摘要
针对恶意篡改程序控制流攻击方式,提出一种监控程序控制流完整性的方法。对程序源代码进行扫描,以函数作为识别程序行为的基本粒子,利用函数调用执行的序列信息,建立表现程序原意的行为轨迹模型,利用该模型在运行期监控程序的执行流程。实验结果表明,该方法对篡改控制流的攻击起到了很好的防御作用。
Current software attacks often build on exploits that subvert machine-code execution. This paper proposes a new signature monitoring technique to enhance the control-flow integrity of program. It uses the execution of function as the basic item of the control-flow of the program. To get more exact intent of program, it scans the source code. and gets the information of function call sequence. According to the information, the model of program＇s intent can be built. The model is used to monitor the program in runtime. Experimental results show the monitoring system makes the program more secure to reject the control-flow attacks.
出处
《计算机工程》
CAS
CSCD
北大核心
2009年第9期133-135,共3页
Computer Engineering
基金
国家自然科学基金资助项目"操作系统的安全结构及其在单向网关上的应用"(60473099)
国家"863"计划基金资助项目"分布式可信计算系统研究"(2007AA01Z409)
关键词
程序控制流
源代码
函数调用序列
program control-flow
source code
function call sequence
