KR20080047231A - System and method for detecting software attacks on linux - Google Patents

Abstract

A system and a method for detecting software attack in a Linux OS(Operating System) are provided to prevent attacks by a hacker or worms by detecting the software attack before control of a process is moved to an attack code inputted in an address space of the process. A target address obtainer(210) obtains a target address of a command or a function related to a process execution flow. An address validity checker(230) checks whether the obtained target list is included in an address list(220) of an execution code memory area in which control of a process is moved. The address validity checker includes an address range divider(231) dividing the address list of the execution code memory area into more than one address range, an address range selector(232), and a determiner(233) determining whether the obtained target address is included in the selected address range. The target address obtainer obtains the target address from a command target address searcher(213) searching the target address of an indirect CALL, indirect JUMP, or RET command(211). The target address obtainer obtains the target address from a function target address searcher(214) searching the target address from a longjmp() function(212).

Description

SYSTEM AND METHOD FOR DETECTING SOFTWARE ATTACKS ON LINUX}

1 is a diagram showing a processing procedure for adding code to executable code for detecting a software attack according to the present invention;

2 is a diagram showing the configuration of a software attack detection system in the Linux operating system according to the present invention;

3 is a diagram illustrating a software attack detection method in a Linux operating system according to the present invention;

4 is a diagram illustrating a process of determining whether a specific destination address belongs to an executable code region of a legitimate process according to the present invention;

5 is a diagram illustrating a process of generating an address list of an execution code memory area of a running process according to the present invention;

6 is a diagram showing the contents of a system file displaying a memory map of a process provided by a Linux operating system according to the present invention.

The present invention relates to a method for detecting a software attack. More specifically, when a software attack on a computer system occurs, control of the process is transferred to a data area in which a pre-entered attack code is stored instead of the normal execution code area of the process. By using this method, execution flow control commands that transfer control of a process during execution of a computer program are executed before the control is executed to determine whether the address to which control is transferred is the executable code area of a normal process or another area. The present invention relates to a software attack detection system and method for detecting Linux operating systems.

As a countermeasure against hackers or worms, there are methods to find and remove all vulnerabilities of the target software, and to detect and stop an attack if an attack occurs while the software is running.

The way to remove software vulnerabilities is to analyze the source code of the software and find the code known to be exploited by hackers or worms.

In addition, the method of detecting an attack during the execution of the software is to add code that detects the characteristic of the attack to the existing software, generate the execution code, and execute the attack when the characteristic corresponding to the attack occurs while the execution code is executed. How to detect it.

Software attack detection system and method in the Linux operating system according to the present invention relates to a method for detecting an attack during the execution of the software, and representative techniques using such a method include StackGuard, StackShield, SSP. All of these techniques are methods for detecting buffer overflow attacks among software attack methods. When a buffer overflow occurs, the function's return address or function pointer, which is memory associated with the control of the program around the buffer, is overwritten with a different value, and the data between the buffer and control-related memory in the process. Also, if a certain value is stored between the buffer and the control memory and the memory value stored later is changed to another value, the value of the control memory is changed to another value. It is determined that an attack has occurred.

In addition, most buffer overflow attacks occur when the contents of a buffer are copied using a library function such as 'strcpy', so when the library function is executed, it is replaced with a system library function designed to prevent copying beyond the buffer size. When a method, a hacker or a worm attacks software, the attack code used in the attack is executed after it is stored in the stack memory area where most of the program's data is stored. Therefore, the contents of the stack memory area are not executed. Therefore, the operating system removes memory characteristics. How to control the executable characteristics of the stack or data area in hardware, as in Microsoft's Windows XP SP2.

However, most of the above methods can detect software attacks using a buffer overflow technique, but cannot detect attacks using other attack techniques such as a heap overflow technique and a format string technique. This means that when a software attack occurs, the attack code must be stored in the memory of the program to be attacked and the control of the program transferred to the attack code. The above techniques are mostly used in memory areas (function return address, function pointer, longjmp () related to program control. This is because it mainly detects the change of the function return address related to the function return address. Therefore, to effectively detect other types of software attacks that modify the function pointer or the buffer of the longjmp () function, we need a way to detect all changes in the memory area related to such program control.

Accordingly, the present invention has been made to solve the above-mentioned problems of the prior art, and an object of the present invention is to generate a software attack on a running process before changing the control of the process with the attack code entered in the address space of the process. The present invention provides a system and method for detecting software attacks in the Linux operating system that can prevent attacks by hackers or worms by detecting software attacks.

Meanwhile, another object of the present invention is to provide a software attack detection system capable of detecting a software attack even when the contents of a function pointer and a longjmp () function buffer, as well as the return address of a function used to control the execution of a program, and To provide a method.

