Global tainted data flow detection method, electronic device, system, medium and program

Abstract

The present application discloses a global tainted data flow detection method, electronic device, system, medium and program. The method comprises: performing instruction parsing on a bytecode file to be detected, and performing method inlining when a method call instruction is parsed; performing lexical and grammatical analysis based on the inlined bytecode file to generate an abstract syntax tree; performing semantic analysis on the abstract syntax tree to extract basic block information, code flow information and attribute flow information as metadata; constructing an intermediate directed graph of the code using basic block information as nodes, code flow information as edges, and attribute flow information as labels on edges; and judging whether two nodes are reachable based on the intermediate directed graph of the code, and obtaining data flow information between the two reachable nodes.

Description

Technical Field

[0001] The present application belongs to the field of code security detection in the security field, and particularly relates to a global tainted data flow detection method, electronic equipment, system, medium and program. Background Art

[0002] Identifying tainted functions and tracing tainted data flows is one of the key steps in code detection. Inaccurate identification and positioning of data flow paths will lead to a sharp increase in the false positive and false negative rates of code detection results.

[0003] In the current bytecode-based code detection process, after locating the tainted function, the tainted data flow path analysis is often performed within the process (method). However, in actual coding, the scope of the data flow involves global cross-file and cross-process (method) code. This method cannot accurately and comprehensively find all tainted data flow path information across files and processes (methods).

[0004] Therefore, a method is needed to detect global tainted data flows across files and processes (methods). Summary of the invention

[0005] In view of the above technical problems, the present application proposes a global tainted data flow detection method, electronic device, system, medium and program.

[0006] According to one aspect of the present application, a global tainted data flow detection method is provided, comprising: performing instruction parsing on a bytecode file to be detected, and performing method inlining when a method call instruction is parsed; performing lexical and syntactic analysis based on the inlined bytecode file to generate an abstract syntax tree; performing semantic analysis on the abstract syntax tree to extract basic block information, code flow information, and attribute flow information as metadata; constructing an intermediate directed graph of the code using the basic block information as nodes, the code flow information as edges, and the attribute flow information as labels on the edges; and judging whether two nodes are reachable based on the intermediate directed graph of the code, and obtaining data flow information between the two reachable nodes.

[0007] According to an example embodiment, the method further comprises uploading a bytecode file to be detected.

[0008] According to an example embodiment, instruction parsing is performed on a bytecode file to be detected, and method inlining is performed when a method call instruction is parsed, including: extracting class, attribute and method information of the bytecode file to be detected; determining whether the extracted method contains an entry method; if it is determined that an entry method is contained, sequentially analyzing the method body bytecode instructions in the entry method; determining whether the method body bytecode instructions are method call instructions; recursively merging the bytecode instructions when it is determined that the method body bytecode instructions are method call instructions; recording the current bytecode instructions when it is determined that the method body bytecode instructions are not method call instructions; and generating an inlined bytecode file based on the recursively merged bytecode instructions and / or the recorded bytecode instructions.

[0009] According to an example embodiment, semantically analyzing an abstract syntax tree to extract basic block information, code flow information, and attribute flow information as metadata includes: semantically analyzing the abstract syntax tree to identify and divide basic blocks; filling in basic blocks to generate a control flow graph; and extracting basic block information, code flow information, and attribute flow information as metadata.

[0010] According to an example embodiment, filling basic blocks to generate a control flow graph includes: performing variable assignment analysis; and identifying and recording attribute dependency transitive relationships.

[0011] According to an example embodiment, judging whether two nodes are reachable based on an intermediate directed graph of the code and obtaining data flow information between the two reachable nodes includes: judging whether two nodes are reachable based on the intermediate directed graph of the code and obtaining data flow information between the two reachable nodes by combining basic block information, code flow information and attribute flow information with a depth-first traversal search algorithm.

[0012] According to an example embodiment, the method further comprises outputting a global tainted data stream.

[0013] According to another aspect of the present application, an electronic device is provided, comprising: one or more processors, and a memory coupled to the one or more processors, the memory storing computer-readable program instructions, which, when executed by the one or more processors, enable the one or more processors to execute the global tainted data flow detection method described in the present application.

[0014] According to another aspect of the present application, a global data flow detection system is provided, comprising a module for executing the steps of the global tainted data flow detection method described in the present application.

