KR101217546B1 - Method and system to detect and intercept heap spray attack based on realtime - Google Patents

Abstract

The present invention relates to a method and system that can detect and block heap spray attacks in real time. According to an aspect of the present invention, a method for real-time detection and blocking of a heap spray attack analyzes script code included in source code of a specific web page, and monitors whether the heap memory is changed by the script code. A monitoring step, a first analyzing step of determining whether the changed heap memory area includes a NOP sled when a change of the heap memory is detected, and an area of the changed heap memory is shelled when a change of the heap memory is detected. A second analysis step of determining whether to include a code, and an attack blocking step of converting and recording the changed area of the heap memory when both the first analysis step and the second analysis step are passed.

Description

METHOD AND SYSTEM TO DETECT AND INTERCEPT HEAP SPRAY ATTACK BASED ON REALTIME}

The present invention relates to a method and system that can detect and block a heap spray attack in real time, and more particularly, using a vulnerability code that is executed after manipulating a heap memory of a web browser in a specific pattern using a vulnerability of a web browser. The present invention relates to a real-time detection and blocking method and system that can detect a heap spray attack in real time and block it without affecting the user's web browser use.

As the use of the Internet becomes more common and the technology is developed, the number and types of attack codes that can be transmitted through the Internet are also diversified and developed. Among them, the most vulnerable and the most target of attack are attack code exploiting vulnerabilities of web browser. Among them, 0-day attack is a method of attacking web browser vulnerabilities using script language. Since the web browser's vulnerability attack method can be written in a scripting language such as JavaScript, anyone can easily copy and use it. Therefore, anyone can easily propagate the attack code without the expert knowledge. There is a problem.

More specifically, most of these attack codes are attacked in two stages. First, through the memory manipulation of the web browser, the pattern of the combination of No-Operation (Sled) and Shellcode (Shellcode) is applied to the heap of the target system. Heap spray attack (including the first step of loading into the heap memory and the second step of branching the program to the address of the heap memory using a vulnerability in the web browser to execute shellcode placed after NOP Sled) Also called Heap Spray Attack. Here, NOP Sled refers to a continuous array of no-operations that do virtually no function, and shellcode refers to code written for the purpose of acquiring the system among codes consisting of a series of computer program instructions. If the code is run on a particular system, the attacker could gain privileges on that system. Also, heap memory refers to a large amount of free memory that can be used by a program. If heap memory is loaded with NOP Sled and shellcode, as shown in area A in FIG. Or, if the thread execution is branched somewhere in the area A of the heap memory, it executes shellcode that finally acquires the system authority through the NOP Sled.

As such, the scripting language is widely used as an attack code for manipulating the memory of the web browser and finally executing the shellcode, and the code written in Javascript or Visual Basic Script is especially used without installing a special application in the web browser. It has a viable feature. In this regard, since a web browser can load most file objects available in an operating system containing an ActiveX object, attack code written in the scripting language embedded in a web page is not only a vulnerability that exists in the web browser, but also a web browser. Loadable objects from can also be targeted.

As an example of the prior art for preventing the damage caused by the attack code, a signature of the attack code is created, and then a method of blocking the file when an attack code matching the signature pattern is found is proposed. However, such a conventional attack code prevention technique is not particularly specialized for a heap spray attack, but targets script code that is determined to be an attack code, and thus has been particularly weak in a heap spray attack. In addition, detection is based on the signature pattern of script code rather than behavior-based detection, so signatures for individual attack codes cannot be detected or blocked because new signatures or similar variants of the signature code do not exist. There is a difficulty to fill out. In addition, even in the case of an attack code in which a signature already exists, there is a problem that the signature that was previously created cannot be detected when the attack code is encrypted or manipulated.

