Parity verdict method based on control flow comparison and parity verdict device

Abstract

The application discloses a quasi-state judgment method and a quasi-state judgment device based on control flow comparison, and the method comprises the following steps: identifying characteristic codes in a source code of a to-be-tested executable program; generating a random value as a code landmark by using a pseudo-random function, and inserting the code landmark at the characteristic codes; based on a compiler segment base address randomization technology, setting different code segment and data segment base addresses for the source code after the insertion of the probes, and compiling the source code into multiple equivalent heterogeneous execution bodies; inputting a to-be-tested sample into the multiple heterogeneous execution bodies to generate multiple execution control flow records; dividing the execution control flow by taking a jump instruction as a path segment endpoint, and calculating the Hash value of the code landmark in the path segment by using MD5; calculating the Hamming distance between the multiple control flows based on the Hash value, judging the path similarity, and determining that the to-be-tested sample is a normal sample if the multiple path control flows are similar; otherwise, determining that the to-be-tested sample is an abnormal sample. The application has high quasi-state judgment accuracy and efficiency for vulnerability exploitation attacks.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, and in particular to a quasi-state adjudication method and quasi-state adjudicator based on control flow comparison. BACKGROUND

[0002] Prior art, invention patents: (1) CN112073394A, (2) CN213693764U, (3) CN113315755A; academic papers: (4) "A quasi-state adjudication optimization method based on execution body heterogeneity". The above quasi-state adjudicator or adjudication method discusses the structure of the adjudicator from a general composition, such as (1), (2), without giving the specific data source of the judgment basis. As for the adjudication basis of the adjudicator, the methods given by (3) and (4) are to judge from the execution result difference of the heterogeneous execution body, such as the response data packet of different protocols or the strategy execution situation, without adding the process judgment of the execution flow. SUMMARY

[0003] The present application is based on the execution result of the existing achievements of the heterogeneous execution body adjudication, but the execution result of the program is heterogeneous and difficult to normalize, and there is a large error in judging the difference between the heterogeneous bodies. If the stage output result in the program execution process is judged, there are problems such as synchronization. A quasi-state adjudication method and quasi-state adjudicator based on control flow comparison are proposed, the landmark code is implanted by inserting a stake at the feature code, the path similarity between the heterogeneous execution bodies is determined by Hash calculation and Hamming distance comparison of the path segments of the heterogeneous execution bodies, the possible control flow hijacking behavior is found, the quasi-state adjudication is realized, and the vulnerability exploitation attack is resisted. The advantage of the present application is that the quasi-state adjudication proposed by the present application is based on whether the control flow execution is abnormal as the judgment basis, which returns to the essential attribute of the influence of vulnerability exploitation attack on the program, and the accuracy and efficiency are high.

[0004] In order to achieve the above purpose, the present application adopts the following technical scheme:

[0005] The present application proposes a quasi-state adjudication method based on control flow comparison, which comprises:

[0006] Step 1: identifying the feature code in the source code of the executable program to be tested;

[0007] Step 2: inserting a stake in the executable program source code: a random value generated by a pseudo-random function is used as a "code landmark", and the "code landmark" is inserted at the feature code;

[0008] Step 3: based on the compiler segment base address randomization technology, the source code inserted with a stake in step 2 is compiled into multiple equivalent heterogeneous execution bodies according to different code segment and data segment base addresses;

[0009] Step 4: input the sample to be detected into the plurality of heterogeneous execution bodies generated in step 3, to generate a plurality of execution control flow records, each of which contains a "code landmark" and a jump instruction (including function call return, loop body control, direct jump instruction, etc.) in the instrumented code;

[0010] Step 5: split the execution control flow generated in step 4 by taking the jump instruction as the path segment endpoint, and calculate the "code landmark" Hash value in the path segment using MD5;

[0011] Step 6: calculate the Hamming distance between the plurality of control flows in step 4 based on the Hash values obtained in step 5, and judge the path similarity. If the plurality of path control flows are similar, the sample to be detected is determined as a normal sample; otherwise, the sample to be detected is determined as an abnormal sample.

[0012] Further, the characteristic code includes function call statements, function exit statements (such as return statements), branching statements (such as if, else, etc.), loop statements (such as while, for, etc.), and loop exit statements (such as break, continue, etc.).

[0013] Further, after the step 2, further comprising:

[0014] A function of writing a random value into an external file to ensure the output of the code landmark.

