Parallelization security hole detecting method based on function call graph

Abstract

The invention relates to a parallelization security hole detecting method based on a function call graph, which is characterized in that a function set to be detected is determined by analyzing the function call relation in a C language module, instrumentation and assert analysis are performed for the function set by means of the preprocessing technology, and then security holes of a program are detected by the aid of model checking and the parallelization technology. The method mainly includes the steps: generating the function relation call graph, and determining C function information to be detected by analyzing the function relation call graph; extracting attribute information of a buffer area related to C program source codes by the aid of the constraint analysis technology, and inserting corresponding ASSERT statement information in a variable declaration, an assignment and a function call point by means of the attribute information of the buffer area; and performing accessibility judgment for the instrumented codes, and analyzing whether a dangerous point in the program includes an accessible path to discover the security holes in the source codes or not. The method detects the security holes such as buffer area overflow and the like by combining the constraint analysis static detecting technology, model checking and the parallelization technology, and the detecting precision of the method is higher than that of the general static detecting technology.

Description

Technical field: [0001] The invention relates to a parallel detection method for source code loopholes. Background technique: [0002] With the development of information technology, computer software has penetrated into various fields of the national economy and is closely related to people's production and life. The security of software is becoming more and more important. Once some key software is damaged, it will cause industrial and even national paralysis. Malicious users can target specific software errors and run malicious code to gain access to illegal data. Buffer overflow vulnerability is the most important kind of this kind of security hole at present. Malicious users can analyze the input data format of the program and determine that these data are stored in the buffer of the program, so that the user may overwrite the sensitive data in the stack space through special input data, especially return the saved The address is replaced with the address of the ille...

AI Technical Summary

Problems solved by technology

Different from the static detection method, the dynamic detection technology has no limit to the size of the program and can detect large programs. However, the obvious disadvantage is that the dynamic detection technology is dependent on the input, and only when a specific input makes the program execute to a dangerous point Vulnerabilities are not discovered until , resulting in a high rate of false positives

[0004] Simple model detection methods generally cannot directly detect program vulnerabilities. For example, Blast used Securd to detect references to null pointers in programs, but it cannot detect the security of more complex buffer operations.

Furthermore, model checking methods suffer from the state-space explosion problem when testing large-scale programs.

Images