KR101900813B1 - Apparatus and method for dynamic control-flow analysis for prescribing control-flow with Inputs generated from grammar - Google Patents

Abstract

An apparatus and method for dynamic control flow analysis for prescribing a control flow with inputs generated by a grammar are provided. The input generating apparatus expands a set of sentences, which is a set of sentences generated according to the context free grammar, to convert a special terminal of sentences into a meaningful string according to a rule for generating a string limited to an extended regular grammar. If an indirect branch instruction occurs while the program is being executed with the entire string containing the string as input, the legitimate control flow is analyzed and selected.

Description

TECHNICAL FIELD The present invention relates to a dynamic control flow analysis apparatus and method for prescribing a control flow using an input generated by a grammar,

The present invention relates to a dynamic control flow analysis apparatus and method for prescribing a control flow with an input generated by a grammar, and more particularly, to a dynamic control flow analysis apparatus and method for analyzing a sentence generated by a context free grammar and an extended regular grammar, To a dynamic control flow analysis apparatus and method capable of prescribing a proper control flow by using a converted character string as an input.

An attacked program runs out of normal control flow, executes an attack code injected by an attacker, or re-forms a control flow in an order that an attacker wants to execute a program command already in the system. The attacker changes the data value involved in the control flow to change the control flow of the program. Most of the data involved in the control flow attacks the code pointer of the address memory that contains the instruction address.

For example, programs are vulnerable to buffer overflow attacks if they do not have a safeguard that does not cross the array boundaries. In recent years, ROP [8, 9], an attack that reuses program commands residing in the system, is more threatening than directly inserting malicious code. An ROP attack can find a turing-complete gadget in the standard C library, allowing an attacker to program any work the system intends to do.

The existing defense methods presented to overcome these attacks are mostly overloaded with execution time and are not practical because of compatibility problems.

On the other hand, in terms of the control flow, the structure of the program is divided into two parts, one part for processing the expected normal input and the other part for handling the exceptional situation. Web servers, for example, are divided into two parts: normal tasks such as service request and response, and repetition of abnormal input or error situations. Static analysis can not distinguish between these two cases of control flow and judges all possible control flows as legitimate. The problem of this static analysis is that not only the part prepared for the exceptional situation can not cope with all cases but also the flow of the indirect branching command which is the limit of the static analysis is not completely complete . Therefore, the control flow information by static analysis is likely to be used for attack.

Domestic Registration No. 10-0965426 (Registered on June 15, 2010)

SUMMARY OF THE INVENTION In order to solve the above-described problems, the technical problem to be solved by the present invention is that only a part of a static analysis result is actually observed in comparison with a control flow of a normal web server, and other control flows occur in an external attack or an internal error situation , It does not occur inherently. Therefore, it is not necessary to consider all possible control flows as legitimate in the execution of programs requiring extreme safety or security, And to propose a dynamic control flow analysis apparatus and method for prescribing a control flow with an input generated by a grammar capable of improving security.

The solution of the present invention is not limited to those mentioned above, and other solutions not mentioned can be clearly understood by those skilled in the art from the following description.

According to an embodiment of the present invention, a dynamic control flow analysis apparatus for prescribing a control flow with input generated by a grammar includes a set of sentences generated according to a context free grammar An input generating device for expanding a sentence set and converting a special terminal of the sentences into a meaningful string according to a rule for generating a string limited by an extended normal grammar; And a control flow analyzing unit for analyzing and selecting a proper control flow when an intermediate branch instruction for executing a program is received and the entire string including the converted character string is inputted.

Wherein the input generating apparatus comprises: a specification analyzing unit for generating a syntax mapping table by interpreting the input specification based on the context free grammar and generating a string generating rule table by analyzing the string specification based on the regular grammar; A sentence sequence rejection unit for generating all sentences derivable from the grammar mapping table and listing them in a sentence set table; A sentence output unit for outputting all sentences to be used from the sentence set table; And a character string conversion unit for converting the special terminal in the output sentences into the meaningful character string according to the character string generation rule set in the character string generation rule table.

The specification analyzing unit analyzes an input specification created on the basis of the context free grammar, generates a non-terminal table in which an index number is mapped to non-terminal words, generates a terminal table in which an index number is mapped to the terminal, The grammar mapping table including a table, an index number of the terminal table, and a line number of the input specification.

The specification analyzing unit generates the character string generation rule table using the character string specified for each special terminal in the character string specification.

