Unknown vulnerability scanning verification method and system based on active trapping technology

Abstract

The application provides an unknown vulnerability scanning verification method and system based on an active trapping technology, and relates to the field of security technology, wherein the method comprises the following steps: obtaining trapping parameters and instantiating a plurality of trapping containers on idle computing nodes, screening out one with the largest number of connections with external access objects as a main trapping container to maintain an interactive session, recording the time sequence of each memory page table item dirty bit being set and the physical page number address sequence, generating vulnerability detection parameters through interleaving and recombination and splitting into illegal instruction data and abnormal condition data, and storing them into the reserved bit segment of the instruction cache and the reserved bit segment of the exception vector table register, respectively, monitoring the instruction decoding result and the abnormal condition matching state during the execution of the simulation image asset, positioning the pollution propagation path of the unknown vulnerability in the instruction execution pipeline and marking the existence and pollution depth thereof. The application improves the detection accuracy and scanning verification efficiency of unknown vulnerabilities.

Description

Technical Field

[0001] This application relates to the field of information technology innovation security technology, and in particular to an unknown vulnerability scanning and verification method and system based on active trapping technology. Background Technology

[0002] With the rapid development of information technology application innovation industries, processor architectures, operating platforms, and basic software in the information technology innovation environment are becoming increasingly diversified, and the forms of security threats are also undergoing profound changes. In the existing security protection system, vulnerability scanning and verification mainly rely on the known vulnerability signature database for rule matching. Although this method can quickly identify publicly disclosed vulnerability types, it has a blind spot for unknown vulnerabilities that have not yet been publicly disclosed or lack signatures. Once attackers take advantage of the blind spot to launch penetration, it is often only detected after substantial damage has been caused.

[0003] Meanwhile, current decoy security technologies are mostly based on static honeypot deployment. The configuration parameters of the decoy environment are usually pre-set, resulting in a discernible difference between the external representation of the decoy node and the real business node. Attackers can bypass the decoy node by probing response characteristics and directly target the real assets, making it difficult for decoy methods to effectively capture the complete interaction process of advanced attack behaviors.

[0004] Furthermore, in the vulnerability verification stage, existing solutions typically deploy suspicious samples directly into a sandbox environment for execution and observe behavior logs. While this approach can record the outward manifestations of malicious behavior, it cannot trace the propagation path within the processor pipeline after a vulnerability is triggered at the instruction level. Consequently, the accuracy of locating unknown vulnerabilities and the depth of verification are both limited. Summary of the Invention

[0005] This application provides a method and system for scanning and verifying unknown vulnerabilities based on active trapping technology, in order to solve the problems of insufficient coverage of unknown vulnerability scanning, low realism of trapping interaction, and insufficient fineness of vulnerability verification in the prior art.

[0006] To address the aforementioned technical problems, in a first aspect, this application provides a method for scanning and verifying unknown vulnerabilities based on active trapping technology, comprising: Obtain the trapping parameters and instantiate multiple trapping containers on multiple idle computing nodes based on the trapping parameters; Select the container with the most connections to the external access object from multiple trap containers as the main trap container. The main trap container maintains an interactive session with the external access object. During the interactive session, record the time sequence of the dirty bit of the page table entry corresponding to each memory page that has a write operation in the main trap container and the physical page number address sequence of the corresponding memory page. Vulnerability detection parameters are generated by interleaving and recombining time series and physical page number address series. After the vulnerability detection parameters are split into illegal instruction data and abnormal condition data, they are stored in the reserved bit field of the instruction cache and the reserved bit field of the abnormal vector table register of the simulation image asset, respectively. When the simulation image asset is executed, the matching status of the instruction decoding result and the abnormal condition is monitored. When the instruction decoding result hits a reserved bit field and the abnormal condition matching state is consistent with the reserved bit field, the pollution propagation path of the unknown vulnerability in the instruction execution pipeline is located, and the existence and pollution depth of the unknown vulnerability are marked according to the pollution propagation path.

[0007] Optionally, after recording the time sequence of the dirty bit being set for each memory page corresponding to a write operation occurring within the main trapping container and the corresponding physical page number address sequence during the interactive session, before generating vulnerability detection parameters by interleaving and reassembling based on the time sequence and physical page number address sequence, the process includes: Convert the time sequence and physical page number address sequence of each memory page into time frequency domain data and address frequency domain data, respectively. Convolutional processing of time-frequency domain data and address-frequency domain data yields mixed-frequency domain data; Calculate the energy concentration of the mixed frequency domain data. When the energy concentration is less than the preset concentration threshold, continue to record the time and address of newly added dirty bits until the energy concentration of the mixed frequency domain data reaches the preset concentration threshold. When the energy concentration of the mixed frequency domain data reaches the preset concentration threshold, the step of generating vulnerability detection parameters is triggered.

[0008] Optionally, vulnerability detection parameters are generated by interleaving and recombining time series and physical page number address sequences, including: Convert each time stamp value in the time series into a time binary string, and convert each page number value in the physical page number address sequence into an address binary string; Arrange the binary strings of time into a time string queue according to the time order, and arrange the binary strings of addresses into an address string queue according to the order of address appearance. Take the first binary string of time from the time string queue and perform a bitwise XOR operation with the last binary string of address in the address string queue to obtain the first recombined result. Take the last binary string of time from the time string queue and perform a bitwise XOR operation with the first binary string of address in the address string queue to obtain the second recombined result. The first and second recombination results are concatenated to obtain the vulnerability detection parameters.

[0009] Optionally, after locating the contamination propagation path of the unknown vulnerability in the instruction execution pipeline, the process includes: Convert the register renaming entry number corresponding to each node in the pollution propagation path into a binary sequence number string, and concatenate all the binary sequence number strings into a path string according to the node order in the pollution propagation path. The path string is input to the shift comparator, which performs cyclic shift matching between the path string and the vulnerability detection parameters. For each cyclic shift of one bit, the difference between the path string and the vulnerability detection parameters is calculated once. All shift positions with a difference less than a preset difference threshold are recorded. The offset corresponding to each shift position is used as the branch offset set of the contamination propagation path.

[0010] Optionally, the vulnerability detection parameters are split into illegal instruction data and abnormal condition data and then stored in the reserved bit field of the instruction cache and the reserved bit field of the exception vector table register of the simulation image asset, respectively, including: The vulnerability detection parameters are treated as a long binary string. Starting from the beginning of the binary string, one bit is extracted every other bit to form illegal instruction data. Starting from the next bit after the beginning of the binary string, one bit is extracted every other bit to form abnormal condition data. Zeros are padded to the end of the illegal instruction data. The length of the padded illegal instruction data is equal to the bit width of the reserved bit segment of the instruction cache. The padded illegal instruction data is written into the storage area of ​​an empty slot in the reserved bit segment of the instruction cache. A polynomial loop check is performed on the written illegal instruction data to generate a signature code. The signature code is written into the check area of ​​the same empty slot. The abnormal condition data is padded with zeros at the end. The length of the padded abnormal condition data is equal to the bit width of the reserved bit field in the abnormal vector table register. The padded abnormal condition data is then written into the reserved bit field of the abnormal vector table register.

[0011] Optionally, the container with the most connections established with external access objects is selected from multiple trapping containers as the main trapping container, including: Obtain the number group corresponding to the established Transmission Control Protocol half-open connection between each trap container and the external access object, and perform cyclic redundancy check on the number group of each trap container to generate the container check value of each trap container. Arrange the container verification values ​​of all the trapping containers into a verification value queue according to the instantiation order of the trapping containers. Use the verification value queue as the initial state value of the linear feedback shift register to drive the linear feedback shift register to cyclically shift and generate a characteristic expression. Mark the trap container corresponding to the term with the largest absolute value of the coefficient in the characteristic expression as the main trap container, and close the connection channels between other trap containers and external access objects except for the main trap container.

