Single-time multi-vulnerability code detection method and system

Abstract

The invention discloses a single-time multi-vulnerability code detection method and system, and the method comprises the steps: converting a to-be-detected code into an LLVM intermediate language through an LLVM compiler, carrying out the type-sensitive pointer analysis, and constructing a program call graph of a whole program code; then, a value flow graph of a whole program code memory object and a global constant is constructed according to a pre-marked function, and abstract modeling representation is carried out on memory leak and pointer dual release and use after release and constant sensitive data; marking code points with security vulnerabilities through traversal of a value flow graph and code security problem mode matching; and finally, carrying out modeling on false alarm modes of different code vulnerabilities, carrying out false alarm filtering on the collected vulnerability code points, and outputting the residual vulnerability code points to obtain a final code security vulnerability report. The method has good expansibility, supports detection of more types of code vulnerabilities, greatly guarantees the security of user codes, and reduces the labor cost.

Description

technical field [0001] The present invention relates to a technique in the field of information security, in particular to a method and system for single-shot multi-vulnerability code detection. Background technique [0002] Code problems emerge in endlessly. From the underlying operating system to various smart terminals widely used in daily life, the vulnerability problems caused by unsafe code will make users threatened by malicious attackers. Memory-related code security issues can lead to user data leakage, denial-of-service attacks, and even remote code execution; cryptography-related vulnerabilities can also cause the confidentiality, integrity, and availability of user data to be compromised. The cause of the above problems is the negligence of programmers or the lack of relevant security knowledge, which leads to code fragments that can be used by malicious attackers in the code. The accuracy and efficiency of existing vulnerability detection tools have always been...

AI Technical Summary

Problems solved by technology

[0003] Aiming at the above-mentioned deficiencies in the prior art, the present invention proposes a single-time multi-vulnerability code detection method and system to quickly detect problems such as memory leaks, pointer double release and use after release, and constant sensitive data. Perform effective analysis and evaluation, have good scalability and support more types of code vulnerability detection, while greatly ensuring user code security and reducing labor costs

Images