The character string conversion unit converts an attribute of a sentence into a character string of a general terminal belonging to the output sentences, converts the attribute into a corresponding character string by referring to the character string generation rule, Into the entire string.

An address checking unit for extracting an address pair corresponding to the indirect branch instruction and storing the address pair in an accumulated address storage unit when an indirect branch instruction is generated while the program is being executed and the entire string is input; And an address output unit for outputting the address pairs accumulated in the cumulative address storage unit to the control flow prescription table.

Wherein the address checking unit analyzes the instruction input during the execution of the program to determine whether the instruction is an indirect branch instruction and generates the address pair by extracting a source address of the memory where the instruction is generated and a destination address of the instruction, The generated address pair is stored in the control flow prescription table as a result of dynamic control flow analysis of the program.

According to another embodiment of the present invention, (A) a sentence set which is a set of sentences generated according to a context free grammar is extended, and a special terminal of the sentences is defined as a meaningful string ; And (B) analyzing and selecting a legitimate control flow when an intermediate branch instruction for executing a program is received, taking an entire string including the converted string as an input.

The step (A) includes the steps of: (A1) generating a grammar mapping table by interpreting the input specification based on the context free grammar, and generating a string generating rule table by analyzing the string specification based on the regular grammar; (A2) generating all sentences derivable from the grammar mapping table and listing them in a sentence set table; (A3) outputting all sentences to be used from the sentence set table; And (A4) converting the special terminal in the output sentences into the meaningful character string according to the character string generation rule set in the character string generation rule table.

The step (B) comprises the steps of: (B1) extracting an address pair corresponding to the indirect branch instruction and storing the address pair in an accumulated address storage when an indirect branch instruction is generated while the program is being executed; And (B2) outputting the address pair accumulated in the cumulative address storage unit to the control flow prescription table.

According to the present invention, in the execution of a program requiring extreme safety or security, only the control flow confirmed to be legitimate through a pre-test or a dynamic analysis process without regard to all possible control flows, The security can be improved.

The effects of the present invention are not limited to those mentioned above, and other effects not mentioned can be clearly understood by those skilled in the art from the following description.

FIG. 1 schematically illustrates a dynamic control flow analysis apparatus for prescribing a control flow with inputs generated by a grammar according to an embodiment of the present invention; FIG.
FIG. 2 is a detailed block diagram of the dynamic control flow analysis apparatus shown in FIG. 1;
3 is a view for explaining the operation of the input generating apparatus in detail,
4 is a view for explaining the operation of the control flow analysis apparatus in detail,
5 is a diagram showing an example of a program manual and an input specification,
6 is a diagram showing an example of a non-terminal table, a terminal table, and a syntax mapping table;
7 is a diagram showing an example of a character string specification input to the specification analyzing unit;
8 is a diagram showing an example of a sentence set derived from sentence rejection,
9 is a diagram showing an example of the entire character string converted by the character string conversion unit,
10 is a diagram for schematically explaining a series of processes of extracting and generating an address pair of an address checker,
11 to 13 are flowcharts for explaining a dynamic control flow analysis method for prescribing a control flow to an input generated by a grammar according to an embodiment of the present invention.

BRIEF DESCRIPTION OF THE DRAWINGS The above and other objects, features, and advantages of the present invention will become more readily apparent from the following description of preferred embodiments with reference to the accompanying drawings.

Where an element, component, apparatus, or system comprises an element comprising a program or software, an element, component, apparatus, or system, unless expressly stated otherwise, It should be understood to include hardware (e.g., memory, CPU, etc.) necessary for operation or other programs or software (e.g., drivers necessary to drive an operating system or hardware).

It is also to be understood that the elements (or elements) may be implemented in software, hardware, or any form of software and hardware, unless the context requires otherwise.

Also, terms used herein are for the purpose of illustrating embodiments and are not intended to limit the invention. In the present specification, the singular form includes plural forms unless otherwise specified in the specification. The terms "comprises" and / or "comprising" used in the specification do not exclude the presence or addition of one or more other elements.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Hereinafter, the present invention will be described in detail with reference to the accompanying drawings.

Each of the configurations of the dynamic control flow analysis apparatus for prescribing the control flow to the input generated by the grammar shown in Figs. 1 and 2 is shown to be functionally and logically separable, It will be easily understood by those skilled in the art that the present invention is not limited to a physical device or a separate code.

FIG. 1 is a schematic diagram of a dynamic control flow analysis apparatus for prescribing a control flow with inputs generated by a grammar according to an embodiment of the present invention.

