一种语义感知的安全检查检测方法

方宇彤; 刘洪毅; 李经纬; 文伟平

引用本文：

方宇彤,刘洪毅,李经纬,文伟平.一种语义感知的安全检查检测方法[J].信息安全学报,2020,5(5):17-29 [点击复制]
FANG Yutong,LIU Hongyi,LI Jingwei,WEN Weiping.Semantic-aware Security Check Detection Method[J].Journal of Cyber Security,2020,5(5):17-29 [点击复制]

本文已被：浏览 6067次下载 6538次	码上扫一扫！
一种语义感知的安全检查检测方法
方宇彤, 刘洪毅, 李经纬, 文伟平
0 字体:加大+\|默认\|缩小-
(北京大学软件与微电子学院北京中国 102600)

摘要:

安全检查是OS中最常见的安全增强方式，是漏洞检测的重要基石。检测安全检查必然要用到异常处理函数，本论文从检测异常处理函数入手，实现了基于异常处理函数的安全检查检测方法。论文提出了一种语义感知的安全检查检测方法（Sased），通过基于自然语义、程序语义的异常处理函数检测方法对Linux系统的函数控制流进行静态分析。同时，Sased可以对异常处理函数和安全检查进行回溯过滤从而降低其误报率。通过实验，Sased共报告异常处理函数795个，安全检查41519个，二者都达到了90%以上的检测准确率。这其中，有208个异常处理函数是之前的工作中从未发现的。同时，我们结合已有的漏洞检测方法，发现了Linux内核的9个新漏洞。实验表明Sased可以非常高效地检测OS中的异常处理函数及安全检查，从而为操作系统漏洞检测提供有益的参考。

关键词: 异常处理安全检查系统安全

DOI：10.19363/J.cnki.cn10-1380/tn.2020.09.02

投稿时间：2019-11-30修订日期：2020-02-17

基金项目:

Semantic-aware Security Check Detection Method

FANG Yutong, LIU Hongyi, LI Jingwei, WEN Weiping

(School of Software and Microelectronics, Peking University, Beijing 102600, China)

Abstract:

The security check is the most common security enhancement method in OS, and it is an essential cornerstone of vulnerability detection. Detecting security checks has to use the functions of exception handling. This paper starts with the detection of the exception handling function and implements a method of security check detection based on the exception handling function. This paper proposes a Semantic-aware Security Check Detection Method (Sased), which performs static analysis on the function control flow of the Linux system via an exception handling function detection method based on natural and program semantics. At the same time, Sased can retrospectively filter exception handling functions and security checks to reduce its false-positive rate. Through experiments, Sased reports a total of 795 exception handling functions and 41519 security checks, both of which have achieved a detection accuracy of more than 90%. Among them, 208 exception handling functions have never been found in previous work. At the same time, we combined the existing vulnerability detection methods and found 9 new vulnerabilities in the Linux kernel. Experiments show that Sased can detect exception handling functions and security checks in the OS very efficiently, thus providing a useful reference for operating system vulnerability detection.

Key words: exception handling security check system security