KR102299640B1 - Method and system for similarity analysis among kernel system calls using fuzz testing - Google Patents

Abstract

Disclosed are a method and system for analyzing a kernel system call similarity using a fuzz testing. The method for analyzing a system call similarity according to one embodiment may comprise: a step of calling system calls, in a modulated kernel, by using a fuzz testing tool; and a step of classifying the called system calls through a similarity analysis for the called system calls. Therefore, the present invention is capable of reducing a possibility of a security accident from occurring.

Description

Kernel system call similarity analysis method and system using fuzz testing

The following description relates to an efficient method for automatically analyzing the similarity of kernel system calls, and more particularly, to a method for quantifying the similarity by analyzing the records stored by the kernel modulated by the analyst.

With the development of computer technology, various types of systems are emerging. Among them, in the case of a computer operating system or a system having a function and structure similar to that of the operating system, a communication means between execution layers called a system call is provided. System design or management wants to have a means to efficiently control this system call. In this case, the frequently used method is to reduce the total number of system calls by classifying system calls, or to bundle similar types of system calls at once. management of restrictions, etc.

In the case of a normal operating system, there are at least 100 and as many as 1000 system calls. However, existing studies manually classify system calls, including the possibility of security incidents due to inexperienced administrators. Typically, mmap and read/write system calls in linux are such cases. It is widely known that when file read/write is restricted, it is possible to bypass using the mmap system call when only read/write or related system calls are restricted. Manually arranging the relationships between numerous system calls is difficult to see as highly efficient.

There are a number of prior art techniques for analyzing the similarity between functions. However, most of the preceding studies analyze binaries compiled from the same source code to prevent malicious code analysis or technology leakage.

It was created to solve the problem of manually classifying kernel system calls until now. Each system call can be classified as an arbitrary function, but it is not completely arbitrary two functions in that they are used in the same system. The purpose is to shorten the time by automatically checking the similarity between each system call using the commonalities of the system calls.

The system call similarity analysis method includes calling system calls in a kernel that has been modulated using a fuzz testing tool; and classifying the called system calls through similarity analysis for the called system calls.

The classifying may include analyzing a degree of similarity between the called system calls based on data structure information of the system calls stored in the local storage.

The classifying may include quantifying the analyzed similarity with a numerical value and, when a system call is called, classifying the called system call based on the analyzed similarity.

The calling may include calling the system calls by substituting a random value into the kernel modulated using a fuzz testing tool as the kernel source code is compiled.

In the calling step, the data structure information of the called system calls is recorded through code modification performed in the kernel that is modulated as the system calls are called, and the recorded data structure information is stored in a local storage. may include

The system call similarity analysis system includes: a call call unit that calls system calls in a kernel modulated using a fuzz testing tool; and a call similarity analyzer for classifying the called system calls through similarity analysis for the called system calls.

The call similarity analyzer may analyze the similarity between the called system calls based on data structure information of the system calls stored in the local storage.

The call similarity analyzer may quantify the analyzed similarity as a numerical value and, when a system call is called, classify the called system call based on the analyzed similarity.

The call calling unit may call the system calls by substituting a random value into the modulated kernel using a fuzz testing tool as the kernel source code is compiled.

The call calling unit may record data structure information of the called system calls through code modification performed in a kernel that is modulated as the system calls are called, and store the recorded data structure information in a local storage.

When there are multiple system calls in a certain system, it helps to automatically classify system calls based on the similarity between system calls. This helps in system design and management, reducing the possibility of security incidents and enabling efficient work.

1 is an example of a kernel source code according to an embodiment.
FIG. 2 is a diagram for explaining an operation of storing a data structure of a system call called in a system call similarity analysis system according to an embodiment.
3 is a diagram for explaining an operation of performing a similarity analysis in a system call similarity analysis system according to an embodiment.
4 is a block diagram illustrating the configuration of a system call similarity analysis system according to an embodiment.
5 is a flowchart illustrating a system call similarity analysis method in a system call similarity analysis system according to an embodiment.

Hereinafter, embodiments will be described in detail with reference to the accompanying drawings.

1 is an example of a kernel source code according to an embodiment.