The dynamic control flow analyzing apparatus shown in FIG. 1 can input a character string converted by an extended normal grammar and dynamically prescribe a control flow corresponding to an indirect branch instruction.

More specifically, the analysis result of the dynamic control flow proposed in the embodiment of the present invention is dependent on the data inputted during the execution of the program, that is, the inputted character string. From the methodological point of view, since the dynamic control flow analysis does not extract the control flow corresponding to all the programs, in the embodiment of the present invention, an input data generation method for increasing the branch coverage of the control flow appearing for the purpose of executing a specific program To be applied. In other words, in the embodiment of the present invention, a normal input condition according to a requirement for a program purpose is displayed as a context free grammar, and an arbitrary meaningful character string input is generated using a string generation rule according to an extended normal grammar do. Then, the control flow to be prescribed is dynamically analyzed by inputting the generated character string into the program.

Referring to FIG. 1, a dynamic control flow analysis apparatus includes an input generating apparatus 100, a memory 200, a disk 300, and a control flow analysis apparatus 400.

The input generating apparatus 100 converts a set of sentences, which is a set of sentences generated according to the context free grammar, into a meaningful string according to a rule for generating a string limited to an extended regular grammar . A meaningful string means a string having a type and a corresponding value.

According to lexical analysis theory, the basic unit of sentence is called token, which is composed of type and value. The sentence generated by the input generating apparatus 100 includes a plurality of terminals, and the terminals can be classified into tokens. The type of the token indicates the identifier. At the time of lexical analysis, the kind of the token should be classified, and the attribute is distinguished through the identifier. That is, if identifiers are the same, they can have the same property, and the type can be referred to as information indicating the attribute of the special terminal. However, even in the case of a special terminal, a type and a value exist, but the value is not yet determined. For example, in the embodiment described below, there is a value of FILE, which is later converted into a character string A. Therefore, it can be said that the converted string from the sentence is converted to a string if it conforms to the program requirements or contains the information in the program manual. In other words, when converted to a string, when converted to an executable string in the program manual, it is converted to a meaningful string.

The memory 200 stores a grammar mapping table 210, a string generating rule table 220 and a sentence set table 230 generated by the input generating apparatus 100. The memory 200 receives the entire string including the converted character string from the input generating apparatus 100 while the program is being executed in the processing unit 240. The memory 200 continuously executes the program, And accumulates the address pairs extracted and collected by the address accumulation table 250 in the address accumulation table 250.

The disc 300 stores all sentences generated in the input generating apparatus 100 and converted strings from all sentences. In addition, the disk 300 stores a control flow prescription table 330 for recording the address pair input from the control flow analysis apparatus 400 as a control flow prescription. The disk 300 may be a mass storage medium such as a hard disk drive (HDD) or a solid state disk (SSD).

The control flow analysis apparatus 400 dynamically analyzes and selects a legitimate control flow according to whether an indirect branch instruction is generated while a program is being executed in the memory 200. [

In the embodiment of the present invention, the meaning of 'legitimate' means that the program follows the requirements of the program and has no problems in its execution. Therefore, in the embodiment of the present invention, when the input data (i.e., character string) generated in the input generating apparatus 100 is input to the process, it can be determined that all the control flows appearing according to the input data are legitimate. During the analysis process, it is assumed that there is no internal or external attack.

FIG. 2 is a detailed block diagram of the dynamic control flow analysis apparatus shown in FIG. 1, FIG. 3 is a view for explaining the operation of the input generation apparatus 100 in detail, Fig.

2 and 3, the input generation apparatus 100 includes a specification analysis unit 110, a sentence rejection unit 120, a sentence output unit 130, and a character string conversion unit 140.

The specification analyzing unit 110 receives the input specification created based on the context free grammar and the character string specification created based on the extended normal grammar.

The reason for using context free grammar and extended regular grammar for input generation is to improve the accuracy of dynamic control flow analysis. Any input that is generated in the absence of a specific condition will most likely cause the program to fail. Therefore, in order to avoid this, in the embodiment of the present invention, a legitimate input specification that can be accepted in the program is displayed in a grammar. Here, 'specification' means 'grammar', and refer to the program manual for the specification of input and the specification of string.

The context-free grammar, commonly used as an input display format, consists of:

G = (N, T, P, S)

Where N is a finite set of nonterminals, and T is a finite set of terminals, NnT = f . P is a finite set of rules P ⊆ N × (N ∪ T) ^* , where S is a start sign, S ∈ N.

