CN114707143B - Method and device for monitoring memory data corruption attacks - Google Patents

Abstract

The present invention provides a method and device for monitoring memory data corruption attacks, the method comprising: statically analyzing memory data to obtain key data; inserting a label check instruction before a memory read instruction, a function call instruction, and a function return instruction of the memory data, and inserting a label setting instruction before a memory write instruction of the memory data, to obtain an executable file of the memory data; executing the executable file, and performing label checks according to the label check instructions of the memory read instruction, the function call instruction, and the function return instruction of the key data. The present invention locks key data in memory data, reduces the amount of protected data, and proposes a data flow integrity defense mechanism based on key data, so that memory data corruption attacks can be more efficiently monitored when the program is running.

Description

Method and device for monitoring memory data corruption attacks

Technical Field

The present invention relates to the field of computer technology, and in particular to a method and device for monitoring memory data corruption attacks.

Background Art

Programs written in C/C++ languages may have various memory vulnerabilities. Memory vulnerabilities refer to the time or space errors in the operation of memory by programmers during the software writing process, which may cause the program to behave in a manner that violates the program's design. Attackers trigger these vulnerabilities to leak or modify memory data, and then carry out various attacks, causing serious harm.

Common attacks include return-oriented programming (ROP) attacks, jump-oriented programming (JOP) attacks, and data-oriented programming (DOP) attacks. ROP attackers put the addresses of a series of accessories into the stack. When the CPU runs to Return, it will take out the first address and jump to this accessory to start execution. When the first accessory is finished executing, the Return instruction at the end will take out the second address and jump to the second accessory to start execution. This cycle is repeated to construct any malicious behavior. JOP attacks use code fragments ending with jump as accessories, and use jump as a connection between different accessories. The data on the stack is controlled through stack overflow, and then the pop instruction is used to pop the data on the stack into the general register. By modifying the memory data, the load instruction is used to store the memory data in the general register. DOP attacks modify the data variables involved in the operation through memory vulnerabilities, such as library function parameters, loop parameters, conditional branch parameters, etc., to complete malicious attacks without changing the control flow.

The key point of these attacks is to damage memory data at runtime and read and write it arbitrarily. Currently, the Data Flow Integrity (DFI) mechanism is often used as the mainstream technology to protect memory data at runtime, detect abnormal behavior of the program, and prevent such attacks. However, since the DFI mechanism protects all memory data, it uses an over-approximate analysis process to obtain the legal write set of the data. There will be redundant information, and it is difficult to ensure accuracy, which weakens security. When the program is running, due to the design of the label checking mechanism, it will bring huge memory overhead and performance loss.

Summary of the invention

The present invention provides a method for monitoring memory data corruption attacks, which is used to solve the defects of insufficient security and huge performance overhead in the prior art and realize efficient monitoring of memory data corruption attacks.

The present invention provides a method for monitoring memory data corruption attacks, comprising:

Perform static analysis on memory data to obtain key data;

Inserting a label checking instruction before a memory read instruction, a function call instruction, and a function return instruction of the memory data, and inserting a label setting instruction before a memory write instruction of the memory data, to obtain an executable file of the memory data;

The executable file is executed, and a label check is performed according to the label check instructions of the memory read instruction, the function call instruction and the function return instruction of the key data.

According to a method for monitoring memory data corruption attacks provided by the present invention, the step of performing static analysis on memory data to obtain key data includes:

Performing data flow analysis on the memory data to obtain initial key data;

Performing control flow analysis and pointer analysis on the initial key data to obtain precise key data, wherein the precise key data includes control flow information and pointer pointing information of the initial key data;

The key data is obtained by performing key data propagation analysis based on the data dependency relationship between the initial key data and the precise key data.

According to a method for monitoring memory data corruption attacks provided by the present invention, the initial key data includes three categories, namely:

Pointers that have been operated on and parameters of vulnerable functions;

User input and external data received in web applications;

Conditional branch parameters, loop judgment parameters, library function parameters, system call parameters, function pointers, indirect call target address and return address.