In addition, as another example of the prior art, a method of determining a heap spray attack and blocking the execution of a web browser when one or more sub-regions having the same size are continuously positioned using the features of the heap spray attack has been proposed. However, since successive subregions with the same size can often exist in the course of normal and normal program execution, the accuracy of detection of the heap spray attack is greatly reduced when judged as an attack simply because it is similar to the characteristics of the heap spray attack. Problems that are more likely to be misdiagnosed can cause problems. In addition, since the conventional method of determining the heap spray attack is only a passive method of blocking the execution of the web browser, that is, stopping the execution of the web browser, it may cause a great concern for users who are unfamiliar with the technical content. Even if the user visits a normal web page due to the fall, there is a problem that the execution of the web browser is likely to be terminated.

An object of the present invention is to solve the above-mentioned problems of the prior art.

One object of the present invention is to monitor the heap memory of the web browser in real time to determine the presence of both NOP Sled and shellcode to provide a higher accuracy when detecting a heap spray attack.

In addition, another object of the present invention is to block the heap spray attack by converting the shellcode when the heap spray attack is detected, while allowing the user to visit the web page normally without ending the execution of the web browser, the user can use the web browser without inconvenience To make it possible.

In order to achieve the above-described object of the present invention and to achieve the specific effects of the present invention described below, the characteristic structure of the present invention is as follows.

According to an aspect of the present invention, a method for real-time detection and blocking of a heap spray attack analyzes script code included in source code of a specific web page, and monitors whether the heap memory is changed by the script code. A monitoring step, a first analyzing step of determining whether the changed heap memory area includes a NOP sled when a change of the heap memory is detected, and an area of the changed heap memory is shelled when a change of the heap memory is detected. And a second analysis step for determining whether to include a code, and an attack blocking step for converting and writing the changed region of the heap memory when both the first analysis step and the second analysis step are passed.

According to another aspect of the present invention, a real-time detection and blocking system of a heap spray attack analyzes script code included in source code of a specific web page and monitors whether the heap memory is changed by the script code. A heap memory monitoring unit, a first analysis module that determines whether the changed heap memory area includes NOP Sled when a change of the heap memory is detected, and an area of the changed heap memory when a change of the heap memory is detected Heap memory analysis unit including a second analysis module for determining whether to include shell code, and a heap spray attack blocking for converting and recording the changed region of the heap memory when passing both the first analysis step and the second analysis step Contains wealth.

As described above, according to the present invention, since the presence of both NOP Sled and shellcode is determined while monitoring the heap memory of the web browser in real time, a higher accuracy rate can be provided when the heap spray attack is detected.

In addition, according to the present invention, while blocking the heap spray attack by converting the shellcode when the heap spray attack is detected, the user can visit the web page normally without ending the execution of the web browser so that the user can use the web browser without inconvenience. have.

1 is a diagram illustrating a heap memory structure and a state of a heap memory area due to a heap spray attack according to an embodiment of the present invention.
2 is a view schematically showing the configuration of a real-time detection and blocking system of a heap spray attack according to an embodiment of the present invention.
3 illustrates a heap memory write pattern for a heap spray attack according to an embodiment of the present invention.
4 is a diagram illustrating a form of memory change by a heap spray blocking method according to an embodiment of the present invention.
5 is a diagram illustrating one embodiment of a heap spray attack detection method according to an embodiment of the present invention.
6 is an operation flowchart according to an embodiment of the present invention.

DETAILED DESCRIPTION The following detailed description of the invention refers to the accompanying drawings that show, by way of illustration, specific embodiments in which the invention may be practiced. These embodiments are described in sufficient detail to enable those skilled in the art to practice the invention. It should be understood that the various embodiments of the present invention are different, but need not be mutually exclusive. For example, certain features, structures, and characteristics described herein may be implemented in other embodiments without departing from the spirit and scope of the invention in connection with an embodiment. It is also to be understood that the position or arrangement of the individual components within each disclosed embodiment may be varied without departing from the spirit and scope of the invention. Accordingly, the following detailed description is not to be taken in a limiting sense, and the scope of the present invention is defined only by the appended claims, along with the full range of equivalents to which such claims are entitled. In the drawings, like reference numerals refer to the same or similar functions throughout the several views.

Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the accompanying drawings, so that those skilled in the art can easily carry out the present invention.

