Compiler security test method based on system structure cross check

Abstract

The invention provides a compiler security test method based on system structure cross check. The method is used for detecting software security vulnerabilities introduced when a compiler compiles common open source software into different system structure binary codes. Due to the fact that the changes of the safety related codes before and after compiling meet the system structure consistency, the software vulnerabilities introduced by the compiler can be detected by comparing the changes and conducting system structure cross check. The method comprises the following steps of: modeling and positioning a safety related instruction, corresponding to an IR (Intermediate Representation) code and a binary code, judging the change of a semantic state of the safety related instruction, and carrying out cross check on a system structure. By means of the method, efficient and accurate positioning of the software security vulnerabilities introduced by the compiler is achieved.

Description

Technical field [0001] The present invention relates to a compiler safety test method based on an architecture cross-check. Background technique [0002] Software Vulnerability refers to a threat to the system security, confidentiality, integrity, availability, access control of the system or its application data. Compiler is a computer program that is widely used to convert source code written in some programming language into binary files used to actually run. [0003] Software vulnerabilities typically come from the source program itself, can be positioned to the software source code related errors. However, in recent years, more and more software security vulnerabilities have not been present directly in the source code, but is introduced by the compiler in the compiler. [0004] Each architecture is likely to have a question introduced by its compiler. The rear end of the compiler of each architecture is independent of each other, there are many proprietary code generation a...

AI Technical Summary

Problems solved by technology

This leads to the fact that these methods require prior knowledge and cannot detect unknown types of problems

[0011] 2. It is difficult to address the problems related to the architecture

On the one hand, the existing targeted static methods do not consider the architecture-related compiler optimization behavior, and cannot find architecture-related problems at all.

On the other hand, dynamic methods still face the following problems: (1) The deployment of multi-architecture is difficult: many methods are difficult to be migrated to multi-architecture environments because of their high dependence on architecture-related infrastructure; (2) ) The workload of duplicate detection is too large: the dynamic analysis of binaries with different architectures of the same source code must be independent. If multiple architectures are considered, the analysis amount will be greatly increased (many of which are repeated), making the inherent coverage of dynamic methods rate problem is more serious

Images