions are currently being used, which also comes from... Extracted from memory distribution characteristics; calculating the impact of potential attack paths. At this time, it is necessary to identify which process behaviors and system calls are abnormal. The risk points corresponding to the process behavior and system call characteristics within the context. Based on this, The calculation process satisfies the following formula: (12); (13); (14); In formula (12), Let be the probability distribution of memory addresses at time t, that is, the probability that a memory address is used at time t. , The number of memory addresses; in formula (13), the address space coverage C(t) represents the ratio of the current memory address usage to the entire address space, where, For indicator functions, memory address The address space, when memory address When time t is used The value is 1 if it is not 0 otherwise. The total memory address space; Formula (14) is used to identify the impact of potential attack paths G(t), and based on memory access patterns and process behavior data, to assess memory regions that may be exploited by attackers, where, For the weight parameter, measure the first... The importance of potential attack paths , This represents the total number of potential attack paths. For indicator functions, This is a potential vulnerability area; when a potential attack path has a potential vulnerability at time t... ， The value is 1 if it is not 0 otherwise.

[0049] S23. Solve the memory optimization objective function to obtain the adjustment strategy.

[0050] For example, based on the calculation results H(t), C(t), and G(t), an optimized address space layout strategy Y(t) is generated: (15); Wherein, according to formula (11), the optimization function The objective function is solved based on memory optimization, satisfying the following formula: (16); in, This means finding the strategy A that maximizes the value of the objective function among all possible adjustment strategies A. Here, A corresponds to the dynamic adjustment strategy, such as reallocating memory addresses or adjusting stack addresses.

[0051] In this embodiment of the invention, memory layout can be comprehensively evaluated and optimized from three dimensions: memory randomness, space utilization efficiency, and security risk. Entropy quantification enhances the unpredictability of memory address distribution, significantly increasing the difficulty for attackers to guess memory addresses. Combined with address space coverage, it ensures the rational utilization of memory resources. Simultaneously, controlling the number of potential attack paths effectively reduces the risk of system attacks. The resulting adjustment strategy achieves a dynamic balance between memory security and resource utilization efficiency, building an intelligent memory security barrier for the operating system. This significantly enhances the system's ability to resist memory attacks such as buffer overflows, improving the overall stability and security of the operating system.

[0052] S3. Adjust the memory address of the operating system according to the adjustment strategy; wherein the adjustment strategy includes at least one of reallocating memory addresses, adjusting stack addresses, and adjusting the loading address of dynamic link libraries.

[0053] For example, the adjustment process for the three adjustment strategies mentioned above is as follows: 1) Reallocate memory addresses and migrate the original fixed memory blocks to the new address area during process execution (without restarting).

[0054] For example, memory allocates dedicated memory blocks for processes, such as heap memory for storing process runtime data and code segment memory for storing program code. In the traditional approach, the addresses of these memory blocks are relatively fixed (or only change when the system restarts). Suppose that the order data processing process of an e-commerce system originally stores core data such as order amount and user ID in a memory block with addresses 0x12345600-0x12345800. If an attacker discovers the pattern of this address, they may tamper with the data through a vulnerability. In this case, by reallocating the memory address, the system will migrate the memory block to a new address 0x789abc00-0x789abc200 in real time, and the address will not be repeated after each adjustment. As soon as the attacker locates the old address, the core data has already been moved, and the tampering attempt is directly invalidated.

[0055] 2) Adjust the stack address, dynamically modify the stack base address offset and the heap allocation start address, so that the stack position changes in real time with the system running state.

[0056] For example, the stack is a critical repository of clues for process execution. The stack stores the return address of function calls and local variables (such as temporary parameters within functions), while the heap stores dynamically allocated memory (such as temporary file data created during program execution). Traditional ASLR only fixes the base address of the stack at system startup, making it easy for attackers to deduce patterns through repeated trials. Suppose that when an office software's file save function is called, it temporarily stores local variables indicating the file save path on the stack. Traditionally, the stack address is fixed around 0x23456700. An attacker can use a buffer overflow attack to overwrite the function return address on the stack, hijacking the program's execution flow. By adjusting the stack address, the system will offset the stack's base address by a random value between 0x1000 and 0x5000 before each function call, for example, from 0x23456700 to 0x23466700. The heap allocation starting address is also adjusted synchronously. Attackers can no longer pinpoint the location of the return address on the stack or the data in the heap, thus losing their target for the attack.

[0057] 3) Adjust the loading address of dynamic link libraries. Each time a dynamic link library is loaded, instead of using a fixed starting address, a random loading address is assigned according to the real-time strategy. Furthermore, the address of the same library will be different when it is loaded in different processes or at different times.

