WO2004077294A1 - 不正処理判定方法、データ処理装置、コンピュータプログラム、及び記録媒体 - Google Patents
不正処理判定方法、データ処理装置、コンピュータプログラム、及び記録媒体 Download PDFInfo
- Publication number
- WO2004077294A1 WO2004077294A1 PCT/JP2004/002310 JP2004002310W WO2004077294A1 WO 2004077294 A1 WO2004077294 A1 WO 2004077294A1 JP 2004002310 W JP2004002310 W JP 2004002310W WO 2004077294 A1 WO2004077294 A1 WO 2004077294A1
- Authority
- WO
- WIPO (PCT)
- Prior art keywords
- data
- instruction
- byte
- code
- instruction code
- Prior art date
Links
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
- G06F21/55—Detecting local intrusion or implementing counter-measures
- G06F21/56—Computer malware detection or handling, e.g. anti-virus arrangements
- G06F21/562—Static detection
- G06F21/563—Static detection by source code analysis
Definitions
- the present invention relates to an unauthorized processing determination method for detecting data for performing an unauthorized processing, a data processing device, a computer program for realizing the data processing device, and a computer that stores the computer program. It relates to a possible recording medium.
- attack data containing instruction codes for performing unauthorized processing (hereinafter referred to as “illegal code”) is targeted for server devices, personal computers, etc.
- the information code is transmitted to the information processing device, and the instruction code is executed by the information processing device.
- attack methods one of which is known as an attack method based on buffer overflow.
- the buffer reserved in the stack is in a state where writing is being performed on the stack query more than the reserved buffer. If it falls into a flow state, it can cause unexpected variable rupture and cause a program to malfunction.
- a buffer overflow attack intentionally causes a program to malfunction, for example, gaining system administrator privileges.
- identifications such as those found in malicious codes are used.
- the process of detecting the presence or absence of the bit pattern of the received data was executed. Then, if such a bit pattern is included in the received data, it is determined that the attack data contains an illegal code, and rejection of data reception and notification to the user are performed. I was
- the conventional detection method for the attack data uses the known bit information, as described above.
- attack processing such as detecting turns or simply repeating a non-operation (NOP) instruction
- NOP non-operation
- each of the present invention has been made in view of such circumstances, and has as its object the purpose of each of the present invention is to form a continuous byte string, and to provide a leading byte of each byte string.
- each data sequence detects whether or not each data sequence generates a plurality of character codes constituting the command name of the external command, and based on the detection result, By configuring whether or not processing by each data sequence is illegal processing, it is necessary to prepare in advance a bit pattern etc. for detecting instruction code groups that perform illegal processing.
- Illegal processing determination method for realizing the data processing device, and recording of the computer program, which can detect an unknown instruction code group that performs illegal processing without any It is an object of the present invention to provide a recording medium that can be read by a computer. Disclosure of the invention
- the unauthorized processing determination method uses a data processing device that includes a receiving unit that receives data including a plurality of instruction codes having different byte lengths, and a storage unit that stores the received data.
- the fraudulent process judging method for judging whether or not fraudulent processing is executed by an instruction code included in the data the data stored in the storage means is sequentially read out in byte units, and For a plurality of data sequences that consist of byte sequences, and the first byte of each byte sequence corresponds to a different read position, the instruction code included in each data sequence is used to execute illegal processing. It is characterized in that it is detected whether or not to generate a plurality of character codes constituting a column, and it is determined whether or not the external command is to be executed based on the detected result.
- a data processing device includes a receiving unit that receives data including a plurality of instruction codes having different byte lengths, a storage unit that stores the received data, and an instruction code included in the data.
- Data processing apparatus comprising: a determination unit configured to determine whether an unauthorized process is performed.
- Detecting means for detecting whether or not an instruction code included in each data series generates a plurality of character codes constituting a character string used for performing an illegal process;
- the determining means is configured to determine whether or not the external command is executed based on a detection result of the detecting means.
- the data processing device is the data processing device according to the second aspect of the present invention, wherein the correspondence relationship between the first byte of the instruction code and the byte length of the instruction code is stored. It is characterized by further comprising a table.
- the data processing device is the data processing device according to the second aspect, wherein an instruction code for activating a system call is included after the instruction code for generating the character code.
- the data processing device is the data processing device according to the fourth aspect of the present invention, further comprising: means for detecting whether or not the character code includes a predetermined character code; When a code is detected, the determining means is configured to determine that an unauthorized process is performed.
- a data processing device is the data processing device according to the second aspect, wherein the character code generated by the instruction code included in each data sequence corresponds to an immediate value included in the data. It is characterized by having.
- the data processing device is a data processing device according to the second invention.
- the computer program according to the eighth invention further comprising means for notifying the information to the outside when the determination means determines that the unauthorized process is performed.
- each of the computers includes: The instruction code included in each data series is composed of continuous byte strings, and the first byte of each byte string corresponds to a different read position. A step of detecting whether or not to generate a plurality of character codes constituting a character string to be used.
- the computer-readable recording medium is a computer-readable storage medium that executes an external command related to an unauthorized process based on data that includes a plurality of input instruction codes having different byte lengths.
- the computer is composed of a series of successive bytes, each of which is a sequence of bytes.
- the instruction code included in each data sequence is composed of a plurality of characters that constitute a character string used when performing illegal processing
- a computer program having a step of detecting whether or not to generate a code is recorded.
- the first invention, the second invention, the eighth invention, and the ninth invention whether or not an instruction code for sequentially reading data from the storage means in byte units and executing an illegal process is included.
- an instruction code for sequentially reading data from the storage means in byte units and executing an illegal process.
- the detection result since detection is performed for each instruction code, the detection result may differ depending on where the detection start position is set. However, detection is performed for a plurality of data sequences in which the read positions are sequentially changed. Therefore, the number of erroneous determinations is reduced, and the detection accuracy can be improved.
