Unknown sensitive function discovery method based on two-stage analogy reasoning

Abstract

The invention relates to an unknown sensitive function discovery method based on two-stage analogy reasoning, which comprises the following steps: preprocessing a to-be-detected target system code to obtain a function call sequence; according to the function call sequence, obtaining a plurality of frequent function pairs through frequent pattern mining; training the obtained word vector model by using the function call sequence to obtain an embedded vector corresponding to each frequent function pair; calculating a first similarity between the initial seed function and each frequent function pair, and selecting at least one frequent function pair as a secondary seed function pair according to a calculation result; calculating a second similarity between each quadratic seed function pair and each frequent function pair, and obtaining a potential sensitive function pair candidate set of each quadratic seed function pair according to a calculation result; and according to the potential sensitive function pair candidate set, a potential sensitive function pair set is obtained after merging and deduplication. According to the method, through two-stage analogy reasoning, a seed function pair set can be gradually expanded, and more potential sensitive function pairs can be found.

Description

technical field [0001] The invention belongs to the technical field of network security, and in particular relates to a method for discovering unknown sensitive functions based on two-stage analogy reasoning. Background technique [0002] Sensitive functions are a class of functions that are prone to various potential defects. Sensitive functions often appear in pairs. For example, resource release functions such as free functions are paired with resource allocation functions such as malloc functions. When developers use these functions inappropriately, it may lead to dangerous consequences such as leakage of sensitive information, data corruption, and even execution of arbitrary code. Unfortunately, there are a large number of sensitive functions that are not well known in large software systems. In fact, these sensitive functions are often only known to some program developers. The relevant defect detection, system security protection and other work must know these sensi...

AI Technical Summary

Problems solved by technology

[0004] However, when analogy reasoning is used directly in practical applications, a small number of seed function pairs often cannot completely cover the semantics of sensitive functions of this type, resulting in the potential sensitive functions derived by analogy inference often having homogeneity with the seed function, and there is a certain difference between the pair and the seed function. Qualitative sensitive function detection is not good

Images