针对ROP攻击的动态运行时检测系统  

Dynamic Runtime Detection System for Return-oriented Programming Attack

作　　者：韩浩[1,2] 茅兵[1,2] 谢立[1,2] 

机构地区：[1]南京大学计算机软件新技术国家重点实验室,南京210093 [2]南京大学计算机科学与技术系,南京210093

出　　处：《计算机工程》2012年第4期122-125,共4页Computer Engineering

基　　金：国家自然科学基金资助项目(61073027;90818022;60721002);国家"973"计划基金资助项目(2009CB320705)

摘　　要：根据面向返回的编程(ROP)攻击及其变种的攻击原理,设计一个针对ROP攻击的动态运行时检测系统。该系统包括静态插桩和动态运行监控2个阶段。静态插桩为待检测程序装配分析代码,动态运行利用ret完整性检测、call完整性检测和jmp完整性检测方法分析程序的控制流和数据流,判断是否为ROP攻击。实验结果表明,该方法能完全检测出ROP恶意代码。Return-oriented Programming（ROP） is a new attack based on code-reuse technique. This paper proposes a dynamic runtime detection system for return-oriented programming attack, studies the intrinsic nature of ROP and its variant. According to these nature, it designs ret integrity checking, call integrity checking and jmp integrity checking. The detecting system is implemented to static instrument and dynamic run-time checking. Static instrumentassemble the analysis code into the program to be detected and dynamic run-time checking do the real detection with the three integrity checking. Preliminary experimental results show that the method can efficiently detect ROP malicious code and have no false positives and negatives.

关 键 词：面向返回的编程 恶意代码 ROP检测 JOP检测 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]