Sensitive information flow tracking and tracing method and system based on high-order function abstract

Abstract

The invention discloses a sensitive information flow tracking and tracing method and system based on a high-order function abstract, and relates to the technical field of program analysis and supply chain safety. The method comprises the steps of receiving and preprocessing a to-be-tested program, performing dependency analysis on a function module of the to-be-tested program, converting the to-be-tested program into an intermediate language, constructing a cross-module function call graph and a control flow graph, traversing the function call graph according to an inverse topological sequence, and determining a function analysis sequence; carrying out analysis parameter configuration, and defining a related sensitive source, a related sensitive sink and a control probability set; and constructing an in-process analysis framework. According to the method, through high-order function abstract and dependency matrix operation, a data flow path in an open source software supply chain can be effectively analyzed, the dependency relationship between functions can be captured, tracing is carried out, an abstract matrix is stored as a sparse matrix, therefore, the space overhead in the analysis process can be effectively reduced, and the analysis efficiency is improved. And the detection efficiency of the sensitive information flow in the process is improved on the premise of not losing the detection precision.

Description

Technical Field

[0001] This invention relates to the fields of program analysis and supply chain security technology, specifically to a method and system for tracing and tracking sensitive information flows based on higher-order function summaries. Background Technology

[0002] In the open-source software supply chain, multiple developers participate in the writing, maintenance, and updating of code, resulting in complex and difficult-to-track information flows. Especially when multiple components are interdependent, effectively tracing data and information flows within the program to ensure the transparency and security of the software supply chain has become an important research topic. Currently, the open-source software supply chain typically consists of multiple components, libraries, and modules with complex dependencies and diverse code sources. This complexity leads to the following problems: 1. Difficulty in tracing information flows: Traditional information flow analysis methods (such as analysis based on System Dependency Graphs (SDGs)) are inefficient and computationally expensive when handling higher-order function calls and cross-component dependencies; 2. Supply chain security risks: It is difficult to trace the true source of the code, potentially leading to malicious code injection, license violations, or memory leaks.

[0003] To address the aforementioned issues, existing technologies typically generate function call graphs and control flow graphs through static analysis, but these methods lack sufficient support for dependency propagation in higher-order functions. Program slicing techniques propose symbolic slicing to improve efficiency, but these are not optimized for supply chain scenarios. Dependency analysis introduces dependency algebra, but it doesn't incorporate the characteristics of higher-order functions for information flow tracing. Therefore, this invention proposes a sensitive information flow tracing and source identification method and system based on higher-order function summaries. Summary of the Invention

[0004] The purpose of this invention is to provide a method and system for tracing and tracking sensitive information flow based on higher-order function summaries, which can effectively analyze the data flow path in the open-source software supply chain, capture the dependencies between functions, and trace their origins.

[0005] To achieve the above objectives, the present invention provides the following technical solution: a sensitive information flow tracing and source identification method based on higher-order function summaries, comprising the following steps: The program is received and preprocessed. Dependency analysis is performed on the function modules of the program under test. The program under test is converted into intermediate language. Cross-module function call graph and control flow graph are constructed. The function call graph is traversed according to the reverse topology sort to determine the function analysis order. Configure analysis parameters and define relevant sensitive sources, sinks, and control probability sets; An in-process analysis framework is constructed, and in-process analysis is performed according to the determined function analysis order. Symbolic function call information is formed through formal parameters, global variables, and source and sink points, and a higher-order function summary of each function is generated based on the function call information. For function call statements, an inter-process analysis framework is constructed. The actual parameter information at the call point is substituted into the summary, and the instantiated information flow result is applied to the call environment according to the correspondence between formal and actual parameters, so as to realize the accurate transmission of inter-process information flow. After all functions have been analyzed, a sensitive information flow analysis report is generated based on the inter-process information flow analysis results. This report reveals the flow path and potential risk points of sensitive information, enabling information flow traceability.

[0006] Furthermore, the program to be tested is received and preprocessed, as follows: (21) Perform library dependency analysis and preprocessing on the program to be tested. For open source libraries with source code, compile the project source code into an intermediate representation. (22) Without a source code library, disassembly produces an intermediate language that loses semantic information; (23) Generate cross-module function call graphs and control flow graphs; (24) Traverse the call graph in reverse topological order to determine the function analysis order and avoid interference from circular dependencies.

[0007] Further, the analysis parameters are configured, and the relevant sensitive sources, sinks, and control probability sets are defined, as follows: (31) During the sensitive information flow tracing phase, identify sensitive data sources and sensitive APIs, and mark sensitive sources. Collection and aggregation gather.

