信息网络安全

信息网络安全 ›› 2017, Vol. 17 ›› Issue (11): 62-66.doi: 10.3969/j.issn.1671-1122.2017.11.010

• • 上一篇    下一篇

基于签名认证的DLL加载漏洞防御技术研究

刘峰宇(), 解炜   

  1. 国防科技大学计算机学院,湖南长沙 410073
  • 收稿日期:2017-08-28 出版日期:2017-11-20 发布日期:2020-05-12
  • 作者简介:

    作者简介： 刘峰宇（1987—）, 男, 河北, 硕士研究生, 主要研究方向为操作系统和网络安全;解炜（1984—）,男,湖南,助理研究员,博士,主要研究方向为物联网安全、Web安全。

  • 基金资助:
    国家自然科学基金 [61472437]

Research on DLL Loading Vulnerability Defense Technology Based on Signature Verification

Fengyu LIU(), Wei XIE   

  1. College of Computer, National University of Defense Technology, Changsha Hunan 410073, China
  • Received:2017-08-28 Online:2017-11-20 Published:2020-05-12

RichHTML

1

PDF (PC)

531

摘要：

动态链接库（Dynamic Link Library,DLL）是Windows操作系统中共享函数库概念的一种实现方式,其中包含可供多个程序同时使用的代码和数据。动态链接库虽然为操作系统提供模块化的共享机制,但由于其加载机制不完善,衍生出DLL劫持等安全漏洞。文章首先提出一种利用操作系统回调机制进行DLL加载认证以抵御DLL加载漏洞攻击的技术方案;然后在Windows 7操作系统平台上实现和验证;最后分析评述该方法的实用性、稳定性和扩展性。仿真实验结果证明,文章提出的防御机制能够有效监控DLL文件的加载过程,并在近实时环境条件下监测到恶意文件加载行为。

关键词: 驱动编程, DLL加载漏洞, 回调机制

Abstract:

The dynamic link library is an implementation of the shared library concept in the Windows operating system, which includes codes and data that can be simultaneously used in many programs. Although the dynamic link library provides a modular sharing mechanism for the operating system, its imperfect loading mechanism causes many security vulnerabilities such as DLL hijacking. This paper firstly proposes a technical solution to verify the DLL loading and defense DLL loading vulnerability attacks by the operating system callback mechanism, then implements and tests the technical solution on the platform of Windows 7 operating system, finally discusses the practicality, stability and scalability of the technical solution. The simulation results prove that the defense mechanism can effectively monitor the loading process of DLL files, and find out the loading behavior of malicious files in nearly real-time conditions.

Key words: drive programming, DLL loading vulnerability, callback mechanism

中图分类号: