【摘要】：嵌入式系統(tǒng)在人們的生活中隨處可見,但由于嵌入式系統(tǒng)的特點(diǎn),使得在嵌入式操作系統(tǒng)的裁剪或移植過(guò)程中面臨著許多困難。本文主要研究了一種在仿真平臺(tái)上對(duì)Linux內(nèi)核運(yùn)行進(jìn)行自動(dòng)跟蹤與分析的方法,可以對(duì)操作系統(tǒng)內(nèi)核代碼進(jìn)行測(cè)試、分析與驗(yàn)證,可以作為操作系統(tǒng)裁剪或移植過(guò)程中的一個(gè)輔助工具。 首先,本文介紹了行為分析的概念及特點(diǎn),并分析了它在信息安全等領(lǐng)域中的應(yīng)用方法。分析了仿真平臺(tái)的特點(diǎn)以及它與傳統(tǒng)硬件平臺(tái)相比在進(jìn)行系統(tǒng)分析和軟件跟蹤時(shí)存在的優(yōu)勢(shì)。結(jié)合行為分析的特點(diǎn)和仿真平臺(tái)的特點(diǎn),提出了一種基于行為分析的仿真平臺(tái)上Linux內(nèi)核運(yùn)行的跟蹤機(jī)制。針對(duì)本文的應(yīng)用環(huán)境定義了行為跟蹤的粒度,包括粗粒度跟蹤與細(xì)粒度跟蹤。粗粒度跟蹤是從函數(shù)級(jí)層次跟蹤被監(jiān)測(cè)函數(shù)序列的運(yùn)行軌跡,它記錄了每一個(gè)被監(jiān)測(cè)函數(shù)執(zhí)行時(shí)的狀態(tài)以及被監(jiān)測(cè)函數(shù)的調(diào)用序列。細(xì)粒度跟蹤是從指令級(jí)層次跟蹤被監(jiān)測(cè)函數(shù)的運(yùn)行軌跡,它記錄了被監(jiān)測(cè)函數(shù)執(zhí)行時(shí)每條指令的地址。對(duì)兩種跟蹤方式的算法進(jìn)行了詳細(xì)描述；其次,簡(jiǎn)單介紹了ARM微處理器的特點(diǎn)以及ARM函數(shù)調(diào)用標(biāo)準(zhǔn)。在ARM仿真平臺(tái)上,實(shí)現(xiàn)了粗粒度跟蹤與細(xì)粗粒度跟蹤的算法；最后,分析了在Linux2.6內(nèi)核中進(jìn)程創(chuàng)建、進(jìn)程調(diào)度以及程序加載的實(shí)現(xiàn)原理,在此基礎(chǔ)上設(shè)計(jì)了測(cè)試用例,對(duì)基于行為分析的仿真平臺(tái)上Linux內(nèi)核運(yùn)行自動(dòng)跟蹤與分析的方法進(jìn)行了驗(yàn)證。
[Abstract]:The embedded system can be seen everywhere in people's life, but because of the characteristic of the embedded system, it faces many difficulties in the process of cutting or transplanting the embedded operating system. This paper mainly studies a method of automatically tracking and analyzing the running of Linux kernel on the simulation platform, which can test, analyze and verify the kernel code of the operating system. It can be used as an auxiliary tool in the process of operating system tailoring or porting. Firstly, this paper introduces the concept and characteristics of behavior analysis, and analyzes its application in information security. The characteristics of the simulation platform and its advantages in system analysis and software tracking compared with the traditional hardware platform are analyzed. According to the characteristics of behavior analysis and simulation platform, a tracking mechanism of Linux kernel running on the simulation platform based on behavior analysis is proposed. The granularity of behavior tracking is defined for the application environment in this paper, including coarse-grained tracking and fine-grained tracking. Coarse-grained tracking is to track the track of the monitored function sequence from the function level. It records the state of each monitored function when it is executed and the call sequence of the monitored function. Fine-grained tracking is to track the track of the monitored function from the instruction level, which records the address of each instruction when the monitored function is executed. The algorithms of two tracking methods are described in detail. Secondly, the characteristics of ARM microprocessor and the standard of ARM function call are briefly introduced. The algorithms of coarse-grained tracking and fine-coarse-grained tracking are realized on the ARM simulation platform. Finally, the implementation principle of process creation, process scheduling and program loading in Linux2.6 kernel is analyzed, and the test cases are designed. The method of automatic tracking and analysis of Linux kernel running on the simulation platform based on behavior analysis is verified.
【學(xué)位授予單位】：華北電力大學(xué)
【學(xué)位級(jí)別】：碩士
【學(xué)位授予年份】：2012
【分類號(hào)】：TP316.81;TP368.1

【參考文獻(xiàn)】

相關(guān)期刊論文 前10條

1 黎亮;傅一帆;;基于嵌入式Linux的內(nèi)核錯(cuò)誤跟蹤技術(shù)[J];電子技術(shù)應(yīng)用;2008年09期

2 王澤東;劉宇;朱隨江;劉寶旭;潘林;;采用行為分析的單機(jī)木馬防護(hù)系統(tǒng)設(shè)計(jì)與實(shí)現(xiàn)[J];計(jì)算機(jī)工程與應(yīng)用;2011年11期

3 劉紅;;嵌入式系統(tǒng)技術(shù)發(fā)展趨勢(shì)淺析[J];中國(guó)建設(shè)教育;2006年10期

4 羅亞麗;周安民;吳少華;胡勇;丁怡;;一種基于行為分析的程序異常檢測(cè)方法[J];計(jì)算機(jī)應(yīng)用;2008年10期

5 徐庚保;曾蓮芝;;數(shù)字仿真[J];計(jì)算機(jī)仿真;2009年09期

6 涂剛,陽(yáng)富民,胡貫榮;嵌入式操作系統(tǒng)綜述[J];計(jì)算機(jī)應(yīng)用研究;2000年11期

7 李云華;;Linux內(nèi)核調(diào)試新秀SystemTap[J];程序員;2010年03期

8 郝東白;郭林;黃皓;;基于Hook的程序異常行為檢測(cè)系統(tǒng)設(shè)計(jì)與實(shí)現(xiàn)[J];計(jì)算機(jī)工程與設(shè)計(jì);2007年18期

9 江泓;何恩;;行為分析技術(shù)及其在可信網(wǎng)絡(luò)中的應(yīng)用前景[J];信息安全與通信保密;2009年02期

10 王兆菊;龔龍慶;;面向SoC的系統(tǒng)級(jí)設(shè)計(jì)語(yǔ)言[J];計(jì)算機(jī)技術(shù)與發(fā)展;2007年11期

，

本文編號(hào)：2404726