[0008] (32) During program analysis, pay attention to sensitive APIs and mark inputs and outputs as unique. , Finally, add it to the corresponding function. , gather; (33) Configure the control probability set, analyze and estimate the probability in each control flow, and form a predefined probability set. When performing data dependency analysis, the dependency edge can be defined directly through the probability set.

[0009] Furthermore, an in-process analysis framework is constructed, and in-process analysis is performed according to the determined function analysis order, as follows: (41) Define the summary data structure for each function as follows: The details are as follows: In the formula, IN is the symbolic input vector, where each x represents the intersection of the reference set, formal parameter set, and global variable set of the current function, as well as the side effect variables introduced by the function; OUT is the symbolic output vector, where each y represents the intersection of the definition set, formal parameter set, and global variable set of the current function, as well as the side effect variables and return variables caused by the function; A is the dependency matrix of the function, where each element represents the probability value from the input variable to the output variable, where... middle The possible values ​​are dimensionality The possible values ​​are dimensionality; For the set of all data stream triples, A summary of the relevant functions; (42) Generate a function summary for each function. The summary includes the function's input parameters and output parameters. Both input and output parameters are replaced by symbolic variables. The input parameters are variables captured by the function, specifically including formal parameters, global variables, and variables within the function. The output parameters are variables applied to the calling environment, specifically including formal parameters, global variables, and return values; (43) Function summaries avoid redundant dependency analysis for each call by symbolizing parameters and return values. It is a set of triples, each element including , respectively represent Variable to The flow of variables and their weights; The dependency matrix between multiple instruction statements and function calls is merged to form a larger dependency structure. For sparse matrices, an adjacency list is used to optimize matrix storage. The elements stored in the dependency matrix are probability values. Sets enable sparse matrix storage operations; (44) For each function It can generate a summary of high-order formal function matrices: To express its internal data dependencies; among which arrive The variable is Input variables in a vector The column vectors of the matrix are vector; Each summary matrix records the flow from source to sink, which is used to calculate the contribution of each source to the sink and to find the sensitive source with the largest contribution when tracing the source.

[0010] Furthermore, for function call statements, an inter-procedural analysis framework is constructed. The actual parameter information at the call point is substituted into the summary, and the instantiated information flow result is applied to the calling environment based on the correspondence between formal and actual parameters, achieving precise transmission of inter-procedural information flow, as detailed below: (51) In the procedure call process, check whether a function summary has been generated for the call point. If not, generate the call point. Summary of the function matrix; (52) Based on formal parameters and global variables Perform corresponding instantiation and collect functions. The required set of actual variables, each Each vector element is an input. Column vectors, therefore The vector will be instantiated into a dependency matrix. , able to pass Dependency passing is performed on each column vector and the values ​​of the various input variables corresponding to its dependencies; (53) Obtain the influence of the current environment on the variables calling the point function through matrix operations. The operation applies the output variables to the environment.

[0011] Furthermore, after all function analyses are completed, a sensitive information flow analysis report is generated based on the inter-process information flow analysis results. This report identifies the flow path and potential risk points of sensitive information, enabling information flow traceability, as detailed below: (61) Utilize the anomaly information in the higher-order function summary to analyze the sensitive information flow of the program and generate anomaly reports: Through intra-process analysis and inter-process information flow analysis, track the data flow path in the program, record the source and destination of the data, and when constructing the dependency matrix, combine the input, output and global variable dependencies of the function, use matrix operations to simplify the analysis process, and when there are sensitive sources in the input, focus on their flow path or sink, so as to effectively capture the sensitive information flow across modules. At that time, a sensitivity analysis report will be generated, and Remove from the analysis variables; (62) Until all functions have been analyzed, compile the anomaly report, synthesize the sensitive flow path, perform sensitive flow analysis and source tracing, and finally visualize the sensitive path.

[0012] According to a second aspect of the present invention, the present invention provides a sensitive information flow tracing and source tracking system based on higher-order function digests, for implementing the above-described sensitive information flow tracing and source tracking method based on higher-order function digests, comprising: The program preprocessing module is used to receive the program under test and perform preprocessing. It performs dependency analysis on the function modules of the program under test, converts the program under test into intermediate language, constructs cross-module function call graphs and control flow graphs, traverses the function call graphs in reverse topological sorting, and determines the function analysis order. The parameter configuration module is used to configure analysis parameters, define relevant sensitive sources, sinks, and control probability sets. In-process analysis module: Used to construct the in-process analysis framework, perform in-process analysis according to the determined function analysis order, form symbolic function call information through formal parameters, global variables, source and sink points, and generate a higher-order function summary for each function based on the function call information; Inter-process analysis module: Used to construct an inter-process analysis framework for function call statements, it substitutes the actual parameter information at the call point into the summary, and applies the instantiated information flow results to the calling environment according to the correspondence between formal and actual parameters, thereby achieving accurate transmission of inter-process information flow. Source tracking report module: After all functions have been analyzed, based on the inter-process information flow analysis results, a sensitive information flow analysis report is generated to obtain the flow path and potential risk points of sensitive information, which is used for information flow traceability.

