Method and device for detecting security flaws of software source codes

Abstract

The invention discloses a method for detecting security flaws of software source codes. The method comprises the following steps: establishing an abstract syntax tree AST corresponding to source codesof software to be detected; determining controllable points and risk points of each node of the established AST according to predefined controllable points and risk points; and searching an executionpath between the controllable points and the risk points in the AST, and if the risk points on the execution path can be controlled by the controllable points on the execution path, the execution path is determined as a potential risk execution path probably causing the security flaws. The invention also discloses a device for detecting the security flaws of the software. The method and the device can effectively detect the security flaws existing in the source codes of the software.

Description

technical field [0001] The invention relates to the technical field of software security, in particular to a detection method and a detection device for security loopholes of software source codes. Background technique [0002] At present, software is increasingly used to process various sensitive and high-value information, such as business information, financial information, etc., which makes software increasingly an attack target for attackers who attempt to obtain such information. Attackers attempt to exploit security holes in the software to interfere with the running of the software and implement malicious operations on the software. Among them, the security loopholes introduced in the source code writing stage are the most common security loopholes. Therefore, it is necessary to develop an effective security vulnerability detection method to detect potential security vulnerabilities existing in the source code. [0003] At present, automatic code security auditing ...

AI Technical Summary

Problems solved by technology

However, its disadvantage is that static source code analysis is only suitable for detecting syntax-related security vulnerabilities, such as buffer overflows, race conditions, etc., but it is powerless to analyze semantic-related security vulnerabilities such as command injection and database injection.

[0004] It can be seen from the above that although the current security vulnerability detection methods can detect some security vulnerabilities in the software, due to the limitation of the detection method, the detection is not comprehensive enough, and cannot effectively detect various security vulnerabilities in the software source code. security breach

Images