[0012] Optionally, during the interactive session, the time sequence of when the dirty bit is set and the physical page number address sequence of each memory page in the main trap container are recorded, including: When the main trapping container interacts with the external access object, a dirty bit record area is allocated for each memory page. Each time the dirty bit of the memory page is detected to switch from an unset state to a set state, the current timestamp and the page number of the memory page are combined to form a dirty bit record pair and stored in the dirty bit record area corresponding to the memory page. Extract all dirty record pairs from each dirty record area, extract the timestamps from each dirty record pair in ascending order of timestamp to form the time sequence of memory pages, and extract the page numbers from each dirty record pair to form the physical page number address sequence of memory pages.

[0013] Optionally, locate the propagation path of the unknown vulnerability in the instruction execution pipeline, including: When the instruction decoding result hits illegal instruction data in the reserved segment, read the feature code in the check area of ​​the illegal instruction slot where the current illegal instruction data is located, and match the feature code with the instant feature code obtained by recalculating the illegal instruction data; The location of the illegal instruction data in the instruction register is determined based on the slot number of the illegal instruction slot where the successfully matched feature code is located. Starting from the location of the stop, the register renaming table entry number corresponding to each pipeline stage through which the illegal instruction data is issued to the execution unit is traced. The register renaming table entry numbers are arranged into a path sequence according to the pipeline order, and the path sequence is used as the pollution propagation path.

[0014] Optionally, trapping parameters are obtained, and multiple trapping containers are instantiated on multiple idle computing nodes based on the trapping parameters, including: The data stream of the external access object is intercepted. When the port number of the data stream is a non-standard port and the time to live value is lower than the preset baseline value, the data stream is identified as an abnormal scanning stream, and the first data segment and the second data segment are extracted from the abnormal scanning stream. Use the first data segment and the second data segment as initial codes to generate a random code sequence; The random code sequence is XORed with the source identifier of the data stream. The result of the XOR operation is broadcast as a trapping parameter to multiple idle computing nodes, triggering each idle computing node to instantiate multiple trapping containers simultaneously according to the trapping parameter.

[0015] Secondly, this application provides an unknown vulnerability scanning and verification system based on active trapping technology, comprising: The acquisition module is used to acquire the trapping parameters and instantiate multiple trapping containers on multiple idle computing nodes based on the trapping parameters. The filtering module is used to select the container with the most connections to external access objects from multiple trapping containers as the main trapping container. The main trapping container maintains an interactive session with the external access objects. During the interactive session, it records the time sequence of the dirty bit of the page table entry corresponding to each memory page that has a write operation in the main trapping container being set, as well as the physical page number address sequence of the corresponding memory page. The generation module is used to generate vulnerability detection parameters by interleaving and recombining time series and physical page number address sequences. The splitting module is used to split the vulnerability detection parameters into illegal instruction data and abnormal condition data, and then store them into the reserved bit field of the instruction cache and the reserved bit field of the abnormal vector table register of the simulation image asset, respectively. When the simulation image asset is executed, the module monitors the matching status of the instruction decoding result and the abnormal condition. The location module is used to locate the pollution propagation path of an unknown vulnerability in the instruction execution pipeline when the instruction decoding result hits a reserved bit segment and the abnormal condition matching state is consistent with the reserved bit segment. Based on the pollution propagation path, the module marks the existence and pollution depth of the unknown vulnerability.

[0016] This application provides a method for scanning and verifying unknown vulnerabilities based on active trapping technology. The method includes: acquiring trapping parameters and instantiating multiple trapping containers on multiple idle computing nodes based on these parameters; selecting the container with the most connections to external access objects as the main trapping container, which maintains an interactive session with the external access objects; recording the time sequence of dirty bits being set for each memory page corresponding to a write operation within the main trapping container and the corresponding physical page number address sequence; generating vulnerability detection parameters by interleaving and recombining the time sequence and physical page number address sequence; splitting the vulnerability detection parameters into illegal instruction data and abnormal condition data, storing them respectively in the reserved bit segment of the instruction cache and the reserved bit segment of the exception vector table register of the simulation image asset; monitoring the matching status of instruction decoding results and abnormal conditions during the execution of the simulation image asset; locating the pollution propagation path of the unknown vulnerability in the instruction execution pipeline when the instruction decoding result hits the reserved bit segment and the abnormal condition matching status matches the reserved bit segment; marking the existence and pollution depth of the unknown vulnerability based on the pollution propagation path.

[0017] This application improves the interactivity of the trapping environment by dynamically generating trapping parameters and instantiating trapping containers; it enhances the targeting of vulnerability detection by recording the time series of dirty bits in memory pages and the physical page number address sequence and generating vulnerability detection parameters by interleaving and reassembling them; and it improves the accuracy and depth of vulnerability verification by injecting vulnerability detection parameters into simulation image assets for instruction-level simulation verification, thereby locating the pollution propagation path of unknown vulnerabilities at the processor pipeline level. Attached Figure Description

[0018] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0019] Figure 1 This is a schematic diagram of an unknown vulnerability scanning and verification system architecture based on active trapping technology disclosed in this application.

[0020] Figure 2 This is an overall flowchart of an unknown vulnerability scanning and verification method based on active trapping technology disclosed in this application.

[0021] Figure 3 This is an overall flowchart of an unknown vulnerability scanning and verification method based on active trapping technology disclosed in this application.

[0022] Figure 4 This is a flowchart of the generation of trapping parameters and the instantiation of trapping containers disclosed in this application.

[0023] Figure 5 This is a flowchart of a main trapping container screening method disclosed in this application.

[0024] Figure 6 This is a flowchart of frequency domain data convolution processing and energy concentration determination disclosed in this application.

[0025] Figure 7 This is a schematic diagram of the data flow for generating dirty bit records and vulnerability detection parameters for memory pages as disclosed in this application.

[0026] Figure 8 This is a schematic diagram of the structure of a simulated image asset for splitting and injecting vulnerability detection parameters as disclosed in this application.

[0027] Figure 9 This is a flowchart for locating the contamination propagation path in an instruction execution pipeline disclosed in this application. Detailed Implementation

[0028] The technical solutions in the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. All other embodiments obtained by those skilled in the art based on the embodiments of this application without creative effort are within the scope of protection of this application.

[0029] In the context of domestic IT security innovation, due to the high diversity of processor architecture and operating platform in the domestic IT environment, attackers may use unknown vulnerabilities that have not yet been disclosed to penetrate domestic IT assets. Traditional passive scanning methods based on known feature libraries are difficult to cover the detection needs of unknown vulnerabilities. In order to overcome this problem, this application discloses an unknown vulnerability scanning and verification system and method based on active trapping technology.

[0030] See Figure 1 As shown, the unknown vulnerability scanning and verification system based on active trapping technology provided in this application includes: a traffic interception module 11, a trapping parameter generation module 12, an idle computing node cluster 13, a main trapping container screening module 14, a dirty location recording module 15, a frequency domain evaluation module 16, an interleaving and recombination module 17, a simulation image asset 18, and a contamination path location module 19.

[0031] The traffic interception module 11 is deployed at the network entry point of the information technology innovation asset. It is used to intercept the data flow of the external access object 10, and to judge the port number and time-to-live value of the data flow. The data flow that meets the abnormal scanning characteristics is forwarded to the trapping parameter generation module 12.

[0032] The trapping parameter generation module 12 receives the abnormal scan stream from the traffic interception module 11, extracts the first data segment and the second data segment from it and generates a random code sequence, then performs an XOR operation on the random code sequence and the source identifier of the data stream to obtain the trapping parameters, and broadcasts the trapping parameters to the idle computing node cluster 13.