[Preferred Embodiment of the Present Invention]

In an embodiment of the present invention, the term "web page" refers to a passive or active document that can be viewed or loaded through the World Wide Web, directly or indirectly, using a web browser program such as Internet Explorer. It should be interpreted in a broad sense that includes both the format or the object, and HTML (HyperText Markup Language) is mainly used as a file format of a web page, but is not limited thereto, either directly or through a web browser program. Any document type that can be viewed indirectly (including when connected to a plug-in or other separate program) or an object that can be loaded in a web browser can be a web page. In order to browse a web page using a web browser program, an address in which a web document is located is generally input as a URL, and HTTP (HyperText Transfer Protocol) is widely used as the address format, but is not limited thereto. Preferably, the web page may include a scripting language such as Javascript directly in the source code or indirectly in the form of file include, in which case the user accesses the webpage using a web browser. In this case, the web browser executes a script language included directly or indirectly in the source code of the received web page.

Complete system configuration

2 is a view schematically showing the configuration of a real-time detection and blocking system of a heap spray attack according to an embodiment of the present invention.

As illustrated in FIG. 2, the system includes a heap memory monitor 110, a heap memory analyzer 120, and a heap spray attack blocker 130.

First, according to an embodiment of the present invention, the heap memory monitoring unit 110 may operate together in the process of the web browser when the web browser is executed, and monitors the heap memory area of the web browser in real time. More specifically, the heap memory monitoring unit 110 analyzes the script code directly or indirectly included in a specific web page transmitted to the web browser when the web browser visits a specific web page, and transmits specific content to a predetermined region of the heap memory. Determines whether the command to record is executed. In this case, the heap memory monitoring unit 110 may further include a script engine analyzer (not shown) that may receive and analyze the script code. As a result of the analysis of the heap memory monitoring unit 110, when the script code determines that the specific data is written to the heap memory, the heap memory analyzing unit 120 notifies the fact. The heap memory monitor 110 may transmit the address of the heap memory region in which the script code records the specific data together with the fact notification to the heap memory analyzer 120.

In addition, according to an embodiment of the present invention, when the heap memory analyzer 120 is notified from the heap memory monitoring unit 110 of the fact that the specific data recording of the script code, the data recorded in the heap memory is subjected to a heap spray attack 3, it is determined whether the heap memory consists of a coupling pattern in which a series of NOP Sled regions appear first, followed by shellcode, as shown in FIG. It is not limited to any particular embodiment to identify whether the data recorded in the heap memory is recorded as a combined pattern of NOP Sled and shellcode for the purpose of the heap spray attack, and specific examples of the identification method will be described later. As a result of the determination, when the data recorded in the heap memory is recorded for the purpose of the heap spray attack, the heap spray attack warning detected by the heap spray attack blocking unit 130 is transmitted.

According to an embodiment of the present invention, when the heap spray attack blocking unit 130 receives the heap spray attack warning from the previous heap memory analyzer 120, the heap spray attack blocking unit 130 converts the shellcode among the data recorded in the heap memory. Blocks possible heap spray attacks. An example of a shellcode conversion method will be described with reference to FIG. 4, and the heap memory area A of FIG. 4A is an area recorded by the script code and is NOP Sled by the heap memory analyzer 120 for the purpose of a heap spray attack. It is already determined that the combination pattern of the region and the shellcode region is constituted. In this case, the heap spray attack blocking unit 130 converts and writes a shellcode area capable of attacking the system to another harmless OP CODE, so that even if the flow of execution is branched to the heap memory area A, the existing shellcode is Since it is incapacitated, it is only possible to execute the converted OP CODE and not be affected by the heap spray attack. As an example of a harmless OP CODE, an existing shellcode region can be converted to NOP as shown in FIG. 4B, where the flow of execution is prevented from moving out of region A recorded by the script code to another region such as B. For example, the flow of execution does not leave the region A by using an alternative to an OP CODE that performs a loop iteration at the end of the region A. By converting the shellcode into a harmless OP CODE before detection, even if the flow of execution diverges while the user visits the web pages using the web browser, the user may end the browser execution even if the heap spray attack is executed. This has the advantage that the user can use the functions of the visited webpage normally without any problem.

