基于数据特征的内核恶意软件检测

内核恶意软件对操作系统的安全造成了严重威胁.现有的内核恶意软件检测方法主要从代码角度出发,无法检测代码复用、代码混淆攻击,且少量检测数据篡改攻击的方法因不变量特征有限导致检测能力受限.针对这些问题,提出了一种基于数据特征的内核恶意软件检测方法,通过分析内核运行过程中内核数据对象的访问过程,构建了内核数据对象访问模型;然后,基于该模型讨论了构建数据特征的过程,采用动态监控和静态分析相结合的方法识别内核数据对象,利用EPT监控内存访问操作构建数据特征;最后讨论了基于数据特征的内核恶意软件检测算法.在此基础上,实现了内核恶意软件检测原型系统MDS-DCB,并通过实验评测MDS-DCB的有效性和性能.实验结果表明：MDS-DCB能够有效检测内核恶意软件,且性能开销在可接受的范围内.     

RTDMiner: 基于数据挖掘的引用计数更新缺陷检测方法

在Linux内核等大型底层系统中广泛采用引用计数来管理共享资源.引用计数需要与引用资源的对象个数保持一致,否则可能导致不恰当引用计数更新缺陷,使得资源永远无法释放或者被提前释放.为检测不恰当引用计数更新缺陷,现有静态检测方法通常需要知道哪些函数增加引用计数,哪些函数减少引用计数.而手动获取这些关于引用计数的先验知识过于费时且可能有遗漏.基于挖掘的缺陷检测方法虽然可以减少对先验知识的依赖,但难以有效检测像不恰当引用计数更新缺陷这类路径敏感的缺陷.为此,提出一个将数据挖掘技术和静态分析技术深度融合的不恰当引用计数更新缺陷检测方法 RTDMiner.首先,根据引用计数的通用规律,利用数据挖掘技术从大规模代码中自动识别增加或减少引用计数的函数.然后,采用路径敏感的静态分析方法检测增加了引用计数但没有减少引用计数的缺陷路径.为了降低误报,在检测阶段再次利用数据挖掘技术来识别例外模式.在Linux内核上的实验结果表明,所提方法能够以将近90%的准确率自动识别增加或减少引用计数的函数.而且RTDMiner检测到的排行靠前的50个疑似缺陷中已经有24个被内核维护人员确认为真实缺陷.     

基于虚拟机监控器的隐私透明保护

操作系统漏洞经常被攻击者利用,从而以内核权限执行任意代码(返回用户态攻击,ret2user)以及窃取用户隐私数据.使用虚拟机监控器构建了一个对操作系统及应用程序透明的内存访问审查机制,提出了一种低性能开销并且无法被绕过的内存页面使用信息实时跟踪策略;结合安全加载器,保证了动态链接库以及应用程序的代码完整性.能够确保即使操作系统内核被攻击,应用程序的内存隐私数据依然无法被窃取.在Linux操作系统上进行了原型实现及验证,实验结果表明,该隐私保护机制对大多数应用只带来6%~10%的性能负载.     

基于森林算法的电力计量终端通信故障识别

针对当前电力计量终端通信故障识别存在识别正确率、召回率较低的问题,引入森林算法,尝试开展对其故障识别方法的设计研究。通过对电力计量终端通信数据预处理、基于森林算法的故障的识别随机森林模型构建、电力计量终终端通信故障识别与排查,提出一种全新的故障识别方法。通过实验的方式将新的故障识别方法和基于样本均衡与特征交互的识别方法应用到相同环境,验证表明新的识别方法具有更优的正确率和召回率,进而促进识别精度提升。     

Linux内核启动过程分析

结合Linux内核代码,分析了80x86平台上Linux操作系统内核的启动过程,特别对内核的动态加载、CPU工作模式的转换以及内存分页机制最终启动的全过程做了较为细致的阐述.该分析有助于更深入地了解Linux内核的工作原理和多任务操作系统的实现机理,是将Linux运用于嵌入式系统的前期工作.     

本体辅助的自动化模式匹配技术

在基于映射的数据交换系统框架下,提出了一种本体辅助的模式匹配方法.它利用WordNet词汇本体和决策树学习相结合的方法进行属性名称匹配,构建数据类型本体计算属性数据类型的语义距离,依赖领域本体发现一对多的语义匹配关系,这3个过程逐步提高了匹配质量.建立在实际应用数据上的实验结果表明,该方法具有较高的精确度和召回率.     

