ROP and variant attack dynamic detection method based on multi-strategy instruction detection

Abstract

The invention discloses an ROP and variant attack dynamic detection method based on multi-strategy instruction detection. The method is based on a binary dynamic instrumentation technology to intercept an instruction, and adopts two strategy judgment methods of a key instruction detection strategy and an attack instruction fragment feature detection strategy to realize ROP attack and variant attack detection. And the key instruction detection strategy performs characteristic analysis according to the instruction address and the instruction quantity. And the attack instruction fragment featuredetection strategy comprises an attack instruction fragment size judgment strategy and an attack instruction fragment continuous length judgment strategy according to the attack function and complexity feature analysis. According to the method, a multi-layer detection strategy is adopted, four characteristic dimensions of instruction addresses, the number, attack functions and attack complexity are integrated from two aspects of normal and abnormal instruction characteristics, and detection of ROP attacks and variant attacks of the ROP attacks is comprehensively achieved by combining a deterministic detection method and an uncertain detection method. The method is low in performance consumption and small in occupied memory space.

Description

technical field [0001] The invention relates to a dynamic detection method for ROP and variant attacks based on multi-strategy command detection, in particular to a multi-strategy detection method for judging ROP attacks and variant attacks based on key command detection strategies and attack command segment detection strategies, which belongs to memory attack and defense field. Background technique [0002] Solar Designer proposed the return-into-libc attack technology in 1997 to replace the return address of the function with the address of the function code block in the libc library by exploiting the vulnerability, and directly transfer the control flow to the attack code composed of the attacker's pre-designed libc function piece. But once the libc developers remove the commonly used system and other library functions, the attack capability will be greatly restricted. Hovav Shacham proposed the ROP attack (Return-Oriented Programming) in 2007, by scanning the existing ...

AI Technical Summary

Problems solved by technology

Second, compared with the instruction-based detection method, the performance consumption of the stack-based detection method is too large

For example, the ROPdefender detection method based on the shadow stack needs to perform two operations on the stack, which has high performance overhead and takes up more memory.

Images