Method for monitoring data pollution based on memory address
The target program is monitored through binary instrumentation and disassembly technology, which solves the problem of difficult location and process of data pollution in the existing technology, and achieves high-precision and real-time data tampering detection.
Patent Information
- Application Number
- CN202410140702.3
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-02-01
- Publication Date
- 2025-08-01
AI Technical Summary
The existing data pollution monitoring methods cannot locate data pollution locations and processes in real time and accurately, and rely on a large number of log storage resources, lacking real-time and efficientness.
The binary instrumentation technology Pin and disassembly technology Capstone monitor the target program. By extracting the instruction stream sequence and disassembly, the instruction stream is sliced to detect the MOV instructions of the memory address, judging data tampering and triggering an alarm.
It realizes high-precision detection of data pollution, covers all possible tampering behaviors, reduces dependence on log storage, and has real-time and high coverage.
Smart Images
Figure CN120406960A_ABST
Abstract
Description
Technical Field
[0001] The present invention belongs to the field of data monitoring, and particularly relates to a method for monitoring data pollution based on memory addresses. Background Art
[0002] With the rapid development of computer technology, the problems of data security and data pollution are becoming increasingly serious. Data pollution can be understood as that during the process of data storage or transmission, the data is illegally tampered with or damaged, resulting in data distortion or invalidation. This not only affects the quality and reliability of the data, but may also have an adverse impact on business operations and decision-making. Therefore, how to effectively monitor and prevent data pollution has become an urgent problem to be solved.
[0003] The existing data pollution monitoring methods mainly include integrity verification and log monitoring, etc. Integrity verification refers to using an asymmetric encryption method (such as RSA), encrypting with the public key when generating data, decrypting with the private key during verification, and using algorithms such as hash functions to perform integrity verification on the data. If the hash values before and after verification match, and the decrypted data is the same as the original data, it indicates that the integrity and confidentiality of the data are guaranteed.
[0004] Log monitoring refers to performing taint marking on the data memory area, marking the direct operation instructions of the area and setting up a callback mechanism to monitor the access and modification operations of the data in real time. At the same time, an alarm mechanism is set up. When an abnormal operation or potential threat is detected, the alarm is triggered in a timely manner. Afterward, log analysis tools can be used to analyze the logs to identify the access patterns, abnormal behaviors, etc. of the data, helping to discover potential security problems and attack behaviors.
[0005] By performing log monitoring and integrity verification on the data, data pollution can be detected and located to a certain extent, but there are some deficiencies. For example, log monitoring requires a large amount of storage space and computing resources, and may be maliciously tampered with; checksum monitoring can only detect whether the data has been tampered with, but cannot locate the specific pollution location and process, and this method belongs to post-analysis behavior and does not have real-time performance.
[0006] Therefore, a method for monitoring data pollution that can more effectively monitor data pollution, locate the specific pollution location and process, and reduce the dependence on a large amount of logs is needed. Summary of the Invention
[0007] The purpose of the present invention is to provide a method for monitoring data pollution based on memory addresses in view of the deficiencies of the prior art.
[0008] To achieve the above purpose, the present invention adopts the following technical solutions: A method for monitoring data pollution based on memory addresses, comprising the following steps:
[0009] (1) Start the target program and extract the process PID of the target program;
[0010] (2) Use binary instrumentation technology to attach to the target program according to the process PID to obtain the instruction stream sequence Ins during the running process; (3) Perform attribute processing and disassembly on the instruction stream sequence Ins to obtain the assembly instruction set Ins_Ass;
[0011] (4) Retrieve and trace back upward from the assembly instruction set Ins_Ass to obtain the memory address set of the target value V; the target value V refers to the data value V that needs to be monitored;
[0012] (5) Slice the assembly instruction set Ins_Ass according to the memory address set to obtain the sliced instruction stream Ins_Slice related to each target address add_Vi;
[0013] (6) Continuously monitor whether there is a MOV instruction for the trace address of the target value V in the sliced instruction stream Ins_Slice. If it is determined that there is, it is considered that the data has been rewritten, immediately trigger a protection alarm, and solidify the data modification evidence. If not, continue to monitor.
