期刊文献+
任意字段
题名或关键词
题名
关键词
文摘
作者
第一作者
机构
刊名
分类号
参考文献
作者简介
基金资助
栏目信息

基于静态污点分析技术的软件内核驱动安全性检测

SECURITY DETECTION ON SOFTWARE KERNEL DRIVERS BASED ON STATIC TAINT ANALYSIS
在线阅读 下载PDF
导出
摘要 由于软件内核驱动运行在内核态,对其进行安全性检测需要与传统用户态软件不同的方法。通过对真实内核驱动漏洞的分析,总结其漏洞模式,针对性地提出一种检测方法。采用静态污点追踪技术,对内核函数进行收敛状态约束的计算求得其状态不动点,检测用户态下输入污点参数在内核Dispatch例程内的传播情况,判定是否存在内核驱动漏洞。通过对多款知名杀毒软件内核驱动的真实测试,发现四个未公开的内核驱动漏洞,验证了该检测方法的有效性。 Security detection on software kernel drivers seeks the method different from the one for traditional user mode software, as they run in kernel mode. By analysing the vulnerabilities of real kernel drives, we summerise their patterns and propose a new detection method in targeted way. Using static taint tracking technology we calculate the convergence state constraint on kernel function to find its state fix point, detect the spreading of taint parameter inputted in user mode within kernel Dispatch routine, and judge whether the vulnerability of kernel drives exists. Real testing is applied to the kernel drivers of a variety of famous antivirus software and four undiscovered kernel vulnerabilities are found, this verifies the effectiveness of the detection method.
作者 倪涛
机构地区 南京政治学院上海校区军事信息管理系
出处 《计算机应用与软件》 CSCD 2015年第5期262-266,共5页 Computer Applications and Software
基金 国家高技术研究发展计划主题项目(2012AA012902)
关键词 内核驱动 安全性检测 污点分析 状态不动点 Kernel drivers Security detection Taint analysis State fix point
分类号 TP393.08 [自动化与计算机技术—计算机应用技术]
  • 相关文献

参考文献14

  • 1Petroni Jr N L, Hicks M. Automated detection of persistent kernel con- tml-flow attacks [ C ]//Proceedings of the 14th ACM conference on Computer and security. ACM, 2007 : 103 - 115.
  • 2Lanzi A, Sharif M, Lee W. K-Tracer: A system for extracting kernel malware behavior[ C ]//Proceedings of the 16th Annual Network and Distributed System Security Symposium(NDSS). 2009.
  • 3Xiong X, Tian D, Liu P. Practical protection of kernel integrity for commodity OS from untrnsted extensions [ C ]//Proceedings of the 18th Annual Network and Distributed System Security Symposium(NDSS). San Diego, California. 2011.
  • 4Symantec awhost32 overflow [ EB/OL ]. http://www, cve. mitre, org/ cgi-bin/cvename, cgi? name = CVE-2011-3478.
  • 5Kaspersky klim5 buffer overflow[ EB/OL]. http://www, cve. mitre. org/cgi-bin/cvename, cgi? name = CVE-20094)449.
  • 6TrendMicro remote Vulnerability [ EB/OL ]. 2011. http://secunia. com/advisories/47114/.
  • 7姚洪波,尹亮,文伟平.基于FUZZING测试技术的Windows内核安全漏洞挖掘方法研究及应用[J].信息网络安全,2011(12):9-16. 被引量：4
  • 8Tian D, Zeng Q, wu D, et al. Kruiser: Semi-synchronized Non-bloc- king Concurrent Kernel Heap Buffer Overflow Monitoring [ C ]//Pro- ceedirtgs of the 18th Annum Network and Distributed System Security Symposium(NDSS) , California, USA, 2012.
  • 9IOCtrlFuzzer[EB/OL]. http://code, google, corrr/p/ioctlfuzzer/.
  • 10J Newsome, D Song. Dynamic taint analysis: Automatic detection, a-nalysis, and signature generation of exploit attacks on commodity soft- ware[ C ]//Proceedings of the Network and Distributed Systems Securi- ty Symposium, Feb. 2005.

二级参考文献13

  • 1邵林,张小松,苏恩标.一种基于fuzzing技术的漏洞发掘新思路[J].计算机应用研究,2009,26(3):1086-1088. 被引量：17
  • 2NEWSOME J, SONG D. Dynamic taint analysis for automatic detection, analysis, and signature generation of exploits on commodity software [ D]. Pittsburgh: Carnegie Mellon University, School of Computer Science, 2005.
  • 3SUH G E, LEE J W, ZHANG D, et al. Secure program execution via dynarnie information flow tracking [ C]// ASPLOS-XI: Proceedings of the 11 th International Conference on Architectural Support for Programming Languages and Operating Systems. New York: ACM, 2004:85-96.
  • 4KONG JINGFEI, ZOU C C, ZHOU HUIYANG. Improving software security via rumime instruction-level taint checking [ C]// ASID '06: Proceedings of the 1st Workshop on Architectural Support for Programming Languages and Operating Systems. New York: ACM, 2006:18 - 24.
  • 5NGUYEN-TUONG A, GUARNIERI S, GREENE D, et al. Automatically hardening Web applications using precise tainting [ J]. IFIP Advances in Information and Communication Technology, 2005, 181(10) : 295 -307.
  • 6LEEK T R, BAKER G Z, BROWN R E, et al. Coverage maximization using dynamic taint tracing, TR-I 112 [ R]. Lexington, Massachusetts, US: MIT Lincoln Laboratory, 2007.
  • 7KANG M G, POOSANKAM P, YIN H. Renovo: a hidden code extractor for packed executables [ C]//WORM 07: Proceedings of the 2007 ACM Workshop on Recurring Malcode. New York: ACM, 2007: 46 - 53.
  • 8YIN H, SONG D, EGELE M, et al. Panorama: capturing systemwide information flow for malware detection and analysis [ C]// CCS '07: Proceedings of the 14th ACM Conference on Computer and Communications Security. New York: ACM, 2007:116 - 127.
  • 9YIN H, LIANG Z, SONG D. HookFinder: identifying and understanding malware hooking behaviors [ C]// NDSS 2008: Proceedings of the Network & Distributed System Security Symposium. San Diego, Califomia: [s.n], 2008: 16-23.
  • 10BRUMLEY D, HARTWIG C, LIANG Z, et al. Automatically identifying trigger-based behavior in malware [ J]. Botnet Detection, 2008, 36(5): 65 -88.

共引文献10

计算机应用与软件
2015年 第5期

相关作者

内容加载中请稍等...

相关机构

内容加载中请稍等...

相关主题

内容加载中请稍等...

浏览历史

内容加载中请稍等...
;
使用帮助 返回顶部