Referring to FIG. 1 , it is assumed that it is a part of the kernel source code. There is a point in time when a function named ksys_read uses a data structure named struct fd. Before using the data structure in the code, use the code modification technique so that the kernel can record that a specific data structure is used. Code modification technique refers to what is often called static instrumentation. For example, it may be done by an automated tool such as LLVM, or it may be modified manually. Through this code modification technique, the kernel can be modified to have a function to record the data structures used by the kernel. Various techniques such as LLVM/Clang exist for the code modification technique, and the embodiment is not limited thereto.

FIG. 2 is a diagram for explaining an operation of storing a data structure of a system call called in a system call similarity analysis system according to an embodiment.

You can compile the kernel source code and make it executable. A large number of system calls in which random values are substituted into the modulated kernel 220 by utilizing the fuzz testing tool 210 may be called. Referring to Non-Patent Document 1 <https://terms.naver.com/entry.nhn?docId=5670033&cid=42346&categoryId=42346>, a description of fuzz testing is mentioned. Such fuzz testing or fuzzing is a software testing technique in which valid, unexpected or random data is entered into a computer program. Fuzz testing means a test that analyzes the cause after generating an exception error by randomly inputting data to find software vulnerabilities. It is mainly used to find exceptional situations such as program crashes, errors in source code, and potential memory leaks.

The origins of the fuzz testing concept began in the 1950s when data was stored on a punch card, and a random number was entered and tested and corrected for unexpected response. In 1988, Professor Barton Miller of the University of Wisconsin first developed fuzz testing to systematically analyze source code errors and systematically evaluate various software. The initial fuzzing tool was a form of inputting a random data file as a command-line parameter in a Unix environment, but later, in addition to the command line application, various types of fuzzing tools such as a network protocol and a web application appeared. Fuzzing may be classified into a mutation-based or generation-based fuzzing program according to a method of generating test data. The mutation-based method tests with test data created by transforming existing data samples, and the generation-based method finds software vulnerabilities by executing newly defined test data based on the input model. In addition, depending on the knowledge of the internal structure of the software, white-box testing, gray-box testing, and black-box testing are available. White-box testing tests the software operation with knowing the internal structure, black-box testing without knowing it, and gray-box testing with only partial knowledge. In the field of security, fuzzing is used instead of source code analysis to find vulnerabilities in the source code. It is also known to be used to identify zero-day attacks (a hacking technique that exploits security vulnerabilities before they are patched).

In this way, the kernel 220 modulated by using the fuzz testing tool 210 may record which kernel data structure is utilized by the system call called through the code modification made above. In this case, the type of the fuzz testing tool 210 and the storage method of the record are not limited. Information related to the kernel data structure utilized in the called system call may be stored in the local storage 230 . For example, information related to the kernel data structure including the structure name of the kernel data structure used in the called system call, the number of accesses, etc. may be stored in the local storage. Information related to such a kernel data structure may be stored in a database.

3 is a diagram for explaining an operation of performing a similarity analysis in a system call similarity analysis system according to an embodiment.

A similarity analysis may be performed based on the records stored in the local storage. As an example, a similarity analysis between the read system call and the write system call may be performed. For example, by comparing the data structures used in each system call, matching data structures (names) are extracted, so that the similarity can be analyzed primarily. Thereafter, the similarity can be analyzed secondarily by comparing the number of data structures matching each system call or the number of accesses of the data structures. In this case, the result of the similarity analysis may be quantified as a percentage. For example, information related to a data structure utilized in each of the read system call and the write system call stored in the local storage may be compared. The matching data structure among the data structure used in the read system call and the data structure used in the write system call can be extracted. Data structures called struct fd and struct file can be used in the read system call, and data structures called struct fd and struct file can be used in the write system call.

As shown in Fig. 3, the number of times that the data structure called struct fd was accessed 3 times in the read system call, the number of times that the data structure called struct file was accessed 5 times, and the data structure struct fd was accessed in the write system call. It can be accessed 3 times, and the data structure called struct file can be accessed 6 times. In this case, similarity analysis may be performed by comparing the structure names or access counts of identical or similar data structures in each system call. In addition, there are several known statistical methods that can be used for similarity analysis, but the present invention is not limited thereto.

