Method and device for detecting integrated or customized open source project bugs in software
A technology for detecting software and vulnerabilities, applied in computer security devices, instruments, electrical digital data processing, etc., can solve problems such as slowness and complexity, inability to detect vulnerabilities, and inability to accurately determine whether the vulnerable code has been patched, etc.
Active Publication Date: 2017-02-22
CHINA ACADEMY OF INFORMATION & COMM
View PDF3 Cites 40 Cited by
- Summary
- Abstract
- Description
- Claims
- Application Information
AI Technical Summary
Problems solved by technology
[0004] At present, there are few vulnerability detection schemes for integrated or customized open source projects in software, and most of them detect vulnerabilities through component version comparison, that is, search for component names and version number strings in software files and compare them with the version affected by the vulnerability To determine whether a vulnerability exists, and to avoid incompatibilities caused by version update iterations, the integrated or customized software of open source projects generally only repairs the code with vulnerabilities and does not update the component version. Therefore, general detection methods or tools cannot accurately determine the existence of vulnerabilities. Whether the code of the vulnerability has been patched, so that the vulnerability cannot be accurately detected. In addition, the component name and version number string may be removed from the software of some integrated or customized open source projects, so the vulnerability cannot be detected through the method of component version comparison
However, general software vulnerability detection methods, such as fuzzing technology that detects software anomalies by constructing random test cases according to strategies, and code audits that manually read audit codes to detect vulnerabilities in software integration and customized components, are relatively slow and complicated, and lack efficiency
It can be seen that there is currently a lack of methods for quickly and accurately detecting the vulnerabilities of integrated or customized open source projects in software
Method used
the structure of the environmentally friendly knitted fabric provided by the present invention; figure 2 Flow chart of the yarn wrapping machine for environmentally friendly knitted fabrics and storage devices; image 3 Is the parameter map of the yarn covering machine
View moreImage
Smart Image Click on the blue labels to locate them in the text.
Smart ImageViewing Examples
Examples
Experimental program
Comparison scheme
Effect test
Embodiment Construction
[0046] The following will clearly and completely describe the technical solutions in the embodiments of the present invention with reference to the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only some, not all, embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by persons of ordinary skill in the art without making creative efforts belong to the protection scope of the present invention.
[0047] Such as figure 1 As shown, the embodiment of the present invention provides a method for detecting integrated or customized open source project vulnerabilities in software, including:
[0048] Step 101. Obtain original vulnerability information of open source projects from a preset collection library.
[0049] Step 102, according to the original vulnerability information of the open source project, extract the vulnerability description information of t...
the structure of the environmentally friendly knitted fabric provided by the present invention; figure 2 Flow chart of the yarn wrapping machine for environmentally friendly knitted fabrics and storage devices; image 3 Is the parameter map of the yarn covering machine
Login to view more PUM
Login to view more Abstract
The invention provides a method and device for detecting integrated or customized open source project bugs in software and relates to the technical field of software bug detecting. The method includes the steps that original bug information of an open source project is obtained from a preset gather library; according to the original bug information of the open source project, bug description information, bug influenced software or component version information and bug detection detail feature information of the open source project are extracted; according to the bug description information, bug influenced software or component version information and bug detection detail feature information of the open source project, a bug detection database is established; the bug detection database comprises all detection items which are arrayed according to a preset index sequence; a code and an executable file of software to be detected are extracted from the software to be detected; according to all the detection items in the bug detection database, the code and the executable file of the software to be detected are sequentially matched and detected according to the preset index sequence so as to determine whether the bugs exist in the integrated or customized open source project in the software to be detected or not.
Description
technical field [0001] The invention relates to the technical field of software loophole detection, in particular to a method and device for detecting loopholes of integrated or customized open source projects in software. Background technique [0002] Open source projects are registered as certification marks by non-profit software organizations and formally defined to describe software whose source code can be used by the public. The use, modification and distribution of open source projects are not restricted by licenses. At present, with the vigorous development of open source projects on the Internet, excellent open source software has been widely integrated or custom-developed into components by other software projects, such as linux, openssl, webkit, etc. At the same time, the number of integrated or customized open source projects in a piece of software has greatly increased, such as Google Chrome browser integration and customized open source software have exceeded ...
Claims
the structure of the environmentally friendly knitted fabric provided by the present invention; figure 2 Flow chart of the yarn wrapping machine for environmentally friendly knitted fabrics and storage devices; image 3 Is the parameter map of the yarn covering machine
Login to view more Application Information
Patent Timeline
Login to view more Patent Type & Authority Applications(China)
IPC IPC(8): G06F21/57
CPCG06F21/577
Inventor 倪昀泽潘娟杨正军王艳红李乔刘颖
Owner CHINA ACADEMY OF INFORMATION & COMM
Who we serve
- R&D Engineer
- R&D Manager
- IP Professional
Why Eureka
- Industry Leading Data Capabilities
- Powerful AI technology
- Patent DNA Extraction
Social media
Try Eureka
Browse by: Latest US Patents, China's latest patents, Technical Efficacy Thesaurus, Application Domain, Technology Topic.
© 2024 PatSnap. All rights reserved.Legal|Privacy policy|Modern Slavery Act Transparency Statement|Sitemap