Also, the terminal includes a general terminal set (NT) and a special terminal set (ST), and NT∪ST = T and NT∩ST = ? . A special terminal set (ST) consists of special terminals that can be replaced with any meaningful string. The general terminal set (NT) is composed of all terminals except the special terminal set (ST).

5 is a diagram showing an example of a program manual and an input specification.

The input specification shown in FIG. 5 is written in the form of a context free grammar referring to the program manual. 5, the non-nouns N include <S> and <OPTION>, and the terminals T include base64, FILE, OPT, COLS, UINT, -w, , --decode, --ignore-garbage, and -wrap.

The specification analyzing unit 110 generates a grammar mapping table 210 by analyzing the input specification based on the context free grammar as shown in FIG.

In detail, the specification analyzing unit 110 analyzes an input specification created on the basis of the context free grammar, generates a non-terminal table in which an index number is mapped to a non-terminal, generates a terminal table in which an index number is mapped to the terminal do. The specification analyzer 110 generates a syntax mapping table 210 including an index number and an input specification line number displayed on the non-terminal table and the terminal table.

When the input specification as shown in FIG. 5 is input, the specification analysis unit 110 analyzes the input specification to generate the non-terminal table and the terminal table shown in FIG.

Referring to FIG. 6, the specification analyzing unit 110 identifies <S> and <OPTION> as non-nouns N from the result of analyzing the input specification, maps the index numbers 0 and 1 to each non- And creates a non-ending table. That is, the specification analysis unit 110 sequentially analyzes the line numbers of the rule P and maps the index numbers in the order in which the terminals appear.

The specification analyzing unit 110 extracts base64, FILE, OPT, COLS, UINT, -w, --help, --version, --decode, --ignore -garbage and -wrap, and generates terminal tables by mapping index numbers 2 to 12 to each terminal. The specification analyzer 110 maps the index numbers to the terminals after the last index number of the non-ending table and maps the index numbers in the order indicated in the line numbers of the rules P. [

The specification analyzer 110 stores the generated non-terminal table and terminal table in the specification analyzer 110 for utilization.

The specification analyzer 110 generates a grammar mapping table 210 including a line number and an index number as shown in FIG. The specification analyzer 110 generates the syntax mapping table 210 by checking the line numbers corresponding to the respective lines of the input specification and the index numbers of the non-terminal or terminal of each line in the non-terminal table and the terminal table.

At this time, the specification analyzer 110 maps the leftmost column of the index number to the index number indicated in the number of the non-end table, and maps the index number referring to the terminal table from the second column of the index number. For example, in the input specification of FIG. 6, the leftmost column of the line corresponding to the line number '1' (ie, the portion immediately below the <S>) represents the index number '0' mapped to <S> 2 'to the column corresponding to' FILE 'and the index number' 3 'to the column corresponding to' FILE 'to the syntax mapping table 210 in order do.

In addition, the leftmost column of the line corresponding to the line number '5' (ie, immediately below the <OPTION>) has the index number '1' mapped to the <OPTION> 1 'in the column corresponding to &lt; OPTION &gt; to the grammar mapping table 210 in order.

In this way, the specification analyzing unit 110 analyzes the input specification, generates a grammar mapping table 210 as shown in FIG. 6, and stores the generated syntax grammar mapping table 210 in the memory 200. FIG.

On the other hand, the specification analyzing unit 110 generates a character string generating rule table 220 by analyzing the inputted character string specification based on the extended regular grammar.

Regular grammar, which is one of the ways to display programming languages, is divided into Basic Regular Grammar and Extended Regular Grammar. The basic regular grammar refers to the regular grammar presented at the beginning, and the extended regular grammar refers to a method that increases the expressible grammar expression by adding a meta character to the basic regular grammar.

7 is a diagram showing an example of a character string specification input to the specification analyzing unit 110. FIG.

Referring to FIG. 7, the character string specification includes a meaningful character string assigned to each special terminal. That is, in the string specification, a character string for converting special terminals corresponding to the special terminal set (ST) among all the terminals (T) into meaningful strings is designated. This specification of the string specification uses extended normal grammar.

The specification analyzing unit 110 analyzes the inputted character string specification to generate a character string generating rule table 220 shown in FIG. 7 from a meaningful character string designated for each special terminal, and stores the generated character string generating rule table 220 in a memory 200).