[0013] According to a third aspect of the present invention, the present invention provides a terminal device, including a memory, a processor, and a computer program stored in the memory and capable of running on the processor, wherein when the processor loads and executes the computer program, it employs the above-described sensitive information flow tracing and source tracking method based on higher-order function summaries.

[0014] This invention has at least the following beneficial effects: 1. Efficiency and Accuracy: This invention utilizes the characteristics of higher-order functions to obtain information flow information within a process, generating a function summary in the form of a higher-order matrix. This allows for convenient substitution of function input vectors from the function matrix summary at the call point during inter-process calls, directly instantiating formal and actual parameters in matrix operations. Compared to traditional summary-based analysis methods, the parameters in the higher-order function matrix summary of this invention can not only be represented as a specific variable, but also carry more information (such as probability information) during parameter passing, thus effectively improving the accuracy of sensitive information flow detection between programs.

[0015] 2. Powerful source tracing capability: Compared with traditional graph-based reachability methods, this invention does not require the construction of various hypergraphs, avoiding the problem of low analysis efficiency caused by the large size of the graph and the complexity of the graph construction process. In addition, the summary matrix of this invention is stored as a sparse matrix, which can effectively reduce the space overhead in the analysis process and improve the efficiency of sensitive information flow detection without sacrificing detection accuracy.

[0016] 3. Adaptable to supply chain scenarios: The design of this invention takes into account cross-module dependencies and multi-component interactions. Through unified IR and global call graph processing, it can adapt well to the complex environment of the open source software supply chain.

[0017] 4. Optimizability: This invention supports optimization techniques such as lazy operations and sparse matrices, further reducing the complexity of the analysis and enabling it to handle larger-scale software systems.

[0018] Of course, any product implementing this invention does not necessarily need to achieve all of the advantages described above at the same time. Attached Figure Description

[0019] Figure 1 This is a flowchart illustrating the method described in this invention; Figure 2 The diagrams shown are the function call graph and control flow graph in this embodiment of the invention. Detailed Implementation

[0020] The technical solutions of the embodiments of this disclosure will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this disclosure, and not all embodiments. Based on the embodiments of this disclosure, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this disclosure.

