Добавил:
ivanov666
Опубликованный материал нарушает ваши авторские права? Сообщите нам.
Вуз:
Предмет:
Файл:The design of the exoskeleton. Monograph
.pdf
121
22. Wei, Wei et al. 2013. “Effective Detection of Sophisticated Online
Banking Fraud on Extremely Imbalanced Data.” World Wide Web 16(4):
449–75. https://doi.org/10.1007/s11280-012-0178-0.
23. Kim, Ae Chan, Seongkon Kim, Won Hyung Park, and Dong Hoon
Lee. 2014. “Fraud and Financial Crime Detection Model Using Malware
Forensics.” Multimedia Tools and Applications 68(2): 479–96.
https://doi.org/10.1007/s11042-013-1410-3.
24. Carminati, Michele et al. 2014. “BankSealer: An Online Banking
Fraud Analysis and Decision Support System.” In ICT Systems Security and
Privacy Protection, eds. Nora Cuppens-Boulahia et al. Berlin, Heidelberg:
Springer Berlin Heidelberg, 380–94.
25. Hand, D J et al. 2008. “Performance Criteria for Plastic Card
Fraud Detection Tools.” Journal of the Operational Research Society 59(7):
956–62. https://doi.org/10.1057/palgrave.jors.2602418.
26. Molloy, Ian et al. 2017. “Graph Analytics for Real-Time Scoring of
Cross-Channel Transactional Fraud.” In Financial Cryptography and Data
Security, eds. Jens Grossklags and Bart Preneel. Berlin, Heidelberg:
Springer Berlin Heidelberg, 22–40.
27. Adewumi, Aderemi O, and Andronicus A Akinyelu. 2017. “A
Survey of Machine-Learning and Nature-Inspired Based Credit Card Fraud
Detection Techniques.” International Journal of System Assurance
Engineering and Management 8(2): 937–53.
https://doi.org/10.1007/s13198-016-0551-y.
28. Jog, Anita, and Anjali A Chandavale. 2018. “Implementation of
Credit Card Fraud Detection System with Concept Drifts Adaptation.” In
Intelligent Computing and Information and Communication, eds. Subhash
Bhalla et al. Singapore: Springer Singapore, 467–77.
29. Khattri, Vipin, and Deepak Kumar Singh. 2018. “A Novel Distance
Authentication Mechanism to Prevent the Online Transaction Fraud.” In
Advances in Fire and Process Safety, eds. N A Siddiqui, S M Tauseef, S A
Abbasi, and Ali S Rangwala. Singapore: Springer Singapore, 157–69.
122
30. Blackwell, Clive. 2014. “Using Fraud Trees to Analyze Internet
Credit Card Fraud.” In Advances in Digital Forensics X, eds. Gilbert Peterson
and Sujeet Shenoi. Berlin, Heidelberg: Springer Berlin Heidelberg, 17–29.
123
THE LISTING OF THE PROGRAM (FULL CODE)
#ifndef VERSION
#error "Please use ./build script."
#endif /* not VERSION */
#define _GNU_SOURCE
/* Hackish hack to import kernel stat struct without much collateral damage */
#define stat __kernel_stat
#define stat64 __kernel_stat64
#define old_stat __old_kernel_stat
#define new_stat __kernel_stat
#include <asm/stat.h>
#undef stat
#undef stat64
#undef old_stat
#undef new_stat
/* End of nasty hack. */
#include <sys/ptrace.h>
#include <sys/user.h>
#include <stdio.h>
#include <unistd.h>
#include <stdlib.h>
#include <assert.h>
#include <time.h>
#include <getopt.h>
#include <signal.h>
#include <sys/stat.h>
#include <ctype.h>
#include <sched.h>
#include <sys/types.h>
#include <sys/wait.h>
#include <errno.h>
#include <string.h>
#include "asmstring.h"
#include <fcntl.h>
#include <dlfcn.h>
#include <asm/unistd.h>
#include <sys/mman.h>
#include <malloc.h>
#include <asm/types.h>
#include <utime.h>
#include <sys/resource.h>
124
#include <linux/types.h>
#include <linux/dirent.h>
#include <sys/vfs.h>
#include <sys/socket.h>
#include <netdb.h>
#include <grp.h>
#include <pwd.h>
#include <bfd.h>
//#include <libiberty.h>
#include "config.h"
#include "fenris.h"
#include "ioctls.h"
#include "libdisasm/libdis.h"
#include "fenris-decl.h"
#include "fdebug.h"
#include "hooks.h"
#ifdef PROFILE
#define static
#define inline
#endif /* PROFILE */
#ifdef MINIMAL
#define inline
#endif /* MINIMAL */
// including allocs.h will automagically turn every malloc, realloc, free
// and strdup into my_malloc,my_realloc,my_free and my_strdup respectively
// you can override this by uncommenting the following line:
// #define USE_ORIGINAL_ALLOCS (but you don't want to do it for Fenris,
// otherwise, it'll break into tiny pieces and cut you badly).
