Static code security diagnosis method and device

Abstract

A static code security diagnosis method and device provided by the embodiment of the invention can be applied to the technical field of information security. The method comprises the steps of obtaining a static code of a to-be-diagnosed program; performing lexical analysis on each segmented word to obtain a segmented word symbol table; and performing vulnerability detection on the segmented wordsunder each entry according to the feature information of each segmented word, determining vulnerability segmented words under each entry, and further diagnosing vulnerability codes. On the basis of atext analysis technology, a lexical analyzer is constructed, lexical analysis is carried out on static codes to obtain a symbol table corresponding to the codes, and under the condition that developers do not need to carry out manual operation, the security index condition of application codes, finer-grained vulnerability description, specific vulnerability detailed information and a vulnerabilityrectification scheme are obtained, the obtained data can be subjected to vulnerability overall data analysis and data mining, and security code vulnerability test inspection and analysis do not needto be conducted manually.

Description

technical field [0001] The invention relates to the technical field of safety diagnosis, in particular to a static code safety diagnosis method and device. Background technique [0002] In the era of rapid development of Internet business. Each project team adopts agile, iterative and other development methods to ensure development efficiency. In this fast-online and fast-delivery mode, how to use efficient testing methods to ensure the safety testing process in the project and shorten the project testing cycle is particularly important. At present, there are many conventional methods for security testing of Java web applications, such as using AppScan tool for black-box scanning, and using some penetration testing tools such as Nessus to conduct security analysis on data by tampering with requests. But without exception, they all belong to the security inspection after the completion of the project coding stage, but the earlier the security problems are found in the projec...

AI Technical Summary

Problems solved by technology

The above methods all require testers to manually crawl the application link and make some kind of modification to the request. However, the modification of the request may cause some irreversible damage to the system at the same time, such as system downtime and persistent data in the database. Deletion will affect the normal function / process / performance test, etc., which will undoubtedly cause a great burden on the testers, and the test time will be greatly increased; at the same time, after the problem is fixed during the development, the tester needs to iteratively test again, and the test cost will be greatly increased.

Images