Existing memory attacks against SGX use the enclave interface, such as ECALLs and OCALLs, to inject malicious data into the enclave’s trusted memory to trigger memory corruption vulnerabilities therein. Therefore, en...
Existing memory attacks against SGX use the enclave interface, such as ECALLs and OCALLs, to inject malicious data into the enclave’s trusted memory to trigger memory corruption vulnerabilities therein. Therefore, enclave interface security becomes a key issue in defending against such attacks. However, a comprehensive static analysis of source SGX programs is currently lacking to obtain sufficient a priori knowledge to provide effective runtime interface protection for the enclave. In view of this, we identify 8 types of unsafe input data of enclave and design a new interface cropping method, SGXCrop. This method extracts critical interface information from source SGX programs, including ECALLs in use and unsafe input data, which are cropped at runtime of SGX programs. Tests in real SGX environment verify that the proposed method can effectively crop illegal ECALLs and unsafe input data.
With the intensification of informatization and mobility, various web security threats are emerging. Cross-site scripting (XSS) attack is the most common type of web attack. Most traditional detection methods have bee...
详细信息
With the intensification of informatization and mobility, various web security threats are emerging. Cross-site scripting (XSS) attack is the most common type of web attack. Most traditional detection methods have been difficult to adapt to the existing confusion variants of XSS attacks. In this paper, we extract features based on big data collected from 2017 to 2022. In order to improve the XSS detection effect of detection tools, we build machine learning models based on more than 210,000 positive and negative samples, among which CNN has the best performance. Furthermore, we propose a new algorithm that improves the traditional virtual sample generation technology based on prior knowledge in order to improve the generalization of the models. Experimental results show that in most cases, the performance of the algorithm in this paper is better than other VSG methods, and the ability to detect and discover unknown attacks is improved to a certain extent.
Software vulnerability detection is crucial for maintaining the security and stability of software systems. In this paper, we propose a novel neural network model called TS-GGNN to address the problem of vulnerability...
Software vulnerability detection is crucial for maintaining the security and stability of software systems. In this paper, we propose a novel neural network model called TS-GGNN to address the problem of vulnerability detection in source code slices. The TS-GGNN model effectively captures both local and global features of vulnerable code by fusing sequence features with graph features. To achieve this, we utilize graph structure and sequence structure learning approaches to comprehensively extract valuable information from the source code slices. Our experiments are conducted on the SARD dataset, which consists of 61,638 code samples annotated for the presence or absence of vulnerabilities. The results demonstrate that TS-GGNN has the best vulnerability detection performance, with an accuracy of 99.4%, a precision of 98.81%, and an F1 score as high as 99.4% thereby validating the effectiveness of the TS-GGNN model in capturing features relevant to software vulnerabilities.
The difference between real devices and virtual environments causes a low success rate of application-layer program emulation when the firmware is operating in full-system emulation during the dynamic analysis of the ...
The difference between real devices and virtual environments causes a low success rate of application-layer program emulation when the firmware is operating in full-system emulation during the dynamic analysis of the firmware of embedded devices. In this paper, we propose ALEmu, an emulation framework for application-layer programs, which can effectively improve the emulation success rate of application-layer programs in embedded device firmware through automatic preprocessing of target programs, building configuration libraries, and hooking external program calls. When we test ALEmu on a variety of real-world devices, including routers and IP cameras, we find that it performs more successfully and accurately than the current state-of-the-art full-system emulation frameworks like Firmadyne and FirmAE.
Device simulation is an important method of embedded device security analysis, due to the extensive and heterogeneous nature of the current peripherals, the existing simulation technology for peripheral simulation is ...
详细信息
Device simulation is an important method of embedded device security analysis, due to the extensive and heterogeneous nature of the current peripherals, the existing simulation technology for peripheral simulation is mostly fuzzy, to find the input and output that meet the firmware requirements as the main goal. In order to construct a template based on IO interface identification to extend the peripheral simulation scheme, this paper identifies the IO interface without firmware source code based on the characteristics of the IO configuration process in MCU firmware. Through experimental comparison, this method has a certain effect in MCU firmware interface recognition.
Targeted at the situation of rampant attack on UEFI Platform Firmware, this paper systematically analyzes the Security mechanisms of UEFI platform firmware. Then the vulnerability factors of UEFI firmware are describe...
详细信息
A major user need is the completion of security audits by locating vulnerability functions using vulnerability information published by firmware manufacturers. However, it is difficult to manually analyze the relative...
详细信息
Knowledge graph representation learning provides a lot of help for subsequent tasks such as knowledge graph completion, information retrieval, and intelligent question answering. By representing the knowledge graph as...
详细信息
As the existing malware intelligent detection methods have shortcomings and low accuracy of manual feature extraction and feature processing, a Malware Detection Framework with Attention mechanism based on Bi-directio...
详细信息
Cross-network user matching is the one of the fundamental problems in social network fusion and analysis. This paper proposes an unsupervised algorithm based on association strength to address this problem. Specifical...
详细信息
暂无评论