Non-control data attack detection method and device based on novel program dependence graph

Abstract

The invention belongs to the technical field of network security space, and particularly relates to a non-control data attack detection method and device based on a novel program dependency graph, andthe method comprises the steps: constructing a security-sensitive non-control data set in a program and the novel program dependency graph of basic block granularity through static analysis, and carrying out instrumentation of the LLVM intermediate language representation of the program; in the running process, access and calling operation of the safety-sensitive non-control data in the program is verified, and therefore the data flow integrity of the safety-sensitive non-control data is protected. The control flow and the data flow of the program are combined, and data flow integrity protection of safe and sensitive non-control data in the target program is realized according to the novel program dependency graph during running. The protected non-control data is shrunk to a safe and sensitive non-control data set, analysis and instrumentation processing are carried out on the granularity of the basic block, the running efficiency of a program is guaranteed, safety and performance expenditure are balanced, good universality is achieved, and a new solution is provided for non-control data attack detection.

Description

technical field [0001] The invention belongs to the technical field of network security space, and in particular relates to a non-control data attack detection method and device based on a novel program dependency graph, which can be used to detect non-control data attack behavior existing in a target program. Background technique [0002] Cyberspace is a network that connects various information technology infrastructures, including the Internet, various computer systems, and a virtual environment where people interact with each other. The network is not only a carrier and medium of information, it also improves people's thinking. To some extent, people's environment is endowed with the attributes of network and information. Therefore, it can be considered that the core of cyberspace security is information security. Today, information technology and its industrial applications are ushering in unprecedented prosperity, and cyberspace security issues are becoming more and ...

AI Technical Summary

Problems solved by technology

Since non-control data will not violate the integrity of control flow, and the existing control flow attack detection methods cannot effectively detect this type of attack, although DFI (Date Flow Integrity) can defend against non-control data attacks, it introduces Up to 103% performance overhead, making it difficult to deploy applications in real environments

Images