[0015] According to another aspect of the present application, a non-transitory computer-readable medium is provided. The non-transitory computer-readable medium has instructions stored thereon, which are used to be executed by a processor to perform the global tainted data flow detection method according to the present application.

[0016] According to another aspect of the present application, a computer program product is provided, including a computer program. When the computer program is executed by a processor, the global tainted data flow detection method according to the present application is performed. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application, and a person skilled in the art can also obtain other drawings based on these drawings.

[0018] In order to better understand the present disclosure and to show how it may be implemented, it will now be described by way of example with reference to the accompanying drawings, in which:

[0019] Figure 1 An exemplary block diagram of an electronic device for implementing a global tainted data flow detection method according to an embodiment of the present disclosure is shown;

[0020] Figure 2 An exemplary flow chart of a global tainted data flow detection method according to an embodiment of the present disclosure is shown;

[0021] Figure 3 An exemplary flow chart of method inlining according to an embodiment of the present disclosure is shown;

[0022] Figure 4 A schematic diagram of the inline effect of a method according to an exemplary embodiment of the present disclosure is shown;

[0023] Figure 5 An exemplary flow chart of extracting metadata according to an embodiment of the present disclosure is shown;

[0024] Figure 6 A schematic diagram of an intermediate directed graph according to an embodiment of the present disclosure is shown.

[0025] Note that throughout the drawings, like reference numerals designate corresponding parts. DETAILED DESCRIPTION

[0026] The following detailed description is made with reference to the accompanying drawings, and the following detailed description is provided to assist in a comprehensive understanding of the various exemplary embodiments of the present disclosure. The following description includes various details to assist in understanding, but these details are considered to be examples only and not to limit the present disclosure, which is defined by the appended claims and their equivalents. The words and phrases used in the following description are only used to enable a clear and consistent understanding of the present disclosure. In addition, for the sake of clarity and brevity, descriptions of well-known structures, functions, and configurations may be omitted. Those of ordinary skill in the art will recognize that various changes and modifications may be made to the examples described herein without departing from the spirit and scope of the present disclosure.

[0027] Figure 1 1 is a block diagram showing an exemplary configuration of an electronic device 100 according to an embodiment of the present disclosure. The electronic device 100 can be used to implement the global tainted data flow detection method according to the present application.

[0028] like Figure 1 As shown, the electronic device 100 includes a user interface 20, a network interface 21, a power supply 22, an external network interface 23, a memory 24, and a processor 26. The user interface 20 may include, but is not limited to, buttons, keyboards, keypads, LCDs, CRTs, TFTs, LEDs, HDs, or other similar display devices, including a display device with a touch screen capability that enables interaction between a user and a gateway device. In some embodiments, the user interface 20 may be used to present a graphical user interface (GUI) to receive user input.

[0029] The network interface 21 may include various network cards and circuit systems implemented in software and / or hardware so that it can communicate with the user device using a wired or wireless protocol. The wired communication protocol is, for example, any one or more of an Ethernet protocol, a MoCA specification protocol, a USB protocol, or other wired communication protocols. The wireless protocol is, for example, any IEEE 802.11 Wi-Fi protocol, a Bluetooth protocol, a low-power Bluetooth (BLE), or other short-range protocols that operate according to wireless technology standards, for using any licensed or unlicensed frequency band (such as a Citizen Broadband Radio Service (CBRS) band, a 2.4 GHz band, a 5 GHz band, a 6 GHz band, or a 60 GHz band), an RF4CE protocol, a ZigBee protocol, a Z-Wave protocol, or an IEEE802.15.4 protocol to exchange data over a short distance. In the case where the network interface 21 uses a wireless protocol, in some embodiments, the network interface 21 may also include one or more antennas (not shown) or a circuit node for coupling to one or more antennas. The electronic device 100 may provide an internal network to the user device through the network interface 21.

[0030] The power supply 22 provides power to the internal components of the electronic device 100 through the internal bus 27. The power supply 22 can be a self-contained power supply, such as a battery pack, whose interface is powered by a charger connected to a socket (for example, directly or through other devices). The power supply 22 can also include a rechargeable battery that is removable for replacement, such as a NiCd, NiMH, Li-ion or Li-pol battery. The external network interface 23 can include various network cards and circuit systems implemented in software and / or hardware to enable communication between the electronic device 100 and a provider of an external network (for example, an Internet service provider or a multi-system operator (MSO)).