Referring again to FIG. 2, the sentence rejection unit 120 generates all sentences derivable from the grammar mapping table 210 and lists them in the sentence set table 230. Sentence rejection 120 uses Dong's algorithm. That is, the sentence rejection unit 120 constructs a parse tree based on the context free grammar, generates all sentences derived from the hierarchical relationship of the parse tree, The sentence set table 230 is generated.

The algorithm of Dong is briefly described as follows: G _i = (N, T, P, X _i ) when N = {X ₁ ,?, X _m }, i = L _i , and the height of the tree is n, the hierarchy for constructing the sentence consists of the following four sentence sets.

- heap ⁱ (231): sentences contained in L _i with height not greater than n + 1.

- hierarchy ⁱ (232): sentences contained in L _i of height n + 1.

- cluster ^p (233): Sentences with height n + 1 that are used first when deriving sentence rule p.

- cube ^{p, t} (234): Sentences contained in cluster ^p corresponding to t-th sub-sentences extracted from layer (n-1).

Therefore, the sentence rejection unit 120 generates all the derivable sentences using the line number and the index number stored in the grammar mapping table 210, hierarchically lists the generated sentences according to the Dong algorithm, (230). A sentence is a set of terminals, and includes at least one of a general terminal and a special terminal.

The sentence output unit 130 outputs all sentences to be used or available from the sentence set table 230 and stores the sentences in the sentence storage area 310 of the disc 300.

FIG. 8 is a diagram showing an example of a sentence set derived from the sentence rejection unit 120. FIG.

In FIG. 8, FILE, UINT, COLS, and OPT represent special terminals. For example, the statement base64 --help 'consists of a base terminal called base64 and a generic terminal called --help. Also, 'base64 FILE' is composed of a general terminal called base64 and a special terminal called FILE.

On the other hand, the string conversion unit 140 converts the special terminals in all the sentences output from the sentence output unit 130 into a meaningful string according to the string creation rule set in the string creation rule table 220.

More specifically, the string conversion unit 140 sequentially converts all sentences stored in the sentence storage area 310 into a character string, and the special terminal in each sentence converts the character string into a corresponding character string by referring to the character string generation rule. Also, the character string conversion unit 140 converts the attribute from a sentence to a character string in a general terminal in each sentence.

For example, base64 which is a general terminal among the statements of base64 FILE in FIG. 8 is converted to be recognized as a character string by the character string conversion unit 140, and FILE is converted into a character string A with reference to FIG.

Table 1 below describes the limitations of strings.

Limitations Explanation example Example Description
String length The length of the string to convert A {1,10} Converts the letter A to any number from 1 to 10 The size of the number Limit number sizes according to type

Converts to a random number between 0 and 65536, the range of unsigned integer type types Case
division Capitalize alphabetic characters [a-zA-Z] Convert lowercase a to z or any one of uppercase A through Z Special Characters
division Display special characters,

Show more

Special Characters

Convert to Separate logical operators Show logical operators,

Show more

Convert to logical operator OR (|),
Represents A OR B

The Special Terminal Set (ST) combines the restrictions of [Table 1] and converts it into any meaningful string satisfying it. As shown in [Table 1], character string conversion based on extended regular grammar is an input generation method that extends sentence enumeration. Since a string is partially converted under limited conditions, various types of input (ie, strings) are generated in the same sentence . For example, when converting a special terminal aaa into a string based on A {1, 10} twice, the converted string may be different between 1 and 9, or may be equal to 1 and 1.

Hereinafter, a character string converted by the string conversion unit 140 for each sentence is referred to as an entire character string.

9 is a diagram showing an example of an entire character string converted by the character string conversion unit 140. As shown in FIG.

8 and 9, a sentence composed of general terminals is converted into an entire character string of the same type, and a sentence composed of a general terminal and a special terminal is converted into an arbitrary meaningful character string only by the special terminal.

The string conversion unit 140 stores the converted entire strings in the character string storage area 320 of the disc 300.

2 and 4, after all the sentences are converted into the entire character string, the processing unit 240 executes the program according to the input command. While the program is being executed, the entire character string stored in the character string storage area 320 is sequentially input to the processing unit 240 and processed.

The control flow analyzing apparatus 400 sequentially inputs all the strings and analyzes and selects a legitimate control flow depending on whether an indirect branch instruction is generated while the program is being executed. For this, the control flow analyzing apparatus 400 includes an address checking unit 410 and an address outputting unit 420.

