具有抗语义攻击的虚拟机软件保护方法研究与实现

发布时间：2018-03-26 14:16

本文选题：虚拟机软件保护　切入点：数据流混淆　出处：《西北大学》2017年硕士论文

【摘要】：软件安全问题一直以来倍受学术界和工业界的广泛关注,据2016年BSA发布的全球软件调查结果显示,2015年全球个人电脑安装的软件中39%都是非法授权使用的,这些非法授权使用的软件商业总值高达522亿美元。如何对软件进行保护,提高软件核心算法被非法逆向、破解的难度,从而保护软件研发人员的合法利益,成为急需解决的问题。虚拟机软件保护方法是目前最为主流的软件保护方法,其主要思想是利用虚拟化技术将软件内部本地x86指令转化为虚拟机设计的虚拟指令,由于虚拟指令很难被攻击者所理解,所以其具有很强的保护效果。然而已有的虚拟机软件保护方法仍无法抵御基于语义的攻击技术,给虚拟机软件保护方法带来了新的威胁。因此,本文提出了具有抗语义攻击的虚拟机软件保护方法DAS-VMP,从软件内部的数据流和执行流出发进行混淆,提高虚拟机软件保护方法抵抗语义攻击的能力,主要研究工作包括以下四个方面:(1)深入研究虚拟机软件保护方法的基本原理,对虚拟机内部框架和各个组成部分深入了解,研究基于语义的攻击技术对虚拟机软件保护方法的威胁,并针对这种攻击威胁研究相对应的保护策略。(2)针对传统虚拟机软件保护方法保护后软件内部数据流信息容易被攻击者动态追踪获取,提出对虚拟解释器引入数据流混淆技术,使虚拟解释器具有反污点分析和反符号执行的能力,并设计实现数据流混淆引擎。(3)针对传统单一进程虚拟机结构执行流简单、容易被追踪调试,在对虚拟机深入研究的基础上,将传统单一进程虚拟机结构重新设计为双进程虚拟机结构,混淆虚拟机保护后软件的执行流结构,使虚拟机保护后软件的执行流更加复杂多样,执行过程更加安全。(4)设计并实现了具有抗语义攻击的虚拟机软件保护系统DAS-VMP,并通过一组经过DAS-VMP系统保护后的软件,对本文提出的方法进行理论分析和实验分析,实验结果表明DAS-VMP方法能够有效抵抗基于语义的攻击技术。
[Abstract]:Software security has long been the focus of attention in academia and industry. According to the results of a global software survey released by BSA in 2016, 39 percent of the software installed on personal computers worldwide in 2015 was illegally licensed. The business value of these illegally licensed software is as high as $52.2 billion. How to protect the software and make it more difficult for the software core algorithms to be illegally reversed, thus protecting the legitimate interests of software developers. Virtual machine software protection method is the most popular software protection method at present. Its main idea is to use virtualization technology to transform the software internal x86 instructions into virtual instructions of virtual machine design. Because the virtual instruction is difficult to understand by the attacker, it has strong protection effect. However, the existing virtual machine software protection method is still unable to resist the semantic attack technology. It brings new threat to virtual machine software protection method. Therefore, this paper proposes a semantic attack resistant virtual machine software protection method DAS-VMP.DAS-VMPs is confused from the internal data flow and execution outflow of the software. To improve the ability of virtual machine software protection method to resist semantic attack, the main research work includes the following four aspects: 1) deeply study the basic principle of virtual machine software protection method, and deeply understand the internal framework and each component of virtual machine. This paper studies the threat of semantic attack technology to virtual machine software protection. Aiming at the corresponding protection strategy of this attack threat research. (2) aiming at the traditional virtual machine software protection method, the data flow information inside the software is easy to be dynamically tracked and acquired by the attacker, so a data stream obfuscation technique is introduced to the virtual interpreter. The virtual interpreter has the ability of anti-stain analysis and anti-symbol execution, and designs and implements the obfuscation engine of data flow. It is simple and easy to be tracked and debugged in view of the traditional single process virtual machine structure. The traditional single process virtual machine structure is redesigned as a dual process virtual machine structure, which confuses the execution flow structure of the software after virtual machine protection, and makes the execution flow of the software after virtual machine protection more complex and diverse. This paper designs and implements a virtual machine software protection system DAS-VMPwith semantic attack. Through a set of software which is protected by DAS-VMP system, the method proposed in this paper is analyzed theoretically and experimentally. Experimental results show that the DAS-VMP method can effectively resist semantic attack techniques.
【学位授予单位】：西北大学
【学位级别】：硕士
【学位授予年份】：2017
【分类号】：TP311.5;TP309

【相似文献】