[0033] The idle computing node cluster 13 contains multiple idle computing nodes, which are marked as idle computing node A, idle computing node B, idle computing node C and idle computing node D respectively. After receiving the trapping parameters, each idle computing node instantiates a corresponding trapping container, which is marked as trapping container A, trapping container B, trapping container C and trapping container D respectively. Each trapping container opens a connection port to attract connection requests from external access object 10.

[0034] The main trap container screening module 14 performs statistical analysis on the half-open connection status between each trap container and the external access object 10, filters out the main trap container through cyclic redundancy check and linear feedback shift register, and closes the connection channels between other trap containers and the external access object 10.

[0035] During the interaction session between the main trapping container and the external access object 10, the dirty bit recording module 15 monitors the changes in the dirty bit status of the page table entries of each memory page in the main trapping container, and records the dirty bit status switching events as a time series and a physical page number address series.

[0036] The frequency domain evaluation module 16 performs frequency domain transformation and convolution processing on the time series and physical page number address sequence output by the dirty location recording module 15, calculates the energy concentration of the mixed frequency domain data, and notifies the interleaving and reassembly module 17 to start the generation of vulnerability detection parameters when the energy concentration reaches the preset concentration threshold.

[0037] The interleaving and reassembly module 17 receives the time series and the physical page number address sequence, generates vulnerability detection parameters through first and last interleaving XOR and splicing operations, and transmits the vulnerability detection parameters to the simulation image asset 18.

[0038] Simulation Mirror Asset 18 is a software simulation environment that performs full-system-level simulation of real information technology innovation assets. After receiving vulnerability detection parameters, it splits the vulnerability detection parameters into illegal instruction data and abnormal condition data, and writes them into the reserved bit field of the instruction buffer and the reserved bit field of the abnormal vector table register, respectively. During the simulation execution, it monitors the instruction decoding result and the abnormal condition matching status.

[0039] After detecting an instruction decoding anomaly and matching anomaly conditions in the simulated image asset 18, the pollution path localization module 19 tracks the propagation path of illegal instruction data in the instruction execution pipeline, locates the existence and pollution depth of unknown vulnerabilities, and analyzes the branch offset set through shift comparison.

[0040] Based on the aforementioned system architecture, this application provides a method for scanning and verifying unknown vulnerabilities using active trapping technology. (See [link to relevant documentation]). Figure 2 and Figure 3 As shown, where Figure 2 and Figure 3 For flowcharts that convey the same meaning but have different representations, the method includes the following steps: Step S101: Obtain the trapping parameters and instantiate multiple trapping containers on multiple idle computing nodes based on the trapping parameters.

[0041] The purpose of this step is to extract attack behavior feature information from the network data stream of the external access object 10, and dynamically generate trapping parameters accordingly. Multiple trapping containers are instantiated on multiple idle computing nodes at the same time, so that the trapping containers can present external features similar to real business nodes, thereby attracting the external access object 10 to establish a connection with the trapping container and interact with it.

[0042] See Figure 4 As shown, the specific implementation process of obtaining the trapping parameters and instantiating the trapping container is as follows: The first step is to intercept the data stream of the external access object 10 by the traffic interception module 11. The data stream refers to the sequence of network data packets sent by the external access object 10 to the information technology asset. Then, the port number and time-to-live (TTL) value of the data stream are judged. When the port number of the data stream is a non-standard port and the TTL value is lower than the preset baseline value, the data stream is judged as an abnormal scanning stream. The non-standard port refers to the port number that is not within the range of regular service ports. The TTL value refers to the maximum number of route hops that a data packet is allowed to traverse in the network. The preset baseline value is a threshold determined based on the statistical distribution of the TTL of normal business data streams. For example, it can be obtained by subtracting twice the standard deviation from the average TTL of historical normal data streams. The specific value can be set according to the statistical data in the actual network environment.

[0043] The second step is to extract the first data segment and the second data segment from the abnormal scan stream. The first data segment is the first half of the bytes of the data packet payload in the abnormal scan stream, and the second data segment is the second half of the bytes of the data packet payload in the abnormal scan stream.

[0044] The third step involves the trapping parameter generation module 12 inputting the first data segment and the second data segment as initial codes into the pseudo-random number generator to generate a random code sequence. The pseudo-random number generator uses a linear congruential algorithm, with the value of the concatenation of the first data segment and the second data segment as the seed value, and iteratively generates a random code sequence according to preset modulus, multiplier and increment parameters. The length of the random code sequence is determined by the total amount of configuration parameters required by the trapping container.

[0045] The fourth step is to perform a bitwise XOR operation on the random code sequence and the source identifier of the data stream, where the source identifier is the concatenation of the source address and source port number of the data stream; the result of the bitwise XOR operation is broadcast as the decoy parameter to each idle computing node in the idle computing node cluster 13.

[0046] In the fifth step, after receiving the trapping parameters, each idle computing node instantiates the corresponding trapping container based on the environment configuration information contained in the trapping parameters. Each idle computing node creates a container image according to the random code fragment allocated to it in the trapping parameters and starts network listening. The idle computing nodes synchronize container status information through a distributed coordination protocol to ensure that all trapping containers are instantiated and open connection ports within the same time window.

[0047] The reason for using the method of extracting data segments from the abnormal scan stream and generating decoy parameters through XOR operation is that the decoy parameters need to be associated with the current attacker's probing behavior characteristics, so that the response mode of the decoy container can be consistent with the target characteristics that the attacker expects to probe, thereby increasing the likelihood that the decoy container will attract the attacker to continue interacting.

[0048] In practical engineering applications, assume that the total length of the data packet payload in the intercepted abnormal scan stream is 64 bytes, the first data segment is the first 32 bytes, and the second data segment is the last 32 bytes. After concatenating the first data segment and the second data segment, a 64-byte initial code is obtained. The first 8 bytes of the initial code are converted into integer values ​​as the seed value of the linear congruential algorithm. The modulus is set to 2 to the power of 32, the multiplier is 1,664,525, and the increment is 1,013,904,223. 128 pseudo-random numbers are generated iteratively to form a random code sequence.

[0049] The source identifier of the data stream is the integer value obtained by concatenating the source address 192.168.10.5 and the source port number 45321. Each pseudo-random number in the random code sequence is XORed with the source identifier to obtain 128 XOR result values ​​as trapping parameters. Assume that there are currently four idle computing nodes in the idle computing node cluster 13: idle computing node A, idle computing node B, idle computing node C, and idle computing node D. Each idle computing node reads 32 consecutive XOR results from the trapping parameters as its own container configuration parameters, thereby instantiating trapping containers A, B, C, and D respectively. The above example is only one implementation method of this application. The specific data segment length, random code generation algorithm parameters, and number of idle computing nodes can be adjusted according to the actual deployment environment.

[0050] This step improves the dynamic adaptability of the trapping environment and the difficulty for attackers to identify it by dynamically extracting feature data from the abnormal scan stream and combining it with the source identifier to generate trapping parameters.

[0051] Step S102: Select the container with the most connections established with the external access object from multiple trapping containers as the main trapping container. The main trapping container maintains an interactive session with the external access object. During the interactive session, record the time sequence of the dirty bit being set for each memory page corresponding to the memory page where a write operation occurs, and the physical page number address sequence of the corresponding memory page.

[0052] In step S101, trap container A, trap container B, trap container C and trap container D have been instantiated on each idle computing node of the idle computing node cluster 13. Since the network configuration parameters of each trap container are different, the external access object 10 will establish a different number of connections with different trap containers when performing port scanning and connection attempts. The purpose of this step is to select the one that interacts most actively with the external access object 10 as the main trap container, so as to concentrate resources on deep monitoring of the attacker's behavior and record the modification trajectory of the main trap container's memory.

[0053] This step consists of two sub-processes: the first sub-process is the filtering of the main trapping container, and the second sub-process is the recording of dirty bits in memory pages during the interactive session.