[0031] The memory 24 includes a single memory or one or more memories or storage locations, including but not limited to random access memory (RAM), dynamic random access memory (DRAM), static random access memory (SRAM), read-only memory (ROM), EPROM, EEPROM, flash memory, logic blocks of an FPGA, a hard disk, or any other layers of the memory hierarchy. The memory 24 can be used to store any type of instructions, software, or algorithms, including software 25 for controlling the general functions and operations of the electronic device 100.

[0032] The processor 26 controls the general operation of the electronic device 100 and performs management functions related to other devices in the network (such as user devices). The processor 26 may include, but is not limited to, a CPU, a hardware microprocessor, a hardware processor, a multi-core processor, a single-core processor, a microcontroller, an application-specific integrated circuit (ASIC), a DSP, or other similar processing devices, capable of executing any type of instructions, algorithms, or software for controlling the operation and functions of the electronic device 100 according to the embodiments described in the present disclosure. The processor 26 may be various implementations of a digital circuit system, an analog circuit system, or a mixed signal (a combination of analog and digital) circuit system that performs functions in a computing system. The processor 26 may include, for example, an integrated circuit (IC), a portion or circuit of a separate processor core, an entire processor core, a separate processor, a programmable hardware device such as a field programmable gate array (FPGA), and / or a system including multiple processors.

[0033] An internal bus 27 may be used to establish communications between components of the electronic device 100 (eg, 20 - 22 , 24 , and 26 ).

[0034] Although specific components are used to describe the electronic device 100, in alternative embodiments, different components may be present in the electronic device 100. For example, the electronic device 100 may include one or more additional controllers, memories, network interfaces, external network interfaces, and / or user interfaces. In addition, one or more of the components may not be present in the electronic device 100. Furthermore, in some embodiments, the electronic device 100 may include Figure 1 One or more components not shown in FIG. Figure 1 100, but in some embodiments, some or all of a given component may be integrated into one or more of the other components in the electronic device 100. In addition, the circuits and components in the electronic device 100 may be implemented using any combination of analog and / or digital circuits.

[0035] Figure 2 An exemplary flowchart 200 of a global tainted data flow detection method according to an embodiment of the present disclosure is shown. Figure 2 The global tainted data flow detection method shown can be obtained by Figure 1 The electronic device 100 shown in FIG.

[0036] like Figure 2 As shown, at step S210, the bytecode file to be detected is uploaded. According to an exemplary embodiment of the present invention, when Java programming is used, the bytecode file to be detected can be a Jar package.

[0037] In step S220, the bytecode file to be detected is instruction parsed, and method inlining is performed when a method call instruction is parsed.

[0038] Figure 3 An exemplary flow chart 300 for performing method inlining according to one embodiment of the present disclosure is shown.

[0039] like Figure 3 As shown, at step S310, the class, attribute and method information of the bytecode file to be detected are extracted. According to an exemplary embodiment of the present invention, when the bytecode file to be detected is a Jar package, the bytecode to be detected is a *.class file, and its class is class.

[0040] At step S320, it is determined whether the extracted method contains an entry method. If it is determined that the method contains an entry method, the step proceeds to S330, otherwise it returns to step S310.

[0041] When it is determined that an entry method is included, at step S330, the method body bytecode instructions in the entry method are sequentially analyzed. According to an exemplary embodiment of the present invention, the entry method may be an API call.

[0042] At step S340, it is determined whether the method body bytecode instruction is a method call instruction. If it is determined that the method body bytecode instruction is a method call instruction, the step proceeds to S350, otherwise it proceeds to step S360.

[0043] According to an embodiment of the present invention, method calling instructions include but are not limited to invokeSpecial, invokeInterface, invokeStatic and invokeVirtual.

[0044] When it is determined that the method body bytecode instruction is a method call instruction, at step S350, the bytecode instructions are recursively merged. When it is determined that the method body bytecode instruction is not a method call instruction, at step S360, the current bytecode instruction is recorded.

[0045] At step S370, an inlined bytecode file is generated based on the recursively merged bytecode instructions and / or the recorded bytecode instructions.