- the instruction sequence having a data reading position is provided.
- the instruction code when the instruction code is located at a position other than the first byte of the instruction code, it is possible to prevent the detection of an illegal code, thereby improving the processing speed.
- the fourth invention it is detected whether or not an instruction code for activating a system call is included after an instruction code for executing a process for generating a character code. It is highly probable that a parameter consisting of the generated character code is passed to the system call, and it can be determined that an instruction code for executing an illegal process is included.
- the detection accuracy can be improved.
- the generated character code corresponds to the immediate value in the data
- the presence of illegal code can be easily detected by monitoring the register area and the stack area. And the detection accuracy can be improved.
- the fact is notified to the outside. Therefore, it is possible to prevent a trouble caused by the unauthorized code by, for example, shutting down the communication when the unauthorized code is detected.
- FIG. 1 is a block diagram of a data processing device according to the present embodiment.
- FIG. 2 is a schematic diagram illustrating a process executed by the data processing device.
- FIG. 3 is a schematic diagram illustrating the configuration of data to be analyzed.
- FIG. 4 is a flowchart illustrating a procedure for detecting an unauthorized code by the data processing device.
- FIG. 5 is a flowchart illustrating a procedure for detecting an unauthorized code by the data processing device.
- FIG. 6 is a flowchart for explaining the procedure of the analysis ⁇ determination processing routine.
- FIG. 7 is a schematic diagram illustrating an example of a malicious code.
- FIG. 8 is a schematic diagram for explaining another example of the malicious code.
- FIG. 9 is a flowchart for explaining the processing procedure of the analysis processing routine.
- FIG. 10 is a flowchart illustrating the processing procedure of the analysis processing routine.
- FIG. 11 is a flowchart for explaining the processing procedure of the analysis processing routine.
- FIG. 12 is a flowchart for explaining a processing procedure of a judgment processing routine. It is.
- FIG. 13 is a schematic diagram illustrating a configuration of a data processing device according to the present embodiment.
- FIG. 1 is a block diagram of a data processing device according to the present embodiment.
- reference numeral 10 denotes a data processing device, which is a communication interface for connecting to a CPU 11 and an external network. 15a and a communication interface 15b for connecting to the internal network.
- the data processing device 10 is a device for relaying data transmitted and received on a communication network such as a router, a broadband router, and a switch, and the communication interface 15a includes: An information processing device and a communication device to be communicated with are connected via an external network, and an information processing device and a communication device used by a user are connected to the communication interface 15 b via an internal network.
- the information processing device includes a personal computer, a workstation, a server device, a PDA (Personal Digital Assistant), and the like, and the communication device includes a mobile phone and the like.
- PDA Personal Digital Assistant
- the CPU 11 is connected to hardware such as a memory 12, a buffer memory 13, and a routing unit 14, and the CPU 11 has a control program stored in the memory 12 in advance.
- the memory 12 includes a control program for operating each hardware, a routing table storing a destination network address for determining a communication path, and a computer program of the present invention. Is stored.
- the CPU 11 When transmitting data from the internal network to the external network, if the communication interface 15b of the data processor 10 receives the data, the CPU 11 is stored in the memory 12. The communication route is determined with reference to the routing table, and the routing unit 14 is controlled according to the determined communication route. Then, data is transmitted to the destination information processing device or communication device via the communication interface 15a, and data transmitted from the external network to the internal network is The data is relayed by the data processing device 10 according to the same procedure as described above. At this time, the data processor 10 temporarily stores the data received from the external network side via the communication interface 15a in the buffer memory 13 and analyzes the stored data.
- the CPU 11 reads the computer program of the present invention from the memory 12 and executes it to analyze and determine the data inside itself.
- the virtual CPU execution environment 1 la includes registers used by the protected CPU, virtual registers corresponding to the stacks, virtual stacks, etc., and analyzes the data to be analyzed by the instruction code of the protected CPU. This is interpreted as virtual and decoded virtually, and the parameters and the like generated at that time are stored.
- the CPU 11 includes a virtual register and a virtual status provided in the virtual CPU execution environment 11a. The presence of illegal code is determined by monitoring the status of the network.
- the CPU 11, the memory 12, and the buffer memory 13 are individually provided.
- the buffer memory and the IC (Integrated Circuit) storing the computer program of the present invention are used.
- ASICs Application Specified ICs, etc., which are implemented in one chip may be provided.
- FIG. 2 is a schematic diagram for explaining processing executed by the data processing device 1.0.
- the processing executed by the data processing device 10 is roughly divided into (1) data reception from an external network, (2) extraction of data to be analyzed, and (3) multiple data derived from the data to be analyzed. (4) Detection of illegal code in each instruction sequence.
- each process will be described.
- the communication interface 15a of the data processing device 10 receives data in a predetermined unit (for example, packet unit) according to a communication procedure conforming to the communication standard of the connected external network.
- a predetermined unit for example, packet unit
- Each unit of data to be received has a predetermined byte length, and is composed of a communication header including address information of a transmission source and a transmission destination, and user data arbitrarily created by a user.
- the user data contains an instruction code for executing a process desired by the user, and there is a possibility that an illegal process is executed by the instruction code.
- the data processing device 10 sequentially extracts the received data in byte units, stores the data in the buffer memory 13 and performs analysis.
- the position at which data extraction is started can be any predetermined position.
- the first byte of the received data may be used as the analysis start position, and the user data excluding the communication header may be used.
- the first byte of the data may be the analysis start position.
- the buffer size of the buffer memory 13 for storing the data extracted as the analysis target is predetermined, and the maximum instruction length among the instruction codes that can be decoded by the CPU to be protected is specified.
- the instruction code is preset to have a size such that at least one or more instruction codes having the same are stored.
- the instruction sequence refers to a sequence of instruction codes of the protection target CPU starting from the position specified for the analysis target data.
