Monitoring range determination device, monitoring range determination method, and computer readable medium
A device includes: an input/output unit configured to receive input of the binary of the software to be monitored in which a tamper detection feature and tamper detection feature calling functions are embedded; a CFG (control flow graph) generation unit configured to generate a CFG based on the binary; and an allowed list creation unit configured to determine the monitoring range for the tamper detection feature calling functions based on the CFG. The allowed list creation unit sequentially selects the tamper detection feature calling functions on the CFG, adds a node to the monitoring range for the selected tamper detection feature calling functions according to a predetermined rule, searches for the tamper detection feature calling function to be be executed next to the added node according to the predetermined rule, and adds the found tamper detection feature calling function to the monitoring range for the selected tamper detection feature calling functions.
1. A monitoring range determination device configured to determine a monitoring range for tamper detection feature calling functions that are embedded with a tamper detection feature in software to be monitored, the monitoring range determination device comprising:
at least one memory storing instructions; and
at least one processor configured to execute the instructions to:
receive input of a binary of the software in which the tamper detection feature and the tamper detection feature calling functions are embedded;
generate a control flow graph (CFG) based on the binary; and
determine the monitoring range for the tamper detection feature calling functions based on the CFG,
wherein the at least one processor is further configured to execute the instructions to
sequentially select the tamper detection feature calling functions on the CFG;
add a node to the monitoring range for the selected tamper detection feature calling functions according to a predetermined rule; and
search for the tamper detection feature calling function that is to be executed next to the added node according to the predetermined rule, and add the tamper detection feature calling function that is found to the monitoring range for the selected tamper detection feature calling functions,
wherein the predetermined rule is a rule that traces nodes that do not contain the tamper detection feature calling functions among all descendant nodes of a node containing the selected tamper detection feature calling functions, and adds the range from the node containing the selected tamper detection feature calling functions to a node immediately before the next node containing the tamper detection feature calling functions to the monitoring range for the selected tamper detection feature calling functions.
2. The monitoring range determination device according to claim 1 , wherein upon finding a node that has not been added to the monitoring range for any of the tamper detection feature calling functions on the CFG before finding the tamper detection feature calling function that is to be executed next after the node added according to the predetermined rule, the at least one processor is further configured to execute the instructions to add the node that has been found to the monitoring range for the selected tamper detection feature calling functions.
3. The monitoring range determination device according to claim 1 , wherein the tamper detection feature is an allowed list type tamper detection feature created as a list of hash values of the monitoring range for the tamper detection feature calling functions.
4. A monitoring range determination method performed by a monitoring range determination device configured to determine a monitoring range for tamper detection feature calling functions that are embedded with a tamper detection feature in a software to be monitored, the monitoring range determination method comprising:
inputting a binary of the software in which the tamper detection feature and the tamper detection feature calling functions are embedded;
generating a control flow graph (CFG) based on the binary; and
a monitoring range determination step of determining the monitoring range for the tamper detection feature calling functions based on the CFG,
wherein the monitoring range determination method includes
sequentially selecting the tamper detection feature calling functions on the CFG;
adding a node to the monitoring range for the selected tamper detection feature calling functions according to a predetermined rule; and
searching for the tamper detection feature calling function that is to be executed next to the added node according to the predetermined rule, and adding the tamper detection feature calling function that is found to the monitoring range for the selected tamper detection feature calling functions,
wherein the predetermined rule is a rule that traces nodes that do not contain the tamper detection feature calling functions among all descendant nodes of a node containing the selected tamper detection feature calling functions, and adds the range from the node containing the selected tamper detection feature calling functions to a node immediately before the next node containing the tamper detection feature calling functions to the monitoring range for the selected tamper detection feature calling functions.
5. A non-transitory computer readable medium storing a program that executable by a computer to perform processing of determining a monitoring range for tamper detection feature calling functions that are embedded with a tamper detection feature in a software to be monitored, the processing comprising:
inputting a binary of the software in which the tamper detection feature and the tamper detection feature calling functions are embedded;
generating a control flow graph (CFG) based on the binary; and
a monitoring range determination step of determining the monitoring range for the tamper detection feature calling functions based on the CFG,
wherein the monitoring range determination method includes
sequentially selecting the tamper detection feature calling functions on the CFG;
adding a node to the monitoring range for the selected tamper detection feature calling functions according to a predetermined rule; and
searching for the tamper detection feature calling function that is to be executed next to the added node according to the predetermined rule, and adding the tamper detection feature calling function that is found to the monitoring range for the selected tamper detection feature calling functions,
wherein the predetermined rule is a rule that traces nodes that do not contain the tamper detection feature calling functions among all descendant nodes of a node containing the selected tamper detection feature calling functions, and adds the range from the node containing the selected tamper detection feature calling functions to a node immediately before the next node containing the tamper detection feature calling functions to the monitoring range for the selected tamper detection feature calling functions.