[0014] Further, the target program is an application, a service, or a script.
[0015] Further, the binary instrumentation technology in step (2) is the PinTool tool.
[0016] Further, the instruction stream sequence Ins in step (2) includes the instruction addresses, pointers of instruction operations, registers, memory valid addresses, and constants during the program running process.
[0017] Further, the Capstone tool is used for attribute processing and disassembly of the instruction stream sequence Ins in step (3).
[0018] Further, the obtaining of the address set of the target value V in step (4) specifically adopts the following steps: organize the final output result data of the monitored target program into a key-value pair structure <K, V>. Starting from the target K, retrieve the memory address Add_V of the final target value V in the assembly instruction set Ins_Ass n , and trace back upward the address change trajectory of the target value V, and record it as the address set of the target value V: Add_V n →Add_V n-1 →...→Add_V0.
[0019] This application provides a method for monitoring data contamination based on memory addresses. By dynamically analyzing the execution of a target program, using the binary instrumentation technology Pin and the disassembly technology Capstone to disassemble the instruction stream during program execution, obtaining the assembly instruction set of the program, and by extracting the set of target addresses of the final output result data in the process image, using the program slicing technology to slice the instruction stream, and finally determining whether to give an alarm by judging whether there are multiple MOV instructions for the set of target addresses in the sliced instruction stream, and solidifying the evidence of data modification, so as to realize the detection of tampering with core data.
[0020] Advantages of the present invention:
[0021] (1) Through technical means such as binary instrumentation, disassembly, and program slicing, the target program with data contamination can be accurately located and identified, getting rid of the inefficiency of technical means such as logging.
[0022] (2) Taking the final output result of the target program as the target starting point, gradually tracing back to obtain the address change trajectory of the core data in the program, and using whether there is tampering on the address change trajectory as the detection mechanism, covering all possible tampering behaviors of the program, and the detection result has high accuracy and wide coverage.
[0023] (3) Starting from the execution flow of the target program itself, it effectively prevents malicious attackers from destroying the detection mechanism itself. Description of the Drawings
[0024] Figure 1 is a flowchart of the method for monitoring data contamination based on memory addresses in the embodiment. Detailed Embodiments
[0025] In order to enable those skilled in the art to better understand the solution of this application, the technical solutions in the embodiments of this application will be clearly and completely described below in conjunction with the embodiments of this application. Obviously, the described embodiments are only a part of the embodiments of this application, rather than all the embodiments. Based on the embodiments in this application, all other embodiments obtained by those of ordinary skill in the art without creative efforts shall fall within the protection scope of this application.
[0026] It should be noted that the terms "including" and "having" and any variations thereof in the description and claims of this application and the above-mentioned drawings are intended to cover non-exclusive inclusion. For example, a process, method, system, product, or device including a series of steps or units does not necessarily have to be limited to those steps or units clearly listed, but may include other steps or units not clearly listed or inherent to these processes, methods, products, or devices.
[0027] A method for monitoring data contamination based on memory addresses, and its processing steps are as follows: start the target program, track the target program, disassemble the instruction stream, extract the target address, slice the instruction stream, extract the initial target address, judge MOV instructions, give an alarm and record the log, and forcefully close the program.
[0028] Step 1: Start the target program
[0029] First, start and run the target program that may tamper with core data. This program can be any type of program, such as an application program, a service, or a script, etc., and extract the process PID of this process.
[0030] Step 2: Track the target program
[0031] Using binary instrumentation techniques such as the instrumentation detection API provided by Pin, write the required instrumentation code and analysis code to form a PinTool tool, and then attach the PinTool tool to the target program according to the PID obtained in the above Step 1 to obtain the instruction stream sequence Ins during the program operation, which includes the instruction addresses during the program operation, and records data such as pointers, registers, memory valid addresses, and constants operated by the instructions.