[0054] I. Screening Subprocess of the Main Trapping Container See Figure 5 As shown, the main trapping container screening module 14 performs the screening of the main trapping container. The specific implementation process is as follows: The first step is to obtain the number group corresponding to the Transmission Control Protocol (TCP) half-open connection established between each trapping container and the external access object 10. The TCP half-open connection refers to the connection that has completed the first two handshakes but has not yet completed the third handshake confirmation. The number group refers to the set of connection sequence numbers corresponding to all TCP half-open connections on the same trapping container. Each connection sequence number is the initial sequence number sent by the external access object 10 during the TCP handshake process.

[0055] The second step is to perform cyclic redundancy check on the number group of each trap container to generate the container check value for each trap container. The cyclic redundancy check uses a standard generator polynomial to perform a modulo-2 division operation on the binary data after sequentially concatenating all the connection sequence numbers in the number group. The remainder obtained is the container check value of the trap container.

[0056] The third step is to arrange the container verification values ​​of trap container A, trap container B, trap container C and trap container D into a verification value queue according to the instantiation order of the trap containers.

[0057] The fourth step involves using the checksum queue as the initial state value of the linear feedback shift register (LFP register) to drive it through cyclic shifting, generating a characteristic expression. The LFP register is a sequence generator based on a shift register and XOR feedback logic. It performs cyclic shifting according to a preset feedback polynomial, outputting one bit per clock cycle during the shift process. The sequence of all output bits is then represented by a polynomial to obtain the characteristic expression. The specific form of the characteristic expression is as follows: Where x is the independent variable representing the number of shifts, The coefficients ai are determined by the bit values ​​output by the linear feedback shift register during the 0th, 1st, 2nd, up to the mth shift, where m is the total number of shifts minus 1. Each coefficient ai is obtained by weighting the bit output by the register during the i-th shift with the corresponding check value in the check value queue. The reason for using a linear feedback shift register to assist in filtering, rather than simply counting the number of connections, is that simple counting can be interfered with by attackers forging a large number of short connections. By mapping the number group to container check values ​​through cyclic redundancy check (CRC) before driving the linear feedback shift register to generate a feature expression, the comprehensive features of the number of connections and the distribution of connection sequence numbers can be integrated into a single mathematical expression, thereby more accurately identifying the trap container with the highest interaction depth with the external access object 10.

[0058] Fifth, the absolute value of each coefficient in the characteristic expression reflects the contribution weight of the corresponding trap container's verification value in the overall verification value sequence. The trap container corresponding to the item with the largest absolute value of the coefficient in the characteristic expression is marked as the main trap container. Then, the connection channels between the other trap containers and the external access object 10 are closed.

[0059] In practical engineering applications, assume that the number group of trap container A contains 3 connection sequence numbers [1001, 2035, 3078], the number group of trap container B contains 5 connection sequence numbers [1520, 2210, 3300, 4015, 4870], the number group of trap container C contains 2 connection sequence numbers [1100, 2900], and the number group of trap container D contains 4 connection sequence numbers [1680, 2450, 3120, 3990]. Perform cyclic redundancy check on each number group. Assuming that an 8-bit cyclic redundancy check generator polynomial is used, the container check value of trap container A is 0xA3, the container check value of trap container B is 0x5F, the container check value of trap container C is 0x12, and the container check value of trap container D is 0x7B.

[0060] The checksums are arranged in the order of instantiation into a queue of [0xA3, 0x5F, 0x12, 0x7B]. This queue of checksums is converted to binary and used as the initial state values ​​for the 4-stage linear feedback shift register. Assume the preset feedback polynomial is... The linear feedback shift register performs 8 cyclic shifts and outputs 8 bits to form a sequence [1, 0, 1, 1, 0, 1, 0, 1]. The characteristic expression is obtained by weighting the output sequence with each check value in the check value queue. The coefficient 163 corresponds to the weighted value of trap container A, coefficient 95 corresponds to the weighted value of trap container B, coefficient 18 corresponds to the weighted value of trap container C, and coefficient 123 corresponds to the weighted value of trap container D. The term with the largest absolute value in the characteristic expression is the constant term 163, which corresponds to trap container A. Therefore, trap container A is marked as the main trap container, and the connection channels between trap containers B, C, and D and the external access object 10 are closed. The above example is only one implementation method of this application; the specific cyclic redundancy check bits and feedback polynomial can be set according to actual needs.

[0061] II. Sub-procedure for recording dirty bits in memory pages After the main trapping container is determined, the main trapping container maintains an interaction session with the external access object 10. During the interaction session, the dirty bit recording module 15 records the changes in the dirty bit status of each memory page in the main trapping container that has undergone write operations. The specific implementation process is as follows: The first step is to allocate a dirty bit record area for each memory page when the main trapping container interacts with the external access object 10. Here, a memory page refers to the basic memory unit managed by the operating platform after dividing physical memory into page frames of fixed size. The dirty bit record area is a dedicated storage area allocated for each memory page in the memory management module of the main trapping container.

[0062] The second step involves continuously monitoring the dirty bit status of page table entries for each memory page. Page table entries are data structure entries maintained by the operating platform to record the mapping relationship between virtual memory pages and physical memory page frames. The dirty bit is a flag bit in the page table entry. When a write operation occurs on a memory page, the operating platform switches the dirty bit from an unset state to a set state. Each time a dirty bit state switch of a memory page is detected, a dirty bit record pair is formed by combining the current timestamp and the page number of the memory page and stored in the corresponding dirty bit record area. The timestamp is a high-precision timestamp of the moment when the dirty bit state switch was detected, and the page number is the page frame number of the memory page in physical memory.

[0063] The third step is to extract all dirty record pairs from each dirty record area, extract the timestamps from each dirty record pair in ascending order of timestamps to form the time sequence of memory pages, and extract the page numbers from each dirty record pair to form the physical page number address sequence of memory pages.

[0064] In practical engineering applications, it is assumed that the main trapping container has written operations on three memory pages during the interactive session, namely page number 0x0012, page number 0x0045 and page number 0x0078.

[0065] Assume that the dirty record area at page number 0x0012 contains 3 dirty record pairs, namely [time stamp 100, page number 0x0012], [time stamp 250, page number 0x0012], and [time stamp 410, page number 0x0012]; Assume that the dirty record area at page number 0x0045 contains two dirty record pairs, namely [time stamp 150, page number 0x0045] and [time stamp 380, page number 0x0045].

[0066] Assume that the dirty record area at page number 0x0078 does not contain any dirty record pairs.

[0067] In summary, after merging all dirty bit pairs from all memory pages and arranging them in ascending order of their timestamps, the overall time sequence is [100, 150, 250, 380, 410], corresponding to the physical page address sequence [0x0012, 0x0045, 0x0012, 0x0045, 0x0012]. The above example is merely one implementation of this application; in real-world scenarios, the number of memory pages and dirty bit pairs can vary depending on the duration of the interactive session and the complexity of the attack.

[0068] This step improves the accuracy of main decoy container screening and the completeness of attack behavior capture by comprehensively filtering the main decoy container and accurately recording memory modification trajectories through linear feedback shift registers and feature expressions.

[0069] After recording the time series and physical page number address sequence in step S102, it is necessary to evaluate the sufficiency of the data to determine whether enough attack behavior feature data has been accumulated. This is because the time series and physical page number address sequence are gradually accumulated during the attacker's continuous interaction. If the vulnerability detection parameters are generated too early in step S103 when the amount of data is insufficient, the attack behavior feature information contained in the vulnerability detection parameters may not be sufficient, thus affecting the accuracy of subsequent vulnerability verification.

[0070] See Figure 6 As shown, the specific implementation process of energy concentration assessment performed by the frequency domain assessment module 16 is as follows: The first step is to convert the time series of each memory page into time-frequency domain data through Discrete Fourier Transform (DFT). DFT converts the dirty location time stamp sequence in the time domain into amplitude and phase representations in the frequency domain, which is used to reveal the periodic characteristics of dirty location events in the time dimension.