[0021] Example 1: Please see Figure 1 This invention provides a technical solution: a sensitive information flow tracing and source identification method based on higher-order function summaries, comprising the following steps: S1. Receive the program under test and preprocess it. Perform dependency analysis on the function modules of the program under test, convert the program under test into intermediate language, construct cross-module function call graphs and control flow graphs, traverse the function call graphs according to inverse topological sorting, and determine the function analysis order, as follows: S1.1 Perform library dependency analysis and preprocessing on the program under test. For open-source libraries with source code, compile the project source code into an intermediate representation, such as LLVM IR; S1.2 Without source code, an intermediate language with lost semantic information is formed through disassembly; S1.3 generates cross-module function call graphs and control flow graphs, such as Figure 2 As shown; A cross-module function call graph is a directed graph that illustrates the function call relationships between modules in a program. In the open-source software supply chain, programs consist of multiple interdependent modules with complex function call relationships. A cross-module function call graph uses nodes to represent functions and directed edges to represent call relationships, clearly presenting the hierarchical structure of function calls between different modules. For example, in an application containing user interface, data processing, and database interaction modules, functions in the user interface module may call functions in the data processing module, and vice versa. This graph provides a visual understanding of the program's execution flow and the jumps between different modules, clearly identifying the starting function of the call chain and frequently called functions, which is of great significance for understanding program information flow analysis. Control flow graphs focus on the directed graph of control flow within a single function, depicting the control transfer relationships between basic blocks (sequentially executed instruction sequences without branches or jumps) within the function. During program execution, control flow jumps between different basic blocks based on conditional statements, loop statements, etc. For example, in an `if-else` conditional statement within a function, the control flow graph will show that the `if` branch is executed when the condition is true, and the `else` branch is executed when the condition is false. For `for` or `while` loop statements, it will show the relationship between the loop body and the loop conditional statement, demonstrating the repeated execution of control flow within the loop body until the exit condition is met. This graph allows for in-depth analysis of the internal logical structure of functions, checking whether the program control flow conforms to expectations, identifying potential logical errors or unreasonable control transfers, and ensuring program correctness and reliability. By generating cross-module function call graphs and control flow graphs, program structure and execution flow can be comprehensively analyzed from both macro and micro perspectives, laying the foundation for data flow analysis. S1.4 Traverse the call graph in reverse topological order to determine the order of function analysis and avoid interference from circular dependencies; S2. Configure the analysis parameters and define the relevant sensitive sources, sinks, and control probability sets, as follows: S2.1 In the sensitive information flow tracing phase, sensitive data sources (such as user data, passwords, etc.) and sensitive APIs (read, write, etc.) are identified, and sensitive sources are marked. Collection and aggregation gather; S2.2 pays particular attention to sensitive APIs during program analysis and marks inputs and outputs as unique. , Finally, add it to the corresponding function. , gather; S2.3 Configure the control probability set, analyze and estimate the probability in each control flow, and form a predefined probability set. When performing data dependency analysis, dependency edges can be defined directly through the probability set. S3. Construct an in-process analysis framework, perform in-process analysis according to the determined function analysis order, form symbolic function call information through formal parameters, global variables, and source and sink points, and generate a higher-order function summary for each function based on the function call information, as detailed below: S3.1 defines the summary data structure for each function as follows: (illustrate: For the input vector, For the output vector, Let be the dependency matrix of all relevant variables in a process. For the set of all data stream triples, Here is a summary of the relevant functions, details of which are as follows: Where IN is the symbolic input vector, and each x represents the intersection of the function's reference set, formal parameter set, global variable set, and side effect variables introduced by the function; OUT is the symbolic output vector, and each y represents the intersection of the function's definition set, formal parameter set, global variable set, and side effect and return variables caused by the function; A is a function dependency matrix, where each element represents the probability value from the input variable to the output variable. in The possible values ​​are dimensionality The possible values ​​are dimensionality; S3.2 generates a function summary for each function. The summary includes the function's input parameters (variables captured by the function, including formal parameters, global variables, and possible variables within the function). The input and output parameters are all symbolic variables, while the output parameters are variables applied to the calling environment, including formal parameters, global variables, and return values. S3.3 function summaries avoid redundant dependency analysis for each call by symbolizing parameters and return values. It is a set of triples, each element including , respectively represent Variable to The flow of variables and their weights; for This branching statement, assuming each branch has the same probability, will produce two triples. , For a subsequent triple Then, through matrix operations, it will become Therefore, the probability of information flow will also be transmitted accordingly. The specific probability allocation for each branch needs to be obtained by combining the actual situation and data analysis. The sign probability can also be instantiated; instantiation is path-sensitive analysis. , The elements within the vector are all symbolic parameters during the procedural analysis, each representing a vector, which facilitates instantiation during function calls; Dependency matrices between multiple instruction statements and function calls can be combined using operations (matrix addition or multiplication) to form a larger dependency structure. For sparse matrices, adjacency lists can be used to optimize matrix storage. The elements stored in the dependency matrix are probability values, which are implemented using... Sets can be used to perform sparse matrix storage operations; S3.4 For each function It can generate a summary of high-order formal function matrices: This is to express its internal data dependencies so that it can be directly used by the caller. arrive The variable is Input variables in a vector The column vectors of the matrix are The vector, each summary matrix records the flow from source to sink, can calculate the contribution of each source to the sink, and can find the sensitive source with the largest contribution when tracing the source; S4. For function call statements, construct an inter-procedural analysis framework, substitute the actual parameter information at the call point into the summary, and apply the instantiated information flow results to the calling environment according to the correspondence between formal and actual parameters, thereby achieving accurate transmission of inter-procedural information flow, as detailed below: S4.1 In the procedure call process, check if a function summary has been generated for the call point. If not, generate the call point. Summary of the function matrix; S4.2 Based on formal parameters and global variables Perform corresponding instantiation and collect functions. The required set of actual variables, each Each vector element is an input. Column vectors, therefore The vector will be instantiated into a dependency matrix. It can be accessed Perform dependency transitivity, including the values ​​of each column vector and its corresponding input variables; S4.3 uses matrix operations to obtain the influence of the current environment on the variables calling the point function. Operations can apply the output variables to the environment; S5. After all function analyses are completed, based on the inter-process information flow analysis results, a sensitive information flow analysis report is generated to obtain the flow path and potential risk points of sensitive information for information flow traceability, as detailed below: S5.1 utilizes anomaly information from higher-order function summaries to analyze sensitive information flow in the program and generate anomaly reports: Through intra-process and inter-process information flow analysis, it tracks data flow paths within the program, recording data sources and destinations; when constructing the dependency matrix, it combines the dependencies of function inputs, outputs, and global variables, using matrix operations to simplify the analysis process; when there are sensitive sources in the input, it focuses on their flow paths or sinks, thus effectively capturing sensitive information flows across modules; when encountering... At that time, a sensitivity analysis report will be generated, and Remove from the analysis variables; S5.2 Analyze data race conditions: Utilize multithreading for parallel optimization, and improve software execution efficiency and security by modifying code or adding locking mechanisms; S5.3 Lazy evaluation: Matrix operations of the same order have a cubic time complexity. The time and space complexity can be reduced by sparse matrix operations. Lazy evaluation is used, and the corresponding matrix operations are only performed when the matrix is ​​instantiated or applied.