- the CPU 11 When performing analysis on the data to be analyzed, the CPU 11 reads data one byte at a time sequentially from the first byte of the buffer memory 13. The CPU 11 interprets which instruction code corresponds to the first byte of the instruction code in the protected CPU and reads the instruction type and the next instruction based on the interpretation result. The start position of the command and the parameters used in the instruction are stored. Actually, the correspondence between the character code of the first byte of the instruction code used in the protected CPU in the computer program of the present invention, the instruction length of the instruction code, the parameters used, and the like is determined. It has a prescribed table (hereinafter referred to as an instruction table), and when the CPU 11 loads the computer program of the present invention, the instruction table is stored in the memory 12. The CPU 11 interprets one byte of data read from the buffer memory 13 by referring to the instruction table.
- an instruction table hereinafter referred to as an instruction table
- the analysis start buffer position corresponding to the read position from buffer memory 13 is shifted by 1 byte, and another 1-byte data is read and read. Data read position
- the analysis is performed on the instruction sequence with the first byte as the first byte. By repeatedly performing such processing while sequentially shifting the analysis start buffer position, analysis is performed on a plurality of instruction sequences having different read positions.
- the data at the next read data position from the received data is stored in the analysis start buffer position of the buffer memory 13 after the analysis.
- the CPU 11 of the data processing device 10 hands over the character string of the external command or the system call based on the state of the virtual register and the virtual stack included in the virtual CPU execution environment 11a.
- An instruction sequence including an instruction code for generating a parameter or the like is detected.
- the instruction sequence it is determined that an illegal code has been detected.
- a description is given of an illegal command that generates a character string that constitutes the command name of an external command.
- immediate A is written to register ax by the mo V instruction, and the written immediate A is pushed onto the stack by the push instruction.
- immediate B is written to the register bX by the mo V instruction, and the written immediate B is! ) Pushing on the stack by the ush instruction.
- Immediate value A and immediate value B In this case, it is possible to create a desired character string on the stack, and the created character string is executed as an external command.
- the data processing unit 10 detects the instruction code group for executing the above-described processing, the external command for executing the illegal processing is monitored by monitoring the state of the register and the stack. It is possible to detect whether or not a character string is about to be created on the stack.
- the received data is interpreted as the instruction code of the CPu to be protected, and the actual states of the registers and the stack are changed to the virtual state in the virtual CPU execution environment section 11a. Monitoring is done by reflecting on the stack and virtual registers.
- the instruction code group described above is not a general code generated by the compiler, if the data processing device 10 detects such an instruction code group, an illegal code is generated. It is determined that the probability of inclusion is high.
- FIG. 3 is a schematic diagram illustrating the configuration of the analysis target data.
- the instruction length of the instruction code used in the CPU to be protected is not always constant, and instruction codes of various instruction lengths may be used.
- the received data may include, for example, simple data that is not an instruction code such as image data and document data. Therefore, if the read position of the data to be analyzed is not properly set, there is a possibility that the instruction code cannot be interpreted correctly, and the judgment about the presence or absence of the illegal code may be erroneously made.
- the analysis target stored in the buffer memory 13 is used. Reads data one byte at a time, treats it as the first byte of a certain instruction code and reads the data. Advance the analysis. By referring to the above-mentioned instruction table, the position of the next instruction code can be determined from the read one-byte data, so that the instruction codes can be sequentially grasped and analyzed.
- the target data can be interpreted as a single parallel (instruction sequence) in which multiple instruction codes are consecutive.
- the data to be analyzed shown in Fig. 3 consists of four bytes of simple data from the beginning, two bytes of instruction code (instruction 1), four bytes of instruction code (instruction 2), and four bytes of instruction code.
- Instruction code (instruction 3), 1-byte instruction code (instruction 4) are consecutive data.
- the analysis start buffer position is set to b1
- one byte of data is read, and information such as the instruction contents, the position of the next instruction code, and the parameters used in the instruction code is obtained.
- analysis of instruction sequence 1 with b 1 as the first byte is started.
- instruction sequence 5 with the position of b5 as the first byte is a correct instruction code sequence, and when instruction sequence 5 is analyzed, a character string of an external command is generated. If an invalid instruction code group is detected, it is determined that an illegal code has been detected.
- FIG. 4 and FIG. 5 are flowcharts illustrating a procedure for detecting an unauthorized code by the data processing apparatus 10.
- step S5 it is determined whether or not the data at the analysis start buffer position is the end of the received data (step S5). If the data at the analysis start buffer position ends (S5: YES), the detection of the illegal code by this flowchart ends, and if the data at the analysis start buffer position does not end (S5: YES). NO), and reads one byte of data at the analysis start buffer position (step S6). Next, the next instruction start position, instruction type, and parameters are acquired based on the read one-byte data, and are stored in the memory 12 (step S7).
- the CPU 11 determines whether or not there is an instruction sequence whose current position matches the next start position stored in the instruction sequence under analysis (step S8). If there is an instruction sequence that matches the current position with the stored next start position (S8: YES), an analysis / determination process described later is executed for all the instruction sequences (step S10). .
- step S9 analysis and judgment processing is executed (S10).
- step S11 the write buffer position is set as the analysis start buffer position (step S11), and the read data position is increased by one (step S12). Then, one byte of data is read from the read data position to the write buffer position on the buffer memory 13 (step S13). Next, the remainder obtained by dividing the value obtained by increasing the analysis buffer position by one by the buffer size is set as the next analysis start buffer position (step S14), and the processing is performed. Return to step S5 and repeat the analysis.
- Fig. 6 is a flowchart explaining the procedure of the analysis ⁇ judgment processing routine.
- the analysis process described below is performed on all instruction sequences including the one byte data read from the buffer memory 13 including the one corresponding to the first byte of the instruction code (step S). twenty one ) .
