Software patch detection method and device based on data flow analysis

Abstract

The invention relates to a software patch detection method based on data flow analysis. The software patch detection method comprises the following steps of: analyzing a patch code by using Extractor,and sequentially selecting and detecting modified semantics of an assignment statement, a conditional statement, a function call statement, a type related statement and other types of statements in the patch code as features of a patch to be detected; establishing a mapping relationship between a binary code and a source code; selecting VEX-IR as an intermediate code for binary code promotion ofequipment firmware in an Internet of Things environment, analyzing the binary code by using the open-source Angr, and extracting a control flow, wherein the control flow takes functions as units, andeach function comprises a control flow with nodes as basic blocks and program skip semanteme as sides; analyzing the data flow in the basic blocks, reversely analyzing codes of the basic blocks one byone, and extracting a use chain of a variable in each statement; analyzing the data flow across the basic blocks; optimizing the extracted data stream; and acquiring the patch features from the basicblocks, and performing multi-stage matching on the patch features.

Description

technical field [0001] The invention relates to the field of computer technology, in particular to a software patch detection method and device based on data flow analysis. Background technique [0002] With the rapid development of IoT and the wide application of open source software in IoT devices, a large number of vulnerable devices are exposed to the Internet environment. According to a report released by Gartner, it is estimated that there will be 20 billion IoT devices worldwide by 2020. Although open source software regularly releases vulnerability patches, due to the lack of an effective software update mechanism and patch management mechanism, a large number of vulnerabilities remain unpatched. For example, the Heartbleed vulnerability that broke out in 2014 led to the risk of more than 200 million Android devices being attacked. Although OpenSSL released a patch for this vulnerability in a timely manner, as of 2017, the vulnerability in more than 200,000 devices ...

AI Technical Summary

Problems solved by technology

However, due to the rapid iteration of software products and the differentiation of product release platforms, patch detection is very difficult to achieve

[0003] The current patch detection methods include: extracting the control flow of the binary code and performing embedding learning, and then using the learned feature vectors for discriminant analysis. Although the detection efficiency of this type of method is relatively high, the detection accuracy is greatly limited.

Another type of method uses a method based on symbolic execution combined with data flow analysis to detect patches in binary code. However, this type of method is extremely inefficient and cannot be applied to large-scale software product detection tasks.

These limit the efficiency and accuracy of existing patch detection tools

[0004] Efficient and accurate automated patch detection tools play an extremely important role in the security protection of IoT devices. However, the existing work and devices are far from meeting the needs of practical applications in terms of detection efficiency and accuracy.

Images