[0015] Further, the starting addresses of the code segments and data segments of different heterogeneous execution bodies are different, but the relative offsets of each function and statement relative to the base address are unchanged.

[0016] Further, the step 5 further comprises:

[0017] For the processing of loop statements, the entry and exit of the current loop body are taken as the path endpoints instead of the jump instruction as the division point, and the Hash is calculated only once in the loop to prevent inefficient calculation of repeated Hash.

[0018] Another aspect of the present application proposes a quasi-state arbiter based on control flow comparison, comprising:

[0019] A characteristic code recognition module for recognizing characteristic code in a source code of an executable program to be detected;

[0020] A code landmark instrumenting module for generating a random value as a "code landmark" using a pseudo-random function, and inserting the "code landmark" at the characteristic code;

[0021] A loading base address randomization compiling module for compiling the source code instrumented by the code landmark instrumenting module into a plurality of equivalent heterogeneous execution bodies according to different code segment and data segment base addresses based on a compiler segment base address randomization technology.

[0022] An execution control flow generation module is configured to input a to-be-detected sample into a plurality of heterogeneous execution bodies generated by the randomization compilation module at a base address, and generate a plurality of execution control flow records, each of which comprises a "code landmark" and a jump instruction in the instrumented code.

[0023] An execution control flow segmentation module is configured to segment the execution control flow generated by the execution control flow generation module by taking the jump instruction as a path segment endpoint, and calculate the "code landmark" Hash value in the path segment using MD5.

[0024] A paratonic decision module is configured to calculate the Hamming distance between a plurality of control flows in the execution control flow generation module based on the Hash value obtained by the execution control flow segmentation module, and determine the path similarity, if the plurality of path control flows are similar, the to-be-detected sample is determined as a normal sample, otherwise, the to-be-detected sample is determined as an abnormal sample.

[0025] Further, the feature code comprises a function call statement, a function exit statement, a branch statement, a loop statement, and a loop exit statement.

[0026] Further, the method further comprises:

[0027] A random value writing module is configured to write a random value into a function of an external file, and ensure the output of the code landmark.

[0028] Further, the starting address of the starting loading memory of the code segment and the data segment of different heterogeneous execution bodies is different, but the relative offset of each function and statement relative to the base address is unchanged.

[0029] Further, the execution control flow segmentation module is further configured to:

[0030] For the processing of the loop statement, the entrance and the exit of the current loop body are taken as the path endpoints instead of the jump instruction as the segmentation point, and the Hash is calculated only once in the loop.

[0031] Compared with the prior art, the present application has the beneficial effects:

[0032] The present application realizes the landmark code implantation by instrumenting at the feature code, realizes the path similarity determination between the heterogeneous execution bodies through the Hash calculation and the Hamming distance comparison of the path segments of the heterogeneous execution bodies, finds the possible control flow hijacking behavior, realizes the paratonic decision maker, and resists the vulnerability exploitation attack. The advantage of the present application is that the decision maker is based on the abnormality of the control flow execution as the determination basis, returns to the essential attribute of the influence of the vulnerability exploitation attack on the program, and has high accuracy and efficiency. BRIEF DESCRIPTION OF DRAWINGS

[0033] Figure 1A flowchart of a method for mimetic adjudication based on control flow comparison according to an embodiment of the present application;

[0034] Figure 2 A structural diagram of a mimetic adjudicator based on control flow comparison according to an embodiment of the present application. DETAILED DESCRIPTION

[0035] The present application will be further explained in conjunction with the accompanying drawings and specific embodiments:

[0036] As shown in the drawings, Figure 1 a method for mimetic adjudication based on control flow comparison, comprising:

[0037] First, select the statement position that needs code instrumentation. The program points selected should be able to identify the change in execution control flow with the least instrumentation cost. Such characteristic code needs to be selected in combination with the characteristics of control flow hijacking triggered by vulnerabilities. Generally, when a vulnerability is exploited, it will affect the PC register, causing the program execution process to change. The execution of abnormal flow is often started with a jump statement. Through static analysis of the code, identify structured feature statements, select function calls, function exits (such as return statements), branching statements (such as if, else, etc.), loop statements (such as while, for, etc.), and break out of the loop (such as break, continue, etc.) statements that may cause the program to execute in a non-sequential manner as feature statements. These statements are the target points for code instrumentation.