[0022] The technical solution of the present invention will be further described below with reference to specific embodiments: In this embodiment, the selected program code to be detected is shown in Table 1 below: Table 1. Program Code to be Detected S1, preprocess the program; S1.1 compiles the project source code into an intermediate representation, such as LLVM IR: The following examples will all use LLVM IR for explanation, and the conversion code is shown in Table 2 below: Table 2. Intermediate representation of the program under test (LLVM IR) S1.2 Without source code, an intermediate language with lost semantic information is formed through disassembly; S1.3 generates cross-module function call graphs and control flow graphs, such as Figure 2 As shown; S1.4 Determine the order of function analysis to avoid interference from circular dependencies; The function analysis order in this embodiment is as follows: ; S2, Data configuration before analysis S2.1 Marking Sensitive Sources Collection and aggregation gather; , ; S2.2 The default control probability set is an equal probability set. , Branches occur with equal probability; S3, In-process analysis, generating function summary S3.1 defines the summary data structure for each function as follows: ; S3.2 Table 3 below is The iteration process of each statement in the function; Each IR statement is one For each node, there is a corresponding and Vector, based on which iterative analysis of relevant variables is performed. The set is iterated until a fixed point is reached, and finally... The collection stores each Variable to The transitive probability value of the variable; example: This indicates that all targets are The flow of variables and the probability of the flow occurring, represented in this set as symbolic vectors. arrive The probability of the flow is 1; Table 3 shows the iteration process for each statement in the function. S3.3 Generate a function summary for each function: The summary includes the input vector (variables captured by the function, including formal parameters, global variables, and possible variables within the function). (Points), according to the table, we can obtain Equal to all The intersection of relevant variables with all formal parameters, global variables, and variables involved in the function. Points, output vectors (variables applied to the calling environment, including formal parameters, global variables, and return values), can be obtained from the table. Equal to all The intersection of relevant variables with all formal parameters, global variables, and variables involved in the function. Points, input vectors, and output vectors are all replaced by symbolic vectors; The vector generated by the function is , The final set of streams formed by iterating to the fixed point is Alias ​​analysis is also used in iterative analysis. When two variables are aliases, aliasing is performed. Set update, until each variable corresponds to The set continues until it reaches a fixed point; S3.3 function summaries avoid repeated dependency analysis for each call by symbolizing parameters and return values; It is a set of triples, each element including , respectively represent Variable to The flow of variables and their weights; for This branching statement, assuming each branch has the same probability, will produce two triples. , For a subsequent triple Then, through matrix operations, it will become Therefore, the probability of information flow will also be transmitted accordingly. The specific probability allocation for each branch needs to be determined based on the actual situation, data analysis, or by controlling the probability set. The sign probability can also be instantiated; instantiation is path-sensitive analysis. , The elements within the vector are all symbolic parameters during the procedural analysis, each representing a vector, which facilitates instantiation during function calls; S3.4 For each function It can generate a summary of high-order formal function matrices: This is to express its internal data dependencies so that it can be directly used by the caller. arrive The variable is Input variables in a vector The column vectors of the matrix are Vector. Through in-process analysis, Dependency matrix corresponding to the function As shown in Table 4 below: Table 4 Dependency Matrix of Functions S4, Inter-procedural analysis, instantiates and applies higher-order function summaries at the procedure call points. S4.1 When a function is called from a procedure, check the call point. Has a function summary been generated? If not, generate a call point. The function matrix summary is then converted into process 3 for analysis; S4.2 After obtaining the function summary for the corresponding call point, it performs operations based on the actual arguments and global variables. Instantiate the corresponding symbolic variables and collect functions. The required set of actual variables, each Each vector element is an input. Column vectors, therefore The vector will be instantiated into a dependency matrix. It can be accessed Dependency transitivity is performed, with each column vector and the values ​​of its corresponding input variables, thus enabling... To judge Whether the vector will be output to the sink depends on... Determine the function being called Will it affect variable; For example It will be instantiated as ( for In the function The column vector corresponding to the set of formal variables Then this vector can be combined with the matrix. The corresponding row vectors are multiplied together, that is... ; can be seen In the function The variable was not output. Click. View. Whether the point has an effect on the variable, then , It will be instantiated as Corresponding column vector ,but ,show In Point propagation to function Ordered; S4.3 Obtains the influence of the current environment on the variables calling the point function through matrix operations, using the formula shown in step S4.2. achievable Will the data in [the data source] be disseminated to [other sources]? In ,pass achievable of Will it spread to ; pass The calculation yields The impact on the output vector can ultimately be directly applied to... State at the call point When applied to an environment, this is achieved through matrix addition operations, thereby... The changes are applied to the calling environment; After S4.4 has analyzed each function, it continues to analyze by topological sorting until all functions have been analyzed. S5, Generate Sensitivity Analysis Report, Process Ended S5.1 uses anomaly information from higher-order function summaries to analyze the program's sensitive information flow and generate anomaly reports: During the analysis in steps 3 and 4, if there are any issues during the analysis process... , Each point will record the corresponding data stream information, for example... Will record arrive The path and related function signatures, when returning to When calling the point, if The function exists Then record the relevant information. Variable to The data flows to the report, and so on, until all functions have been analyzed. Then, the anomaly report is compiled, sensitive flow paths are synthesized, sensitive flow analysis and source tracing are performed, and finally, the sensitive paths are visualized.