Software attack detection system in the Linux operating system of the present invention for achieving the above object is an object address obtaining unit for obtaining the object address of a command or function related to process execution control;

And an address validity checker for checking whether the obtained destination address is included in the address list of the executable code memory area to which the control of the process can be transferred from the memory area information provided by the operating system.

In this case, the command related to the processor execution control is made of an indirect CALL, indirect JMP or RET command, and the acquisition of the destination address of the RET command is characterized by obtaining a return address stored in the stack.

In addition, the function related to the process execution control is characterized in that consisting of a longjmp () function, the acquisition of the destination address of the longjmp () function is the address to which the longjmp () function is to transfer control before the call to the longjmp () function Characterized in that the obtained.

The address validity checker may determine whether the obtained destination address belongs to the selected address range by selecting at least one address range from an address list of an execution code memory area of the process. If it is determined that the address does not belong to the selected address range, the next address range is determined.

And if the obtained destination address does not belong to the address list of all the execution code memory areas, terminates the process, and executes a command or calls a function when the obtained destination address belongs to the selected address range. .

On the other hand, the software attack detection method in the Linux operating system according to the present invention comprises the steps of obtaining the target address of the command or function associated with the process execution control;

Generating an address list of an executable code memory area to which the control of the process can be transferred from the memory area information provided by the operating system;

And confirming whether the obtained destination address is included in an address list of the generated execution code memory area.

In this case, the generating of the address list of the execution code memory region may include generating an address list of the execution code memory region of the process by using the memory map of the process immediately after the main () function of the program is executed, and the processor may dynamically When the dlopen () function that loads or the dlclose () function that unloads is called, the memory map of the process is rechecked to rewrite the address list of the memory region of the execution code.

In addition, the generation of the address list of the execution code memory area to which the control of the process can be transferred is characterized in that it is made while reading the / proc / self / maps file provided by the operating system.

Hereinafter, a software attack detection system and method in a Linux operating system of the present invention will be described in detail with reference to the accompanying drawings.

1 is a diagram illustrating a processing procedure for adding code to an executable code for detecting a software attack according to the present invention.

The code for detecting software attacks contains the destination address of the indirect CALL, indirect JMP, and RET instructions that are generated when the program source code is compiled, and the destination address that the longjmp () function uses to transfer control. Detect software attacks by verifying that they belong to a memory area. Figure 1 illustrates the process of adding code to detect such a software attack.

First, the program source code 100 is input using a compiler to generate assembly code 112 for the program source code. (111) The program source code 100 is a source of a program to be protected from a software attack. Is the code.

In the Linux operating system, when using the gcc compiler, assembly code can be generated by using the compiler option '-S'. However, the present invention is not limited to the type of compiler as long as the same function can be performed.

In the generated assembly code 112, execution code finally executed by a computer is represented in an assembly form in order to perform the same function as the source code of the program.

The generated assembly code 112 contains indirect CALLs (also called "indirect calls"), indirect JMPs (also referred to as "indirect JMPs"), RET instructions and the main () function, and dlopen ( / dlclose () function, the longjmp () function call to retrieve the code to detect software attacks, and to call the support library 115 function to generate an address list of the process's executable code area to detect software attacks. Add code (113)

The assembly code 114 processed by the compiler along with the support library 115 is added to the generated assembly code 112 by adding code for detecting a software attack and code for calling the support library 115 function. It is used to generate safe executable code 120.

2 is a diagram showing the configuration of a software attack detection system in the Linux operating system according to the present invention.

The software attack detection system in the Linux operating system includes a destination address acquisition unit 210, an address list 220 of an execution code memory area, and an address validity checker 230.

The destination address obtaining unit 210 obtains a destination address of a command or a function related to process execution control. Commands related to process execution control include indirect CALL, indirect JMP, and RET command 211. The function related to processor execution control is used by the longjmp () function.

The address list of the execution code memory area is generated by the address list generator 221 by executing the main () function and the address list generator 222 by calling the dlopen () and dlclose () functions. The address list generator 221 by executing the main () function may generate a list of the execution code region of the process by using the memory map of the process immediately after the main () function of the program is executed. When the dlopen () and dlclose () functions are called, the address list generator 222 reconfirms the memory map of the process and re-creates the address list of the memory area of the execution code when the dlopen () and dlclose () functions are called. Write.

The address validity checking unit 230 determines whether the destination address obtained by the destination address obtaining unit 210 is included in the address list 220 of the execution code memory area, and if the destination address is included in the address list, the control unit 240 determines whether the destination address is included in the address list. By executing a command or calling a function, and if the destination address is not included in the address list, the control unit 240 terminates the system.

