Memory-unsafe programming languages,such as C/C++,are often used to develop system programs,rendering the programs susceptible to a variety of memory corruption attacks.Among these threats,just-in-time return-oriented...Memory-unsafe programming languages,such as C/C++,are often used to develop system programs,rendering the programs susceptible to a variety of memory corruption attacks.Among these threats,just-in-time return-oriented programming(JIT-ROP)stands out as an advanced method for conducting code-reuse attacks,effectively circumventing code randomization safeguards.JIT-ROP leverages memory disclosure vulnerabilities to obtain reusable code fragments dynamically and assemble malicious payloads dynamically.In response to JIT-ROP attacks,several re-randomization implementations have been developed to prevent the use of disclosed code.However,existing re-randomization methods require recurrent re-randomization during program runtime according to fixed time windows or specific events such as system calls,incurring significant runtime overhead.In this paper,we present the design and implementation of PtrProxy,an efficient re-randomization approach on the AArch64 platform.Unlike previous methods that necessitate frequent runtime rerandomization or reply on unreliable triggering conditions,this approach triggers the re-randomization process by detecting the code page harvest operation,which is a fundamental operation of the JIT-ROP at-tacks,making our method more efficient and reliable than previous approaches.We evaluate PtrProxy on benchmarks and real-world applications.The evaluation results show that our approach can effectively protect programs from JIT-ROP attacks while introducing marginal runtime overhead.展开更多
Advanced persistent threat(APT)can use malware,vulnerabilities,and obfuscation countermeasures to launch cyber attacks against specific targets,spy and steal core information,and penetrate and damage critical infrastr...Advanced persistent threat(APT)can use malware,vulnerabilities,and obfuscation countermeasures to launch cyber attacks against specific targets,spy and steal core information,and penetrate and damage critical infrastructure and target systems.Also,the APT attack has caused a catastrophic impact on global network security.Traditional APT attack detection is achieved by constructing rules or manual reverse analysis using expert experience,with poor intelligence and robustness.However,current research lacks a comprehensive effort to sort out the intelligent methods of APT attack detection.To this end,we summarize and review the research on intelligent detection methods for APT attacks.Firstly,we propose two APT attack intelligent detection frameworks for endpoint samples and malware,and for malwaregenerated audit logs.Secondly,this paper divides APT attack detection into four critical tasks:malicious attack detection,malicious family detection,malicious behavior identification,and malicious code location.In addition,we further analyze and summarize the strategies and characteristics of existing intelligent methods for each task.Finally,we look forward to the forefront of research and potential directions of APT attack detection,which can promote the development of intelligent defense against APT attacks.展开更多
Focusing on the sensitive behaviors of malware, such as privacy stealing and money costing, this paper proposes a new method to monitor software behaviors and detect malicious applications on Android platform. Accordi...Focusing on the sensitive behaviors of malware, such as privacy stealing and money costing, this paper proposes a new method to monitor software behaviors and detect malicious applications on Android platform. According to the theory and implementation of Android Binder interprocess communication mechanism, a prototype system that integrates behavior monitoring and intercepting, malware detection, and identification is built in this work. There are 50 different kinds of samples used in the experiment of malware detection, including 40 normal samples and 10 malicious samples. The theoretical analysis and experimental result demonstrate that this system is effective in malware detection and interception, with a true positive rate equal to 100% and a false positive rate less than 3%.展开更多
基金supported in part by the National Natural Science Foundation of China(62272351,61972297,62172308).
文摘Memory-unsafe programming languages,such as C/C++,are often used to develop system programs,rendering the programs susceptible to a variety of memory corruption attacks.Among these threats,just-in-time return-oriented programming(JIT-ROP)stands out as an advanced method for conducting code-reuse attacks,effectively circumventing code randomization safeguards.JIT-ROP leverages memory disclosure vulnerabilities to obtain reusable code fragments dynamically and assemble malicious payloads dynamically.In response to JIT-ROP attacks,several re-randomization implementations have been developed to prevent the use of disclosed code.However,existing re-randomization methods require recurrent re-randomization during program runtime according to fixed time windows or specific events such as system calls,incurring significant runtime overhead.In this paper,we present the design and implementation of PtrProxy,an efficient re-randomization approach on the AArch64 platform.Unlike previous methods that necessitate frequent runtime rerandomization or reply on unreliable triggering conditions,this approach triggers the re-randomization process by detecting the code page harvest operation,which is a fundamental operation of the JIT-ROP at-tacks,making our method more efficient and reliable than previous approaches.We evaluate PtrProxy on benchmarks and real-world applications.The evaluation results show that our approach can effectively protect programs from JIT-ROP attacks while introducing marginal runtime overhead.
基金supported by the National Natural Science Foundation of China(No.62562012,No.62172308,and No.61972297)the Guizhou Provincial Basic Research Program(Natural Science)under Grant QKHJC-MS[2025]686+3 种基金the Major Scientific and Technological Special Project of Guizhou Province under Grant[2024]014the Guizhou Provincial Key Technology R&D Program under Grant PA[2025]004the Research Project for Recruited Talents at Guizhou University under Grant GDRJH[2024]15the Student Innovation Funding Project of the School of Cyber Security(i.e.,security knowledge graph of Qianxin project).
文摘Advanced persistent threat(APT)can use malware,vulnerabilities,and obfuscation countermeasures to launch cyber attacks against specific targets,spy and steal core information,and penetrate and damage critical infrastructure and target systems.Also,the APT attack has caused a catastrophic impact on global network security.Traditional APT attack detection is achieved by constructing rules or manual reverse analysis using expert experience,with poor intelligence and robustness.However,current research lacks a comprehensive effort to sort out the intelligent methods of APT attack detection.To this end,we summarize and review the research on intelligent detection methods for APT attacks.Firstly,we propose two APT attack intelligent detection frameworks for endpoint samples and malware,and for malwaregenerated audit logs.Secondly,this paper divides APT attack detection into four critical tasks:malicious attack detection,malicious family detection,malicious behavior identification,and malicious code location.In addition,we further analyze and summarize the strategies and characteristics of existing intelligent methods for each task.Finally,we look forward to the forefront of research and potential directions of APT attack detection,which can promote the development of intelligent defense against APT attacks.
基金Supported by the National Natural Science Foundation of China(61103220)the Fundamental Research Funds for the Central Universities (6082013)+1 种基金the National Natural Science Foundation of Hubei(2011CDB456)Chenguang Program(2012710367)
文摘Focusing on the sensitive behaviors of malware, such as privacy stealing and money costing, this paper proposes a new method to monitor software behaviors and detect malicious applications on Android platform. According to the theory and implementation of Android Binder interprocess communication mechanism, a prototype system that integrates behavior monitoring and intercepting, malware detection, and identification is built in this work. There are 50 different kinds of samples used in the experiment of malware detection, including 40 normal samples and 10 malicious samples. The theoretical analysis and experimental result demonstrate that this system is effective in malware detection and interception, with a true positive rate equal to 100% and a false positive rate less than 3%.