According to a memory data corruption attack monitoring method provided by the present invention, the control flow analysis and pointer analysis of the initial key data are performed to obtain accurate key data, including:

The control flow information is obtained by using control flow analysis on the initial key data, wherein the control flow information includes a program execution process within a process and a function jump process between processes;

Using pointer analysis on the control flow information to obtain the pointer pointing information;

The pointer in the initial key data is replaced by the target set pointed to by the pointer pointing information to obtain accurate key data.

According to a memory data corruption attack monitoring method provided by the present invention, the pointer analysis adopts the Anderson pointer analysis algorithm.

According to a memory data corruption attack monitoring method provided by the present invention, a tag check is performed according to a tag check instruction of the memory read instruction, including:

If the runtime tag of the key data of the memory read instruction is consistent with the legal tag, no attack is found; if they are inconsistent, an attack is found.

The present invention also provides a monitoring device for memory data corruption attacks, comprising:

Static analysis module, used to perform static analysis on memory data to obtain key data;

A code stub module, used for inserting a label check instruction before a memory read instruction, a function call instruction and a function return instruction of the memory data, and inserting a label setting instruction before a memory write instruction of the memory data, so as to obtain an executable file of the memory data;

The tag checking module is used to execute the executable file and perform tag checking according to the tag checking instructions of the memory read instructions, function call instructions and function return instructions of the key data.

The present invention also provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, a method for monitoring memory data corruption attacks as described in any one of the above is implemented.

The present invention also provides a non-transitory computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the method for monitoring memory data corruption attacks as described in any one of the above is implemented.

The present invention also provides a computer program product, comprising a computer program, wherein when the computer program is executed by a processor, the computer program implements any of the above-mentioned methods for monitoring memory data corruption attacks.

The present invention provides a method and device for monitoring memory data corruption attacks, which lock key data in memory data, reduce the amount of protected data, and propose a data flow integrity defense mechanism based on key data, so as to more efficiently monitor memory data corruption attacks when the program is running.

BRIEF DESCRIPTION OF THE DRAWINGS

In order to more clearly illustrate the technical solutions in the present invention or the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

FIG1 is a flow chart of a method for monitoring memory data corruption attacks provided by the present invention;

FIG2 is a schematic diagram of a static analysis process provided by the present invention;

FIG3 is a schematic diagram of the flow of control flow analysis and pointer analysis provided by the present invention;

FIG. 4 is a schematic diagram of an attack detection example provided by the present invention

FIG5 is a second flow chart of the method for monitoring memory data corruption attacks provided by the present invention;

6 is a schematic diagram of the structure of a monitoring device for memory data corruption attacks provided by the present invention;

FIG. 7 is a schematic diagram of the structure of an electronic device provided by the present invention.

DETAILED DESCRIPTION

In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution of the present invention will be clearly and completely described below in conjunction with the drawings of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

ROP: Return-oriented programming uses code snippets ending with ret as accessories, combined with the control of stack space, using ret as the connection between different accessories, and continuously allowing the program to run these accessories. When the program executes a Return, the CPU takes an address from the current stack and jumps to the code pointed to by this address to start running.

DOP: Data-oriented programming attacks modify data variables involved in operations through memory vulnerabilities, such as library function parameters, loop parameters, conditional branch parameters, etc., to complete malicious attacks without changing the control flow.

JOP: Jump-oriented programming uses code snippets ending with jump as accessories, and uses jump as the connection between different accessories. The data on the stack is controlled by stack overflow, and then the data on the stack is popped into the general register using the pop instruction. The memory data is modified and the load instruction is used to store the memory data into the general register.

DFI: The data flow integrity defense mechanism obtains the legal write set of data through static analysis, and uses code instrumentation to instrument the memory read and write instructions of the data to obtain an executable file. When the program is running, the label of the memory write instruction is calculated in real time; when encountering a memory read instruction, a label check is performed, that is, checking whether the label value of the memory write corresponding to the memory read instruction is in the legal write set obtained by static analysis. If it is, the execution continues; if not, it means that the data has been illegally damaged and abnormal behavior has occurred, and the program execution is terminated.