[0032] Step 3: Disassemble the instruction stream
[0033] Using open-source disassembly techniques such as the Capstone tool, perform attribute processing and disassembly on the instruction stream sequence Ins obtained in the above Step 2 through the API provided by the Capstone tool to obtain the assembly instruction set Ins_Ass to be analyzed.
[0034] Step 4: Extract the target address
[0035] Organize the final output result data of the monitored target program into a key-value pair structure <K, V>. Starting from the target K, retrieve the memory address Add_V of the final target value V in the assembly instruction set in the above Step 3 n , and trace back the address change trajectory of the target value V upward, and record it as the address set of the target value V: Add_V n →Add_V n-1 →...→Add_V0.
[0036] Step 5: Slice the instruction stream
[0037] Using the address set of the target value V obtained in the above Step 4: Add_V n →Add_V n-1 →...→Add_V0 as the input for instruction slicing, slice the assembly instruction Ins_Ass obtained in the above Step 3, and classify each target address Add_V according to the instruction set of Vi Related slice instruction stream Ins_Slice i 。
[0038] Step 6: MOV instruction judgment
[0039] Based on the slice instruction stream Ins_Slice obtained in the above step 5 i , determine whether there is a MOV instruction for the trace address of the target value V. If so, it means that the program has rewritten the trace address data of the target value V, and then proceed to step 7.
[0040] Step 7: Alarm and record logs
[0041] During the monitoring process, once a data rewrite instruction is found, immediately trigger a protection alarm and solidify the evidence of data modification.
[0042] The above is only the preferred embodiment of the present invention and is not used to limit the present invention. For those skilled in the art, the present invention can have various changes and modifications. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.
Claims
1. A method for monitoring data pollution based on memory addresses, characterized in that It includes the following steps: (1) Start the target program and extract the process PID of the target program; (2) Use binary instrumentation technology to attach to the target program according to the process PID to obtain the instruction stream sequence Ins during the running process; (3) Perform attribute processing and disassembly on the instruction stream sequence Ins to obtain the assembly instruction set Ins_Ass; (4) Retrieve and trace back upward from the assembly instruction set Ins_Ass to obtain the memory address set of the target value V; (5) Slice the assembly instruction set Ins_Ass according to the memory address set to obtain the sliced instruction stream Ins_Slice related to each target address add_Vi; (6) Continuously monitor whether there is a MOV instruction for the trace address of the target value V in the sliced instruction stream Ins_Slice. If it is determined that there is, it is considered that the data has been rewritten, immediately trigger a protection alarm, and solidify the data modification evidence. If not, continue to monitor.
2. The method for monitoring data pollution based on memory addresses according to claim 1, wherein: The target program is an application program, service or script.
3. The method for monitoring data pollution based on memory addresses according to claim 1, wherein: The binary instrumentation technology in step (2) is the PinTool tool.
4. The method for monitoring data pollution based on memory addresses according to claim 1, wherein: The instruction stream sequence Ins in step (2) includes the instruction address, the pointer of the instruction operation, the register, the memory effective address and the constant during the program running process.
5. The method for monitoring data pollution based on memory addresses according to claim 1, wherein: The attribute processing and disassembly of the instruction stream sequence Ins in step (3) adopt the Capstone tool.
6. The method for monitoring data pollution based on memory addresses according to claim 1, characterized in that: The acquisition of the address set of the final target value V in the step (4) is specifically carried out by the following steps: organize the final output result data of the target program to be monitored into a key-value pair structure <K, V>, starting from the target K, retrieve the memory address Add_V of the target value V in the assembly instruction set Ins_Ass n , and trace back upward the address change trajectory of the target value V, and record it as the address set of the target value V: Add_V n →Add_V n-1 →...→Add_V0.