[0023] In summary, this invention first preprocesses the program, including module dependency analysis and program-to-intermediate representation (such as LLVM). The process involves several steps: First, the system performs an IR (Information Relationship) transformation and constructs a cross-module function call graph and control flow graph. The order of function analysis is determined by inverse topological sorting. Second, analysis parameters are configured, defining sensitive information sources, sensitive APIs (sinks), and related control flow probabilities (if needed). Next, an intra-process analysis framework is constructed, generating a higher-order function summary for each function. This summary represents the information flow within the function using symbolic parameters (formal parameters, global variables, source and sink points) and a dependency matrix. Then, an inter-process analysis framework is constructed. At the function call point, the higher-order function summary of the called function is instantiated, substituting the actual parameter information at the call point into the summary. Based on the correspondence between formal and actual parameters, the instantiated information flow result is applied to the calling environment, achieving accurate transmission of inter-process information flow. Finally, after all functions are analyzed, a sensitive information flow detection report is generated based on the inter-process information flow analysis results, indicating the flow path of sensitive information and potential risk points. This invention, through higher-order function summaries and dependency matrix operations, can effectively improve the efficiency and accuracy of sensitive information flow tracking and tracing in software supply chain scenarios.

[0024] Example 2: This invention provides a sensitive information flow tracing and source tracking system based on higher-order function digests, used to implement the aforementioned sensitive information flow tracing and source tracking method based on higher-order function digests, comprising: The program preprocessing module is used to receive the program under test and perform preprocessing. It performs dependency analysis on the function modules of the program under test, converts the program under test into intermediate language, constructs cross-module function call graphs and control flow graphs, traverses the function call graphs in reverse topological sorting, and determines the function analysis order. The parameter configuration module is used to configure analysis parameters, define relevant sensitive sources, sinks, and control probability sets. In-process analysis module: Used to construct the in-process analysis framework, perform in-process analysis according to the determined function analysis order, form symbolic function call information through formal parameters, global variables, source and sink points, and generate a higher-order function summary for each function based on the function call information; Inter-process analysis module: Used to construct an inter-process analysis framework for function call statements, it substitutes the actual parameter information at the call point into the summary, and applies the instantiated information flow results to the calling environment according to the correspondence between formal and actual parameters, thereby achieving accurate transmission of inter-process information flow. Source tracking report module: After all functions have been analyzed, based on the inter-process information flow analysis results, a sensitive information flow analysis report is generated to obtain the flow path and potential risk points of sensitive information, which is used for information flow traceability.

[0025] Specifically, the aforementioned program preprocessing module, parameter configuration module, intra-process analysis module, inter-process analysis module, and source tracing report module can be embedded into a computer processing system. The computer, based on the sensitive information flow tracing and source tracing method based on higher-order function summaries provided above, calls each of the above modules to complete the task of tracing and source tracing the sensitive information flow. The aforementioned program preprocessing module, parameter configuration module, intra-process analysis module, inter-process analysis module, and source tracing report module can perform operations according to the specific steps given by the sensitive information flow tracing and source tracing method based on higher-order function summaries.