The fundamental problem of the data flow integrity defense mechanism is that there is too much data to be protected. For memory data corruption attacks, some data is necessary for the attack. If these data are not controlled, the attack cannot be carried out. Therefore, only by protecting these data from being controlled can the attack be impossible. Through the study of current memory attack and defense, the present invention clarifies the key data related to memory data corruption attacks, and only by protecting the key data can the memory data corruption attacks be effectively defended.

The following describes the memory data corruption attack monitoring method of the present invention in conjunction with FIG. 1 to FIG. 3. The method comprises the following steps:

Step 101: Perform static analysis on memory data to obtain key data;

Step 102: insert a label check instruction before a memory read instruction, a function call instruction, and a function return instruction of the memory data, and insert a label setting instruction before a memory write instruction of the memory data, to obtain an executable file of the memory data;

It should be noted that the purpose of setting the label instruction for the memory write instruction stub is to obtain the runtime label.

Step 103: execute the executable file, and perform label checking according to the label checking instructions of the memory read instructions, function call instructions, and function return instructions of the key data.

It should be noted that the objects of the execution label check instruction are, for example, parameters of vulnerable functions, pointers that have been operated on, conditional branch parameters, etc.

A method for monitoring memory data corruption attacks provided by an embodiment of the present invention locks key data in memory data, reduces the amount of protected data, and proposes a data flow integrity defense mechanism based on key data, so as to more efficiently monitor memory data corruption attacks when the program is running.

In at least one embodiment of the present invention, the tag checking according to the tag checking instruction of the memory read instruction includes:

If the critical data runtime tag of the memory read instruction is consistent with the legal tag, no attack is found and the execution continues; if they are inconsistent, an attack is found and the execution stops.

In at least one embodiment of the present invention, the performing label checking according to the label checking instructions of the function return instruction and the function call instruction comprises:

For the function return instruction, a label is added to the function header to protect the function pointer, and an instruction to check the label is added to the end of the function. If the label of the function return instruction is consistent with the label protecting the function pointer when it is executed, no attack is found; if they are inconsistent, an attack is found.

For the function call instruction, if the runtime label of the function pointer of the indirect call instruction is in the corresponding legal label, no attack is found; if not, an attack is found.

In at least one embodiment of the present invention, the step of performing static analysis on the memory data to obtain key data includes:

Step 201: Perform data flow analysis on the memory data to obtain initial key data;

It should be noted that the initial key data is obtained after data flow analysis is performed at the Abstract Syntax Tree (AST) layer of the LLVM front-end Clang compiler. During the syntax analysis process of compilation, LLVM generates a relatively complete abstract syntax tree for the program, marks variables and functions according to their types, and analyzes the assignment operations to obtain the corresponding data flow information. The class Clang Plug in AST Visitor is defined, and each node is recursively visited by inheriting the class Recursive AST Visitor. Each Decl node is processed by the VisitDecl function, and each Stmt node is processed by the VisitStmt function to obtain variable information and data flow transmission relationships.

Step 202: Perform control flow analysis and pointer analysis on the initial key data to obtain precise key data, where the precise key data includes control flow information and pointer pointing information of the initial key data;

It should be noted that the control flow analysis is used to determine the execution flow of each function of the program and the calling relationship between procedures, that is, to obtain the control flow information of the program. The analysis is performed in basic blocks. There are several instructions in each basic block. The basic block is executed continuously from the first instruction to the last instruction. The basic block ends with a jump instruction or a return instruction. By establishing the relationship between the pointer and the address of the variable it points to, the target set pointed by the pointer is obtained, and the pointer in the data flow is replaced with the target pointed to. The variables pointed to by the same pointer in this step use the same label. .

Step 203: Perform key data propagation analysis based on the data dependency relationship between the initial key data and the precise key data to obtain the key data.

It should be noted that due to the dependency between data, key data is tracked, possible execution paths of the program are detected, and the status of the current operation is identified. The data that affects the key data is found and expanded to obtain the final key data.

Specifically, the expansion is performed with the aid of a LogicBlox simulation program.