[0071] The second step is to convert the physical page number address sequence of each memory page into address frequency domain data through discrete Fourier transform. The address frequency domain data is used to reveal the distribution pattern of dirty bit write operations in the address space dimension.

[0072] The third step involves convolving the time-frequency domain data with the address-frequency domain data to obtain mixed-frequency domain data. The specific calculation method for the convolution process is as follows: Let the time-frequency domain data sequence consist of N complex values, T(0), T(1), T(2) up to T(N-1), and the address-frequency domain data sequence consist of M complex values, D(0), D(1), D(2) up to D(M-1). Then the length of the mixed-frequency domain data H(k) is N+M-1 complex values, where the k-th element H(k) is calculated as follows: The cumulative result, where the value of j is any integer value that makes the indices of T(j) and D(kj) within the valid range; by multiplying and accumulating each term, the hybrid frequency domain data integrates the frequency characteristics of the time and address dimensions, and can comprehensively reflect the correlation patterns of attack behavior in both time and space dimensions.

[0073] The fourth step is to calculate the energy concentration of the mixed frequency domain data. Specifically, this involves first calculating the total energy of the mixed frequency domain data. Total energy The calculation method is as follows: ;in, This represents the total energy of the mixed frequency domain data. The first part representing the mixed frequency domain data A complex value, where L represents the total length of the mixed frequency domain data. Indicates the first The real part of a complex value, Indicates the first The imaginary part of each complex value is determined. Then, all L energy values ​​are sorted in descending order, and the sum of the top few energy values ​​is obtained. Energy concentration That is A higher ratio indicates that the energy of the mixed frequency domain data is more concentrated in a few major frequency components, suggesting that the characteristic pattern of the attack behavior is more stable. When the energy concentration is less than the preset concentration threshold, it means that the currently accumulated dirty bit data cannot fully characterize the stable characteristics of the attack behavior. It is necessary to continue recording the location time and physical page number address of newly added dirty bits, and then re-execute the above calculation after incorporating the new data into the time series and physical page number address series.

[0074] Fifth, when the energy concentration of the mixed frequency domain data reaches the preset concentration threshold, it indicates that sufficient attack behavior feature information has been accumulated in the time series and physical page number address series. At this time, step S103 is triggered to generate vulnerability detection parameters.

[0075] In practical engineering applications, assuming the time series of a memory page is [100, 150, 250, 380, 410], a 5-point Discrete Fourier Transform is applied to the time series. The calculation process of the Discrete Fourier Transform is to perform frequency domain transformation on the 5 values ​​in the time series according to the standard formula to obtain time frequency domain data composed of 5 complex values. Assume that the time frequency domain data is T(0)=1290+0i, T(1)=-205+287i, T(2)=-105+38i, T(3)=-105-38i, T(4)=-205-287i, where the values ​​of the real part and the imaginary part are calculated by the values ​​of each time mark in the time series using the Discrete Fourier Transform formula.

[0076] The physical page number address sequence is [18, 69, 18, 69, 18]. A 5-point discrete Fourier transform is applied to the physical page number address sequence; similarly, five complex values ​​are obtained as address frequency domain data. Assume that the address frequency domain data are D(0)=192+0i, D(1)=-51+16i, D(2)=-51-16i, D(3)=-51+16i, and D(4)=-51-16i.

[0077] Then, the time frequency domain data and the address frequency domain data are calculated according to the aforementioned convolution formula to obtain mixed frequency domain data consisting of 5+5-1=9 complex values.

[0078] Next, the energy value of each frequency component in the mixed frequency domain data is calculated. The square of the magnitude of each complex value in the mixed frequency domain data is calculated to obtain the corresponding energy value. The total energy of the mixed frequency domain data is obtained by summing the nine energy values. Then, sort the nine energy values ​​in descending order, and sum the top three energy values ​​to obtain the result. Assuming the energy concentration is calculated... The value is 0.62, while the preset aggregation threshold is set to 0.75. Therefore, the energy aggregation degree of 0.62 is less than the preset aggregation threshold of 0.75, and it is necessary to continue recording the newly added dirty spot data.

[0079] After several more dirty location records are subsequently recorded, the energy aggregation degree is recalculated to be 0.81, which is greater than the preset aggregation degree threshold of 0.75. At this point, step S103 is triggered. The above example is only one implementation method of this application.

[0080] This evaluation process ensures that vulnerability detection parameters are generated with sufficient data by using frequency domain transformation and energy concentration determination, thereby improving the effectiveness of the vulnerability detection parameters.

[0081] Step S103: Based on the time series and physical page number address sequence, generate vulnerability detection parameters by interleaving and recombining.

[0082] In step S102, the time sequence and physical page number address sequence corresponding to each memory page in the main trap container where write operations occurred have been recorded, and the data has been confirmed to be sufficient through frequency domain evaluation. The purpose of this step is to fuse the time information and address information through interleaving and reassembly to generate vulnerability detection parameters that can trigger vulnerability verification in the simulation environment.

[0083] See Figure 7 As shown, the specific implementation process of generating vulnerability detection parameters by the interleaving and reassembly module 17 is as follows: The first step is to convert each timestamp value in the time series into a time binary string, where the time binary string is the binary representation of the timestamp value; at the same time, convert each page number value in the physical page number address sequence into an address binary string, where the address binary string is the binary representation of the page number value.

[0084] The second step is to arrange the time binary strings into a time string queue according to the time order, and arrange the address binary strings into an address string queue according to the address appearance order.

[0085] The third step is to take the first time binary string from the time string queue and perform a bitwise XOR operation with the last address binary string from the address string queue to obtain the first recombined result; at the same time, take the last time binary string from the time string queue and perform a bitwise XOR operation with the first address binary string from the address string queue to obtain the second recombined result.

[0086] The fourth step is to concatenate the first and second recombination results to obtain the vulnerability detection parameters. The total length of the vulnerability detection parameters needs to be adapted to the fetch width of the target processor. When the total length of the vulnerability detection parameters exceeds an integer multiple of the fetch width, it is truncated according to the fetch width. When it is insufficient, zeros are added to the end to make it an integer multiple of the fetch width.

[0087] The reason for using the first and last XOR concatenation method is that this method can fuse the earliest attack behavior characteristics in the time dimension with the last modified memory region characteristics in the address dimension, and at the same time fuse the latest attack behavior characteristics in the time dimension with the first modified memory region characteristics in the address dimension. Statistically, the binary string generated by the interleaving and reassembly method has a higher probability of hitting undefined instructions or retaining instruction codes in the instruction encoding space than the randomly generated binary string, thus providing an effective triggering condition for vulnerability verification.

[0088] In practical engineering applications, assuming the time series is [100, 410] and the physical page number address sequence is [0x0012, 0x0012]; the time stamp 100 is converted into a 16-bit time binary string as [0000000001100100], the time stamp 410 is converted into a 16-bit time binary string as [0000000110011010], and the page number 0x0012 is converted into a 16-bit address binary string as [0000000000010010].

[0089] The time string queue is {[0000000001100100], [0000000110011010]}, and the address string queue is {[0000000000010010], [0000000000010010]}. The first time binary string [0000000001100100] in the time string queue is bitwise XORed with the last address binary string [0000000000010010] in the address string queue to obtain the first reassembled string. The result is [0000000001110110]. The last time binary string [0000000110011010] in the time string queue is XORed with the first address binary string [0000000000010010] in the address string queue to obtain the second reassembled result [0000000110001000]. After concatenation, a 32-bit vulnerability detection parameter [0000000001110110000000110001000] is obtained. The above example is merely one implementation of this application.

[0090] This step generates vulnerability detection parameters by fusing time and address information through interleaving and recombination, which improves the effectiveness of triggering abnormal instructions in the simulation environment.

