Research on trustiness of software behavior based on logic division of function code

摘要

The perspective of trusted computing is different from conventional computer security. Software behavior relies on three basic aspects including the extraction and description of intended software behavior, real-time monitoring of software behavior, and a contrastive analysis of intended software behavior and running-time behavior. Software trajectory is always described by system function chain in the field of trusted computing. But it is a hard nut to extract and describe intended software behavior. In our paper, we present an enhanced status method of function chain after the analysis of logic division of function code. Our method is thinking from the perspective of the attacker and birth defect of binary code. Our experiment also indicates the effectiveness and practicability of our way.