The existing DFI mechanism does not analyze the dependencies between data and the control flow of the program, resulting in inaccurate pointer analysis, etc. However, in the embodiments of the present invention, since the analysis object is only key data, a more accurate analysis process can be adopted without introducing higher performance overhead, such as complete control flow analysis and analysis of dependencies between data.

In at least one embodiment of the present invention, the initial key data includes three categories, namely:

Pointers that have been operated on and parameters of vulnerable functions;

User input and external data received in web applications;

Conditional branch parameters, loop judgment parameters, library function parameters, system call parameters, function pointers, indirect call target address and return address.

It should be noted that the key data in the embodiment of the present invention includes 3 categories and 11 types, as shown in Table 1:

Table 1

In at least one embodiment of the present invention, the performing data flow analysis on the memory data to obtain the initial key data, wherein the performing data flow analysis on each line of source code includes:

If a pointer variable is used as the result of an operation, mark it as Unsafe data;

Determine whether the function is in the vulnerable function set. If so, define its parameter as Unsafedata.

Determine whether the function is a user input function or a function used to receive external data in a network application. If so, define its parameters as input data.

By processing the function call statement, determine whether it is a library function or a system call. If so, define its parameters as Exploit data;

By extracting the left and right subtrees of the assignment statement, we can obtain the data flow transfer relationship and the read and write relationship of the variable, especially the pointer, array, and structure assignment operations. If it is a function pointer, it is the Exploit data;

By processing the conditional branch statement, if it is a child node of a loop or judgment conditional branch statement, the variable is the Exploit data.

In at least one embodiment of the present invention, performing control flow analysis and pointer analysis on the initial key data to obtain accurate key data includes:

Step 301: Use control flow analysis to obtain the control flow information for the initial key data, where the control flow information includes the program execution process within the process and the function jump process between processes;

It should be noted that control flow analysis is used to analyze branch instructions branch, switch and jump instructions call, ret and other instructions to obtain control flow information, and further obtain the data transfer process and function jump process.

Step 302: Use pointer analysis to obtain the pointer pointing information for the control flow information;

It should be noted that pointer analysis is used to analyze the pointer, establish the relationship between the pointer and the variable address it points to, and obtain the target set pointed to by the pointer.

Step 303: Replace the pointer in the initial key data with the target set pointed to by the pointer pointing information to obtain accurate key data.

In at least one embodiment of the present invention, the pointer analysis uses Anderson pointer analysis algorithm.

It should be noted that the Andersen pointer analysis algorithm is used to mark and track pointers or references in the code, find out the possible target set of pointers in the program, and use the same label for variables pointed to by the same pointer. The analysis objects of the Anderson pointer analysis algorithm include Unsafe data, as well as identifying indirect call target addresses, return addresses and other Exploit data.

In at least one embodiment of the present invention, since the number of tags is related to data classification, the tag bit of the tag is 3 bits.

It should be noted that the existing DFI uses 16 bits as tag bits. The present invention designs 3-bit tag bits according to the different roles of data in memory attacks and the categories of key data, which greatly reduces space overhead and reduces performance loss during operation.

In at least one embodiment of the present invention, since the key data is divided into three categories according to the different roles of the data in the memory attack and the category of each data can be determined by static analysis, the malicious behavior of the attacker will change the category of the data, thereby generating anomalies. Therefore, it is necessary to design labels according to the categories of the key data.

Specifically, the runtime label and legal label are represented by three bits of binary:

001: indicates that the data is Unsafe data

010: Indicates that this data is Exploited data

100: indicates that the data is input data

The final data label value is the sum of the three. Common variable labels are all represented by 000.

