| With the development of computer technology,people’s daily needs for computer software are also increasing.With the rapid development and version iteration,it is difficult to avoid the introduction of software security vulnerabilities.In recent years,attacks using software security are common,which pose a great threat to personal privacy,property security and national security.To improve the discovery ability of the vulnerability exploiting process and the response speed to vulnerability attack events,this paper presents a vulnerability detection technology which is oriented to program control flow,low overhead,transparent and universal.Based on the processor trace characteristics and the idea of control flow integrity,this technology replaces the current commonly used dynamic instrumentation technology by introducing processor trace into the dynamic monitoring of programs to achieve efficient and transparent monitoring of program execution flow.According to the characteristics of processor trace technology,a dynamic-static combination of control-flow graph construction technology is designed to improve the integrity and detection efficiency of control-flow graph.With the idea of control flow integrity,the legitimacy of real-time control flow is detected,and the malicious code after the control flow hijacking attack is re-verified,which reduces the false alarm rate and detect common vulnerability utilization methods such as ROP,virtual table hijacking,ret2libc,ret2shellcode and so on precisely.Based on the above ideas,this paper implements a software vulnerability detection prototype system based on processor trace and control flow integrity.By testing the dynamic monitoring performance of several kinds of common software,it can be verified that it has low overhead and transparency compared with traditional user-state dynamic instrumentation technology.And through the detection of multiple types of software vulnerability exploiting technology,the detection accuracy for return address coverage attack types reaches 100%,and the detection accuracy for other types of attacks is above 94%,which proves that it can resist the common program control flow hijacking attacks,and has a certain resistance to some new types of attacks..In addition,through the detection and analysis of the real vulnerability exploiting process selected randomly,it is proved that the method proposed in this paper can detect vulnerability exploitation quickly,which is helpful to locate and analyze vulnerability attack events,and has high practical value. |