- the analysis process will be described in detail later.
- the instruction table is referred to based on the read 1-byte data, and the contents of the instruction and the parameters to be used, and the following In addition to storing the position of the instruction, etc., it monitors and analyzes the state in the virtual stack in the virtual CPU execution environment 11a.
- the CPU 11 determines whether the analyzed instruction sequence is terminated (step S22), and when the instruction sequence is not completed (S22: NO), Analysis ⁇ Terminate the judgment processing routine and shift to the processing of step S11 in FIG.
- step S23 If it is determined that the instruction sequence has been terminated (S22: YES), a determination process described later is performed (step S23). Then, the CPU 11 receives the result of the determination processing, determines whether or not an illegal code has been detected (step S24), and when it is determined that the illegal code has not been detected (step S24). S 24: NO), deletes the current instruction sequence (step S 26), If it is determined that an illegal code has been detected (S24: YES), information indicating that the illegal code has been detected is output (step S25). The information output may be transmitted to an information processing device connected to the internal network via the communication interface 15b, or displayed as character information on the data processing device 10. Alternatively, a configuration may be adopted in which a display unit that emits light or an indicator lamp that emits light and notifies the user is provided for output. Further, a configuration may be adopted in which processing is performed to shut down communication when an illegal code is detected.
- FIG. 7 is a schematic diagram showing an example of an unauthorized code.
- Figure 7 (a) shows a part of the actual malicious code. It should be noted here that the label (Shellcode + 211) is used to push the immediate value (0x68732 f6e) on the stack, and that Label
- FIG. 8 is a schematic diagram showing another example of an unauthorized code.
- Figure 8 (a) shows a part of the actual malicious code.
- the value of the register pushed to the stack is 0X68732 f2f, and the lower side force of the stack is "Z", “Z", “s”, and so on.
- a 4-byte character string "h” is created (see Fig. 8 (b)).
- the third immediate value (0x61a0b49) is written to the register by the processing of the label bsdcode + 25>, and the processing of the label bsdcode + 11> is performed in the processing of the label bsdcode + 30>.
- the logical operation with the immediate value written in the processing is performed, and the result of the logical operation is pushed to the stack by the processing of the label bsdcode + 32>.
- the value of the register to be pushed to the stack is 0X6e69262f, and the lower side force of the stack, in order, Z, b, i, ⁇ , / , /, s, h "is created (see Fig. 8 (b)).
- the features common to the instruction code groups shown in FIGS. 7 and 8 are (1) that the immediate value is pushed directly or indirectly onto the stack two or more times. )
- the int instruction is being executed without executing the ca11 instruction.
- (1) creates a character string of the name of the external command that the attacker wants to execute on the stack, and (2) calls a system call to execute the external command.
- the external command name indicates a path separator. " Since "/" is often included, the false detection rate is reduced by imposing the condition that the character code is included in the character string of the external command name, and the detection accuracy is reduced. It is also possible to further improve the detection accuracy by further imposing the condition that 0X3b is used for the function number used in the int instruction. .
- FIGS. 9 to 11 are flowcharts illustrating the processing procedure of the analysis processing routine.
- the CPU 11 of the data processing device 10 refers to the above-mentioned instruction table, so that the instruction code starting from the one-byte data read from the buffer memory 13 is mo. It is determined whether or not the instruction is a V instruction (step S31). If it is determined that the instruction is a mo V instruction (S31: YES), it is determined whether or not an immediate value is read into a register by referring to the parameters used in the mov instruction (step S). 3 2). If it is determined that the immediate value is read into the register (S32: YES), the immediate value is stored in the virtual register of the virtual CPU execution environment section 11a (step S33), and the processing is terminated. Analysis. Return to the judgment processing routine.
- step S34 it is determined whether or not the reading of a memory value is to be performed on the register (step S34). If it is determined that the memory value is read into the register (S34: YES), 0 is stored in the corresponding virtual register (step S35), and the processing is analyzed.
- step S36 When it is determined that the value of the memory is not read to the register ( S3 4: NO), it is determined whether or not the value of the register is read into the register (step S36). When it is determined that the register value is read into the register (S36: YES), the value of the virtual register is stored in the corresponding virtual register (step S37), and the processing is analyzed. Return to If it is determined that the register value is not read (S36: NO), the process returns to the analysis / determination process routine.
- step S31 if it is determined that the instruction is not a mo V instruction (S31: NO), the instruction code starting from the data read from the memory 13 is stored in the instruction memory 1a instruction. It is determined whether or not it is (step S38).
- the l ea instruction is an instruction for loading a valid address.
- step S39 it is determined whether or not the result of reading the immediate value by the 1ea instruction is obtained (step S39). If the result is that an immediate value is read (S3'9: YES), the immediate value is stored in the corresponding virtual register (step S40), and the process returns to the analysis / judgment processing routine. If the result of reading the immediate value is not obtained (S39: NO), the process returns to the analysis / judgment processing routine.
- step S38 If it is determined in step S38 that the instruction is not a 1ea instruction (S38: NO), an instruction code starting from one byte of data read from the memory memory 13! It is determined whether or not the instruction is a ush instruction (step S41). If it is determined that the instruction is a push instruction (S41: YES), it is determined whether or not to push a register value by referring to a parameter used in the push instruction (step S41).
- step S42 When the value of the register is pushed (step S42: YES), it is determined whether or not the value of the corresponding virtual register is 0 (step S43). If the value of the corresponding virtual register is 0 (S43: YES), the processing returns to the analysis / determination processing routine. Also support If the value of the virtual register to be executed is not 0 (S43: NO), the value of the virtual register is pushed to the virtual stack (step S44). Then, the push counter is incremented by 1 (step S45), and the process returns to the analysis / judgment processing routine.
- the push counter is a counter for counting the number of pushes to the virtual stack.
- step S42 If it is determined in step S42 that the value of the register is not to be pushed (S42: NO), it is determined whether or not to push the immediate value (step S46). When the immediate value is pushed (S46: YES), the value to be pushed is pushed to the virtual stack (step S47), and the push counter is increased by 1 (step S48). Then, the process returns to the analysis / judgment processing routine. If it is determined that the immediate value is not to be pushed (S46: NO), the process is returned to the analysis / judgment process Noretin.
- step S41 if it is determined that the instruction is not a push instruction (S41: NO), the instruction code starting from one byte of data read from the buffer memory 13 is a ca11 instruction. It is determined whether or not there is (step S49). If it is determined that the instruction is the ca 11 instruction (S49: YES), the virtual stack and the push counter are initialized (step S50), and the processing is returned to the analysis / determination processing routine.
- step S49 If it is determined in step S49 that the instruction is not the ca11 instruction (S49: NO), the instruction code starting from the 1-byte data read from the non-memory 13 is calculated. It is determined whether the instruction is an instruction (step S51). Operation instructions to be detected include instructions related to arithmetic operations and instructions related to logical operations. If it is determined that the instruction is an arithmetic instruction (S51: YES), it is determined whether or not the arithmetic result of the arithmetic instruction is written to a register (step S52). If it is determined that the operation result is to be written to the register (S52: YES), the corresponding operation instruction is stored in the virtual register. The process is performed using a register (step S53), and the process returns to the analysis / determination process routine. If the operation result is not to be written to the register (S52: NO), the process returns to the analysis / judgment processing routine.
- step S51 If it is determined in step S51 that the instruction is not an arithmetic instruction (S51: NO), whether the instruction code starting from one byte of data read from the memory 13 is an int instruction or not. Is determined (step S54). If it is determined that the instruction is an int instruction (S54: YES), the fact that the int instruction is detected is stored in the memory 12 (step S55), and the processing is returned to the analysis / determination processing routine.
- step S54 If it is determined in step S54 that the instruction is not an int instruction (S54: NO), the instruction code starting from the one-byte data read from the non-memory 13 is a ret instruction, It is determined whether the instruction is a ret instruction, an int 3 instruction, or an iret instruction (step S56). Each of these instructions represents an instruction for returning control from the called routine to the calling routine. If it is any of the above instructions (S56: YES), the instruction sequence currently being analyzed is terminated (step S57), and the process returns to the analysis / judgment processing routine. If it is determined that the instruction is not any of the above-mentioned instructions (S56: NO), the processing is analyzed without returning to the instruction sequence. The processing returns to the determination processing routine.
- FIG. 12 is a flowchart for explaining the processing procedure of the judgment processing routine. It is.
- the CPU 11 of the data processing device 10 determines whether or not an int instruction has been detected in the instruction sequence terminated by the above-mentioned analysis routine (step S61). If the int instruction has not been detected (S61: NO), it is determined that there is no illegal code because the system call is not executed by the interrupt processing and the external command is not executed (Step 61). S62).
- step S63 the CPU 11 determines whether or not it is greater than the push counter force (step S63). If the push counter is determined to be 0 or 1 (S63: NO), it can be considered that the character string of the external command name that the attacker wants to execute has not been generated, and there is no illegal code. Is determined (S62).
- step 63 If the push counter determines that the level is larger than 1 (S63: YES), it is determined whether or not the virtual stack has a character code corresponding to "/" indicating a path delimiter (step 63). Step S64). If the character code does not exist in the virtual stack (S64: NO), it is determined that there is no illegal code (S64). If the virtual stack has the character code (S64: YES), it is determined that there is a high probability that a system call will be called by an interrupt process and an external command will be executed. It is determined that there is (step $ 65).
- step S63 when it was detected that the push counter was larger than 1, it was determined that a character string of some external command name was generated, and that there was an illegal code. Therefore, if use in an environment where detection accuracy is required is planned, step S64 It is also possible to omit the subrogation in step S64 if the use in an environment where detection accuracy is not required is planned.
- a character code indicating a path delimiter “, no” is cited.
- a character code indicating a path delimiter is “ In some cases, " ⁇ " is used, and the character code used for side-validation is not necessarily limited to "Z” and must be set in advance according to the type of CPU to be protected.
- a relay device used for data communication such as a router, a broadband router, or a switch
- a personal computer, a server device, a mobile phone, a PDA, or the like may be used. It is also possible to apply to an information processing device having a communication function. -.
- FIG. 13 is a schematic diagram illustrating a configuration of a data processing device according to the present embodiment.
- reference numeral 100 denotes an information processing device such as a personal computer, and the information processing device 100 includes a CPU 101, and is connected to a ROM 101 via a bus 102. , RAM 104, operation unit 105, display unit 106, communication unit 107, internal storage device 108, and auxiliary storage device 109.
- the CPU 101 controls the hardware according to the control program stored in the ROM 103.
- RAM I04 is composed of SRAM or flash memory, etc., data generated when the control program stored in ROM 103 is executed, and external network received via communication unit 107. Receives various data from
- the operation unit 105 is an input device such as a keyboard and a mouse
- the display unit 106 is a display device such as a CRT and a liquid crystal display. operation
- the unit 105 and the display unit 106 are used, for example, when inputting and displaying data to be transmitted.
- the communication unit 107 includes a line termination device such as a modem, and controls transmission and reception of various types of data exchanged with an external network.
- the auxiliary storage device 109 includes an FD drive, a CD-ROM drive, and the like for reading a computer program or the like from a recording medium M such as an FD or a CD-ROM in which the computer program or the like of the present invention is recorded.
- the computer programs and the like stored in the internal storage device 108 are stored.
- the computer program stored in the internal storage device 108 is read into the RAM 104 as appropriate in response to an instruction from the CPU 101 and executed.
