Method for detecting backdoor code through static analysis

Abstract

The invention relates to a method for detecting a backdoor code through static analysis, and is applied to the technical field of information security. The method comprises the steps that detection equipment detects a target code segment where a preset specific function is located in to-be-detected codes; the detection equipment tracks a data stream transmission path of the target code segment; the detection equipment obtains preset backdoor code judgment conditions, wherein the backdoor code judgment conditions at least comprises a system level operation or a data output operation; if the system level operation or the data output operation exists in the data stream transmission path of the target code segment, the detection equipment determines that a backdoor code exists in the target code segment; and the detection equipment locates and displays a specific position of the backdoor code according to the data stream transmission path of the target code segment. According to the method, the backdoor code in the to-be-detected codes is detected through the detection equipment, so that the safety of running a to-be-detected program by an operating system is improved, and data in the operating system is prevented from being damaged and stolen.

Description

technical field [0001] The present application relates to the technical field of information security, in particular to a method for detecting backdoor codes through static analysis. Background technique [0002] At present, the software testing method is mainly static testing, which means that the program under test is detected through analysis without running the program under test. White box testing is a static test. Traditional white box testing is to test the program according to the internal structure of the program. By testing whether all the logic paths in the program under test can run normally according to the predetermined requirements, the loopholes in the program under test are detected. . [0003] Backdoor code is a special kind of vulnerability. Most backdoor codes are illegal codes intentionally reserved by developers. Backdoor codes can bypass the security certification of the operating system and directly obtain data access rights, usually for data destruc...

AI Technical Summary

Problems solved by technology

[0005] Due to the high similarity between the writing logic, functions and code structure of the backdoor code and the normal code in the program under test, it is difficult for the traditional white box test to identify the backdoor code, so it is impossible to detect the backdoor code, and the operating system is running to be tested. There are security risks in the program

Images