| 本文已被：浏览 1900次 下载 4113次 |
码上扫一扫！ |
|
|
| 基于双层BiLSTM的安装程序DLL劫持漏洞挖掘方法 |
|
陈霄1,2, 肖甫1,2, 沙乐天1,2, 王众3, 底伟鹤1,2
|
|
1.南京邮电大学 计算机学院, 江苏 南京 210023;2.江苏省无线传感网高技术研究重点实验室, 江苏 南京 210023;3.字节跳动 无恒实验室, 浙江 杭州 311100
|
|
| 摘要: |
| 动态链接库(dynamic link library, DLL)的出现给开发人员提供了极大的便利, 也提高了操作系统与应用程序之间的交互性. 然而, 动态链接库本身存在的安全性隐患不容忽视, 如何有效地挖掘Windows平台下安装程序执行过程中出现的DLL劫持漏洞是当下保障Windows操作系统安全的关键问题之一. 搜集并提取大量安装程序的属性特征, 从安装程序、安装程序调用DLL模式、DLL文件本身3个角度出发, 使用双层BiLSTM (bi-directional long short-term memory)神经网络进行学习, 抽取出漏洞数据集的多维特征, 挖掘DLL劫持未知漏洞. 实验可有效检测Windows平台下安装程序的DLL劫持漏洞, 共挖掘10个未知漏洞并获得CNVD漏洞授权, 此外通过和其他漏洞分析工具进行对比进一步验证该方法的有效性和完整性. |
| 关键词: 漏洞挖掘 神经网络 动态链接库 |
| DOI：10.13328/j.cnki.jos.006763 |
| 分类号:TP311 |
| 基金项目:国家重点研发计划(2018YFB0803400); 国家杰出青年科学基金(62125203); 国家自然科学基金面上项目(62072253) |
|
| DLL-hijacking Vulnerability Mining in Installers Based on Double-layer BiLSTM |
|
CHEN Xiao1,2, XIAO Fu1,2, SHA Le-Tian1,2, WANG Zhong3, DI Wei-He1,2
|
|
1.School of Computer Science, Nanjing University of Posts and Telecommunications, Nanjing 210023, China;2.Jiangsu High Technology Research Key Laboratory for Wireless Sensor Networks, Nanjing 210023, China;3.Wuheng Lab, ByteDance, Hangzhou 311100, China
|
| Abstract: |
| The emergence of the dynamic link library (DLL) provides great convenience for developers, which improves the interaction between the operating system (OS) and applications. However, the potential security problems of DLL cannot be ignored. Determining how to mine DLL-hijacking vulnerabilities during the running of Windows installers is important to ensure the security of Windows OS. In this paper, the attribute features of numerous installers are collected and extracted, and the double-layer bi-directional long short-term memory (BiLSTM) neural network is applied for machine learning from the perspectives of installers, the invocation modes of DLL from installers, and the DLL file itself. The multi-dimensional features of the vulnerability data set are extracted, and unknown DLL-hijacking vulnerabilities are mined. In experiments, DLL-hijacking vulnerabilities can be effectively detected from Windows installers, and 10 unknown vulnerabilities are discovered and assigned CNVD authorizations. In addition, the effectiveness and integrity of this method are further verified by comparison with other vulnerability analyzers. |
| Key words: vulnerability mining neural network dynamic link library (DLL) |