#include "allocs.h"
#include "libfnprints.h"
#ifndef RTLD_NODELETE
// Damn damn damn. Bury me deep.
#define RTLD_NODELETE 0
#define DO_NOT_DLCLOSE 1
#endif /* not RTLD_NODELETE */
#define CURPCNT(x) current->pstack[current->nest][(int)current->pst_top[current->nest]+x]
char verybigbuf[200000]; // output buffer
extern int break_stopped; // The process is stopped.
extern int break_continuing;
struct user_regs_struct r; // Current process: registers
unsigned char op[8]; // Current process: eip[0..8]
int pid; // Current process: pid
int in_libc; // Current process: eip in LIBCSEG?
unsigned int caddr; // Current process: CALL dest addr
125
unsigned int start_eip, stop_eip;
static char fnm_buf[MAXDESCR]; // Local function name
struct fenris_process ps[MAXCHILDREN]; // Traced process table
struct fenris_process* current; // Currently traced proces
char T_forks, T_execs,T_nocnd,T_nosym, // Execution options
T_noindent,T_nodesc,T_nomem,T_nosig,T_goaway,
T_noskip,T_addip,T_atret=2,T_wnow,T_alwaysret,*T_dostep,T_nolast;
unsigned char be_silent;
#ifdef HEAVY_DEBUG
unsigned int oldip;
unsigned char oldop[8];
#endif /* HEAVY_DEBUG */
char nonstd;
char is_static;
char already_main;
extern int blocking_syscall;
char* running_under_ncaegir;
int runasuid, runasgid;
char* runasuser;
FILE* ostream; // Output stream
int innest = PRETTYSMALL;
int STACKSEG,CODESEG;
const char* scnames[256]= {
0,
#include "scnames.h"
0
};
#define MPS (MAXFNAME*2)
#define RD() reset_pdescr()
#define DD() dump_pdescr(0)
static char pdescr[MAXPDESC+1];
#define reset_pdescr() pdescr[0]=0
struct hacking_table {
unsigned int ip;
unsigned int ad;
unsigned char va;
};
struct hacking_table reptable[MAXREP];
int reptop=0;
static void nappend(char* dst,const char* src,int max) {
126
int i;
i=max-strlen(dst)+2;
if (i<=0) return;
strncat(dst,src,i);
}
#define check_doret() if (current->doret) { debug("\n"); current->doret=0; }
char fatal_there;
extern int sd;
extern char break_shutup;
/************************************************************
* This is our fatal error handling routine. We have three *
* kinds of call scenarios, self-explainatory. *
************************************************************/
extern char test_leaks;
void fatal(const char* x, const int err) {
int i;
if (T_dostep) {
signal(SIGPIPE,SIG_IGN);
break_shutup=1;
break_sendentity();
}
switch (err) {
case -2:
case -1: debug(">> Exit condition: %s\n",x); break;
case 0: debug(">> Error condition: %s\n",x); break;
default: debug(">> OS error : %s [%d]\n"
">> Error condition: %s\n"
,strerror(err),err,x);
}
if (T_dostep && !fatal_there) { fatal_there=1; break_sendentity_force(); }
if (pid>0) {
if (current && current->syscall)
127
debug(">> This condition occured during syscall %s (%d) in pid %d (eip %x).\n",
scnames[current->syscall & 0xff],current->syscall,pid,(int)r.eip);
else debug(">> This condition occured while tracing pid %d (eip %x).\n",pid,(int)r.eip);
}
if (current && (current->cycles))
debug(">> Traced %u user CPU cycles (%d libcalls, %d fncalls, %d "
"syscalls).\n",current->cycles,current->libcalls,current->fncalls,
current->syscalls);
if (err>-1)
debug("\n**************************************************\n"
"* If you believe this is because of programming *\n"
"* error, please report above message, along with *\n"
"* information about your working environment and *\n"
"* traced application, to the author of this *\n"
"* utility (e-mail: lcamtuf@coredump.cx). Thanks! *\n"
"**************************************************\n\n");
fflush(0);
fclose(ostream);
// If you go down in flames, aim for something expensive.