[0026] It should be noted that the division of the various modules in the above system is merely a division of logical functions. In actual implementation, they can be fully or partially integrated into a single physical entity, or they can be physically separated. These modules can be implemented entirely in software through processing element calls; they can be fully implemented in hardware; or some modules can be implemented by processing element calls to software, while others are implemented in hardware. For example, the program preprocessing module can be a separate processing element or integrated into a chip in the aforementioned device. Alternatively, it can be stored as program code in the memory of the aforementioned device, and called and executed by a processing element of the device. The implementation of other modules is similar. Furthermore, these modules can be fully or partially integrated together or implemented independently. The processing element mentioned here can be an integrated circuit with signal processing capabilities. During implementation, each step of the above method or each of the above modules can be completed through integrated logic circuits in the hardware of the processor element or through software instructions.

[0027] For example, these modules can be one or more integrated circuits configured to implement the above methods, such as one or more Application Specific Integrated Circuits (ASICs), one or more Digital Signal Processors (DSPs), or one or more Field Programmable Gate Arrays (FPGAs). As another example, when a module is implemented using processing element scheduler code, the processing element can be a general-purpose processor, such as a Central Processing Unit (CPU) or other processor capable of calling program code. Furthermore, these modules can be integrated together to form a system-on-a-chip (SOC).

[0028] Example 3: The present invention provides a terminal device, including a memory, a processor, and a computer program stored in the memory and capable of running on the processor. The memory stores the computer program capable of running on the processor. When the processor loads and executes the computer program, it employs the aforementioned sensitive information flow tracing and source tracing method based on higher-order function summaries.

[0029] It should be noted that the terminal device can be a computer device such as a desktop computer, a laptop computer, or a cloud server, and the terminal device includes, but is not limited to, a processor and a memory. For example, the terminal device may also include input / output devices, network access devices, and buses.

[0030] Furthermore, the processor can be a central processing unit (CPU). Of course, depending on the actual use, other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), off-the-shelf programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. can also be used. The general-purpose processor can be a microprocessor or any conventional processor, etc., and this application does not limit it in this regard.

[0031] It should be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus.

[0032] For those skilled in the art, the specific meaning of the above terms in this invention can be understood according to the specific circumstances. When an element is referred to as being "assembled on," "mounted on," "fixed to," or "set on" another element, it may be directly on the other element or there may be an intermediate element present. When an element is considered to be "connected to" another element, it may be directly connected to the other element or there may be an intermediate element present. The terms "vertical," "horizontal," "upper," "lower," "left," "right," and similar expressions used herein are for illustrative purposes only and do not represent the only possible embodiments.

[0033] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended claims and their equivalents.

[0034] In the description of this specification, references to terms such as "an embodiment," "example," "specific example," etc., indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of this disclosure. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples.

Claims

1. A method for sensitive information flow tracking and tracing based on higher-order function abstraction, characterized in that, The method comprises the following steps: Receiving a program to be tested and performing preprocessing, performing dependency analysis on function modules of the program to be tested, converting the program to be tested into an intermediate language, constructing a cross-module function call graph and a control flow graph, traversing the function call graph according to reverse topological sorting, and determining a function analysis order; Performing analysis parameter configuration, defining related sensitive sources, sinks and control probability sets; Constructing an intra-process analysis framework, performing intra-process analysis according to the determined function analysis order, forming symbolic function call information through parameters, global variables and source-sink points, and generating a high-order function summary of each function according to the function call information; For function call statements, constructing an inter-process analysis framework, substituting actual parameter information at a call point into the summary, and applying the instantiated information flow result to a call environment according to a correspondence between formal parameters and actual parameters, to realize accurate transmission of inter-process information flow; After all functions are analyzed, generating a sensitive information flow analysis report based on the inter-process information flow analysis result, obtaining a sensitive information flow path and potential risk points, and realizing information flow traceability.

2. The method of claim 1, wherein: Receiving a program to be tested and performing preprocessing, specifically as follows: (21) performing library dependency analysis and preprocessing on the program to be tested, compiling project source code into an intermediate representation form for an open source library with source code; (22) forming an intermediate language with lost semantic information through disassembly for a library without source code; (23) generating a cross-module function call graph and a control flow graph; (24) traversing the call graph in reverse topological order to determine a function analysis order, to avoid interference of circular dependencies.

3. The method of claim 2, wherein: Performing analysis parameter configuration, defining related sensitive sources, sinks and control probability sets, specifically as follows: (31) In the sensitive information flow tracking phase, determine sensitive data sources and sensitive APIs, mark sensitive sources collections and sinks collections. (32) During program analysis, focus on sensitive APIs and mark inputs and outputs as unique , , and finally add them to the corresponding , set in each function. (33) configuring a control probability set, analyzing and estimating probabilities in each control flow, and forming a predefined probability set, so that a dependency edge can be directly defined through the probability set during data dependency analysis.

