一种抗语义攻击的虚拟化软件保护方法

发布时间：2018-06-19 08:19

本文选题：虚拟机软件保护 + 数据流混淆　；参考：《工程科学与技术》2017年01期

【摘要】：随着计算机和网络的发展,软件核心算法面临着被逆向的威胁越来越大。虚拟机软件保护方法作为一种新型的软件保护方法,利用虚拟化技术保护软件的核心算法。因虚拟指令很难被理解,故其保护强度较高。但是,该方法仍无法抵御基于语义的攻击方法对虚拟机保护后的软件攻击,由此给软件安全带来了严重的威胁。针对现有的各类虚拟机软件保护方法无法应对目前恶意攻击者基于语义攻击的问题,提出了一种抗语义攻击的虚拟机软件保护方法即DAS-VMP。该方法分析了基于语义攻击的关键技术,依此研究出抵抗语义攻击的方法。从程序内部的数据流和执行流出发,通过设计数据流混淆引擎对虚拟机中虚拟解释器(Handlers)进行数据流混淆,使程序内部的数据流结构变得复杂多样,从而攻击者无法进行数据流的分析。隐藏虚拟机中的谓词信息,以抵抗攻击者的符号执行技术,同时将单一进程虚拟机设计为双进程虚拟机,控制软件运行过程中的执行流,使软件的执行过程更加难以被追踪,最终使经过保护后的软件呈现出一种复杂的数据流和执行流,从而阻止攻击者通过基于语义的攻击方法进行逆向分析。理论分析表明,DAS-VMP能够有效抵抗基于语义的攻击,与两款商业虚拟机保护系统的比较表明DAS-VMP对系统的性能开销较小。
[Abstract]:With the development of computer and network, software core algorithm is facing the threat of reverse. Virtual machine software protection, as a new software protection method, uses virtualization technology to protect the core algorithm of software. Because the virtual instruction is difficult to understand, its protection intensity is high. However, the method can not resist the semantic attack on the virtual machine protection software attack, which brings a serious threat to the software security. In order to solve the problem of malicious attackers based on semantic attack, a method of virtual machine software protection (DAS-VMPs) against semantic attack is proposed. The key technology of semantic attack is analyzed, and the method of resisting semantic attack is studied. Starting from the data flow and execution flow within the program, the virtual interpreter Handlersin the virtual machine is confused by designing the data stream confusion engine, which makes the data flow structure of the program complex and diverse. As a result, the attacker is unable to analyze the data flow. The predicate information in the virtual machine is hidden to resist the symbol execution technology of the attacker. At the same time, the single process virtual machine is designed as a dual process virtual machine, which controls the execution flow in the software running process, which makes the software execution process more difficult to track. Finally, the protected software presents a kind of complex data flow and execution flow, which prevents the attacker from performing reverse analysis through a semantic-based attack method. Theoretical analysis shows that DAS-VMP can effectively resist semantic-based attacks, and compared with two commercial virtual machine protection systems, DAS-VMP has low performance overhead.
【作者单位】：西北大学信息科学与技术学院;西北大学-爱迪德信息安全联合实验室;
【基金】：国家自然科学基金资助项目(61572402;61373177) 陕西省国际科技合作与交流计划资助项目(2013KW01-02;2015KW-003;2016KW-034) 中国博士后科学基金资助项目(2012M521797)
【分类号】：TP309

【相似文献】