面向动态链接过程的随机化防护机制
作者:
作者单位:

作者简介:

通讯作者:

中图分类号:

基金项目:

国家重点研发计划 (2023YFB4503702)


Randomization-based Protection Mechanism for Dynamic Linking Process
Author:
Affiliation:

Fund Project:

  • 摘要
  • |
  • 图/表
  • |
  • 访问统计
  • |
  • 参考文献
  • |
  • 相似文献
  • |
  • 引证文献
  • |
  • 资源附件
  • |
  • 文章评论
    摘要:

    程序的动态链接过程中多个阶段均存在显著的安全隐患, 然而现有的控制流保护机制对动态链接过程保护较少, 且存在防御能力片面、性能开销高及硬件依赖强等局限性. 针对上述问题, 本文提出了一种面向动态链接过程的随机化安全防护机制SecLoader. 该机制通过3个核心模块的协同工作, 实现了对动态链接全生命周期的安全防护. 在加载阶段, 引入混合加密认证机制, 防止信息泄露和动态库劫持攻击; 在符号解析阶段, 设计动态库函数名随机化技术, 防御符号劫持攻击; 在地址重定位阶段, 提出GOT表随机化技术, 增加GOT劫持的攻击成本. 本文在glibc中实现了SecLoader, 具有良好的兼容性, 并对上层应用无感知. 为验证防护能力的有效性, 构建了渗透攻击测试集, 并在真实CVE漏洞上验证了防御的有效性. 此外, 本文采用SPEC CPU 2017的C语言基准测试集进行了性能评估. 实验结果表明, SecLoader能够有效防御多种对动态链接过程的安全威胁. 在性能方面, 仅在程序加载阶段引入了42.2%的毫秒级开销, 且对程序实际运行阶段几乎无影响.

    Abstract:

    Significant security vulnerabilities exist at multiple stages of the dynamic linking process. However, existing control flow protection mechanisms provide limited protection for dynamic linking process and suffer from incomplete defense capabilities, high performance overhead, and strong hardware dependence. To address these issues, this study proposes a randomization-based protection mechanism for the dynamic linking process, named SecLoader. Security protection over the full lifecycle of dynamic linking is achieved through three collaborative modules. During the loading stage, a hybrid encryption authentication mechanism is introduced to prevent information leakage and dynamic library hijacking attacks. During symbol resolution, a randomization technique for dynamic library function names is designed to defend against symbol hijacking attacks. During address relocation, a global offset table (GOT) randomization technique is proposed to increase the attack cost of GOT hijacking. The study implements SecLoader in glibc, exhibiting good compatibility and transparency to upper-layer applications. To evaluate defense effectiveness, a penetration attack test set is constructed and real CVE vulnerabilities are used for validation. Furthermore, the study uses the C-language benchmark suite of SPEC CPU 2017 for performance evaluation. Experimental results show that SecLoader effectively mitigates multiple security threats targeting dynamic linking. In terms of performance, only a 42.2% millisecond-level overhead is introduced during program loading, while almost no impact is observed during actual program execution.

    参考文献
    相似文献
    引证文献
引用本文

刘思成,林炜,戴华昇,蒋金虎,张为华.面向动态链接过程的随机化防护机制.计算机系统应用,2026,35(8):193-204

复制
分享
相关视频

文章指标
  • 点击次数:
  • 下载次数:
  • HTML阅读次数:
  • 引用次数:
历史
  • 收稿日期:2025-12-23
  • 最后修改日期:2026-01-12
  • 录用日期:
  • 在线发布日期: 2026-05-20
  • 出版日期:
文章二维码
您是第位访问者
版权所有:中国科学院软件研究所 京ICP备05046678号-3
地址:北京市海淀区中关村南四街4号,邮政编码:100190
电话:010-62661041 传真: Email:csa@iscas.ac.cn
技术支持:北京勤云科技发展有限公司

京公网安备 11040202500063号