Hereinafter, according to an embodiment of the present invention, the data recorded in the heap memory in the heap memory analyzer 120 is recorded for the purpose of the heap spray attack, that is, the identification method for detecting the heap spray attack will be described in more detail. do.

NOP Sled  Identification method

As the first step of the identification method for detecting the heap spray attack, the heap memory analyzer 120 identifies whether the data recorded in the heap memory includes NOP Sled, and the specific steps are as follows.

First, the heap memory analyzer 120 checks whether data written by the script code in the heap memory, that is, data in the corresponding memory area is a valid OP CODE (Operation Code) (step 1). In this case, the OP CODE is a part of a machine language that can be directly decoded and executed by a central processing unit (CPU) of a computer, and means a code that designates an instruction to be executed. Since the specifications and format of the OP CODE may differ depending on the CPU and are shown in the instruction set, which is a set of all instructions that can be executed by the processor, the heap memory analyzer 120 may refer to the instruction set to refer to the corresponding memory. You can check whether the data in the area is a valid OP CODE included in the instruction set.

If it is determined that the OP code is valid in the first step, the heap memory analyzer 120 checks whether the data in the corresponding memory area includes a continuous array of OP codes that can be used as the NOP (step 2). . As described in the background art above, since NOP Sled means a continuous array of no-operations that do not function substantially, the heap memory analyzer 120 determines whether the OPP code can be used as a NOP in advance. You can also check whether it is a known NOP or not-For example, for Intel x86 CPUs, OP CODE such as 0x90 can be directly checked with NOP. Alternatively, in order to determine whether no function is performed as a result of the execution of the OP CODE, the OP CODEs of the corresponding memory area may be emulated to determine the result. As a result of the analysis, when OP codes that may be used as NOPs are continuously arranged on the heap memory, the heap memory analyzer 120 may determine that data in the corresponding memory area includes NOP Sled.

If it is determined through the second step that the data of the memory area includes the NOP Sled, the heap memory analyzer 120 emulates the OP CODE of the memory area to determine whether the flow of execution is delivered to the shellcode area. Determine (step 3). The goal of a heap spray attack is to execute a shellcode by finally branching to a shellcode region, so even if NOP Sled exists in that memory region, a heap spray is not delivered to the shellcode region. It is not intended to be an attack, but rather a record of heap memory following a normal process.

In addition, the heap memory analyzer 120 may determine whether data of the corresponding memory area supports an arbitrary starting point for execution (step 4). Specifically, referring to FIG. 5, the memory area illustrated in FIG. 5 is a NOP sled area having NOPs from a to f and a coupling pattern of g having an OP CODE corresponding to a shellcode. For example, even if the flow of execution starts by branching to any one of the starting points ①, ②, and ③, it is determined whether the first to third stages are satisfied, so that the memory area is more precisely for the purpose of the heap spray attack. It can be determined whether it has been recorded.

Shellcode  Identification method

As the second step of the identification method for the detection of the heap spray attack, the heap memory analyzer 120 identifies whether the area suspected of being shellcode in the data recorded in the heap memory is the shellcode for the heap spray attack. One embodiment of the specific method is as follows.

The heap memory analyzer 120 may check whether an area suspected of as a shellcode area is a valid OP CODE (step 5), and the test according to step 5 is performed in a similar manner to the first step of the above-described NOP sled. Can be.

If it is determined by the fifth step that the area suspected of being a shellcode area is a valid OP CODE, the heap memory analyzer 120 may determine that a shell in which the OP CODE described in the area suspected of being a shellcode area may be used for a heap spray attack. Determine if the code (step 6). The shellcode requires access to the system, so an example of such shellcode can be determined by checking whether the system API is called, such as creating a socket for external communication.

The above-described NOP Sled identification scheme and shellcode identification scheme over several steps are merely practical examples that can be used in the heap memory analyzer 120, and may be described by various methods according to the technical level of the related art and technical common knowledge of those skilled in the art. It should be appreciated that examples of the steps may be performed in part or in whole, or may be modified to perform the same or similar functions.