The similarity analysis should quantify and show the relationship between a plurality of arbitrary system calls (eg, between two system calls). For example, the similarity may be quantified using an equation for the similarity analysis.

Formula:

라고 한다. 시스템 콜 A가 아닌 다른 시스템 콜에 대하여 상기 수학식을 적용한 결과를 내림차순으로 정렬하면, 그 결과가 시스템 콜 A에 대한 유사도 순 정렬이 된다. 만일, 상기 수학식의 결과가 동일한 경우, 대상으로 하는 시스템 콜이 이용하는 커널 구조체의 이용 횟수가 적은 순으로 우선순위를 둘 수 있다. 또는, 로컬 저장소에 저장된 각각의 시스템 콜에서 활용되는 자료구조와 관련된 정보에 기초하여 일치하는 자료구조와 관련된 정보의 비율을 통해 유사도가 수치화될 수 있다. 이와 같이, 수치화된 유사도가 유사도 분석 결과로서 출력될 수 있다. 이를 토대로 임의의 시스템 콜(새로운 임의의 시스템 콜)이 주어졌을 때, 유사한 시스템 콜을 일차적으로 정렬할 수 있게 된다. A function that returns the number of kernel structures i used for system calls is called _{num i.} A function representing the relationship with another system call (system call B) for one system call (system call A).

It is said When the results of applying the above equation to system calls other than system call A are arranged in descending order, the result is sorted in order of similarity to system call A. If the results of the above equations are the same, priority may be given in the order of the number of times of use of the kernel structure used by the target system call is small. Alternatively, the similarity may be quantified through a ratio of information related to a data structure that is matched based on information related to a data structure used in each system call stored in the local storage. In this way, the quantified similarity may be output as a similarity analysis result. Based on this, when a random system call (a new random system call) is given, similar system calls can be sorted primarily.

According to an embodiment, it can be used in an operating system system, and in the case of a program having various types of structures through processing, it can be used in a general program. In addition, the IT/SW company can reduce security accidents caused by products sold by the company based on the technology presented in the examples, thereby increasing the reliability of the company's products.

4 is a block diagram illustrating a configuration of a system call similarity analysis system according to an embodiment, and FIG. 5 is a flowchart illustrating a system call similarity analysis method in the system call similarity analysis system according to an embodiment.

The processor of the system call similarity analysis system 400 may include a call calling unit 410 and a call similarity analysis unit 420 . These processor components may be representations of different functions performed by the processor according to control instructions provided by program code stored in the task offloading system. The processor and components of the processor may control the system call similarity analysis system to perform steps 510 to 520 included in the system call similarity analysis method of FIG. 5 . In this case, the processor and components of the processor may be implemented to execute instructions according to the code of the operating system and the code of at least one program included in the memory.

The processor may load the program code stored in the file of the program for the system call similarity analysis method into the memory. For example, when a program is executed in the system call similarity analysis system 400 , the processor may control the system call similarity analysis system 400 to load a program code from a file of the program into the memory according to the control of the operating system. At this time, the processor and the processor included in the processor execute the following steps 510 to 520 by executing the instructions of the corresponding portions of the program code loaded in the memory, respectively, in the call calling unit 410 and the call similarity analysis unit 420 . They may be different functional representations of a processor for execution.

In step 510 , the call calling unit 410 may call system calls in the modulated kernel using a fuzz testing tool. The call calling unit 410 may call system calls by substituting a random value into the modulated kernel using a fuzz testing tool as the kernel source code is compiled. The call call unit 410 may record data structure information of system calls called through code modification performed in a kernel modulated as the system calls are called, and store the recorded data structure information in a local storage.

In operation 520, the call similarity analyzer 420 may classify the called system calls through similarity analysis of the called system calls. The call similarity analyzer 420 may analyze the similarity between the called system calls based on the data structure information of the system calls stored in the local storage. The call similarity analyzer 420 may quantify the analyzed similarity as a numerical value, and, when an arbitrary system call is called, classify the called arbitrary system call based on the analyzed similarity.