When the indirect branch instruction is generated while the program is being executed, the address checking unit 410 extracts the address pair corresponding to the indirect branch instruction and stores the extracted address in the cumulative address table 250. That is, the address checking unit 410 selectively and dynamically analyzes the control flow by using the converted character string as an input during program execution. The dynamic analysis of the control flow is performed on the low-level indirect branch instruction in the x86 series, and the branch type is as follows.

1. Indirect jump / call: generated by function pointer, virtual method dispatch, switch statement

2. Return: Store the return address on the stack when calling the function, and read it when returning.

Whenever the above two types of indirect branching occur, the address checking unit 410 extracts the source address and the destination address of the instruction and stores the same in the cumulative address table 250.

In more detail, the address checking unit 410 monitors a program executed in the processing unit 240, and analyzes all the commands inputted into the program. As a result of the analysis, if the input instruction is an indirect branch instruction, the address checking unit 410 determines that an indirect branch instruction has occurred. The address checking unit 410 extracts a source address of a memory (not shown or a register) in which an instruction corresponding to the indirect branch instruction is generated and a destination address of the instruction to generate an address pair corresponding to the indirect branch instruction, And stores the address pair in the cumulative address table 250.

A method of extracting and generating an address pair by the address checking unit 410 is disclosed in Application No. 10-2014-0175623, filed by the same applicant, using a hash-based address searching apparatus and method using time locality .

FIG. 10 is a diagram for explaining a process of extracting and generating an address pair by the address checking unit 410. Referring to FIG.

Referring to FIG. 10, if an instruction input to a running program is a call, the address checking unit 410 determines whether the instruction call is an indirect branch instruction. If it is determined that the branch instruction is an indirect branch instruction, the address checking unit 410 checks the address stored in the address memory (not shown). If it is confirmed that the call instruction is registered in the memory address 0xA, the address checking unit 410 extracts 0xA as the source address of the call instruction.

Also, the address checking unit 410 checks the value push% ebp stored in the eax register by referring to *% eax matched with the call, and confirms 0xB as a value at the memory address ebp. The address checking unit 410 extracts the checked 0xB as a destination address.

The address checking unit 410 determines the extracted source address 0Xa and the destination address 0Xb as one address pair, maps it to a command called "call", and stores it in the cumulative address table 250. At this time, the address checking unit 410 checks whether the extracted address pair is stored in the cumulative address table 250, and if not, the cumulative address table 250 stores the address pair. The address checking unit 410 determines whether the instruction is an indirect branch instruction for all instructions input until the execution of the program is completed. If the instruction is an indirect branch instruction, the address checking unit 410 extracts and stores the address pair.

When the program execution is completed and the analysis of the control flow for all the string inputs is completed, the address output unit 420 outputs the address pairs accumulated in the cumulative address table 250 to the control flow prescription table 330. As a result, the address pairs extracted and generated by the address checking unit 410 are stored in the control flow prescription table 330 as a result of dynamic control flow analysis of the program.

Meanwhile, the dynamic control flow analysis apparatus for prescribing the control flow with the input generated by the grammar according to the above-described embodiment of the present invention includes an input generation apparatus 100, a memory 200, a disk 300, (Not shown) that controls and manages the overall operation including the above-described operation of the dynamic control flow analysis apparatus in a state of establishing communication connection with the apparatus 400. [

In addition, the address pairs stored in the control flow prescription table 330 by dynamic control flow analysis and sorting are used as a control flow prescription. For example, during execution of a program without knowing whether a program attack occurs later, the address checking unit 410 extracts the address pair corresponding to the indirect branch instruction, and the extracted address pair is sent to the control flow prescription table 330 If it is not stored, it can be determined that an attack has occurred and can be promptly followed up.

Hereinafter, a dynamic control flow analysis method for prescribing a control flow based on an input generated by a grammar according to an embodiment of the present invention will be described with reference to FIGS.

11 is a flowchart briefly explaining a dynamic control flow analysis method of a dynamic control flow analysis apparatus for prescribing a control flow to an input generated by a grammar according to an embodiment of the present invention.

Since the apparatus for the dynamic control flow analysis method of FIGS. 11 to 13 is the dynamic control flow analysis apparatus described with reference to FIGS. 1 to 10, a detailed description of the dynamic control flow analysis method will be omitted below.

11, the input generating apparatus 100 may expand a set of sentences, which is a set of sentences generated according to a context free grammar, to convert special terminals of sentences into meaningful strings according to the rules for generating a string limited by extended regular grammars , And the general terminal is used as it is, but the attribute is converted from a sentence into a character string (S1110).