for (i=0;i<MAXCHILDREN;i++) if (ps[i].pid>0) kill(ps[i].pid,9);
if (sd>0) { shutdown(sd,2); close(sd); }
// for (i=3;i<128;i++) close(i);
if (running_under_ncaegir) {
char buf[100];
printf("\033[0;37m\n\033[1;41mFenris has terminated, press RETURN to close...\033[0;37m\n");
read(0,buf,sizeof(buf));
}
#ifdef DEBUG
if (err>-1) abort();
#endif /* DEBUG */
exit(1);
}
/***********************************************
* Produce nice graphical indentation and such *
***********************************************/
128
static inline void indent(const int corr) {
static char intbuf[MAXINDENT+2];
static int tib;
if (T_noindent) return;
intbuf[0]=0;
if (current->nest>=0) {
tib=(corr+current->nest)>MAXINDENT?MAXINDENT:(corr+current->nest);
if (tib>0) {
memset(intbuf,' ',tib);
intbuf[tib]=0;
}
}
if (T_addip) debug("[%08x] ",(int)r.eip);
if ((current->nest+corr)<0) debug("%d:-- %s",pid,intbuf);
else debug("%d:%02d %s",pid,corr+current->nest,intbuf);
}
/********************************************************
* Here we simply execute what we have to execute after *
* fork() and syncing with our parent process. *
********************************************************/
extern int sd; // Debugger socket.
static int start_child(const char** argv) {
int ret,n=1;
ret=fork();
if (ret<0) fatal("cannot fork",errno);
if (ret) { pid=ret; return ret; }
if (runasuser) {
if (initgroups(runasuser,runasgid)) fatal("initgroups failed",errno);
if (setgid(runasgid)) fatal("setgid failed",errno);
if (setuid(runasuid)) fatal("setuid failed",errno);
debug("+++ [%s] Executing '%s",runasuser,argv[1]);
} else debug("+++ Executing '%s",argv[1]);
while (argv[++n]) debug(" %s",argv[n]);
debug("' (pid %d, %s) +++\n",getpid(),is_static?"static":"dynamic");
fflush(0);
{ int i;
// Close our own mess.
for (i=3;i<64;i++) if (i!=sd) close(i);
}
if (ptrace(PTRACE_TRACEME,0,0,0)) fatal("PTRACE_TRACEME failed",errno);
execvp(argv[1],(void*)&argv[1]);
129
perror(">> OS error ");
kill(getppid(),SIGUSR1);
fatal("cannot execute requested binary",-1);
return 0; // sanity.
}
/*******************************************
* Temporarily remove int3 traps from code *
*******************************************/
static void remove_traps(void) {
int i;
for (i=0;i<MAXSIG;i++) {
unsigned int addr=get_handler(i);
if (!addr) return;
if ((addr >> 24) == CODESEG || INLIBC(addr)) {
unsigned int chg;
chg=ptrace(PTRACE_PEEKDATA,pid,addr-1,0);
if (current->shret[i])
chg = ( chg & 0xffffff00 ) + 0xc3; /* c3: ret */
else chg = ( chg & 0xffffff00 ) + 0x90; /* 90: nop */
ptrace(PTRACE_POKEDATA,pid,addr-1,chg);
}
}
}
/************************
* Reinstall int3 traps *
************************/
static void install_traps(void) {
int i;
for (i=0;i<MAXSIG;i++) {
unsigned int addr=get_handler(i);
if (!addr) return;
if ((addr >> 28) == CODESEG || INLIBC(addr)) {
unsigned int chg;
chg=ptrace(PTRACE_PEEKDATA,pid,addr-1,0);
chg = ( chg & 0xffffff00 ) + 0xcc; /* cc: int3 */
ptrace(PTRACE_POKEDATA,pid,addr-1,chg);
}
}
}
#define remove_handler(i) add_handler(i,0)
130
/**********************
* Add signal handler *
**********************/
static inline void add_handler(int i,unsigned int a) {
if (i<0 || i>=MAXSIG) return;
current->sh[i]=a;
}
static inline void set_withret(int i,char val) {
if (i<0 || i>=MAXSIG) return;
current->shret[i]=val;
}
/*************************
* Remove signal handler *
*************************/
inline unsigned int get_handler(int i) {
if (i<0 || i>=MAXSIG) return 0;
return current->sh[i];
}
/*******************************************
* Add or update memory region information *
*******************************************/
static inline void add_mem(unsigned int start, int len, unsigned int newaddr,const char* who,char
auth) {
int i;
char* doingmerge=0;
unsigned int owner=0;
char U=0;
char buf[MAXDESCR], b2[MAXDESCR];
struct fenris_mem* f;
if (current->nest<0) return; // No, sorry.
if (len<=0) return; // Sorry even more.
if (start + len < start) fatal("start + len < start in add_mem",0);
if (!start || (start>0xffffff00)) return;
if (newaddr==2) { newaddr=0; U=1; }
if (newaddr) {
// We have some authoritative buffer size readjustment.
// Expect finding buffer with matching address. In
// emergency, you might have to create new buffer description.
Соседние файлы в предмете [НЕСОРТИРОВАННОЕ]