国家重点研发计划(2018YFB0803400); 国家杰出青年科学基金(62125203); 国家自然科学基金面上项目(62072253)
动态链接库(dynamic link library, DLL)的出现给开发人员提供了极大的便利, 也提高了操作系统与应用程序之间的交互性. 然而, 动态链接库本身存在的安全性隐患不容忽视, 如何有效地挖掘Windows平台下安装程序执行过程中出现的DLL劫持漏洞是当下保障Windows操作系统安全的关键问题之一. 搜集并提取大量安装程序的属性特征, 从安装程序、安装程序调用DLL模式、DLL文件本身3个角度出发, 使用双层BiLSTM (bi-directional long short-term memory)神经网络进行学习, 抽取出漏洞数据集的多维特征, 挖掘DLL劫持未知漏洞. 实验可有效检测Windows平台下安装程序的DLL劫持漏洞, 共挖掘10个未知漏洞并获得CNVD漏洞授权, 此外通过和其他漏洞分析工具进行对比进一步验证该方法的有效性和完整性.
The emergence of the dynamic link library (DLL) provides great convenience for developers, which improves the interaction between the operating system (OS) and applications. However, the potential security problems of DLL cannot be ignored. Determining how to mine DLL-hijacking vulnerabilities during the running of Windows installers is important to ensure the security of Windows OS. In this paper, the attribute features of numerous installers are collected and extracted, and the double-layer bi-directional long short-term memory (BiLSTM) neural network is applied for machine learning from the perspectives of installers, the invocation modes of DLL from installers, and the DLL file itself. The multi-dimensional features of the vulnerability data set are extracted, and unknown DLL-hijacking vulnerabilities are mined. In experiments, DLL-hijacking vulnerabilities can be effectively detected from Windows installers, and 10 unknown vulnerabilities are discovered and assigned CNVD authorizations. In addition, the effectiveness and integrity of this method are further verified by comparison with other vulnerability analyzers.