- the information processing device 100 functions as a device that detects an unauthorized code from the data received by the communication unit 107.
- the above-mentioned computer program is desirably a resident type program which is automatically read into the RAM I 04 when the information processing device 100 is started up. It is better to automatically detect illegal code when receiving.
- the procedure for detecting an unauthorized code is the same as that described in the first embodiment, and a description thereof will not be repeated.
- the computer program of the present invention has been described as being provided by the recording medium M, the computer program may be provided by communication means via the communication unit 107.
- the unauthorized code is detected by using an information processing device 100 such as a personal computer.
- an information processing device 100 such as a personal computer.
- a mobile phone, a PDA, a computer game machine Of course, it can be applied to in-vehicle communication devices and various information appliances.
- the computer program of the present invention may be stored in an FD, a CD-ROM, or the like.
- the information on a recording medium it can be provided as a package of application software for detecting computer viruses.
- the detection result may differ depending on where the detection start position is set.
- the detection is performed for a plurality of data sequences in which the read positions are sequentially changed. As a result, the number of erroneous determinations is reduced, and the detection accuracy can be improved.
- the instruction sequence having the data read position is provided.
- the instruction code is located at a position other than the first byte, illegal code detection can be prevented from being performed, and processing speed can be improved.
- the detection accuracy can be improved.
- the generated character code corresponds to the immediate value in the data
- the presence of illegal code can be easily detected by monitoring the register area and the stack area. And the detection accuracy can be improved.
- the fact is notified to the outside. Therefore, it is possible to prevent a trouble caused by the illegal code by, for example, interrupting the communication when the illegal code is detected.
Landscapes
- Engineering & Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Software Systems (AREA)
- Computer Hardware Design (AREA)
- General Engineering & Computer Science (AREA)
- Theoretical Computer Science (AREA)
- Virology (AREA)
- Health & Medical Sciences (AREA)
- Physics & Mathematics (AREA)
- General Physics & Mathematics (AREA)
- General Health & Medical Sciences (AREA)
- Storage Device Security (AREA)
- Devices For Executing Special Programs (AREA)
- Executing Machine-Instructions (AREA)
- Computer And Data Communications (AREA)
Abstract
Description
Claims
Priority Applications (2)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
JP2005502932A JP4320013B2 (ja) | 2003-02-26 | 2004-02-26 | 不正処理判定方法、データ処理装置、コンピュータプログラム、及び記録媒体 |
US11/211,735 US7827612B2 (en) | 2003-02-26 | 2005-08-26 | Malicious-process-determining method, data processing apparatus and recording medium |
Applications Claiming Priority (2)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
JP2003-049912 | 2003-02-26 | ||
JP2003049912 | 2003-02-26 |
Related Child Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US11/211,735 Continuation US7827612B2 (en) | 2003-02-26 | 2005-08-26 | Malicious-process-determining method, data processing apparatus and recording medium |
Publications (1)
Publication Number | Publication Date |
---|---|
WO2004077294A1 true WO2004077294A1 (ja) | 2004-09-10 |
Family
ID=32923330
Family Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
PCT/JP2004/002310 WO2004077294A1 (ja) | 2003-02-26 | 2004-02-26 | 不正処理判定方法、データ処理装置、コンピュータプログラム、及び記録媒体 |
Country Status (4)
Country | Link |
---|---|
US (1) | US7827612B2 (ja) |
JP (1) | JP4320013B2 (ja) |
TW (1) | TW200416542A (ja) |
WO (1) | WO2004077294A1 (ja) |
Cited By (5)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
JP2009501392A (ja) * | 2005-07-15 | 2009-01-15 | マイクロソフト コーポレーション | Htmlブラウザおよび拡張機能の既知の脆弱性からの免疫付与 |
JP2009093615A (ja) * | 2007-10-04 | 2009-04-30 | Korea Electronics Telecommun | 仮想環境を利用した非実行ファイル内のエクスプロイトコード分析方法及び装置 |
US8140912B2 (en) | 2006-11-02 | 2012-03-20 | Nec Corporation | Semiconductor integrated circuits and method of detecting faults of processors |
US8185737B2 (en) | 2006-06-23 | 2012-05-22 | Microsoft Corporation | Communication across domains |
US8239939B2 (en) | 2005-07-15 | 2012-08-07 | Microsoft Corporation | Browser protection module |
Families Citing this family (32)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US8046834B2 (en) * | 2005-03-30 | 2011-10-25 | Alcatel Lucent | Method of polymorphic detection |
US7591016B2 (en) * | 2005-04-14 | 2009-09-15 | Webroot Software, Inc. | System and method for scanning memory for pestware offset signatures |
US7571476B2 (en) * | 2005-04-14 | 2009-08-04 | Webroot Software, Inc. | System and method for scanning memory for pestware |
