Modeled software key behavior tracking method based on memory management

Abstract

According to a modeled software key behavior tracking method based on memory management, a software key behavior monitoring system is formed by monitoring probes which are arranged on a monitoring control platform of servers and a client side. By means of the monitoring control platform, behavior node information of software to be monitored is extracted through static analysis, key behaviors and behavior extraction feature information are defined, and target software is monitored through a probe injection method. The key behavior information is effectively extracted through the monitoring probes by means of the function hijacking technology, the heap space code staying technology based on small memory management and the container management technology for balancing stack space. Single-threaded and multi-threaded software key behaviors with the complex recursive call relation are effectively tracked, high flexibility and high adaptability are achieved, and normal running of the target software and normal running of other software are taken into consideration.

Description

technical field [0001] The invention relates to the field of information security, in particular to a method for tracking key behaviors of software based on memory management models, which realizes flexible management and effective extraction of key behaviors of software, and belongs to the field of computer information security. Background technique [0002] With the continuous deepening of informatization construction, software applications have become an inseparable and important part of large systems such as society, military, and enterprises. At the same time, due to the inherent vulnerability and "black box" characteristics of software behavior, the security and reliability of software applications have also become important issues affecting informatization operation and maintenance, and urgently need to be confirmed and guaranteed. [0003] Software behavior accurately reflects the running track of the software, internally records the security and reliability informat...

AI Technical Summary

Problems solved by technology

Its shortcoming is that when faced with a large number of monitoring target functions, the acquisition of original function signature information not only increases the workload, but also requires developers to be familiar with the functions. In addition, the definition of a large number of callback functions also increases development. staff workload and reduces management flexibility

The second method uses assembly language to modify the function entry address instruction to realize the jump to the monitoring function. The monitoring node mounted by this method is effective for all currently running processes and will affect the normal operation of other software.

Images