一种基于DBI的ROP攻击检测

ROP Attack Detecting Method Based on DBI

随着Return-Oriented Programming(ROP)思想的提出,程序安全面临新的挑战。ROP攻击操作粒度细致,特征隐蔽,构造精巧,静态特征稀少,因此传统的安全防御措施很难对之有效。在这种背景下,利用执行时的动态特征去识别、防御ROP攻击变得非常重要。Dynamic Binary Instrumentation(DBI)技术的引入,为ROP攻击动态特性分析提供了有力的支持。介绍一种利用DBI分析技术识别ROP攻击序列的方法,即通过识别恶意的程序执行流,约束库函数的调用规范,来检测ROP攻击。与此同时,还设计了一套可扩展的程序防御框架,用于检测程序的扩展,由此说明该检测工具的通用性与可扩展性。

As the promotion of the idea of return-oriented programming（ROP）,programs will face many new kinds of challenges from virus programs.With fine granularity,covert virus features,deliberate and sophisticated construction and rare static characteristics,ROP attack can circumvent many traditional defending measures.Under this circumstances,it’s imperative to discover the dynamic features of ROP attack program,identify its characteristics and defend it when it is executed.At this time,introducing the technology of dynamic binary instrumentation provides powerful support for dynamic analysis of ROP attack.We introduced a defending measure to ROP attack with the help of DBI technology.By identifying malicious program execution flow and restricting the call specification of libraries,we detected ROP attack.Furthermore,we designed an extensible defending framework over ROP attack to prove the generality and portability of our detect tool.