How to detect and block heap spray attacks

Next, a heap spray attack detection and blocking method according to an embodiment of the present invention will be described with reference to FIG. 6.

According to an exemplary embodiment illustrated in FIG. 6, when a user accesses a specific web page through a web browser by directly inputting a URL, selecting a bookmark, or clicking a hyperlink, the web browser may access the web. The source code of the page is received (S100).

When the source code of the web browser is received, if the script code is directly included in the source code or indirectly in the form of a file include, the corresponding script code is executed by the web browser (S110).

The heap memory monitoring unit 110 of the real-time detection and blocking system of the spray attack detects the step S110, which is the execution of the script code by the web browser, or the heap memory which can be used by the web browser when the user starts the web browser. When the area is monitored in real time and the script code detects that the specific data is recorded in the predetermined area of the heap memory, the heap memory analyzer 120 notifies the fact (S120). The heap memory monitor 110 may additionally transmit the address of the region where the heap memory records specific data to the heap memory analyzer 120 by script code.

When the heap memory analyzing unit 120 receives a notification from the heap memory monitoring unit 110, a combination pattern of NOP sled and shellcode in which specific data written to the heap memory is loaded for a heap spray attack in steps S130 and S140. Determine if it is

First, in step S130, it is determined whether the specific data recorded in the heap memory includes NOP Sled. As an embodiment of a method of determining whether a NOP sled is included, at least one or more of the first to fourth steps of the above-described NOP sled identification scheme may be performed, regardless of the order in which the identification scheme is performed. It will be apparent to those skilled in the art.

When the heap memory analyzer 120 confirms that the specific data recorded in the heap memory includes NOP Sled through step S130, the heap memory analyzer 120 determines whether the specific data recorded in the heap memory also includes shellcode (S130). S140). As an embodiment of a method of determining whether a shellcode is included, at least one or more of the fifth to sixth steps of the above-described shellcode identification scheme may be performed, regardless of the order of performing the identification scheme. It will be apparent to those skilled in the art.

The heap memory analyzer 120 detects the heap spray attack blocking unit 130 when the specific data recorded in the heap memory is a combined pattern of NOP sled and shellcode recorded for the heap spray attack in steps S130 through S140. The transmitted heap spray attack warning (S150). Simultaneously with the alert transmission, the heap memory analyzer 120 may additionally transmit the address of the memory region in which the combination pattern of NOP Sled and the shellcode is recorded, to the heap spray attack blocking unit 130 for the heap spray attack.

When the heap spray attack blocking unit 130 receives the heap spray attack warning from the heap memory analyzer 120, the heap spray attack blocking unit 130 blocks the heap spray attack by converting the shellcode among memory regions in which a combination of NOP Sled and shellcode is recorded. As an example of a method of converting a shell code, a method of converting a shell code into a harmless OP code such as a NOP may be used as described above.

Meanwhile, the embodiment illustrated in FIG. 6 corresponds to one process that may occur when a specific web page is visited using a web browser. The embodiment disclosed in FIG. 6 may be repeated every time a user visits a specific web page.

Embodiments according to the present invention may be implemented in the form of program instructions that can be executed through various computer means and recorded in a computer-readable medium. The computer readable medium may include program instructions, data files, data structures, etc. alone or in combination. The program instructions recorded on the medium may be those specially designed and constructed for the present invention or may be available to those skilled in the art of computer software. Examples of the computer-readable recording medium include magnetic media such as a hard disk, a floppy disk, and a magnetic tape; optical media such as CD-ROM and DVD; magnetic recording media such as a floppy disk; Includes hardware devices specifically configured to store and perform program instructions such as megneto-optical media and ROM, RAM, flash memory, and the like. Examples of program instructions include not only machine code generated by a compiler, but also high-level language code that can be executed by a computer using an interpreter or the like. The hardware devices described above may be configured to operate as one or more software modules to perform the operations of the present invention, and vice versa.

