Pollution attribute storage method for fine particle taint analysis

Abstract

The invention provides a pollution attribute storage method for fine particle taint analysis. The pollution attribute storage method for the fine particle taint analysis includes: describing a mapping relation between designated memory addresses and pollution attributes thereof, obtained through the fine particle taint analysis, in a key value pair form, wherein using a key in each key value pair to store each memory address, and using a value in each key value pair to store the current pollution attribute of each memory address; directly storing the key value pairs in a two stage memory system composed of a high speed memory used as a first stage and a high capacity external memory used as a second stage.

Description

technical field [0001] The present invention relates to the field of fine-grained stain analysis, and more specifically, the present invention relates to a pollution attribute storage method for fine-grained stain analysis. Background technique [0002] Taint analysis is currently the most widely used analysis technology in the security field, and has a wide range of applications in the fields of vulnerability discovery, malware analysis, and test case generation. Its basic idea is to analyze whether there are security vulnerabilities and what types of vulnerabilities exist by tracking the propagation process of externally input data in the program and the final execution situation. It does not require any special offensive test data, and uses a A traceable way to judge the impact of externally transmitted data on jump addresses, return addresses, and function pointers [0003] Fine-grained stain analysis is a kind of stain analysis technology. It refers to independently n...

AI Technical Summary

Problems solved by technology

[0005] 1. Each memory unit used when the program is running may depend on multiple tainted data, and recording the mapping relationship between each memory unit (or register) and tainted attributes requires a lot of storage space;

[0006] 2. When the program is running, the execution of each instruction may cause the stain to spread from one memory address to another. Calculations are required, so this process has high requirements on computing performance

However, roBDD is used to replace the integer set. In the case of limited memory space, fine-grained taint analysis may still encounter performance bottlenecks in storage space and computing resources.

Images