Software privacy leak behavior detection method and system based on virtualization technology

Abstract

The invention relates to a software privacy leak behavior detection method and system based on the virtualization technology. The software privacy leak behavior detection method includes the steps of loading software to be analyzed into a modified virtual machine for operation; then monitoring execution of instructions in the software operation process, when an application accesses a sensitive resource, signing related taint data, making a related taint propagation rule, on the premise, dynamically generating an instruction-level taint dependence graph, reconstructing translation according to the system, and dynamically generating a system process-level taint dependence graph; analyzing software privacy leak behaviors through a fine-grit taint dependence analysis graph. According to the software privacy leak behavior detection method and system, the fine-grit taint dependence analysis graph is obtained through an instruction-level and process-level combined multi-level dynamic taint analysis method, information of a system pollution path and high-level semantic information such as information leak can be accordingly obtained, and effective analysis and effective detection of the software privacy leak behaviors are achieved.

Description

technical field [0001] The invention belongs to the technical field of network security, and in particular relates to a virtualization technology-based software privacy leakage behavior detection method and system. Background technique [0002] With the continuous updating of computer and Internet technology, the technology of malicious software continues to develop, becoming one of the main threats to the security of information systems at present, and the harm of privacy leakage caused by malicious software is becoming increasingly serious. An important aspect of computer and Internet security. [0003] Malware detection is one of the hot issues of research at home and abroad. With the development of virtualization technology, new research methods for malware analysis and detection have emerged. These methods involve various theoretical methods and technologies, mainly including static software analysis and detection methods based on virtualization technology and dynamic...

AI Technical Summary

Problems solved by technology

[0004] Aiming at the problems existing in the current dynamic taint analysis of malicious codes that are limited to instruction-level data and lack of upper-level information, as well as the problems that the analysis results of the data in the kernel and the precise location of the tainted data in the process cannot be obtained, the purpose of the present invention is to provide a A method and system for detecting software privacy leakage behavior based on virtualization technology, adding modules such as instruction-level dynamic taint analysis, system information reconstruction, and dependency graph generation to virtual machines, through multi-level dynamic taints combining instruction-level and process-level Analysis method, the system can obtain a fine-grained taint dependency analysis graph, so as to obtain the path information of system pollution and high-level semantic information such as information leakage

Images