The input generating apparatus 100 stores all the converted strings in step S1110 on the disc 300 (S1120).

When the program is executed (S1130), the control flow analyzing apparatus 400 dynamically analyzes and selects a legitimate control flow according to whether or not an indirect branch instruction is generated during the processing of a character string input by the program, The address pair corresponding to the branch instruction word is stored (S1140).

FIG. 12 is a flowchart for explaining step S1110 of FIG. 11 in more detail.

Referring to FIG. 12, the input generating apparatus 100 receives a context-free grammar-based input specification as shown in FIG. 5 and a string specification based on an extended regular grammar as shown in FIG. 7 (S1210).

The input generating apparatus 100 generates a grammar mapping table 210 by interpreting the input specification based on the input context free grammar and generates a string generating rule table 220 by analyzing the string specification based on the extended regular grammar, (Step S1220).

The input generating apparatus 100 generates all sentences that can be derived from the generated grammar mapping table 210 as a sentence set as shown in FIG. 8, and creates and stores the sentence set table 230 in the memory 200 (S1230).

The input generating apparatus 100 outputs all the derivable sentences generated in step S1230, that is, all the sentences to be used, from the sentence set table 230 and stores them in the disc 300 (S1240).

The input generating apparatus 100 converts the special terminal in the sentences stored in step S1240 into a meaningful string according to the string generating rule set in the string generating rule table 220, and converts the special terminal into a string attribute (S1250). In step S1250, the converted string of all the sentences has the form as shown in FIG.

If the input generating apparatus 100 has to further convert the character string (S1260-Yes), the input generating apparatus 100 enters the step S1250. This is because the number of times of conversion to a character string may be specified twice or more for the same sentence, so it is checked whether or not the character string is further converted.

When the string conversion is completed (S1260-No), the input generating apparatus 100 stores the converted whole string on the disk 300 (S11120).

FIG. 13 is a flowchart for explaining step S1140 of FIG. 11 in more detail.

Referring to FIG. 13, the control flow analyzer 400 sequentially receives and processes the strings stored in step S1120 during the process, that is, during execution of the program (S1310).

The control flow analysis apparatus 400 analyzes the command every time a command is input to the process while the program is being executed by receiving the character string as an input (S1320).

If the instruction is an instruction corresponding to the indirect branch instruction (S1330-Yes), the control flow analysis apparatus 400 extracts the address pair corresponding to the indirect branch instruction (S1340).

The control flow analyzing unit 400 determines whether the extracted address pair is a previously collected address pair, that is, whether the same address pair is stored in the cumulative address table 250 (S1350).

If the extracted address pair is not stored (S1350-No), the control flow analyzer 400 stores the extracted address pair in the cumulative address table 250 (S1360).

The control flow analyzing apparatus 400 repeats steps S1330 to S1360 until the execution of the program is completed.

When the execution of the program is completed (S1370-Yes), the control flow analyzer 400 determines whether the analysis of the control flow for all character string input is completed (S1380).

If the analysis of the control flow for all the character strings is not completed (S1380-No), the control flow analyzing apparatus 400 proceeds to step S1310 to re-execute the program, .

If the analysis of all the string inputs is completed (S1380-Yes), the control flow analyzing apparatus 400 outputs the accumulated address pairs to the control flow prescription table 330 of the disk 300 and stores them in the memory (S1390).

11 to 13, it can be seen that the dynamic control flow analysis apparatus dynamically analyzes the control flow using a string input in real time.

Meanwhile, the analysis method of the dynamic control flow analyzing apparatus for prescribing the control flow to the input generated by the grammar according to the present invention is characterized in that a program of instructions for implementing the method is tangibly embodied, It is easily understood by a person skilled in the art that the present invention may be included in the present invention.

Thus, the present invention provides a method for analyzing a dynamic control flow analysis apparatus for dynamic control flow analysis apparatus for prescribing a control flow with input generated by a grammar, Provides programs stored on media together.