The address validity checker 230 includes an address range divider 231, an address range selector 232, and a determiner 233.

The address range dividing unit 231 divides the address list of the execution code region of the process into several address ranges, and thus may be divided into several address ranges. In addition, the divided address ranges are specified in a certain order.

The address range selector 232 selects one of the address ranges divided by the address range divider 231. If it is determined by the determination unit 233 that the destination address obtained by the destination address acquisition unit 210 is not included in the selected address range, the next address range is selected and determined.

The control unit 240 executes a command or calls a function when it is determined by the determination unit 233 that the destination address is included in the address list 220 of the execution code memory area. Detect and shut down the system.

3 is a diagram illustrating a software attack detection method in the Linux operating system according to the present invention.

The software attack detection method detects attacks when executing indirect CALL, indirect JMP, RET instruction, and calling longjmp () function during process execution. Before executing indirect CALL, indirect JMP, RET instruction and calling longjmp () function, obtain the destination address where control is transferred by each command and function call. (S300) Here, the destination address is the command executed or the function is called. This is where control of post process transfers.

When the destination address of each instruction and function is obtained, the address validity checking routine is called to check whether the destination address is included in the address list of the execution code area of the process (S310).

After checking whether the destination address is included in the address list of the execution code area of the process by the address validity checking routine, comparing the returned value (return value), if the return value is TRUE, execute the original command or call the function (S230), If the return value is FALSE, it is determined that a software attack on the process has occurred, and the process is terminated (S340).

It describes in detail how to detect software attacks and how to generate a list of executable code area addresses for a process.

How to detect software attacks is distinguished by indirect CALL, indirect JMP, RET command execution and longjmp () functions respectively.

After the RET instruction is executed, control is transferred to the function return address stored on the stack. Therefore, the software attack is detected by adding a code to check whether the return address stored in the stack belongs to the address list of the normal execution code memory area before executing the RET instruction.

In the case of CALL and JMP instructions, processing is performed only for indirect CALL and indirect JMP instructions whose destination address is stored in the data area instead of all CALL and JMP instructions. In the case of CALL and JMP instructions that include the target address in the executable code, the target address is included in the executable code, and the memory area where the executable code is stored cannot be changed. Therefore, in the present invention, a software attack is detected by adding a code for checking whether the destination address of the indirect CALL and indirect JMP commands belongs to the program execution code area before the indirect CALL and indirect JMP commands.

Also, since longjmp () of the system library transfers control of the program to the part of the execution code designated by the setjmp () function, it is necessary to check whether the address where the longjmp () function attempts to transfer control to is before executing the longjmp () function. Add code to detect software attacks.

The memory area of a process represents the area of a computer's total memory address occupied by a particular process. The memory area of a process can be checked using information provided by the operating system after the program is first executed. Therefore, immediately after the main () function of the program is executed, the list of execution code regions of the process can be generated using the memory map of the process. You can also create a list of process execution regions by adding code that performs these functions.

As the process dynamically loads or unloads libraries, the memory map changes. Therefore, when the dlopen () function that dynamically loads the library and the dlclose () function that unloads the library are called, the memory map of the process is rechecked to rewrite the address list of the memory area of the executable code. You can also rewrite the address list of the memory area by adding code that calls code to rewrite the address list of the memory area.

4 is a diagram illustrating a process of determining whether a specific destination address belongs to an executable code region of a legitimate process according to the present invention. That is, the address validity checking routine of FIG. 3 is shown in detail.

There can be multiple address ranges in the address list of the process's executable code area. Therefore, the target of the comparison target address list is initialized. (S410) The initialization of the target of the address list is a process of selecting at least one of a plurality of address ranges.

When the target of the target list of addresses to be compared is initialized (n = 1), the address validity checking routine compares the input address (the input destination address) with the current range of target addresses and checks whether the input address is included in the range of the selected target list. Determine (S420).

If the comparison result input address is in the current check target (n-th address range) address range, TRUE is returned to the result value (S430) .If the input address does not belong to the current scan target address range, the target of the comparison target address list is changed to the next item (n +). 1). (S440)

While repeatedly performing this process, the number (n) of the comparison target address list of the next item is compared with the number of the entire comparison target address list (S450).

As a result, if the number of the next comparison target address list is larger than the number of the entire comparison target address list, the input address is not included in the execution code area, and thus FALSE is returned to the result value (S460).

If the list to be compared remains, continue working.

5 is a diagram illustrating a process of generating an address list of an execution code memory area of a running process according to the present invention.

The address list of the process's executable code memory area is shown in the main () function when the program is first executed, and in the executable code memory area after the dlopen () and dlclose () functions are called if the process loads or unloads dynamically. Create a list of addresses.