[0046] Figure 4 FIG. 1 shows a method inline effect diagram according to an exemplary embodiment of the present disclosure. Figure 4 As shown in the figure, the left side is the source code file, the upper right side is the bytecode file before inlining, and the lower right side is the bytecode file after inlining. Figure 4 It can be seen that before inlining, the bytecode file includes two independent method bodies, main and method, while after inlining, a single method body is generated that associates the two method bodies.

[0047] Reference again Figure 2 At step S230, lexical and grammatical analysis is performed based on the inlined bytecode file to generate an abstract syntax tree (AST). The abstract syntax tree can be generated using techniques known in the art, which will not be described in detail here.

[0048] At step S240 , semantic analysis is performed on the abstract syntax tree to extract basic block information, code flow information, and attribute flow information as metadata.

[0049] Figure 5 An exemplary flow chart 500 for extracting metadata according to one embodiment of the present disclosure is shown.

[0050] like Figure 5 As shown, at step S510, semantic analysis is performed on the abstract syntax tree to identify and divide basic blocks.

[0051] At step S520, basic blocks are filled to generate a control flow graph (CFG). According to an exemplary embodiment of the present invention, filling basic blocks to generate a control flow graph includes performing variable assignment analysis and identifying and recording attribute dependency transfer relationships. According to an embodiment of the present invention, the attribute dependency transfer relationship is an assignment transfer relationship of a variable / field.

[0052] According to a specific embodiment, the content filled in the basic block is a three-address code, and the generated control flow graph is the execution order of the code.

[0053] At step S530 , basic block information, code flow information, and attribute flow information are extracted as metadata.

[0054] Reference again Figure 2 At step S250, the intermediate directed graph of the code is constructed by using the basic block information as nodes, the code flow information as edges, and the attribute flow information as labels on the edges.

[0055] Figure 6 FIG. 2 shows a schematic diagram of an intermediate directed graph according to an embodiment of the present disclosure. Figure 6 As shown in the figure, each box represents a basic block, i.e., a node. The connecting lines in the middle and on the left are code flow information, i.e., edges. The connecting line on the right is attribute flow information, i.e., label P.

[0056] Reference again Figure 2 , at step S260, based on the intermediate directed graph of the code, it is determined whether two nodes are reachable, and the data flow information between the two reachable nodes is obtained.

[0057] If there is a path between two nodes that is reachable, it means that there is a data flow between the two nodes. According to an exemplary embodiment of the present application, based on the intermediate directed graph of the code, a depth-first traversal search algorithm can be used to determine whether any two nodes are reachable by combining and checking basic block information, code flow information, and attribute flow information, and obtain data flow information between the two reachable nodes.

[0058] Reference again Figure 6 , where source() is the tainted data source method and sink() is the defect outbreak method. After a series of propagation:

[0059] 1. String source=source(s);

[0060] 2. String sink=source.trim();

[0061] 3. sink (sink).

[0062] 1-2-3 are reachable, thus forming a tainted data flow from source() to sink().

[0063] According to an exemplary embodiment of the present invention, the following search algorithm is used to traverse the intermediate directed graph of the code:

[0064]

[0065] where v and u are a set of nodes, is a set of directed edges,

[0066] λ: E→∑ is the edge marker, OUT l Returns all nodes reachable from edges with label l.

[0067] Reference again Figure 2 At step S270, the global data flow is output. According to the embodiment of the present invention, the data flow information between any two reachable nodes can be obtained through the above graph reachability traversal, so that the global data flow can be obtained.

[0068] The present application pre-processes the bytecode to be detected, inlines the bytecode file with the entry method as the root node according to the instruction set method call command, establishes the association relationship between the bytecode file class, attributes, and methods, and then extracts the attribute transfer information in the process of generating the control flow graph (CFG) based on the semantic analysis of the bytecode file, and constructs an intermediate graph representation of the bytecode by combining the basic block information, code flow information, and attribute transfer information. Then, through the graph reachability traversal, the reachability between nodes is determined and the global data flow information is obtained, thereby realizing the information tracking of the global data flow of the bytecode.

[0069] The above method proposed in the present application improves the accuracy of code detection and can realize global taint data flow tracking across files and processes (methods), thereby reducing the omission rate and false alarm rate of code detection results.