[0091] Step S104: After splitting the vulnerability detection parameters into illegal instruction data and abnormal condition data, store them in the reserved bit field of the instruction cache of the simulation image asset and the reserved bit field of the abnormal vector table register, respectively. Monitor the instruction decoding result and the abnormal condition matching status when the simulation image asset is executed.

[0092] In step S103, vulnerability detection parameters have been generated. The purpose of this step is to inject the vulnerability detection parameters into a specific hardware simulation area of ​​the simulation image asset 18, so that the simulation image asset 18 can use the vulnerability detection parameters to trigger instruction decoding anomalies and anomaly condition matching during execution, thereby providing triggering conditions for subsequent pollution propagation path location.

[0093] See Figure 8 As shown, the specific implementation process of vulnerability detection parameter splitting and injection is as follows: The first step is to treat the vulnerability detection parameters as a long binary string. Starting from the beginning of the binary string, extract one bit every other bit to form illegal instruction data, that is, extract the bits at odd-numbered positions such as the 1st, 3rd, and 5th bits. Starting from the next bit after the beginning of the binary string, extract one bit every other bit to form abnormal condition data, that is, extract the bits at even-numbered positions such as the 2nd, 4th, and 6th bits.

[0094] The second step is to pad the end of the illegal instruction data with zeros, so that the length of the padded illegal instruction data is equal to the bit width of the instruction cache reserved segment. The instruction cache reserved segment refers to the storage area that is pre-defined in the instruction cache simulation module of the simulation image asset 18 and does not participate in the normal instruction cache scheduling. The instruction cache simulation module is modeled according to the instruction cache structure of the real processor and contains multiple cache line simulation slots. Each cache line simulation slot includes a tag area, a storage area and a check area. The reserved segment is a storage area of ​​several free slots that are not occupied by normal instructions selected from the cache line simulation slots as a dedicated writing area.

[0095] Then, the zero-padded illegal instruction data is written into the storage area of ​​an empty slot in the reserved segment of the instruction cache. During the writing process, the simulator marks the empty slot as an isolated state that does not participate in the normal cache replacement strategy, thereby avoiding the data in the empty slot from being affected by the normal cache coherency protocol and prefetch logic.

[0096] The third step is to perform polynomial loop verification on the written illegal instruction data to generate a signature code. The specific calculation process of polynomial loop verification is as follows: Let the binary representation of the illegal instruction data written be... ,in to These represent the bit values ​​of the illegal instruction data from the most significant bit to the least significant bit. Decrement the number of bits in the illegal instruction data by 1; let the generator polynomial of the cyclic redundancy check be... ,in To determine the order of the generating polynomial, Represents the generator polynomial The coefficient of the term, Represents the generator polynomial The coefficients and order of the terms determine the length of the generated feature code. 1 bit to To generate the coefficients of each term in the polynomial; firstly, Left shift by r bits to get Then / G(x) performs modulo-2 division, which is a polynomial division operation performed over a binary finite field. In this operation, XOR operation is used instead of borrowing subtraction, and the operation is performed bit by bit from the high bit to the low bit until the number of times the remainder is less than the number of times G(x) is performed. The remainder is R(x), and the binary coefficient sequence of R(x) is the CRC signature. The length of the CRC signature is r bits. The CRC signature is written into the check area of ​​the same free slot.

[0097] The fourth step is to pad the end of the abnormal condition data with zeros, making the length of the padded abnormal condition data equal to the bit width of the reserved bit field in the abnormal vector table register. The reserved bit field in the abnormal vector table register refers to the register bit field that is pre-defined in the abnormal vector table simulation module of the simulation image asset 18 and does not participate in the normal abnormal handling distribution. The reserved bit field is a reserved field in the abnormal vector table that is not used by the processor architecture definition. The bit width of the reserved bit field is determined according to the abnormal vector table specification of the target processor architecture. The zero-padded abnormal condition data is then written into the reserved bit field of the abnormal vector table register.

[0098] In practical engineering applications, it is assumed that the vulnerability detection parameters obtained in step S103 are a 32-bit binary string [00000000011101100000000110001000]; starting from the first bit, illegal instruction data is extracted every bit interval as [0000010101000100] for a total of 16 bits; starting from the second bit, abnormal condition data is extracted every bit interval as [0000001100001000] for a total of 16 bits.

[0099] Assuming the reserved bit field of the instruction cache has a width of 32 bits, the illegal instruction data is padded with 16 zeros to obtain 32 bits of data [00000011000010000000000000000000], which is then written to the storage area of ​​the 3rd free slot. This 32 bits of data are then subjected to cyclic redundancy check (CRC) calculation to obtain an 8-bit signature [10110011], which is written to the check area of ​​the 3rd free slot. The above example is merely one implementation of this application.

[0100] This step injects vulnerability detection parameters into the simulation image asset through isolation marking, ensuring the integrity and controllability of vulnerability detection data during simulation execution.

[0101] Step S105: When the instruction decoding result hits the reserved bit field and the abnormal condition matching state is consistent with the reserved bit field, locate the pollution propagation path of the unknown vulnerability in the instruction execution pipeline, and mark the existence of the unknown vulnerability and the pollution depth of the unknown vulnerability according to the pollution propagation path.

[0102] In step S104, illegal instruction data and abnormal condition data have been written into the reserved bit field of the instruction cache and the reserved bit field of the exception vector table register of the simulation image asset 18, respectively. The purpose of this step is to monitor instruction decoding anomalies and abnormal condition matching during the execution of the simulation image asset 18, and to trace the propagation path of illegal instruction data from the instruction execution pipeline when the hit condition is met, thereby locating unknown vulnerabilities.

[0103] See Figure 9 As shown, the specific implementation process of pollution propagation path localization performed by the pollution path localization module 19 is as follows: The first step is to simulate the pipeline behavior of the processor cycle by cycle after the simulation image asset 18 starts execution. When the processor simulation module fetches an instruction from the instruction cache and sends it to the decoding stage during the instruction fetch stage, the decoding module compares the encoding of the instruction with the encoding of all legal instructions in the instruction set architecture bit by bit. If any encoding of the instruction is not equal to the encoding of the corresponding position of any legal instruction, an instruction decoding exception result is generated.

[0104] The second step, after generating an instruction decoding exception, is to confirm whether the exception was triggered by illegal instruction data injected into the reserved bit segment. Specifically, the pre-stored feature code in the verification area of ​​the instruction buffer slot where the instruction data that triggered the exception is located is read. At the same time, the instruction data that triggered the exception is re-inputted into the polynomial loop verification algorithm for calculation. The calculation process is the same as the third step in step S104. That is, let the binary representation of the instruction data that triggered the exception be B'(x). Using the same generator polynomial G(x) as in step S104, B'(x) is shifted left by r bits, and then G(x) is divided by modulo 2. The binary coefficient sequence of the remainder R'(x) is the result. The simulator first calculates the CRC signature. Then, it compares the CRC signature pre-stored in the check area with the instantaneous CRC signature bit by bit. If every bit of the CRC signature and the instantaneous CRC signature are completely identical, that is, the i-th bit of the CRC is equal to the i-th bit of the CRC signature for all i, then it is confirmed that the instruction data that triggered the current exception is indeed the illegal instruction data written to the slot in step S104, and not the data variation caused by cache pollution or other reasons, thus eliminating the possibility of misjudgment. If any bit of the CRC signature and the instantaneous CRC signature are inconsistent, it means that the current exception was not triggered by the data injected in the reserved bit segment, and the simulator continues to execute subsequent instructions.

[0105] The third step is to determine the location of the illegal instruction data in the instruction cache based on the slot number of the illegal instruction slot where the successfully matched feature code is located. The location of the illegal instruction data indicates the specific cache line position when it is retrieved in the instruction cache simulation module.

