Source library mode Java security vulnerability detection method based on value dependency graph

Abstract

The invention discloses a source library mode Java security vulnerability detection method based on a value dependency graph. The method comprises the following steps: extracting a vulnerability mode, constructing a Java value dependency graph and realizing security vulnerability detection. According to the method, Java language characteristics and third-party library characteristics are considered, technologies such as context sensitivity and object sensitivity are combined, the program expression capability of the value dependency graph is improved, the method has the advantages of being high in detection speed and accuracy, according to the completeness degree of the extracted universal jar package, the Source-Sink template and the Filter template, the false report and missing report conditions of the detection result are different, developers and testers can use the method to search most of the vulnerabilities of the Java input verification class in the detected program.

Description

technical field [0001] The invention relates to the technical field of program analysis, in particular to a Java security loophole detection method based on a value dependency graph. Background technique [0002] Value dependency analysis technology is an in-depth study of data flow analysis methods in static program analysis, which is used to achieve a balance between accuracy and efficiency. An accurate description form in the form of a graph, so that it can support the correct detection of various defects. In the defect description stage, focus on the accurate expression of the defect mode and the completeness of the mode, thereby improving the coverage of defect detection. In the detection phase, based on the concept of guard analysis, the detection accuracy and speed can be improved. The construction of the Java value dependency graph is the application of the value dependency analysis technology to the Java language. During the construction process, the characteristics...

AI Technical Summary

Problems solved by technology

[0005] The existing taint analysis technology includes the Source-Sink (source library) mode, which is widely used in data leakage detection, system security vulnerability mining and other fields, but it cannot provide a comprehensive solution for different platforms, languages ​​and frameworks. This is a general solution, which needs to be customized for the above problems. In addition, the existing security vulnerability detection method using Java bytecode as the input source uses a relational database to store the function call graph information of the program, and finds vulnerabilities from the database. Pattern mark pollutes data. This method cannot handle Java source code that has not been compiled in a friendly manner. It lacks sufficient expression for source program and framework support, and cannot provide detailed

Images