US7349931B2 (en) | 2005-04-14 | 2008-03-25 | Webroot Software, Inc. | System and method for scanning obfuscated files for pestware |
JP4754922B2 (ja) * | 2005-09-30 | 2011-08-24 | 富士通株式会社 | ワーム感染装置の検出装置 |
US8255992B2 (en) * | 2006-01-18 | 2012-08-28 | Webroot Inc. | Method and system for detecting dependent pestware objects on a computer |
US8291377B2 (en) * | 2006-01-25 | 2012-10-16 | Microsoft Corporation | External configuration of processing content for script |
US7802089B2 (en) * | 2006-01-25 | 2010-09-21 | Microsoft Corporation | Analyzing interpretable code for harm potential |
US8819822B1 (en) * | 2006-03-30 | 2014-08-26 | Vmware, Inc. | Security method for detecting intrusions that exploit misinterpretation of supplied data |
US7581136B2 (en) * | 2006-05-19 | 2009-08-25 | Hitachi, Ltd. | Method and apparatus for data recovery |
EP2044723A2 (en) * | 2006-07-12 | 2009-04-08 | Koninklijke Philips Electronics N.V. | Verifying authenticity of an execution environment |
US8190868B2 (en) | 2006-08-07 | 2012-05-29 | Webroot Inc. | Malware management through kernel detection |
US8549624B2 (en) * | 2008-04-14 | 2013-10-01 | Mcafee, Inc. | Probabilistic shellcode detection |
IL197477A0 (en) * | 2009-03-08 | 2009-12-24 | Univ Ben Gurion | System and method for detecting new malicious executables, based on discovering and monitoring of characteristic system call sequences |
US8402541B2 (en) * | 2009-03-12 | 2013-03-19 | Microsoft Corporation | Proactive exploit detection |
US11489857B2 (en) | 2009-04-21 | 2022-11-01 | Webroot Inc. | System and method for developing a risk profile for an internet resource |
JP4572259B1 (ja) * | 2009-04-27 | 2010-11-04 | 株式会社フォティーンフォティ技術研究所 | 情報機器、プログラム及び不正なプログラムコードの実行防止方法 |
US8621626B2 (en) * | 2009-05-01 | 2013-12-31 | Mcafee, Inc. | Detection of code execution exploits |
EP2494484A4 (en) * | 2009-10-31 | 2016-05-18 | Hewlett Packard Development Co | IDENTIFICATION OF POOR CODES |
US8042186B1 (en) * | 2011-04-28 | 2011-10-18 | Kaspersky Lab Zao | System and method for detection of complex malware |
US9519775B2 (en) | 2013-10-03 | 2016-12-13 | Qualcomm Incorporated | Pre-identifying probable malicious behavior based on configuration pathways |
US9213831B2 (en) | 2013-10-03 | 2015-12-15 | Qualcomm Incorporated | Malware detection and prevention by monitoring and modifying a hardware pipeline |
US10103890B2 (en) * | 2014-08-08 | 2018-10-16 | Haw-Minn Lu | Membership query method |
US10728040B1 (en) * | 2014-08-08 | 2020-07-28 | Tai Seibert | Connection-based network behavioral anomaly detection system and method |
US9361458B1 (en) * | 2014-10-08 | 2016-06-07 | Trend Micro Incorporated | Locality-sensitive hash-based detection of malicious codes |
US9514301B1 (en) | 2016-01-06 | 2016-12-06 | International Business Machines Corporation | Interlinking modules with differing protections using stack indicators |
US9576128B1 (en) | 2016-01-06 | 2017-02-21 | International Business Machines Corporation | Interlinking routines with differing protections using stack indicators |
US10228992B2 (en) | 2016-01-06 | 2019-03-12 | International Business Machines Corporation | Providing instructions to facilitate detection of corrupt stacks |
US9582274B1 (en) | 2016-01-06 | 2017-02-28 | International Business Machines Corporation | Architected store and verify guard word instructions |
US9495237B1 (en) | 2016-01-06 | 2016-11-15 | International Business Machines Corporation | Detection of corruption of call stacks |
US10120745B2 (en) | 2016-01-06 | 2018-11-06 | International Business Machines Corporation | Providing instructions to protect stack return addresses in a hardware managed stack architecture |
US9606855B1 (en) | 2016-01-06 | 2017-03-28 | International Business Machines Corporation | Caller protected stack return address in a hardware managed stack architecture |
Citations (3)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
JPH01237834A (ja) * | 1988-03-18 | 1989-09-22 | Fujitsu Ltd | ロードモジュールの編集表示方式 |
JPH11167487A (ja) * | 1997-12-02 | 1999-06-22 | Fujitsu Ltd | ウィルスチェックネットワーク、ウィルスチェック装置、クライアント端末及びウィルス情報管理局 |
JP2001344128A (ja) * | 2000-06-02 | 2001-12-14 | Nec Microsystems Ltd | 逆アセンブル表示アドレスの設定方法および記録媒体 |
Family Cites Families (8)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US5826013A (en) * | 1995-09-28 | 1998-10-20 | Symantec Corporation | Polymorphic virus detection module |
JPH09319574A (ja) | 1996-05-29 | 1997-12-12 | Nec Niigata Ltd | コンピュータウィルスチェックシステム |
US5951698A (en) | 1996-10-02 | 1999-09-14 | Trend Micro, Incorporated | System, apparatus and method for the detection and removal of viruses in macros |
US6301699B1 (en) * | 1999-03-18 | 2001-10-09 | Corekt Security Systems, Inc. | Method for detecting buffer overflow for computer security |
US6058372A (en) * | 1999-06-11 | 2000-05-02 | Sweet; Stephen R. | Interactive self-service hard drive copying system |
US6405303B1 (en) * | 1999-08-31 | 2002-06-11 | Advanced Micro Devices, Inc. | Massively parallel decoding and execution of variable-length instructions |
