Method for discovering software vulnerabilities

Abstract

The invention discloses a method for discovering software vulnerabilities, which belongs to the field of software engineering and information security. The method comprises the following steps of: 1) inputting a plurality of normal data into a target program and collecting runtime information of the target program; 2) generating malformed data, inputting the malformed data into the target program, and collecting the runtime information of the target program; 3) identifying a detection code of the checksum in the target program according to the runtime information collected in the step 1) and the step 2); 4) modifying the detection code of the checksum to ensure that the execution behavior of processing the malformed data by the target program is in accordance with that of processing the normal data by the target program; 5) generating a certain number of the malformed data and inputting the generated malformed data into a modified target program, and taking the malformed data which collapses the target program as sample data; and 6) modifying a domain value of the checksum in each sample data and inputting the domain value into an original target program, and if the original target program is collapsed or generates abnormalities, reporting a potential security vulnerability. Compared with the prior art, the method for discovering the software vulnerabilities can greatly improve the efficiency of discovering the vulnerabilities.

Description

technical field [0001] The invention belongs to the fields of software engineering and information security, and in particular relates to a software loophole mining method. Background technique [0002] Software security has become one of the root causes of many security problems in information systems, and how to find security holes in software is very important. A common software vulnerability mining technology is to randomly modify the normal input of the target software to construct a large amount of malformed data as program input. When the program processes these malformed data, observe the performance of the target program. Once the program is abnormal, it is found. A potential security issue. [0003] However, many file formats and network protocols contain checksum information. Checksums are a commonly used method of data integrity testing. For example, the TCP / IP protocol message contains the checksum value of the entire message, and the PNG image stores the che...

AI Technical Summary

Problems solved by technology

[0008] Checksums bring many difficulties to software dynamic vulnerability mining methods, especially when the file format and protocol format are not publicly available

Random modification of normal data will lead to the destruction of the integrity of the entire data, and the input data can be found to be damaged through checksum detection inside the target program, which makes it difficult for the malformed data generated by traditional dynamic vulnerability mining techniques to target program to test effectively

In particular, when the checksum algorithm is unknown, and the file format and protocol format are not disclosed, most of the existing software dynamic vulnerability mining technologies cannot effectively test and analyze the target program.

[0009] The checksum function is essentially a one-way hash function, it is difficult to find different data with the same check value

For example, the modified data part of the normal data part D is D', and the checksum Checksum(D') recalculated for D' is difficult to be consistent with the checksum C in the original data

Images