Abstract: Concerning the low precision of static analysis in the traditional data randomization techniques, a Fine-Grained Data Randomization (FGDR) technique based on field-sensitive pointer analysis was proposed. During the static analysis, firstly, the syntax of the intermediate representation was abstracted to obtain the formal statement representation. Then, a non-standard type inference system was established to describe points-to relationship between the variables. Finally, field-sensitive points-to relationship was solved by implementing type inference based on type rules. Based on the point-to relationship, the intermediate representation was randomizationly encrypted and translated to the randomized executable program. The experimental results indicate that, compared with the existing data randomization techniques, the proposed data randomization technique based on field-sensitive pointer analysis improved the precision of analysis. The processing time of the proposed technique was increased 2% while the run-time was decreased 3% on average. The proposed technique brings less overhead to the executable program and can effectively increase the defense ability with the field-sensitive pointer analysis algorithm.

Key words: randomization, pointer analysis, field-sensitive, injection attack

摘要： 针对传统的数据随机化技术静态分析精度不高的问题,提出一种基于域敏感指针分析算法的细粒度数据随机化技术。在静态分析过程中,首先对中间表示进行语法抽象,得到形式化的语言表示;然后建立非标准类型系统,描述变量之间的指向关系;最后按照类型规则进行类型推断并求解,得到域敏感的指向关系。根据指向关系对数据进行随机化加密,得到经过随机化的可执行程序。实验数据表明,基于域敏感指针分析的数据随机化技术与传统的数据随机化技术相比,分析精度显著提高;处理时间开销平均增加了2%,但运行时间开销平均减少了3%。所提技术利用域敏感的指针分析,给程序带来更少的执行开销,并能够更好地提高程序的防御能力。

关键词: 随机化, 指针分析, 域敏感, 注入型攻击