US7360076B2 (en) * | 2001-06-13 | 2008-04-15 | Itt Manufacturing Enterprises, Inc. | Security association data cache and structure |
US6832302B1 (en) * | 2001-10-24 | 2004-12-14 | At&T Corp. | Methods and apparatus for detecting heap smashing |
-
2004
- 2004-02-26 WO PCT/JP2004/002310 patent/WO2004077294A1/ja active Application Filing
- 2004-02-26 TW TW093104911A patent/TW200416542A/zh unknown
- 2004-02-26 JP JP2005502932A patent/JP4320013B2/ja not_active Expired - Fee Related
-
2005
- 2005-08-26 US US11/211,735 patent/US7827612B2/en not_active Expired - Fee Related
Patent Citations (3)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
JPH01237834A (ja) * | 1988-03-18 | 1989-09-22 | Fujitsu Ltd | ロードモジュールの編集表示方式 |
JPH11167487A (ja) * | 1997-12-02 | 1999-06-22 | Fujitsu Ltd | ウィルスチェックネットワーク、ウィルスチェック装置、クライアント端末及びウィルス情報管理局 |
JP2001344128A (ja) * | 2000-06-02 | 2001-12-14 | Nec Microsystems Ltd | 逆アセンブル表示アドレスの設定方法および記録媒体 |
Non-Patent Citations (1)
Title |
---|
EITARO SAITO: "2001 Nen han virus daizukan", NIKKEI NETWORK, no. 16, 22 July 2001 (2001-07-22), pages 59 - 85, XP002982548 * |
Cited By (8)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
JP2009501392A (ja) * | 2005-07-15 | 2009-01-15 | マイクロソフト コーポレーション | Htmlブラウザおよび拡張機能の既知の脆弱性からの免疫付与 |
US8225392B2 (en) | 2005-07-15 | 2012-07-17 | Microsoft Corporation | Immunizing HTML browsers and extensions from known vulnerabilities |
US8239939B2 (en) | 2005-07-15 | 2012-08-07 | Microsoft Corporation | Browser protection module |
US8185737B2 (en) | 2006-06-23 | 2012-05-22 | Microsoft Corporation | Communication across domains |
US8335929B2 (en) | 2006-06-23 | 2012-12-18 | Microsoft Corporation | Communication across domains |
US8489878B2 (en) | 2006-06-23 | 2013-07-16 | Microsoft Corporation | Communication across domains |
US8140912B2 (en) | 2006-11-02 | 2012-03-20 | Nec Corporation | Semiconductor integrated circuits and method of detecting faults of processors |
JP2009093615A (ja) * | 2007-10-04 | 2009-04-30 | Korea Electronics Telecommun | 仮想環境を利用した非実行ファイル内のエクスプロイトコード分析方法及び装置 |
Also Published As
Publication number | Publication date |
---|---|
TW200416542A (en) | 2004-09-01 |
JPWO2004077294A1 (ja) | 2006-06-08 |
US20050283838A1 (en) | 2005-12-22 |
US7827612B2 (en) | 2010-11-02 |
JP4320013B2 (ja) | 2009-08-26 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
WO2004077294A1 (ja) | 不正処理判定方法、データ処理装置、コンピュータプログラム、及び記録媒体 | |
US20230041014A1 (en) | Data pattern analysis using optimized deterministic finite automaton | |
US7895655B2 (en) | Malicious-process-determining method, data processing apparatus and recording medium | |
US9906540B2 (en) | Detecting network traffic content | |
US9990583B2 (en) | Match engine for detection of multi-pattern rules | |
CN106326742B (zh) | 确定修改的网页的***和方法 | |
KR101213821B1 (ko) | 동적 변환을 통한 프로액티브 컴퓨터 말웨어 보호 | |
JP4855400B2 (ja) | マルチパターン検索のための方法およびシステム | |
US20050273450A1 (en) | Regular expression acceleration engine and processing model | |
CN100481102C (zh) | 用于对处理器指令的快速解密的方法、装置和*** | |
US20090133125A1 (en) | Method and apparatus for malware detection | |
TWI435236B (zh) | 惡意程式偵測裝置、惡意程式偵測方法及其電腦程式產品 | |
JP2007535761A (ja) | 抗タンパーコードを生成するシステム及び方法 | |
CN105260659A (zh) | 一种基于qemu的内核级代码重用型攻击检测方法 | |
JP2012059221A (ja) | 情報処理装置、情報処理プログラム | |
JP2019061636A (ja) | ファイルのウイルス対策スキャン実行のため仮想マシン上にログを生成するシステム及び方法 | |
JP7310936B2 (ja) | 検査装置、検査方法及びプログラム | |
Daubignard et al. | ProTIP: You Should Know What to Expect From Your Peripherals | |
CN117077138B (zh) | 一种基于浏览器的异常检测方法、***、介质及设备 | |
WO2024079897A1 (ja) | 証明装置、通信システム、証明方法、及びプログラム | |
Lamanna | Adaptive security policies enforced by software dynamic translation | |
JP2006172003A (ja) | プログラム実行監視装置、プログラム実行監視方法及びプログラム作成方法 | |
KR100901701B1 (ko) | 침해패턴 처리시스템 및 그 방법 | |
CN115883244A (zh) | 应用***中guid脆弱性检测方法及装置 | |
CN114301672A (zh) | 网络风险检测方法、装置及电子设备 |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
AK | Designated states |
Kind code of ref document: A1 Designated state(s): AE AG AL AM AT AU AZ BA BB BG BR BW BY BZ CA CH CN CO CR CU CZ DE DK DM DZ EC EE EG ES FI GB GD GE GH GM HR HU ID IL IN IS JP KE KG KP KR KZ LC LK LR LS LT LU LV MA MD MG MK MN MW MX MZ NA NI NO NZ OM PG PH PL PT RO RU SC SD SE SG SK SL SY TJ TM TN TR TT TZ UA UG US UZ VC VN YU ZA ZM ZW |
|
AL | Designated countries for regional patents |
Kind code of ref document: A1 Designated state(s): BW GH GM KE LS MW MZ SD SL SZ TZ UG ZM ZW AM AZ BY KG KZ MD RU TJ TM AT BE BG CH CY CZ DE DK EE ES FI FR GB GR HU IE IT LU MC NL PT RO SE SI SK TR BF BJ CF CG CI CM GA GN GQ GW ML MR NE SN TD TG |
|
121 | Ep: the epo has been informed by wipo that ep was designated in this application | ||
WWE | Wipo information: entry into national phase |
Ref document number: 2005502932 Country of ref document: JP |
|
WWE | Wipo information: entry into national phase |
Ref document number: 11211735 Country of ref document: US |
|
DPEN | Request for preliminary examination filed prior to expiration of 19th month from priority date (pct application filed from 20040101) | ||
122 | Ep: pct application non-entry in european phase |