[0038] Second, use a pseudo-random function to generate a "code landmark" (random value). The random value ensures that all generated "code landmark" strings are different. Insert the "code landmark" at the feature code target point in the executable program source code in the first step. In addition to inserting the random value, a function that writes the random value to an external file is also inserted after it to ensure the output of the "code landmark". The "code landmark" list can reflect the program execution control flow.

[0039] Third, based on the compiler segment base address randomization technology, compile the source code instrumented in the second step into multiple equivalent heterogeneous execution bodies according to different code segment and data segment base addresses. As an implementable way, compile into 3 equivalent heterogeneous execution bodies. Heterogeneous execution bodies only differ in the starting address of the starting load memory of the code segment and data segment, and the relative offset of each function and statement relative to the base address remains unchanged. For the same input sample, if there is no malicious control flow hijacking, the execution control flow (function call relationship, program execution order) of the 3 execution bodies, although affected by compiler optimization, is still approximate under the condition that the compilation options are the same.

[0040] Fourthly, inputting the sample to be detected into the three isomorphic execution bodies generated in the third step triggers the generation of three execution control flow records, each of which contains the "code landmark" and the jump instruction in the inserted code.

[0041] Fifthly, the execution control flow generated in the fourth step is divided into path segments by taking the jump instruction as the path segment endpoint. The "code landmark" Hash value in the path segment is calculated by using MD5, that is, the "code landmark" is taken as the input of Hash calculation. The jump instructions include function call return, loop body control, direct jump, etc. The path segment divided by the jump instruction is a sequential instruction stream. For the loop, the entrance and exit of the loop body are taken as the path endpoints instead of the jump instruction as the division point. The Hash is calculated only once in the loop to prevent inefficient calculation of repeated Hash.

[0042] Sixthly, the similarity of the three path Hash value sequences generated in the fifth step is calculated based on the Hamming distance. If the three path control flows are similar, it is determined that the sample to be detected is a normal sample. If one path control flow is significantly different from the other paths, it is determined that the control flow is hijacked, causing an anomaly, and the sample to be detected is determined to be an attack anomaly sample. The reason why the exploit attack leads to different control flows of equivalent isomorphic execution bodies is that the change of the load base address between the isomorphic execution bodies causes the ShellCode of the exploit code to deviate when calculating the PC pointer or the jump address in order to achieve control flow hijacking, resulting in a low possibility that different isomorphic execution bodies can simultaneously satisfy the exploit.

[0043] On the basis of the above embodiment, as shown in Figure 2 The present application also proposes a quasi-state arbiter based on control flow comparison, comprising:

[0044] A feature code identification module is configured to identify the feature code in the source code of the executable program to be detected.

[0045] A code landmark insertion module is configured to generate a random value as the "code landmark" by using a pseudo-random function and insert the "code landmark" at the feature code.

[0046] A load base address randomization compiling module is configured to compile the source code inserted with the "code landmark" by the code landmark insertion module into multiple equivalent isomorphic execution bodies according to different code segment and data segment base addresses based on the compiler segment base address randomization technology.

[0047] An execution control flow generation module is configured to input the sample to be detected into the multiple isomorphic execution bodies generated by the load base address randomization compiling module to generate multiple execution control flow records, each of which contains the "code landmark" and the jump instruction in the inserted code.

[0048] An execution control flow cutting module is configured to cut the execution control flow generated by the execution control flow generation module with the jump instruction as the path segment endpoint, and calculate the "code landmark" Hash value in the path segment using MD5;

[0049] A quorum decision module is configured to calculate the Hamming distance between the control flows in the execution control flow generation module based on the Hash value obtained by the execution control flow cutting module, and determine the path similarity, if the control flows are similar, the sample under test is determined as a normal sample, otherwise, the sample under test is determined as an abnormal sample.

[0050] Further, the feature code comprises a function call statement, a function exit statement, a branch statement, a loop statement and a loop exit statement.

[0051] Further, the feature code comprises a function call statement, a function exit statement, a branch statement, a loop statement and a loop exit statement.

[0052] A random value writing module is configured to write a random value into a function of an external file, and ensure the output of the code landmark.

[0053] Further, the starting addresses of the code segment and the data segment of different heterogeneous execution bodies are different, but the relative offsets of the functions and the statements relative to the base address are unchanged.

[0054] Further, the execution control flow cutting module is further configured to:

[0055] The processing of the loop statement is not divided by the jump instruction, but the entrance and the exit of the current loop body are taken as the path endpoints, and the Hash is calculated only once in the loop.