一种基于属性的操作系统内核自动验证方法

传统的模型检测摒除了很多软件实现细节,要检测实际的代码,就需要从代码中直接建立抽象描述.而操作系统内核结构复杂,手动对源代码进行抽象存在建模工作量大、人工参与过多易出错以及属性难以描述和检测等问题.本文以Linux内核作为实验对象,提出了一种基于属性的OS内核自动验证方法,利用模型抽取工具Modex自动的从inux内核源代码抽取模型,试图保证模型与实现代码一致性的同时减少因人工参与产生的人为错误,然后用时间轴属性来描述属性,最后用模型检测工具Spin对Linux内核代码模型进行检测.实验选取了Linux内核中接口和数据结构相对复杂的调度器进行模型的自动抽取与属性检测,验证了该方法在操作系统内核模型检测中的有效性和实用性.     

在线字轮数字式仪表的自动读取技术

针对字轮数字式仪表传统手工读数所带来的费时、费力、时效性低等问题,提出了一种模板匹配与特征提取相结合的改进数字识别方法.其基于数字的多个明显形状特征,并给予不同加权值的模式匹配法有效地改进了识别正确率.实验证明,该读取技术具有较高的实时性与鲁棒性.     

增强Linux系统安全性的综合实现方式

综合多种安全模型的优点,提出了一种基于Linux内核的安全操作系统分层实现机制,从而弥补原始Linux内核安全性较差的缺点,为安全性要求较高的场合提出了一种可行的方案.     

Linux目标代码内核补丁的机理和应用

该文介绍了基于目标代码(二进制编译文件)为Linux运行时系统内核内存映像打补丁以修改内核的原理和方法,并给出了一个示例场景和程序以说明其应用。掌握该方法对于内核开发、系统调试和系统安全都具有重要的实用价值。     

Refcount Field Identification for Linux Kernel Based on Deep Learning

Reference counting (refcount) is a common memory management technique in modern software. Refcount errors can often lead to severe memory errors such as memory leak and use-after-free. Many efforts to harden refcount security rely on known refcount fields as their input. However, due to the complexity of software code, identifying refcount fields in source code is very challenging. Traditional methods of identifying refcount fields are mainly based on code pattern matching and have great limitations such as requiring expert experience to summarize code patterns, which is a laborious job. Besides, the manually summarized patterns do not cover all cases, resulting in low recall rate. To address these problems, this paper proposes to characterize a field based on the field name and the code behavior associated with the field and designs a multimodal deep learning based approach. The paper implements a prototype of the new approach for Linux kernel code. In the evaluation, the precision and recall rate achieved by the prototype system are 96.98% and 93.54%, respectively. In contrast, the traditional identification method based on code pattern matching did not report any refcount fields on the testing set. In addition, we identify 61 refcount fields which are implemented with insecure data types in the latest Linux kernel. Until now, we have reported 21 of them to the Linux community, of which six have been confirmed.     

针对内核模块访存错误的内存检测方法

分析了Linux 内核模块特点,针对内核模块中二进制指令执行时带来的访存错误,设计了一种针对内核模块的静态检测方法。通过模拟内核模块中指令的执行,并比较访存指令请求与相关内存区域信息,静态检测方法目标是找出代码对内存的非法访问,并对可疑的访存行为发出警告。针对 ARM 处理器平台,给出了静态检测方法的具体实现,并对内核模块中的访存错误就行了检测验证。实验表明,静态检测方法能够有效找出包括地址越界访问、读未初始化内存、访问已释放内存等访存错误,本文的静态检测方法达到了预期的检测效果。     

基于进程切换的任务性能测试内核插桩研究

嵌入式软件测试中,代码覆盖率测试和内存检测通过给程序源代码插桩,在程序动态运行的过程中搜集测试数据;但是这种插桩无法获取进程每次运行的时间。基于进程切换的内核taskhook插桩,是通过对Linux2．6操作系统内核进行分析,建立了进程监控的插桩点选取,获取进程生命周期中的时间相关的指标,最终实现程序的任务性能测试。     

