| With the development of network security technology,software vulnerability security problems emerge in an endless stream.For vulnerability exploitation detection,control flow integrity detection technology has become one of the important methods.In recent years,with the application of deep learning in the field of control flow integrity detection,the research results have gradually improved,but some time sequential features and structural features of control flow are still ignored.The extracted features are not deep enough and cannot mine long sequence control flow features,and related anomaly detection models are under exploration.With the help of program dynamic monitoring technology based on Intel processor trace,this thesis completes the extraction and decoding of the control flow data packets through the processor hardware,and restores the execution sequence of the control flow basic block when the program is running,including the vulnerability exploitation process.Aiming at the problem that control flow feature extraction is not deep enough,this thesis combines graph neural network and basic block feature extraction,and proposes a basic block sequential feature vectorization algorithm based on Deep Walk.This method improves the walking strategy according to the characteristics of basic block sequence,extracts some structural features and sequential features of basic block sequence,and completes the sequential feature vectorization of basic block nodes.In addition,a basic block structural feature vectorization algorithm based on GraphSAGE is also proposed.The basic block abstract coding algorithm is used to combine the frequency features and attribute features of the basic block,and uses the unsupervised sample and aggregate algorithm to complete structural feature vectorization of basic block nodes.Aiming at the problem that long sequence features are not obvious enough,this thesis combines recurrent neural network and control flow anomaly detection,and proposes a multi-scale bidirectional long short term memory network model,which increases the detection accuracy.This thesis completes the experimental verification for Adobe Reader software,including the traditional machine learning comparison experiment,the feature extraction comparison experiment based on graph neural network,and the control flow integrity detection comparison experiment.Experiments show that control flow integrity detection model in this thesis has the characteristics of high precision,high recall rate,and low false positive rate.The abnormal score test and control flow coverage test also achieved good results. |