100: input generating apparatus 110: specification analyzing unit
120: reject sentence 130: sentence output
140: string conversion unit 200: memory
300: Disk 400: Control Flow Analyzer
410: address checking unit 420: address output unit

Claims (15)

An input generating device for expanding a set of sentences that is a set of sentences generated according to the context free grammar and converting the special terminal of the sentences into a meaningful string according to a rule for generating a string limited by an extended normal grammar; And
And a control flow analyzing apparatus for analyzing and selecting a proper control flow when an intermediate branch instruction for executing a program is received and receiving an entire string including the converted character string as an input,
The input generating apparatus includes:
A specification analyzer for generating a grammar mapping table by interpreting the input specification based on the context free grammar and generating a string generation rule table by analyzing the string specification based on the extended regular grammar;
A sentence sequence rejection unit for generating all sentences derivable from the grammar mapping table and listing them in a sentence set table;
A sentence output unit for outputting all sentences to be used from the sentence set table; And
And a character string conversion unit converting the special terminal in the output sentences into the meaningful character string according to a character string generation rule set in the character string generation rule table and converting the attribute into a character string in a general terminal. A dynamic control flow analysis device for prescribing a control flow with generated inputs. delete The method according to claim 1,
The specification analyzing unit,
A non-terminal table in which an index number is mapped to a non-terminal word by interpreting an input specification created based on the context free grammar, a terminal table in which an index number is mapped to the terminal, The grammar mapping table including the index number of the input specification and the line number of the input specification is generated. The method according to claim 1,
The specification analyzing unit,
Wherein the character string generation rule table is generated using the string specified for each special terminal in the character string specification. The method according to claim 1,
Wherein the string conversion unit comprises:
The general terminal belonging to all the sentences converts the attribute into a character string in a sentence. The special terminal belonging to all the sentences converts the character string into a corresponding character string by referring to the character string generation rule, Wherein the controller is configured to generate a control flow based on the input generated by the grammar. The method according to claim 1,
The control flow analyzing apparatus includes:
An address checking unit for extracting an address pair corresponding to the indirect branch instruction and storing the address pair in an accumulated address table when an indirect branch instruction is generated while the program is being executed, And
And an address output unit for outputting the address pairs accumulated in the cumulative address table to the control flow prescription table. The method according to claim 6,
The address checking unit,
Wherein the address pair is generated by extracting a source address of a memory in which the instruction is generated and a destination address of the instruction in a case where the instruction is an indirect branch instruction by analyzing a command input during execution of the program,
Wherein the generated address pair is stored in the control flow prescription table as a result of dynamic control flow analysis of the program. (A) converting a set of sentences, which is a set of sentences generated according to a context free grammar, into a meaningful string according to a rule for generating a string limited to an extended regular grammar; And
(B) analyzing and selecting a legitimate control flow when an intermediate branch instruction for executing a program is received and an entire string including the converted string is input,
The step (A)
(A1) generating a grammar mapping table by interpreting the context-free grammar-based input specification, and generating a string generation rule table by interpreting the string specification based on the extended regular grammar;
(A2) generating all sentences derivable from the grammar mapping table and listing them in a sentence set table;
(A3) outputting all sentences to be used from the sentence set table; And
(A4) converting the special terminal in the output sentences into the meaningful character string according to the character string generation rule set in the character string generation rule table, and converting the attribute into a character string in the general terminal A method for dynamic control flow analysis for prescribing a control flow with input generated by the method. delete 9. The method of claim 8,
The step (A1)
A non-terminal table in which an index number is mapped to a non-terminal word by interpreting an input specification created based on the context free grammar, a terminal table in which an index number is mapped to the terminal, The grammar mapping table including the index number of the input specification and the line number of the input specification is generated. 9. The method of claim 8,
The step (A1)
Wherein the string generating rule table is generated using the character string specified for each special terminal in the character string specification. 9. The method of claim 8,
The step (A4)
The general terminal belonging to all the sentences converts the attribute into a character string in a sentence. The special terminal belonging to all the sentences converts the character string into a corresponding character string by referring to the character string generation rule, Wherein the input of the control flow is an input of a grammar generated by the grammar. 9. The method of claim 8,
The step (B)
(B1) extracting an address pair corresponding to the indirect branch instruction and storing the branch in an accumulated address table when an indirect branch instruction is generated while the program is being executed; And
And (B2) outputting a pair of addresses accumulated in the cumulative address table to a control flow prescription table. &Lt; Desc / Clms Page number 19 &gt; 14. The method of claim 13,
The step (B1)
Wherein the address pair is generated by extracting a source address of a memory in which the instruction is generated and a destination address of the instruction in a case where the instruction is an indirect branch instruction by analyzing a command input during execution of the program,
Wherein the generated address pair is stored in the control flow prescription table as a result of dynamic control flow analysis of the program. delete

Images