The device described above may be implemented as a hardware component, a software component, and/or a combination of the hardware component and the software component. For example, devices and components described in the embodiments may include, for example, a processor, a controller, an arithmetic logic unit (ALU), a digital signal processor, a microcomputer, a field programmable gate array (FPGA). , a programmable logic unit (PLU), a microprocessor, or any other device capable of executing and responding to instructions, may be implemented using one or more general purpose or special purpose computers. The processing device may execute an operating system (OS) and one or more software applications running on the operating system. The processing device may also access, store, manipulate, process, and generate data in response to execution of the software. For convenience of understanding, although one processing device is sometimes described as being used, one of ordinary skill in the art will recognize that the processing device includes a plurality of processing elements and/or a plurality of types of processing elements. It can be seen that can include For example, the processing device may include a plurality of processors or one processor and one controller. Other processing configurations are also possible, such as parallel processors.

The software may comprise a computer program, code, instructions, or a combination of one or more thereof, which configures a processing device to operate as desired or is independently or collectively processed You can command the device. The software and/or data may be any kind of machine, component, physical device, virtual equipment, computer storage medium or device, to be interpreted by or to provide instructions or data to the processing device. may be embodied in The software may be distributed over networked computer systems, and stored or executed in a distributed manner. Software and data may be stored in one or more computer-readable recording media.

The method according to the embodiment may be implemented in the form of program instructions that can be executed through various computer means and recorded in a computer-readable medium. The computer-readable medium may include program instructions, data files, data structures, etc. alone or in combination. The program instructions recorded on the medium may be specially designed and configured for the embodiment, or may be known and available to those skilled in the art of computer software. Examples of the computer readable recording medium include magnetic media such as hard disks, floppy disks and magnetic tapes, optical media such as CD-ROMs and DVDs, and magnetic media such as floppy disks. - includes magneto-optical media, and hardware devices specially configured to store and execute program instructions, such as ROM, RAM, flash memory, and the like. Examples of program instructions include not only machine language codes such as those generated by a compiler, but also high-level language codes that can be executed by a computer using an interpreter or the like.

As described above, although the embodiments have been described with reference to the limited embodiments and drawings, various modifications and variations are possible from the above description by those skilled in the art. For example, the described techniques are performed in a different order than the described method, and/or the described components of the system, structure, apparatus, circuit, etc. are combined or combined in a different form than the described method, or other components Or substituted or substituted by equivalents may achieve an appropriate result.

Therefore, other implementations, other embodiments, and equivalents to the claims are also within the scope of the following claims.

Claims (10)

In the system call similarity analysis method,
Invoking system calls in the modulated kernel using a fuzz testing tool; and
Classifying the called system calls through similarity analysis for the called system calls
including,
The calling step is
As the kernel source code is compiled, system calls are called by substituting random values into the modulated kernel using a fuzz testing tool, and the system calls are called through code modification performed in the modulated kernel as the system calls are called. Recording the data structure information of the data structure, and storing the recorded data structure information in a local storage
A system call similarity analysis method comprising a. According to claim 1,
The classification step is
Analyzing the similarity between the called system calls based on the data structure information of the system calls stored in the local storage
A system call similarity analysis method comprising a. 3. The method of claim 2,
The classification step is
Quantifying the analyzed similarity with a numerical value, and when a system call is called, classifying the called system call based on the analyzed similarity.
A system call similarity analysis method comprising a. delete delete In the system call similarity analysis system,
a call call unit that calls system calls in a kernel that has been modulated using a fuzz testing tool; and
A call similarity analyzer for classifying the called system calls through similarity analysis for the called system calls
including,
The call calling unit,
As the kernel source code is compiled, system calls are called by substituting random values into the modulated kernel using a fuzz testing tool, and the system calls are called through code modification performed in the modulated kernel as the system calls are called. to record their data structure information, and to store the recorded data structure information in a local storage
System call similarity analysis system. 7. The method of claim 6,
The call similarity analysis unit,
Analyze the similarity between the called system calls based on the data structure information of the system calls stored in the local storage
System call similarity analysis system, characterized in that. 8. The method of claim 7,
The call similarity analysis unit,
Quantifying the analyzed similarity with a numerical value and classifying the called arbitrary system call based on the analyzed similarity when an arbitrary system call is called
System call similarity analysis system, characterized in that. delete delete

Images