[0106] The fourth step involves starting from the current location and using the pipeline tracing hook function provided by the emulator to track the register renaming table entry numbers corresponding to each pipeline stage the illegal instruction data passes through after being issued to the execution unit. The pipeline tracing hook function is a callback function automatically called by the emulator during each pipeline stage transition. It is an application of dynamic binary instrumentation technology and is used to record the physical register numbers occupied by the current instruction in each pipeline stage such as issue, execution, and write-back. The register renaming table entry number is the physical register mapping number assigned by the processor to each instruction during out-of-order execution, which is read through the performance monitoring interface provided by the emulator.

[0107] The fifth step is to arrange the register renaming table entries into a path sequence according to the pipeline order, and use the path sequence as the pollution propagation path; mark the existence and pollution depth of unknown vulnerabilities based on the pollution propagation path, where existence means that illegal instruction data successfully triggered the instruction decoding exception during the simulation execution process and generated a traceable propagation path in the pipeline, and pollution depth means the number of pipeline-level nodes contained in the pollution propagation path.

[0108] After completing the location of the pollution transmission path in step S105, the method further includes: S106. Perform branch offset analysis on the pollution propagation path to further identify possible branch diffusion locations in the pollution propagation path. The specific implementation process of branch offset analysis is as follows: The first step is to convert the register renaming table entry number corresponding to each node in the contamination propagation path into a binary sequence number string, and then concatenate all the binary sequence number strings into a path string according to the node order in the contamination propagation path.

[0109] The second step is to input the path string into a shift comparator, which is a logical comparison module that compares the similarity of two binary strings through cyclic shift operations. The shift comparator performs cyclic shift matching on the path string and the vulnerability detection parameters. For each cyclic shift of one bit, it calculates the number of bits that differ between the path string and the vulnerability detection parameters. The number of bits that differ is the total number of bits in which the path string and the vulnerability detection parameters have different values ​​at corresponding bits.

[0110] The third step is to record all shift positions where the difference in the number of bits is less than the preset difference threshold, and use the offset corresponding to each shift position as the branch offset set of the contamination propagation path. The branch offset set is used to indicate the positions where branch diffusion may occur in the contamination propagation path, providing a reference for subsequent vulnerability patching.

[0111] In practical engineering applications, it is assumed that the pollution propagation path contains 4 nodes, and the corresponding register renaming table entry numbers are 7, 12, 3 and 15 respectively. After converting each number into a 4-bit binary sequence string, they are

[0111] ,

[1100] ,

[0011] and

[1111] . By concatenating them in the order of the nodes, a 16-bit path string [0111110000111111] is obtained.

[0112] Assuming the first 16 bits of the vulnerability detection parameter are [0000000001110110], the path string is cyclically shifted and matched with the first 16 bits of the vulnerability detection parameter. The difference in bit length is 8 when the shift is 0, 9 when the shift is 1, and 4 when the shift is 5. Assuming the preset difference threshold is 5, a shift of 5 satisfies the condition, and the branch offset set is {5}. The above example is merely one implementation of this application.

[0113] This step, by tracing the propagation path of illegal instruction data in the instruction execution pipeline of the simulated image asset and performing branch offset analysis, enables precise location of unknown vulnerabilities at the instruction-level granularity.

[0114] In summary, this application dynamically generates trapping parameters associated with attacker behavior characteristics through active trapping technology and instantiates trapping containers. It uses linear feedback shift registers to assist in filtering the main trapping container to concentrate resources on capturing attack behavior. By recording the time series of dirty bits in memory pages and the physical page number address series, and confirming the sufficiency of the data through frequency domain analysis, the data is interleaved and recombined to generate vulnerability detection parameters. The vulnerability detection parameters are then split and injected into the simulation image asset 18 for instruction-level simulation verification. Finally, pipeline tracing and shift comparison are used to locate the pollution propagation path and branch offset of unknown vulnerabilities, thereby improving the detection coverage and verification depth of unknown vulnerabilities and reducing the risk of unknown vulnerabilities being exploited in the context of domestic IT security innovation.

[0115] This application also provides an unknown vulnerability scanning and verification system based on active trapping technology, the system comprising: The acquisition module is used to acquire trapping parameters and instantiate multiple trapping containers on multiple idle computing nodes based on the trapping parameters.

[0116] The filtering module is used to select the container with the most connections to external access objects from multiple trapping containers as the main trapping container. The main trapping container maintains an interactive session with the external access objects. During the interactive session, it records the time sequence of the dirty bit being set for each memory page corresponding to the memory page where a write operation occurs, as well as the physical page number address sequence of the corresponding memory page.

[0117] The generation module is used to generate vulnerability detection parameters by interleaving and recombining time series and physical page number address sequences.

[0118] The splitting module is used to split vulnerability detection parameters into illegal instruction data and abnormal condition data, and then store them into the reserved bit field of the instruction cache and the reserved bit field of the abnormal vector table register of the simulation image asset, respectively. When the simulation image asset is executed, the module monitors the matching status of instruction decoding results and abnormal conditions.

[0119] The location module is used to locate the pollution propagation path of an unknown vulnerability in the instruction execution pipeline when the instruction decoding result hits a reserved bit segment and the abnormal condition matching state is consistent with the reserved bit segment. Based on the pollution propagation path, the module marks the existence and pollution depth of the unknown vulnerability.

[0120] The unknown vulnerability scanning and verification system based on active trapping technology in this application is used to implement the aforementioned unknown vulnerability scanning and verification method based on active trapping technology. Therefore, the specific implementation of the unknown vulnerability scanning and verification system based on active trapping technology can be found in the embodiment section of the unknown vulnerability scanning and verification method based on active trapping technology above. The specific implementation can be referred to the description of the corresponding embodiment, and will not be repeated here.

[0121] This application also provides an electronic device, including: a memory for storing a computer program; and a processor for implementing the steps of the above-described unknown vulnerability scanning and verification method based on active trapping technology when executing the computer program.

[0122] This application also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps of any of the above-described methods for scanning and verifying unknown vulnerabilities based on active trapping technology.

[0123] In one exemplary embodiment, the aforementioned computer-readable storage medium may include, but is not limited to, various media capable of storing computer programs, such as USB flash drives, read-only memory, random access memory, portable hard drives, magnetic disks, or optical disks.

[0124] The embodiments of this application also provide a computer program product, which includes a computer program that, when executed by a processor, implements the steps in any of the above embodiments of the unknown vulnerability scanning and verification method based on active trapping technology.

[0125] Those skilled in the art will further recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0126] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in one or more embodiments of this specification are all information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, use and processing of related data must comply with relevant laws, regulations and standards, and corresponding operation entry points are provided for users to choose to authorize or refuse.

[0127] The above provides a detailed description of the unknown vulnerability scanning and verification method and system based on active trapping technology provided in this application. Specific examples have been used to illustrate the principles and implementation methods of this application. The descriptions of the embodiments above are only for the purpose of helping to understand the method and its core ideas. It should be noted that those skilled in the art can make several improvements and modifications to this application without departing from the principles of this application, and these improvements and modifications also fall within the protection scope of this application.

Claims

1. A method for scanning and verifying unknown vulnerabilities based on active trapping technology, characterized in that, include: Obtain the trapping parameters, and instantiate multiple trapping containers on multiple idle computing nodes based on the trapping parameters; The container with the most connections established with external access objects is selected from multiple trapping containers as the main trapping container. The main trapping container maintains an interactive session with the external access objects. During the interactive session, the time sequence of the dirty bit of the page table entry corresponding to each memory page that has a write operation in the main trapping container and the physical page number address sequence of the corresponding memory page are recorded. Based on the time series and the physical page number address sequence, vulnerability detection parameters are generated by interleaving and recombination. The vulnerability detection parameters are split into illegal instruction data and abnormal condition data and stored in the reserved bit field of the instruction cache and the reserved bit field of the abnormal vector table register of the simulation image asset, respectively. When the simulation image asset is executed, the matching status of the instruction decoding result and the abnormal condition is monitored. When the instruction decoding result hits the reserved bit field and the abnormal condition matching state is consistent with the reserved bit field, the pollution propagation path of the unknown vulnerability in the instruction execution pipeline is located, and the existence of the unknown vulnerability and the pollution depth of the unknown vulnerability are marked according to the pollution propagation path.