[0058] For example, dynamic link libraries (DLLs) are public code libraries shared by multiple processes, such as libsocket.so for network communication and libcrypto.so for encryption. Traditionally, the load addresses of these libraries (i.e., the starting location of the code in memory) are relatively fixed. Attackers can exploit the known address patterns of these libraries to construct malicious code that calls functions within them. Suppose that in a server system, multiple processes rely on libssl.so (a DLL for SSL encryption). Traditionally, its load address is fixed at 0x34567800. Knowing this address, an attacker can construct malicious data to call the ssl_write function (fixed address 0x345678a0) and tamper with encrypted data. By adjusting the load addresses of the DLLs, the system will allocate a starting address of 0x89abc000 when process A loads libssl.so, and a starting address of 0x9abcdef0 when process B loads it. This prevents the attacker from fixing the address of the ssl_write function, and even if they know the library's functionality, they cannot call it precisely, breaking the attack chain.

[0059] In this embodiment of the invention, the memory address distribution adjusted by the above methods makes the memory layout random and non-repeating, increasing the difficulty for attackers to guess and predict memory addresses.

[0060] Furthermore, the system's operational status is continuously monitored, and the neural network model is periodically updated, using new operational data for incremental training to adapt to constantly changing memory usage and attack patterns. After updating the neural network model, the memory address space layout is further optimized based on the latest model parameters and optimization strategies to ensure the randomness and unpredictability of the address space layout.

[0061] In this embodiment of the invention, by executing the above steps S1-S3, the memory address space layout of the operating system can be adjusted in real time, improving the randomness and unpredictability of the address space layout, effectively responding to different operating environments and attack modes, thereby enhancing the system's protection capabilities. By acquiring operating data and inputting it into a neural network model containing an input layer, a data processing layer, and an output layer, the data processing layer performs memory analysis and attack identification on the operating data to obtain feature analysis results. The output layer generates adjustment strategies based on these results and applies them to memory address adjustments. This allows for real-time and accurate perception of operating system memory usage and potential attack conditions, dynamically optimizing the memory address layout, significantly improving the randomness and security of memory address distribution, and effectively resisting attack methods that rely on memory address guessing, such as buffer overflows. Simultaneously, leveraging the adaptive learning capability of the neural network model, it can continuously adapt to system operating modes and new attack variations, ensuring system security while also considering memory resource utilization efficiency. This provides the operating system with an intelligent and dynamic memory security protection scheme, significantly enhancing the overall security and stability of the operating system.

[0062] See Figure 5 , Figure 5 This is a structural block diagram of a memory address adjustment device 100 for an operating system provided in an embodiment of the present invention. The memory address adjustment device 100 includes: The runtime data acquisition module 11 is used to acquire runtime data of the operating system; The adjustment strategy acquisition module 12 is used to input the running data into a preset neural network model and acquire the adjustment strategy output by the neural network model; wherein, the neural network model includes an input layer, a data processing layer and an output layer, the input layer is used to receive the running data, the data processing layer is used to perform memory analysis and attack identification on the running data to obtain feature analysis results, and the output layer generates an adjustment strategy that meets the memory optimization target based on the feature analysis results; The memory address adjustment module 13 is used to adjust the memory address of the operating system according to the adjustment strategy.

[0063] It is worth noting that the working process of each module in the memory address adjustment device 100 described in the embodiments of the present invention can refer to the working process of the memory address adjustment method described in the above embodiments, and will not be repeated here.

[0064] See Figure 6 , Figure 6This is a structural block diagram of a memory address adjustment device 200 for an operating system provided in an embodiment of the present invention. The memory address adjustment device 200 includes a processor 21, a memory 22, and a computer program stored in the memory 22 and executable on the processor 21. When the processor 21 executes the computer program, it implements the steps in the above-described embodiments of the memory address adjustment methods for various operating systems.

[0065] For example, the computer program may be divided into one or more modules / units, which are stored in the memory 22 and executed by the processor 21 to complete the present invention. The one or more modules / units may be a series of computer program instruction segments capable of performing specific functions, which describe the execution process of the computer program in the memory address adjustment device 200 of the operating system.

[0066] The memory address adjustment device 200 of the operating system may include, but is not limited to, a processor 21 and a memory 22. Those skilled in the art will understand that the schematic diagram is merely an example of the memory address adjustment device 200 of the operating system and does not constitute a limitation on the memory address adjustment device 200 of the operating system. It may include more or fewer components than illustrated, or combine certain components, or different components. For example, the memory address adjustment device 200 of the operating system may also include input / output devices, network access devices, buses, etc.

[0067] The processor 21 can be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor can be a microprocessor or any conventional processor. The processor 21 is the control center of the operating system's memory address adjustment device 200, connecting various parts of the operating system's memory address adjustment device 200 via various interfaces and lines.