[0070] The present invention may be implemented by electronic devices, systems, methods and / or computer program products. The computer program product may include a computer-readable storage medium carrying computer-readable program instructions for causing a processor to implement various aspects of the present invention.

[0071] According to one embodiment of the present invention, an electronic device is provided, comprising one or more processors and a memory coupled to the one or more processors, the memory storing computer-readable program instructions, which when executed by the one or more processors perform a global tainted data flow detection method according to the present invention.

[0072] According to another embodiment of the present invention, a global data flow detection system is provided, comprising a module for executing the steps of the global tainted data flow detection method according to the present invention.

[0073] According to another embodiment of the present invention, a non-transitory computer-readable medium is provided. The non-transitory computer-readable medium has instructions stored thereon for being executed by a processor to perform the global tainted data flow detection method according to the present invention.

[0074] According to another embodiment of the present invention, a computer program product is provided, comprising a computer program, wherein when the computer program is executed by a processor, the computer program performs the steps of the global tainted data flow detection method according to the present invention.

[0075] A computer-readable storage medium may be a tangible device that can hold and store instructions used by an instruction execution device. A computer-readable storage medium may be, for example, but not limited to, an electrical storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination of the foregoing. More specific examples of computer-readable storage media (a non-exhaustive list) include: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a static random access memory (SRAM), a portable compact disk read-only memory (CD-ROM), a digital versatile disk (DVD), a memory stick, a floppy disk, a mechanical encoding device, such as a punch card or a raised structure in a groove on which instructions are stored, and any suitable combination of the foregoing. As used herein, a computer-readable storage medium is not to be interpreted as a transient signal per se, such as a radio wave or other freely propagating electromagnetic wave, an electromagnetic wave propagating through a waveguide or other transmission medium (e.g., a light pulse through a fiber optic cable), or an electrical signal transmitted through a wire.

[0076] The computer-readable program instructions described herein can be downloaded from a computer-readable storage medium to each computing / processing device, or downloaded to an external computer or external storage device via a network, such as the Internet, a local area network, a wide area network, and / or a wireless network. The network can include copper transmission cables, optical fiber transmissions, wireless transmissions, routers, firewalls, switches, gateway computers, and / or edge servers. The network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network and forwards the computer-readable program instructions for storage in the computer-readable storage medium in each computing / processing device.

[0077] The computer program instructions for performing the operation of the present invention may be assembly instructions, instruction set architecture (ISA) instructions, machine instructions, machine-related instructions, microcode, firmware instructions, state setting data, or source code or object code written in any combination of one or more programming languages, including object-oriented programming languages, such as Smalltalk, C++, etc., and conventional procedural programming languages, such as "C" language or similar programming languages. Computer-readable program instructions may be executed entirely on a user's computer, partially on a user's computer, as an independent software package, partially on a user's computer, partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer via any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., using an Internet service provider to connect via the Internet). In some embodiments, an electronic circuit, such as a programmable logic circuit, a field programmable gate array (FPGA), or a programmable logic array (PLA), may be personalized by utilizing the state information of the computer-readable program instructions, and the electronic circuit may execute the computer-readable program instructions, thereby realizing various aspects of the present invention.

[0078] Various aspects of the present invention are described herein with reference to the flow charts and / or block diagrams of the methods, devices (systems) and computer program products according to embodiments of the present invention. It should be understood that each box of the flow chart and / or block diagram and the combination of each box in the flow chart and / or block diagram can be implemented by computer-readable program instructions.

[0079] These computer-readable program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, thereby producing a machine, so that when these instructions are executed by the processor of the computer or other programmable data processing device, a device that implements the functions / actions specified in one or more boxes in the flowchart and / or block diagram is generated. These computer-readable program instructions can also be stored in a computer-readable storage medium, and these instructions cause the computer, programmable data processing device, and / or other equipment to work in a specific manner, so that the computer-readable medium storing the instructions includes a manufactured product, which includes instructions for implementing various aspects of the functions / actions specified in one or more boxes in the flowchart and / or block diagram.