This embodiment discloses a piece of actual code for attack detection:

1: int main(){

2: char* dfibuf;

3: char buffer[1024];

4: socketConnet();

5: read(client_sockfd, buffer, 1024);

6: static void (*pfun2) ();

7: static void (*pfun1) ();

8: static char*tmpfile, aa[16], *tmpfile1;

9: static void (*pfun) ();

10: tmpfile = aa;

11: tmpfile1 = aa;

12: static char bb[16];

13: static void (*pfun3) ();

14: pfun = pPp;

15: memcpy(aa, buffer, 32);

16: (*pfun)();

17:}

FIG4 is a schematic diagram of an attack detection example of an embodiment of the present invention. Referring to FIG4 and the above code, it is determined through static analysis whether aa and pfun are Exploit data or aa is Unsafe data, and they are protected by adding labels and checking labels. Uninitialized static variables and global variables are both in the bss data segment, so the variable array aa and the function pointer *pfun are both stored in the bss segment. When the array aa is written in line 15, its label is set to 011 in the address label corresponding table. The function pointer *pfun is written in line 14, and the label is set to 010. The label of *pfun is checked during the reading of the function pointer in line 16. The legal label of *pfun is 010, but since the array aa overflows and covers the corresponding memory of *pfun, the label corresponding to the memory address of *pfun is 011 at this time, which does not belong to the legal label set, so an error is detected, an error is prompted, and the program is terminated.

As shown in FIG5 , a flow chart of a method for monitoring memory data corruption attacks provided by an embodiment of the present invention is provided. First, the source program is obtained. In the static analysis stage, multi-stage static data flow analysis is used to identify key data. In the code stub stage, the specific label value of each data is calculated based on the identified key data. The source code program is stubbed to implement the read and write check of the data label, insert the instruction to set the label before the memory write instruction, and insert a section of label check instructions before the memory read instruction. When encountering a function return instruction, add a label to the function header to protect the function pointer, and add a label check instruction to the end of the function to ensure that the return address has not been modified. For the function call instruction, information such as the function name and function parameters is obtained. For the function parameters, if it is an ordinary function call, the memory read and write in the function parameter passing process is stubbed, and if not, no operation is performed. In particular, for indirect call instructions, it is necessary to obtain the pointer pointing set of the indirect call function based on pointer analysis, find the legal label corresponding to each pointed function pointer, add a label check before the indirect call instruction, and finally obtain an executable file.

When running the executable file and encountering a memory write instruction, the corresponding runtime label is calculated and stored. When encountering a memory read instruction, the runtime label corresponding to the key data in the memory read instruction is obtained. Then the label is checked. If this label value is consistent with the legal label value obtained by static analysis, the program continues to execute; if not, an error is reported and the program execution is terminated. When encountering a function return instruction and a function call instruction, the corresponding label check operation is also performed.

The following is a description of the memory data corruption attack monitoring device provided by the present invention. The memory data corruption attack monitoring device described below and the memory data corruption attack monitoring method described above can be referred to each other. As shown in FIG6 , the memory data corruption attack monitoring device of the present invention includes:

Static analysis module 601, used to perform static analysis on memory data to obtain key data;

A code stub module 602 is used to insert a label check instruction before a memory read instruction, a function call instruction and a function return instruction of the memory data, and to insert a label setting instruction before a memory write instruction of the memory data, so as to obtain an executable file of the memory data;

The tag checking module 603 is used to execute the executable file and perform tag checking according to the tag checking instructions of the memory read instructions, function call instructions and function return instructions of the key data.

A monitoring device for memory data corruption attacks provided by an embodiment of the present invention locks key data in memory data, reduces the amount of protected data, and proposes a data flow integrity defense mechanism based on key data, so as to more efficiently monitor memory data corruption attacks when a program is running.

In at least one embodiment of the present invention, the tag checking according to the tag checking instruction of the memory read instruction includes:

If the runtime tag of the key data of the memory read instruction is consistent with the legal tag, no attack is found and the execution continues; if they are inconsistent, an attack is found and the execution stops.

In at least one embodiment of the present invention, the performing label checking according to the label checking instruction of the function call instruction and the function return instruction comprises:

For the function return instruction, a label is added to the function header to protect the function pointer, and an instruction to check the label is added to the end of the function. If the label of the function return instruction is consistent with the label protecting the function pointer when it is executed, no attack is found; if they are inconsistent, an attack is found.

For the function call instruction, if the label of the function pointer of the indirect call instruction is in the corresponding legal label, no attack is found; if not, an attack is found.