In the Linux operating system, a process can obtain its memory map by reading the '/ proc / self / maps' file provided by the operating system.

Next, the number of all execution code address areas is initialized (S510), and the execution code areas are searched in the memory map (S520).

If a new region exists as a result of searching the execution code region, the corresponding address range is added to the execution code address region list (S540), and the number of execution code address regions is increased (S550). Continue until it no longer exists.

6 is a diagram showing the contents of a system file displaying a memory map of a process provided by a Linux operating system according to the present invention.

The 'Address range', 'Perms', and 'Mapped file' shown in bold in FIG. 6 are for understanding and are not shown in the actual memory map file. In FIG. 6, the marking of the Perms part as 'r-xp' indicates that the memory area designated by the address is not writable and an executable memory area, that is, an executable code area. Therefore, if you make a list of addresses that correspond to the address range of the memory area where the Perms part is 'r-xp', you can create a list of memory areas where the executable code is stored.

Although the present invention has been described in more detail with reference to some embodiments, the present invention is not necessarily limited to these embodiments, and various modifications can be made without departing from the spirit of the present invention.

As described above, the software attack detection system and method in the Linux operating system according to the present invention controls the process that appears when an attack on the software occurs instead of detecting an attack using the characteristics of a specific attack technique. Instead, various types of attacks can be detected by detecting an attack by detecting an abnormal situation in which a pre-entered attack code is moved to a stored area.

In addition, the software attack detection system and method in the Linux operating system according to the present invention detects a software attack when the contents of a function pointer and a longjmp () function buffer as well as the return address of a function used to control the execution of a program are changed. It can work.

Claims (18)

Obtaining a destination address of a command or a function related to process execution control; Generating an address list of an executable code memory area to which the control of the process can be transferred from the memory area information provided by the operating system; And confirming whether the obtained destination address is included in an address list of the generated execution code memory area. The method of claim 1, The method related to processor execution control is a software attack detection method in a Linux operating system, characterized in that the indirect (ALL), indirect (Indirect) JMP or RET command. The method of claim 2, And obtaining the destination address of the RET command by acquiring a return address stored in the stack. The method of claim 1, The function related to the process execution control is a software attack detection method in Linux operating system, characterized in that consisting of a longjmp () function. The method of claim 4, wherein Obtaining the destination address of the longjmp () function is a software attack detection method in the Linux operating system, characterized in that by obtaining the address to which the longjmp () function is to transfer control before the call to the longjmp () function. The method of claim 1, The generating of the address list of the execution code memory region may include generating an address list of the execution code memory region of the process using a memory map of the process immediately after the main () function of the program is executed. Attack detection method. The method of claim 1, The generating of the address list of the execution code memory region may include re-checking the memory map of the process when the dlopen () function for loading a library or the dlclose () function for unloading is called. Software attack detection method in Linux operating system, characterized by rebuilding address list of memory area. The method of claim 1, The method of claim 2, wherein the generation of an address list of an execution code memory area in which the control of the process is shifted is performed by reading an / proc / self / maps file provided by an operating system. The method of claim 1, wherein the three steps An initial step of selecting at least one address range from an address list of an execution code memory area of the process; And determining whether the obtained destination address belongs to the selected address range. The method of claim 9, If it is determined that the obtained destination address does not belong to the selected address range, the software attack detection method of the Linux operating system, characterized in that for determining the next address range. The method of claim 10, If the obtained destination address does not belong to the address list of all the execution code memory area, the process is terminated in the Linux operating system, characterized in that the process. The method of claim 9, And executing a command or calling a function when the obtained destination address belongs to the selected address range. An object address obtaining unit obtaining an object address of a command or a function related to process execution control; The software attack detection system of the Linux operating system, characterized in that it comprises an address validity check unit for confirming that the obtained destination address is included in the address list of the executable code memory area to which the control of the process can be transferred. The method of claim 13, The destination address obtaining unit obtains a destination address from a command destination address search unit for searching for a destination address of an indirect CALL, indirect JMP, or RET command. The method of claim 14, The destination address obtaining unit obtains a destination address from a function destination search unit for searching for a destination address from a longjmp () function. The method of claim 13, wherein the address validity checking unit An address range dividing unit dividing the address list of the execution code memory area into at least one address range; An address range selector which selects one address range from the divided at least one address range; And a determination unit for determining whether the obtained destination address belongs to the selected address range. The method of claim 16, The selection unit selects another address range if it is determined that the destination address does not belong to the selected address range, the software attack detection system of the Linux operating system. The method according to any one of claims 13 to 16, And the process is terminated when the obtained destination address is not included in the address list of the execution code memory area.

Images