采用C＋＋代码插装的实时软件内存错误分析

在航天领域中,安全关键的大型实时软件系统往往直接影响到任务成败,一般难以全面检测、分析或避免内存泄漏等常见内存错误。定义了实时软件的12种典型内存故障模式,提出了一种基于C＋＋代码插装的实时软件内存错误快速分析方法。该方法通过对C＋＋源代码进行静态分析,获取指针变量相关信息;通过C＋＋代码插装和运行不同测试用例,实时收集统计C＋＋指针对象的分配、释放、赋值、c-use和p-use使用情况,结合实时软件的典型内存故障模式进行分析,并自动生成详情报告。应用案例表明,该方法能够高效快捷地发现实时软件潜在的典型内存错误,从而有效提高软件质量。     

KAL: kernel‐assisted non‐invasive memory leak tolerance with a general‐purpose memory allocator

Memory leaks are a continuing problem in the software developed with programming languages, such as C and C++. A recent approach adopted by some researchers is to tolerate leaks in the software application and to reclaim the leaked memory by use of specially constructed memory allocation routines. However, such routines replace the usual general‐purpose memory allocator and tend to be less efficient in speed and in memory utilization. We propose a new scheme which coexists with the existing memory allocation routines and which reclaims memory leaks. Our scheme identifies and reclaims leaked memory at the kernel level. There are some major advantages to our approach: (1) the application software does not need to be modified; (2) the application does not need to be suspended while leaked memory is reclaimed; (3) a remote host can be used to identify the leaked memory, thus minimizing impact on the application program's performance; and (4) our scheme does not degrade the service availability of the application while detecting and reclaiming memory leaks. We have implemented a prototype that works with the GNU C library and with the Linux kernel. Our prototype has been tested and evaluated with various real‐world applications. Our results show that the computational overhead of our approach is around 2% of that incurred by the conventional memory allocator in terms of throughput and average response time. We also verified that the prototype successfully suppressed address space expansion caused by memory leaks when the applications are run on synthetic workloads. Copyright © 2010 John Wiley & Sons, Ltd.     

嵌入式Linux内核运行态性能可视化分析方法的设计与实现

介绍了嵌入式Linux操作系统下的一种内核运行态可视化性能分析方法.它采用Linux的字符设备驱动技术,Linux内核源代码内的探针嵌入以及内核补丁技术,基于Socket的Linux端与Windows端的TCP通信技术和Windows端的图形化显示技术,以模块化方式实现了在Windows宿主操作系统下对Linux操作系统运行时系统事件状态变化的图形化地观察手段,从而辅助软件开发人员方便地去诊断和解决嵌入式Linux系统中存在的调度问题、性能问题以及定时问题等.     

WYSIWIB: exploiting fine‐grained program structure in a scriptable API‐usage protocol‐finding process

Bug‐finding tools rely on specifications of what is correct or incorrect code. As it is difficult for a tool developer or user to anticipate all possible specifications, strategies for inferring specifications have been proposed. These strategies obtain probable specifications by observing common characteristics of code or execution traces, typically focusing on sequences of function calls. To counter the observed high rate of false positives, heuristics have been proposed for ranking or pruning the results. These heuristics, however, can result in false negatives, especially for rarely used functions. In this paper, we propose an alternate approach to specification inference, in which the user guides the inference process using patterns of code that reflect the user's understanding of the conventions and design of the targeted software project. We focus on specifications describing the correct usage of API functions, which we refer to as API protocols. Our approach builds on the Coccinelle program matching and transformation tool, which allows a user to construct patterns that reflect the structure of the code to be matched. We evaluate our approach on the source code of the Linux kernel, which defines a very large number of API functions with varying properties. Linux is also critical software, implying that fixing even bugs involving rarely used protocols is essential. In our experiments, we use our approach to find over 3000 potential API protocols, with an estimated false positive rate of under 15% and use these protocols to find over 360 bugs in the use of API functions. Copyright © 2012 John Wiley & Sons, Ltd.     

基于MPC860启动引导程序研究与设计

启动引导程序是嵌入式程序的开头部分,它负责ES860的硬件初始化,载入操作系统内核,向内核传递参数信息,并将控制转交给内核,然后由内核软件再初始化操作系统,从而实现整个系统的启动;文中通过对Linux引导程序工作原理和机制的分析,介绍了在嵌入式Linux系统下基于MPC860的启动引导程序的设计方法,分析了CPU、存储器、ES860的初始化过程,结合对引导程序Uboot的源代码讨论,提出了一个在ES860开发平台上实现的引导程序,对引导过程的第一阶段和第二阶段以及相应的源程序都作了详细的分析,对源程序的调试和固化过程也作了简要讨论.