[0068] The memory 22 can be used to store the computer programs and / or modules. The processor 21 implements various functions of the operating system's memory address adjustment device 200 by running or executing the computer programs and / or modules stored in the memory 22 and calling the data stored in the memory 22. The memory 22 may mainly include a program storage area and a data storage area. The program storage area may store the operating system, applications required for at least one function (such as sound playback function, image playback function, etc.), etc.; the data storage area may store data created according to the use of the mobile phone (such as audio data, phonebook, etc.). In addition, the memory 22 may include high-speed random access memory, and may also include non-volatile memory, such as hard disk, memory, plug-in hard disk, smart media card (SMC), secure digital (SD) card, flash card, at least one disk storage device, flash memory device, or other volatile solid-state storage device.

[0069] If the module / unit integrated into the memory address adjustment device 200 of the operating system is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, all or part of the processes in the methods of the above embodiments can also be implemented by a computer program instructing related hardware. The computer program can be stored in a computer-readable storage medium, and when executed by the processor 21, it can implement the steps of the various method embodiments described above. The computer program includes computer program code, which can be in the form of source code, object code, executable files, or certain intermediate forms. The computer-readable medium can include: any entity or device capable of carrying the computer program code, recording media, USB flash drives, portable hard drives, magnetic disks, optical disks, computer memory, read-only memory (ROM), random access memory (RAM), electrical carrier signals, telecommunication signals, and software distribution media, etc.

[0070] Furthermore, the present invention also provides a computer program product, including a computer program / instruction that, when executed by a processor, implements the memory address adjustment method of the operating system as described in any of the above embodiments.

[0071] The above description represents the preferred embodiments of the present invention. It should be noted that those skilled in the art can make various improvements and modifications without departing from the principles of the present invention, and these improvements and modifications are also considered to be within the scope of protection of the present invention.

Claims

1. A method for adjusting memory addresses in an operating system, characterized in that, include: Obtain operating system runtime data; The running data is input into a preset neural network model, and the adjustment strategy output by the neural network model is obtained; wherein, the neural network model includes an input layer, a data processing layer and an output layer, the input layer is used to receive the running data, the data processing layer is used to perform memory analysis and attack identification on the running data to obtain feature analysis results, and the output layer generates an adjustment strategy that meets the memory optimization target based on the feature analysis results; The memory addresses of the operating system are adjusted according to the adjustment strategy described above.

2. The operating system memory address adjustment method as described in claim 1, characterized in that, The runtime data includes at least one of memory usage, process behavior data, system call frequency, and memory access mode.

3. The operating system memory address adjustment method as described in claim 2, characterized in that, The data processing layer includes: A kernel-mode feature extraction layer is used to extract features from the memory usage and process behavior data to obtain feature data related to memory allocation and process execution. The memory pattern analysis layer is used to perform correlation analysis on the memory access patterns to obtain characteristic data of memory address distribution; An attack pattern identification layer is used to identify the memory regions exploited by attackers and determine potential attack paths based on the process behavior data and system call frequency.

4. The operating system memory address adjustment method as described in claim 1, characterized in that, The output layer is used for: Based on the feature analysis results obtained from the data processing layer, the entropy value of the memory address distribution, the address space coverage, and potential attack paths are determined. Based on the entropy value of the memory address distribution, the address space coverage, and the potential attack paths, a memory optimization objective function is constructed. Solve the memory optimization objective function to obtain the adjustment strategy.

5. The operating system memory address adjustment method as described in claim 1, characterized in that, The adjustment strategy includes at least one of reallocating memory addresses, adjusting stack addresses, and adjusting the load address of dynamic link libraries.

6. The operating system memory address adjustment method as described in claim 3, characterized in that, The kernel-state feature extraction layer uses an adaptive convolutional neural network, the memory usage pattern analysis layer uses a graph convolutional network, and the attack pattern recognition layer uses a multi-head attention mechanism.

7. A memory address adjustment device for an operating system, characterized in that, include: The runtime data acquisition module is used to acquire runtime data of the operating system; The adjustment strategy acquisition module is used to input the running data into a preset neural network model and acquire the adjustment strategy output by the neural network model; wherein, the neural network model includes an input layer, a data processing layer and an output layer, the input layer is used to receive the running data, the data processing layer is used to perform memory analysis and attack identification on the running data to obtain feature analysis results, and the output layer generates an adjustment strategy that meets the memory optimization target based on the feature analysis results; The memory address adjustment module is used to adjust the memory address of the operating system according to the adjustment strategy.

8. A memory address adjustment device for an operating system, characterized in that, The system includes a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, wherein the processor, when executing the computer program, implements a memory address adjustment method of the operating system as described in any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium includes a stored computer program, wherein, when the computer program is executed, it controls the device on which the computer-readable storage medium is located to perform a memory address adjustment method of an operating system as described in any one of claims 1 to 6.

10. A computer program product, characterized in that, It includes computer instructions that, when executed by a processor, implement the memory address adjustment method of the operating system as described in any one of claims 1 to 6.

Images