[0056] In summary, the code landmark is implanted by inserting a probe at the feature code, the path similarity between the heterogeneous execution bodies is determined by calculating the Hash of the path segment of the heterogeneous execution bodies and comparing the Hamming distance, the possible control flow hijacking behavior is found, the quorum decision is implemented, and the vulnerability exploitation attack is resisted.

[0057] The above only shows the preferred embodiments of the present application, and it should be noted that, for those skilled in the art, without departing from the principles of the present application, a number of improvements and refinements can be made, and these improvements and refinements should also be considered as the protection scope of the present application.

Claims

1. A method of a mimicking state decision based on control flow alignment, characterized in that, The method comprises the following steps: Step 1: identifying feature codes in the source code of the executable program to be tested; Step 2: generating a random value as a "code landmark" by using a pseudo-random function, and inserting the "code landmark" at the feature code; Step 3: based on the compiler segment base address randomization technology, compiling the source code after the insertion of the "code landmark" in step 2 into multiple equivalent heterogeneous execution bodies according to different code segment and data segment base addresses; Step 4: inputting the sample to be tested into the multiple heterogeneous execution bodies generated in step 3 to generate multiple execution control flow records, each of which contains the "code landmark" and a jump instruction in the inserted code; Step 5: dividing the execution control flow generated in step 4 by taking the jump instruction as the path segment endpoint, and calculating the Hash value of the "code landmark" in the path segment by using MD5; Step 6: calculating the Hamming distance between the multiple control flows in step 4 based on the Hash value obtained in step 5, and judging the path similarity; if the multiple path control flows are similar, the sample to be tested is determined as a normal sample; otherwise, the sample to be tested is determined as an abnormal sample.

2. The method of claim 1, wherein, The feature codes comprise function call statements, function exit statements, branch statements, loop statements and loop exit statements.

3. The method of claim 1, wherein, After the step 2, the method further comprises the following steps: A function of writing the random value into an external file is used to ensure the output of the code landmark.

4. The method of claim 1, wherein, The starting addresses of the code segments and data segments of different heterogeneous execution bodies are different, but the relative offsets of the functions and statements relative to the base addresses are unchanged.

5. The method of claim 2, wherein, The step 5 further comprises the following steps: For the processing of the loop statements, the entrance and exit of the current loop body are taken as the path endpoints instead of the jump instruction as the division point, and the Hash value is calculated only once in the loop.

6. A metamorphic arbiter based on control flow comparison, characterized in that, The method comprises the following steps: A feature code identification module is used to identify feature codes in the source code of the executable program to be tested; A code landmark insertion module is used to generate a random value as a "code landmark" by using a pseudo-random function, and insert the "code landmark" at the feature code; A loading base address randomization compiling module is used to compile the source code after the insertion of the "code landmark" by the code landmark insertion module into multiple equivalent heterogeneous execution bodies according to different code segment and data segment base addresses based on the compiler segment base address randomization technology; An execution control flow generation module is used to input the sample to be tested into the multiple heterogeneous execution bodies generated by the loading base address randomization compiling module to generate multiple execution control flow records, each of which contains the "code landmark" and a jump instruction in the inserted code; An execution control flow division module is used to divide the execution control flow generated by the execution control flow generation module by taking the jump instruction as the path segment endpoint, and calculate the Hash value of the "code landmark" in the path segment by using MD5; A quasi-state decision module is used to calculate the Hamming distance between the multiple control flows in the execution control flow generation module based on the Hash value obtained by the execution control flow division module, and judge the path similarity; if the multiple path control flows are similar, the sample to be tested is determined as a normal sample; otherwise, the sample to be tested is determined as an abnormal sample.

7. The control-flow-parity-based memcon of claim 6, wherein, The feature codes comprise function call statements, function exit statements, branch statements, loop statements and loop exit statements.

8. The control-flow-paradigm-based quasimodo arbiter of claim 6, wherein, The method further comprises the following steps: A random value writing module is used to write the random value into an external file to ensure the output of the code landmark.

9. The control-flow-paradigm-based quasimodo arbiter of claim 6, wherein, The starting addresses of the code segments and data segments of different isomeric executors are different, but the relative offsets of respective functions and statements relative to the base address are unchanged.

10. The control-flow-paradigm-based quasimodo arbiter of claim 7, wherein, The execution control flow splitting module is further configured to: The processing of the loop statement is not divided by the jump instruction, but the entrance and exit of the current loop body are taken as the path endpoints, and the Hash is calculated only once in the loop.

Images