In at least one embodiment of the present invention, the step of performing static analysis on the memory data to obtain key data includes:

Performing data flow analysis on the memory data to obtain initial key data;

Performing control flow analysis and pointer analysis on the initial key data to obtain precise key data, wherein the precise key data includes control flow information and pointer pointing information of the initial key data;

The key data is obtained by performing key data propagation analysis based on the data dependency relationship between the initial key data and the precise key data.

In at least one embodiment of the present invention, the initial key data includes three categories, namely:

Pointers that have been operated on and parameters of vulnerable functions;

User input and external data received in web applications;

Conditional branch parameters, loop judgment parameters, library function parameters, system call parameters, function pointers, indirect call target address and return address.

In at least one embodiment of the present invention, the performing control flow analysis and pointer analysis on the initial key data to obtain accurate key data includes:

The control flow information is obtained by using control flow analysis on the initial key data, wherein the control flow information includes a program execution process within a process and a function jump process between processes;

Using pointer analysis on the control flow information to obtain the pointer pointing information;

The pointer in the initial key data is replaced by the target set pointed to by the pointer pointing information to obtain accurate key data.

In at least one embodiment of the present invention, the pointer analysis uses Anderson pointer analysis algorithm.

Compared with the prior art, the present invention adopts a more accurate multi-stage static analysis process, the analysis result is more accurate, and the redundant information is less. This embodiment uses RIPE and CVE-2002-1496 for security assessment. As shown in Table 2, the present invention can more effectively monitor memory data corruption attacks.

Table 2 RIPE monitoring results

Defense Mechanism Total number of attacks Successful defense number Successful monitoring rate DFI 850 663 78.00% The present invention 850 769 90.47%

Since the protection data set is reduced, the present invention is designed to reduce the frequency of runtime checks, thereby reducing the performance overhead during checks. The embodiment of the present invention is tested using SPEC2000, and as shown in Table 3, the overhead is about 10%.

Table 3 SPEC2000 evaluation results

FIG7 illustrates a schematic diagram of the physical structure of an electronic device. As shown in FIG7 , the electronic device may include: a processor 710, a communications interface 720, a memory 730, and a communication bus 740, wherein the processor 710, the communications interface 720, and the memory 730 communicate with each other through the communication bus 740. The processor 710 may call the logic instructions in the memory 730 to execute a method for monitoring memory data corruption attacks, the method comprising:

Perform static analysis on memory data to obtain key data;

Inserting a label checking instruction before a memory read instruction, a function call instruction, and a function return instruction of the memory data, and inserting a label setting instruction before a memory write instruction of the memory data, to obtain an executable file of the memory data;

The executable file is executed, and a label check is performed according to the label check instructions of the memory read instruction, the function call instruction and the function return instruction of the key data.

In addition, the logic instructions in the above-mentioned memory 730 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when it is sold or used as an independent product. Based on such an understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk and other media that can store program codes.

On the other hand, the present invention further provides a computer program product, the computer program product comprising a computer program, the computer program can be stored on a non-transitory computer-readable storage medium, when the computer program is executed by a processor, the computer can execute the memory data corruption attack monitoring method provided by the above methods, the method comprising:

Inserting a label checking instruction before a memory read instruction, a function call instruction, and a function return instruction of the memory data, and inserting a label setting instruction before a memory write instruction of the memory data, to obtain an executable file of the memory data;

The executable file is executed, and a label check is performed according to the label check instructions of the memory read instruction, the function call instruction and the function return instruction of the key data.

In another aspect, the present invention further provides a non-transitory computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the method for monitoring memory data corruption attacks provided by the above methods is implemented, and the method comprises:

Inserting a label checking instruction before a memory read instruction, a function call instruction, and a function return instruction of the memory data, and inserting a label setting instruction before a memory write instruction of the memory data, to obtain an executable file of the memory data;

The executable file is executed, and a label check is performed according to the label check instructions of the memory read instruction, the function call instruction and the function return instruction of the key data.

The device embodiments described above are only illustrative, wherein the units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place, or may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of this embodiment. Those of ordinary skill in the art may understand and implement it without creative work.

Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM/RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims (7)

1. The method for monitoring the damage attack of the memory data is characterized by comprising the following steps of:

Performing static analysis on the memory data to obtain key data;

Inserting a tag checking instruction before a memory reading instruction, a function calling instruction and a function returning instruction of the memory data, and inserting an instruction for setting a tag before a memory writing instruction of the memory data to obtain an executable file of the memory data;

executing the executable file, and performing tag inspection according to the memory read instruction, the function call instruction and the tag inspection instruction of the function return instruction of the key data;

the static analysis of the memory data to obtain key data includes:

performing data stream analysis on the memory data to obtain initial key data;

performing control flow analysis and pointer analysis on the initial key data to obtain accurate key data, wherein the accurate key data comprises control flow information and pointer pointing information of the initial key data;

Carrying out key data propagation analysis according to the data dependency relationship of the initial key data and the accurate key data to obtain the key data;

the initial key data comprises three types, namely:

The pointer that has operated through the operation and the parameter of the vulnerable function;

user input and external data received in the web application;

Conditional branch parameters, loop judgment parameters, library function parameters, system call parameters, function pointers, indirect call target addresses and return addresses;

the performing control flow analysis and pointer analysis on the initial key data to obtain accurate key data includes:

Adopting control flow analysis to the initial key data to obtain control flow information, wherein the control flow information comprises an intra-process program execution process and an inter-process function jump process;

pointer analysis is adopted on the control flow information to obtain pointer pointing information;

And replacing the pointer in the initial key data with the target set pointed in the pointer pointing information to obtain accurate key data.

2. The method for monitoring a memory data corruption attack of claim 1 wherein the pointer analysis employs an anderson pointer analysis algorithm.

3. The method for monitoring a memory data corruption attack according to claim 1 or 2, wherein the performing a tag check according to the tag check instruction of the memory read instruction comprises:

If the running time label of the key data of the memory read instruction is consistent with the legal label, no attack is found; if not, then an attack is found.

4. A device for monitoring a memory data corruption attack, comprising:

The static analysis module is used for carrying out static analysis on the memory data to obtain key data;

The code instrumentation module is used for inserting a tag checking instruction before a memory reading instruction, a function calling instruction and a function returning instruction of the memory data and inserting an instruction for setting a tag before a memory writing instruction of the memory data to obtain an executable file of the memory data;

The tag checking module is used for executing the executable file and checking the tag according to the tag checking instructions of the memory reading instruction, the function calling instruction and the function returning instruction of the key data;

the static analysis of the memory data to obtain key data includes:

performing data stream analysis on the memory data to obtain initial key data;

performing control flow analysis and pointer analysis on the initial key data to obtain accurate key data, wherein the accurate key data comprises control flow information and pointer pointing information of the initial key data;

Carrying out key data propagation analysis according to the data dependency relationship of the initial key data and the accurate key data to obtain the key data;

the initial key data comprises three types, namely:

The pointer that has operated through the operation and the parameter of the vulnerable function;

user input and external data received in the web application;

Conditional branch parameters, loop judgment parameters, library function parameters, system call parameters, function pointers, indirect call target addresses and return addresses;

the performing control flow analysis and pointer analysis on the initial key data to obtain accurate key data includes:

Adopting control flow analysis to the initial key data to obtain control flow information, wherein the control flow information comprises an intra-process program execution process and an inter-process function jump process;

pointer analysis is adopted on the control flow information to obtain pointer pointing information;

And replacing the pointer in the initial key data with the target set pointed in the pointer pointing information to obtain accurate key data.

5. An electronic device comprising a memory, a processor and a computer program stored on the memory and executable on the processor, wherein the processor implements a method of monitoring for a memory data corruption attack according to any one of claims 1 to 3 when executing the program.

6. A non-transitory computer readable storage medium having stored thereon a computer program, wherein the computer program when executed by a processor implements a method of monitoring for a memory data corruption attack according to any one of claims 1 to 3.

7. A computer program product comprising a computer program which, when executed by a processor, implements a method of monitoring for a memory data corruption attack according to any one of claims 1 to 3.