Software security vulnerability detection method based on runtime non-execution state mode

Abstract

The invention discloses a software security vulnerability detection method based on a runtime non-execution state mode, and relates to the technical field of network security. The implementation process comprises the following steps: modifying execution logic of a runtime programming language method by utilizing an intermediate language editing and modifying technology; when the modified method iscalled, triggering a data collection method, namely a vulnerability detection program; using the data collection method to collect and analyze the acquired data; and S4, judging whether the data transmission process conforms to vulnerability characteristics or not according to an analysis result in the step S3, and making a corresponding processing mechanism. According to the software security vulnerability detection method, the implementation program is always in a non-execution state during running, non-perceptual testing can be carried out on application software, and dirty data cannot begenerated; the technology does not depend on payload, the test capability is stable, and application software for data encryption and data signature verification can be tested.

Description

technical field [0001] The invention belongs to the technical field of network security, and in particular relates to a software security loophole detection method based on a running non-executable state mode. Background technique [0002] Today, computers have entered thousands of households and become an indispensable part of people's lives, and the security of software systems has increasingly become a technical issue that has attracted much attention. At present, application software security vulnerability detection includes artificial penetration, traditional black box detection, etc. These testing methods use certain means to detect whether the data input by the user can be transmitted to the code location where the vulnerability is executed. Artificial penetration is through artificially generated payload. Input testing is performed, while black-box detection simulates manual payload testing. [0003] At present, the artificial penetration and traditional black box d...

AI Technical Summary

Problems solved by technology

[0007] To address the above technical problems, the present invention provides a software security vulnerability detection method based on the runtime non-executable state mode to solve the problems in the prior art that the vulnerability detection capability is unstable and dirty data will be left during the test process.

Images