In the present invention as described above has been described by the specific embodiments, such as specific components and limited embodiments and drawings, but this is provided to help a more general understanding of the present invention, the present invention is not limited to the above embodiments. For those skilled in the art, various modifications and variations are possible from these descriptions.

Accordingly, the spirit of the present invention should not be construed as being limited to the embodiments described, and all of the equivalents or equivalents of the claims, as well as the following claims, belong to the scope of the present invention .

Claims (19)

In the real-time detection and blocking method of the heap spray attack,
Each step performed by a real-time detection and blocking system of heap spray attacks,
A watch step that monitors whether heap memory has changed,
A first analysis step of determining whether a changed region of the heap memory includes NOP Sled when a change of the heap memory is detected;
A second analysis step of determining whether a changed region of the heap memory includes shellcode when a change of the heap memory is detected;
And an attack blocking step of converting and recording the changed area of the heap memory when both the first analysis step and the second analysis step have passed.
The method according to claim 1,
The first analysis step,
Checking whether the changed heap memory area is a valid OP CODE; And
Detecting whether the changed heap memory area comprises a contiguous array of OP CODEs that can be used as NOP.
The method according to claim 2,
The first analysis step,
And emulating the OP CODE of the changed heap memory area to determine whether a flow of execution is delivered to a shellcode area.
The method according to claim 2 or 3,
The first analysis step,
Determining whether the modified heap memory region supports any starting point for execution.
The method according to claim 1,
The second analysis step,
And checking whether a region suspected to be a shellcode region among the changed heap memory regions is a valid OP CODE.
The method according to claim 5,
The second analysis step,
And determining whether an OP CODE of a region suspected of being a shellcode region among the changed heap memory regions is a shellcode that can be used for a heap spray attack.
The method of claim 6,
The shellcode that may be used for the heap spray attack includes an OP CODE that calls a system API.
The method according to claim 1,
The attack blocking step,
And converting the shellcode region into the NOP of the changed region of the heap memory and recording the same.
The method according to claim 8,
The attack blocking step,
And converting and recording at least one of the converted NOPs into a loop OP CODE for moving into an area of the changed heap memory.
In the real-time detection and blocking system of the heap spray attack,
A heap memory monitor that monitors whether heap memory has changed,
A first analysis module that determines whether the changed heap memory area includes NOP Sled when a change of the heap memory is detected, and determines whether the changed heap memory area includes shellcode when a change of the heap memory is detected A heap memory analysis unit including a second analysis module to perform
And a heap spray attack blocker for converting and recording the changed area of the heap memory when both the first analysis step and the second analysis step have passed.
The method of claim 10,
The first analysis module,
And a first analyzer to check whether the region of the changed heap memory is a valid OP CODE, and a second analyzer to check whether the region of the changed heap memory includes a continuous array of OP CODEs that can be used as a NOP. Detection and blocking systems.
The method of claim 11,
The first analysis module,
And a third analyzer configured to determine whether a flow of execution is delivered to a shellcode region by emulating the OP CODE of the changed heap memory region.
12. The method according to claim 11 or 12,
The first analysis module,
And a fourth analyzer configured to determine whether the changed heap memory area supports an arbitrary starting point for execution.
The method of claim 10,
The second analysis module,
And a fifth analyzing unit that checks whether a region suspected of being a shellcode region among the changed heap memory regions is a valid OP CODE.
The method according to claim 14,
The second analysis module,
And a sixth analyzer configured to determine whether the OP CODE of the suspected shellcode region of the changed heap memory region is a shellcode that can be used for a heap spray attack.
The method according to claim 15,
The shellcode that can be used for the heap spray attack includes an OP CODE that calls a system API.
The method of claim 10,
The hip spray attack blocking unit,
Detection and blocking system, characterized in that for converting the shell code area of the changed area of the heap memory to NOP.
18. The method of claim 17,
The hip spray attack blocking unit,
And converting and recording at least one of the converted NOPs into a loop OP CODE that moves into the changed area of the heap memory.
A computer-readable recording medium having recorded thereon a program for performing each step of the method according to claim 1 on a computer.

Images