4. The method of claim 1, wherein: Constructing an intra-process analysis framework, performing intra-process analysis according to the determined function analysis order, specifically as follows: (41) The summary data structure defining each function is defined as as follows: where IN is the symbolic input vector, each x is the intersection of the reference set, formal parameter set, global variable set in the current function and side-effect variables introduced by the function; OUT is the symbolic output vector, each y is the intersection of the definition set, formal parameter set, global variable set in the current function and side-effect variables and return variables caused by the function; A is the dependence matrix of the function, where each element represents the probability value of the input variable to the output variable, where The value of is the dimension of The value of is the dimension of ; is the set of all data flow triplets, is the related function summary; (42) generating function summary for each function, the summary including input parameters and output parameters of the function, both of which are replaced by symbolic variables, wherein the input parameters are variables captured by the function, specifically including formal parameters, global variables and variables in the function , and the output parameters are variables applied to the calling environment, specifically including formal parameters, global variables and return values; (43) Function summaries avoid repeated dependence analysis for each call by symbolizing parameters and return values, is a set of triples, each element including , respectively, represent variable to variable flow and weight value; The dependency matrix between multiple instruction statements and function calls is merged (forming a larger range of dependency structures, for sparse matrices, an adjacency list is used to optimize matrix storage, the elements stored in the dependency matrix are probability values Set implements sparse matrix storage operations; (44) For each function A high-order form function matrix summary can be generated: to express its internal data dependency relationship; wherein to the variable is input variable in the vector, column vector of the matrix is vector; Each summary matrix records a flow direction from a source to a sink, is used to calculate a contribution size of each source to the sink, and can find a sensitive source with the largest contribution during source tracing.

5. The method of claim 4, wherein: For function call statements, constructing an inter-process analysis framework, substituting actual parameter information at a call point into the summary, and applying the instantiated information flow result to a call environment according to a correspondence between formal parameters and actual parameters, to realize accurate transmission of inter-process information flow, specifically as follows: (51) During the process call procedure, check if the call point has generated a function summary, and if not, generate a call point function matrix summary; (52) The corresponding instantiation is performed according to the shape and global variables , and the actual variable set required by the function is collected, each vector element being an input column vector, so the vector is instantiated into a dependent matrix , which can pass the value of each column vector and the corresponding dependent input variable through ; (53) obtaining the effect of the current environment on the variables of the call point function by matrix operations, by the operations apply the output variables to the environment.

6. The method of claim 5, wherein: After all functions are analyzed, generating a sensitive information flow analysis report based on the inter-process information flow analysis result, obtaining a sensitive information flow path and potential risk points, and realizing information flow traceability, specifically as follows: (61) Using the exception information in the high-order function abstract, analyzing the program sensitive information flow, generating exception report: through the analysis within the process and the inter-process information flow analysis, tracking the data flow path in the program, recording the source and destination of the data, constructing the dependence matrix, combining the dependence relationship of the function input, output and global variable, using matrix operation to simplify the analysis process, when there is sensitive source in the input, paying attention to the path or sink of the flow, so as to effectively capture the sensitive information flow across modules, when encountering , a sensitive analysis report will be generated, and will be removed in the analysis variable; (62) until all functions are analyzed, arranging abnormal reports, synthesizing sensitive flow paths, performing sensitive flow analysis and source tracing, and finally visualizing the sensitive paths.

7. A system for high-order function summary based sensitive information flow tracking and provenance, configured to implement the method of any one of claims 1 to 6. It comprises: a program preprocessing module, which is used to receive a program to be tested and perform preprocessing, perform dependency analysis on function modules of the program to be tested, convert the program to be tested into an intermediate language, construct a cross-module function call graph and a control flow graph, traverse the function call graph according to reverse topological sorting, and determine a function analysis order; a parameter configuration module, which is used to perform analysis parameter configuration and define related sensitive sources, sinks and control probability sets. The process-in analysis module is used for constructing a process-in analysis framework, performing process-in analysis according to a determined function analysis sequence, forming symbolic function call information through parameters, global variables and source-sink points, and generating a high-order function abstract of each function according to the function call information. The process-in analysis module is used for constructing a process-in analysis framework, performing process-in analysis according to a determined function analysis sequence, forming symbolic function call information through parameters, global variables and source-sink points, and generating a high-order function abstract of each function according to the function call information. The traceability report module is used for generating a sensitive information flow analysis report based on the process-in information flow analysis result when all the functions are analyzed, obtaining a sensitive information flow path and a potential risk point, and realizing information flow traceability.

8. A terminal device comprising a memory, a processor, and a computer program stored in the memory and capable of running on the processor, characterized in that, When the processor loads and executes the computer program, a sensitive information flow tracking and traceability method based on a high-order function abstract is adopted.

Images