2. The method according to claim 1, characterized in that, After recording the time sequence of the dirty bit being set for each memory page corresponding to a write operation occurring within the main trapping container and the corresponding physical page number address sequence during the interactive session, before generating vulnerability detection parameters by interleaving and reassembling based on the time sequence and the physical page number address sequence, the process includes: Convert the time sequence and physical page number address sequence of each memory page into time frequency domain data and address frequency domain data, respectively. The time frequency domain data and the address frequency domain data are convolved to obtain mixed frequency domain data; Calculate the energy concentration of the mixed frequency domain data. When the energy concentration is less than a preset concentration threshold, continue to record the time and address of newly added dirty bits until the energy concentration of the mixed frequency domain data reaches the preset concentration threshold. When the energy concentration of the mixed frequency domain data reaches the preset concentration threshold, trigger the step of generating vulnerability detection parameters.

3. The method according to claim 1, characterized in that, The generation of vulnerability detection parameters based on the time series and the physical page number address sequence through interleaving and recombination includes: Convert each time stamp value in the time series into a time binary string, and convert each page number value in the physical page number address sequence into an address binary string; Arrange the time binary strings into a time string queue according to time order, and arrange the address binary strings into an address string queue according to the address appearance order. Take the first time binary string from the time string queue and perform a bitwise XOR operation with the last address binary string in the address string queue to obtain the first recombination result. Take the last time binary string from the time string queue and perform a bitwise XOR operation with the first address binary string in the address string queue to obtain the second recombination result. The first reconstructed result is combined with the second reconstructed result to obtain the vulnerability detection parameters.

4. The method according to claim 1, characterized in that, After locating the propagation path of the unknown vulnerability in the instruction execution pipeline, this includes: Convert the register renaming entry number corresponding to each node in the pollution propagation path into a binary sequence number string, and concatenate all the binary sequence number strings into a path string according to the node order in the pollution propagation path. The path string is input to a shift comparator, which performs cyclic shift matching between the path string and the vulnerability detection parameters. For each cyclic shift of one bit, the difference between the path string and the vulnerability detection parameters is calculated once. All shift positions where the difference is less than a preset difference threshold are recorded. The offset corresponding to each shift position is used as the branch offset set of the contamination propagation path.

5. The method according to claim 1, characterized in that, The step of splitting the vulnerability detection parameters into illegal instruction data and abnormal condition data and storing them in the reserved bit field of the instruction cache and the reserved bit field of the exception vector table register of the simulation image asset respectively includes: The vulnerability detection parameters are treated as a long binary string. Starting from the beginning of the long binary string, one bit is extracted every other bit to form illegal instruction data. Starting from the next bit after the beginning of the long binary string, one bit is extracted every other bit to form abnormal condition data. Zeros are padded to the end of the illegal instruction data. The length of the padded illegal instruction data is equal to the bit width of the reserved bit segment of the instruction cache. The padded illegal instruction data is written into the storage area of ​​an empty slot in the reserved bit segment of the instruction cache. A polynomial loop check is performed on the written illegal instruction data to generate a feature code. The feature code is written into the check area of ​​the same empty slot. The abnormal condition data is padded with zeros at the end. The length of the padded abnormal condition data is equal to the bit width of the reserved bit field in the abnormal vector table register. The padded abnormal condition data is then written into the reserved bit field of the abnormal vector table register.

6. The method according to claim 1, characterized in that, The step of selecting the container with the most connections to external access objects from multiple trapping containers as the main trapping container includes: Obtain the number group corresponding to the established Transmission Control Protocol half-open connection between each trap container and the external access object, and perform cyclic redundancy check on the number group of each trap container to generate the container check value of each trap container. Arrange the container verification values ​​of all the trapping containers into a verification value queue according to the instantiation order of the trapping containers. Use the verification value queue as the initial state value of the linear feedback shift register to drive the linear feedback shift register to cyclically shift and generate a characteristic expression. Mark the trap container corresponding to the term with the largest absolute value of the coefficient in the characteristic expression as the main trap container, and close the connection channels between other trap containers and external access objects except for the main trap container.

7. The method according to claim 1, characterized in that, The step of recording the time sequence of dirty bits being set and the physical page number address sequence of each memory page in the main trapping container during the interactive session includes: When the main trapping container interacts with the external access object, a dirty bit record area is allocated for each memory page. Each time the dirty bit of the memory page is detected to switch from an unset state to a set state, the current timestamp and the page number of the memory page are combined to form a dirty bit record pair and stored in the dirty bit record area corresponding to the memory page. Extract all dirty record pairs from each dirty record area, extract the timestamps from each dirty record pair in ascending order of timestamps to form the time sequence of the memory page, and extract the page number from each dirty record pair to form the physical page number address sequence of the memory page.

8. The method according to claim 1, characterized in that, The location of the unknown vulnerability and its propagation path in the instruction execution pipeline include: When the instruction decoding result hits illegal instruction data in the reserved segment, the feature code in the verification area of ​​the illegal instruction slot where the current illegal instruction data is located is read, and the feature code is matched with the instant feature code obtained by recalculating the illegal instruction data. The location of the illegal instruction data in the instruction register is determined based on the slot number of the illegal instruction slot where the successfully matched feature code is located. Starting from the location where the illegal instruction data is issued to the execution unit, the register renaming table entry number corresponding to each pipeline stage is traced. The register renaming table entry numbers are arranged into a path sequence according to the pipeline order, and the path sequence is used as the contamination propagation path.

9. The method according to claim 1, characterized in that, The process of obtaining trapping parameters and instantiating multiple trapping containers on multiple idle computing nodes based on the trapping parameters includes: The data stream of an external access object is intercepted. When the port number of the data stream is a non-standard port and the time to live value is lower than a preset baseline value, the data stream is identified as an abnormal scanning stream, and the first data segment and the second data segment are extracted from the abnormal scanning stream. Use the first data segment and the second data segment as initial codes to generate a random code sequence; The random code sequence is XORed with the source identifier of the data stream, and the result of the XOR operation is broadcast as a trapping parameter to multiple idle computing nodes, triggering each idle computing node to instantiate multiple trapping containers simultaneously according to the trapping parameter.

10. An unknown vulnerability scanning and verification system based on active trapping technology, characterized in that, include: The acquisition module is used to acquire trapping parameters and instantiate multiple trapping containers on multiple idle computing nodes based on the trapping parameters. The filtering module is used to select the one with the most connections to the external access object from multiple trapping containers as the main trapping container. The main trapping container maintains an interactive session with the external access object. During the interactive session, the module records the time sequence of the dirty bit of the page table entry corresponding to each memory page in the main trapping container where a write operation occurs and the physical page number address sequence of the corresponding memory page. The generation module is used to generate vulnerability detection parameters by interleaving and recombining the time series and the physical page number address sequence. The splitting module is used to split the vulnerability detection parameters into illegal instruction data and abnormal condition data, and then store them into the reserved bit field of the instruction cache and the reserved bit field of the abnormal vector table register of the simulation image asset, respectively. When the simulation image asset is executed, the module monitors the matching status of the instruction decoding result and the abnormal condition. The positioning module is used to locate the pollution propagation path of the unknown vulnerability in the instruction execution pipeline when the instruction decoding result hits the reserved bit segment and the abnormal condition matching state is consistent with the reserved bit segment, and to mark the existence of the unknown vulnerability and the pollution depth of the unknown vulnerability based on the pollution propagation path.

Images