[0080] Computer-readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other device so that a series of operating steps are performed on the computer, other programmable data processing apparatus, or other device to produce a computer-implemented process, thereby causing the instructions executed on the computer, other programmable data processing apparatus, or other device to implement the functions / actions specified in one or more boxes in the flowchart and / or block diagram.

[0081] The flow chart and block diagram in the accompanying drawings show the possible architecture, function and operation of the system, method and computer program product according to multiple embodiments of the present invention. In this regard, each square box in the flow chart or block diagram can represent a part of a module, program segment or instruction, and a part of the module, program segment or instruction includes one or more executable instructions for realizing the specified logical function. In some alternative implementations, the function marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two continuous square boxes can actually be executed substantially in parallel, and they can sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs the specified function or action, or can be implemented with a combination of special hardware and computer instructions.

[0082] The embodiments of the present invention have been described above, and the above description is exemplary, not exhaustive, and is not limited to the disclosed embodiments. Many modifications and variations will be apparent to those of ordinary skill in the art without departing from the scope and spirit of the described embodiments. The terms used herein are selected to best explain the principles of the embodiments, practical applications, or technical improvements to the technology in the market, or to enable other persons of ordinary skill in the art to understand the embodiments disclosed herein.

Claims

1. A global tainted data flow detection method, comprising: Parse the instructions of the bytecode file to be detected, and perform method inlining when the method call instructions are parsed; Perform lexical and grammatical analysis based on the inlined bytecode file to generate an abstract syntax tree; Perform semantic analysis on the abstract syntax tree to extract basic block information, code flow information, and attribute flow information as metadata; Constructing an intermediate directed graph of the code using basic block information as nodes, code flow information as edges, and attribute flow information as labels on the edges; and Based on the intermediate directed graph of the code, determine whether two nodes are reachable, and obtain the data flow information between the two reachable nodes; The step of parsing the bytecode file to be detected and inlining the method when parsing the method call instruction includes: According to the method call instruction, the bytecode file to be detected is inlined with the entry method as the root node; The step of inlining the bytecode file to be detected comprises: Extracting class, attribute and method information of the bytecode file to be detected; Determine whether the extracted method includes the entry method; When it is determined that the entry method is included, taking the entry method as a root node, sequentially analyzing the method body bytecode instructions in the entry method; Determining whether the method body bytecode instruction is the method call instruction; recursively merging bytecode instructions when determining that the method body bytecode instruction is the method call instruction; When determining that the method body bytecode instruction is not the method call instruction, recording the current bytecode instruction; and The inlined bytecode file is generated based on the recursively merged bytecode instructions and / or the recorded bytecode instructions.

2. The global tainted data flow detection method according to claim 1 further includes uploading a bytecode file to be detected.

3. The global tainted data flow detection method according to claim 1, wherein the semantic analysis of the abstract syntax tree to extract basic block information, code flow information and attribute flow information as metadata comprises: Perform semantic analysis on the abstract syntax tree to identify and divide basic blocks; Fill in basic blocks to generate a control flow graph; as well as Basic block information, code flow information, and attribute flow information are extracted as metadata.

4. The global tainted data flow detection method according to claim 3, wherein filling basic blocks to generate a control flow graph comprises: Perform variable assignment analysis; as well as Identify and document attribute dependency transitive relationships.

5. The global tainted data flow detection method according to claim 1, wherein judging whether two nodes are reachable based on the intermediate directed graph of the code and obtaining the data flow information between the two reachable nodes comprises: Based on the intermediate directed graph of the code, a depth-first traversal search algorithm is used to determine whether two nodes are reachable by combining the basic block information, code flow information and attribute flow information, and obtain the data flow information between the two reachable nodes.

6. The global tainted data flow detection method according to any one of claims 1 to 5, further comprising: Output global data stream.

7. An electronic device comprising: one or more processors, and A memory coupled to the one or more processors, the memory storing computer-readable program instructions, which, when executed by the one or more processors, cause the one or more processors to perform the method according to any one of claims 1 to 6.

8. A global tainted data flow detection system, comprising a module for executing the steps of the method according to any one of claims 1-6.

9. A non-transitory computer readable medium having instructions stored thereon for execution by a processor to perform the steps of the method according to any one of claims 1 to 6.

10. A computer program product, comprising a computer program, which, when executed by a processor, performs the steps of the method according to any one of claims 1 to 6.

Images