A software patch detection method and device based on data flow analysis

Abstract

A software patch detection method based on data flow analysis, using Extractor to analyze the patch code, and sequentially select and detect the modification semantics of assignment statements and conditional statements, function call statements, type-related statements, and other types of statements in the patch code. It is the feature of the patch to be detected; the mapping relationship between the binary code and the source code is established; VEX‑IR is selected as the intermediate code of the binary code promotion of the device firmware in the Internet of Things environment, and the binary code is analyzed using the open source Angr to extract the Control flow, the control flow takes functions as units, each of the functions includes nodes as basic blocks, and the control flow of program jump semantics as edges; the data flow in the basic block is analyzed, and the basic block The code is reversely analyzed one by one, and the use chain of variables in each statement is extracted; the data flow across the basic block is analyzed; the extracted data flow is optimized; the patch feature is obtained from the basic block, and it is multi-stage match.

Description

technical field [0001] The present invention relates to the field of computer technology, and in particular, to a software patch detection method and device based on data flow analysis. Background technique [0002] With the rapid development of IoT and the wide application of open source software in IoT devices, a large number of vulnerable devices are exposed to the Internet environment. According to a report released by Gartner, it is estimated that there will be 20 billion IoT devices worldwide by 2020. Although open source software regularly releases vulnerability patches, due to the lack of an effective software update mechanism and patch management mechanism, a large number of vulnerabilities have not been patched. Although OpenSSL released a patch for the vulnerability in a timely manner, as of 2017 there were still more than 200,000 devices with the vulnerability unpatched. Therefore, both for security researchers and enterprise software product maintainers, effic...

AI Technical Summary

Problems solved by technology

However, due to the rapid iteration of software products and the differentiation of product release platforms, patch detection is very difficult to achieve

[0003] The current patch detection methods include: extracting the control flow of the binary code and performing embedding learning, and then using the learned feature vectors for discriminant analysis. Although the detection efficiency of this type of method is relatively high, the detection accuracy is greatly limited.

Another type of method uses a method based on symbolic execution combined with data flow analysis to detect patches in binary code. However, this type of method is extremely inefficient and cannot be applied to large-scale software product detection tasks.

These limit the efficiency and accuracy of existing patch detection tools

[0004] Efficient and accurate automated patch detection tools play an extremely important role in the security protection of IoT devices. However, the existing work and devices are far from meeting the needs of practical applications in terms of detection efficiency and accuracy.

Images