Apparatus and method for analysis of binary targets to generate security policy
A compiled security program is received, for example, by an electronic tool. The compiled security program is in a form that is generally unreadable to a human user. The compiled program is automatically and electronically analyzed to determine permissible computer function calls that can be made by the security program. A security policy is generated by the analysis. Subsequently, the security policy can be utilized by an operating system. The operating system compares the sys calls requested by the security program as the program is executed. If the requested sys call does not match the approved sys calls, then an action can be taken.
1. A method, comprising:
receiving compiled source code at an electronic tool;
at the electronic tool, analyzing the compiled code and based upon the analyzing, forming a calling tree, the calling tree comprising an electronic tree data structure of associated programming elements, wherein the calling tree when formed has one or more leaf nodes and one or more non-leaf nodes, the leaf nodes being associated with programmatic calls, wherein the programmatic calls are sys calls including one or more of a read operation to a memory, a write operation to a memory, an opening of a file, or a closing of a file, wherein the calling tree is stored at the electronic tool;
at the electronic tool, automatically identifying and recursively traversing the calling tree defined by the source code until all leaf nodes in the tree are reached and identified, the leaf nodes being considered as valid programming elements and being recorded in a security policy as a list of permitted calls,
installing the security policy at a control circuit, wherein the control circuit is disposed at a local control device in physical proximity to an industrial machine;
subsequently, executing a security program at the control circuit, the executing causing one or more programmatic calls to be made by the security program;
comparing the calls made by the security program to the permitted calls in the security policy, and taking an action when there is not a match, and when the permitted calls are on the list allowing the calls to proceed;
wherein a Kernel of an operating system executes the security program, and wherein the operating system performs one or more of scheduling tasks, executing applications, and controlling peripheral devices.
2. The method of claim 1 , wherein a corruption of the security program by a nefarious actor has occurred, and the comparison detects that the corruption has occurred.
3. The method of claim 1 , wherein the action is to issue an alert to a user.
4. A system, comprising:
an electronic tool, the electronic tool configure to receive and analyze compiled source code, the electronic tool forming a calling tree comprising an electronic tree data structure of associated programming elements, wherein the calling tree when formed has one or more leaf nodes and one or more non-leaf nodes, the leaf nodes being associated with programmatic calls, wherein the programmatic calls are sys calls including one or more of a read operation to a memory, a write operation to a memory, an opening of a file, or a closing of a file, wherein the calling tree is stored at the electronic tool, wherein the electronic tool automatically identifies and recursively traverses the calling tree defined by the source code until all leaf nodes in the tree are reached and identified, the leaf nodes being considered as valid programming elements and being recorded in a security policy as a list of permitted calls;
a control circuit that is in communication with the electronic tool, wherein the control circuit receives the security policy, wherein the control circuit is disposed at a local control device in physical proximity to an industrial machine, and subsequently, wherein the control circuit executes a security program, the execution of the security program causing one or more programmatic calls to be made by the security program, wherein the control circuit compares the calls made by the security program to the permitted calls in the security policy, and takes an action when there is not a match, and when the permitted calls are on the list allowing the calls to proceed;
wherein the control circuit executes a Kernel of an operating system, which executes the security program, and wherein the operating system performs one or more of scheduling tasks, executing applications, and controlling peripheral devices.
5. The system of claim 4 , wherein the security program has been corrupted by a nefarious actor, and the comparison made by the control circuit detects that the corruption has occurred.
6. The system of claim 4 , wherein the action is for the control circuit to issue an alert to a user.