Code detection method, device, computer readable medium and electronic device

Abstract

The present application belongs to the field of data security technology, and specifically relates to a code detection method, device, computer-readable medium and electronic device. The present application obtains a whitelist list and a code to be detected; generates a dictionary tree according to the whitelist list; uses a breadth-first traversal method to traverse each node in the dictionary tree, and constructs a mismatch pointer for each node in the dictionary tree to form a whitelist multi-mode matching automaton; and then pre-processes the code to be detected and inputs it into the whitelist multi-mode matching automaton for matching, and outputs the detection result. Using the method of the present application, a dictionary tree can be generated at one time, and the code to be detected can be matched through a whitelist multi-mode matching automaton, which can achieve one-time multi-mode matching, greatly improve the matching efficiency, and have high code detection efficiency.

Description

Technical Field

[0001] The present application belongs to the field of data security technology, and specifically relates to a code detection method, a code detection device, a computer-readable medium, and an electronic device. Background Art

[0002] Code detection is mainly used to solve security problems in source code. Currently, commonly used code detection methods include static detection, interactive detection, dynamic detection, etc. However, these methods are difficult to guarantee the accuracy of code detection and false positives are inevitable.

[0003] In order to reduce the false positives of detection, filtering can be performed through whitelists, rule sets, etc. The existing whitelist filtering method used in code security detection mainly compares the whitelist with the detection object to filter out the objects in the detection object that are the same as the whitelist, so as to reduce false positives. However, this filtering method requires comparing the detection object with the content in the whitelist one by one, which is inefficient and not conducive to code detection.

[0004] It should be noted that the information disclosed in the above background technology section is only used to enhance the understanding of the background of the present application, and therefore may include information that does not constitute the prior art known to ordinary technicians in the field. Summary of the invention

[0005] The purpose of this application is to provide a code detection method, which can at least to some extent overcome the technical problems of low code detection efficiency in related technologies.

[0006] Other features and advantages of the present application will become apparent from the following detailed description, or may be learned in part by the practice of the present application.

[0007] According to one aspect of an embodiment of the present application, a code detection method is provided, including:

[0008] Get the whitelist and the code to be detected;

[0009] Generate a dictionary tree according to the whitelist;

[0010] Traversing each node in the dictionary tree using a breadth-first traversal method, and constructing a mismatch pointer for each node in the dictionary tree to form a whitelist multi-pattern matching automaton;

[0011] The code to be detected is pre-processed and then input into the whitelist multi-mode matching automaton for matching, and the detection result is output.

[0012] In some embodiments of the present application, based on the above technical solution, a method for generating a dictionary tree according to the whitelist list includes:

[0013] Extracting the character string in the whitelist;

[0014] Performing a hash operation on the string to obtain a string code;

[0015] Concatenating the string codes to form a string group;

[0016] A dictionary tree is established according to the character string group.

[0017] In some embodiments of the present application, based on the above technical solution, the whitelist includes multiple security codes; the method of extracting the character string in the whitelist includes:

[0018] Extract signature information of the security code, where the signature information includes at least one of the following: package name, class name, method name, return value, and code parameter.

[0019] In some embodiments of the present application, based on the above technical solution, a method for establishing a dictionary tree according to the string group includes:

[0020] Construct a blank node as the root node;

[0021] A dictionary tree is constructed with the root node as the starting node, the characters of the string group as edges, and the prefix composed of the characters of the string group as secondary nodes.

[0022] In some embodiments of the present application, based on the above technical solution, a method for constructing a mismatch pointer for each node in the dictionary tree includes:

[0023] Finding a parent node of a pending node, wherein the pending node is a secondary node contained in the dictionary tree;

[0024] Determine the relationship between the character corresponding to the edge of the pending node pointing to the parent node and other secondary nodes in the dictionary tree;

[0025] When the character corresponding to the edge of the pending node pointing to the parent node is the same as the designated secondary node in the dictionary tree, and the designated secondary node is the last node of the suffix string of the longest current string among the characters represented by the pending node, the designated secondary node is defined as a candidate node of the pending node, and a mismatch pointer from the pending node to the candidate node is constructed;

[0026] When the character corresponding to the edge of the pending node pointing to the parent node is different from that of other secondary nodes in the dictionary tree, a mismatch pointer from the pending node to the root node is constructed.

[0027] In some embodiments of the present application, based on the above technical solution, the method of pre-processing the code to be detected and inputting it into the whitelist multi-mode matching automaton for matching includes:

[0028] Preprocessing the code to be detected to obtain a signature code group;

[0029] Inputting the characters of the signature encoding group into the whitelist multi-pattern matching automaton in order for matching;

[0030] If the whitelist multi-mode matching automaton outputs a root node and a plurality of secondary nodes in sequence, the code to be detected is successfully matched with the whitelist multi-mode matching automaton.

[0031] In some embodiments of the present application, based on the above technical solution, a method for preprocessing the code to be detected to obtain a signature code group includes:

[0032] Parsing the code to be detected to obtain the bytecode to be detected;

[0033] Extracting signature information of the bytecode to be detected, wherein the signature information includes package name, class name, method name, return value and code parameters;

[0034] Performing a hash operation on the signature information to obtain a signature code;

[0035] The signature codes are concatenated to form a signature code group.

[0036] According to one aspect of an embodiment of the present application, a code detection device is provided, including:

[0037] Acquisition module, used to obtain the whitelist and the code to be detected;

[0038] A dictionary tree module, used for generating a dictionary tree according to the white list;

[0039] A construction module is used to traverse each node in the dictionary tree using a breadth-first traversal method, and to construct a mismatch pointer for each node in the dictionary tree to form a whitelist multi-pattern matching automaton;

[0040] The detection module is used to pre-process the code to be detected and then input it into the whitelist multi-mode matching automaton for matching, and output the detection result.

[0041] In some embodiments of the present application, based on the above technical solution, the dictionary tree module includes:

[0042] An extraction unit, used to extract the character string in the white list;

[0043] An encoding unit, used for performing a hash operation on the string to obtain a string code;

[0044] A concatenation unit, used for concatenating the string codes to form a string group;

[0045] The dictionary tree building unit is used to build a dictionary tree according to the character string group.

[0046] In some embodiments of the present application, based on the above technical solution, the whitelist list includes multiple security codes; the extraction unit is used to extract signature information of the security code, and the signature information includes at least one of the following: package name, class name, method name, return value and code parameters.

[0047] In some embodiments of the present application, based on the above technical solution, the dictionary tree establishment unit is also used to construct a blank node as a root node; and use the root node as the starting node, the characters of the string group as edges, and the prefix composed of the characters of the string group as secondary nodes to construct a dictionary tree.

[0048] In some embodiments of the present application, based on the above technical solution, the construction module includes a mismatch pointer construction unit, and the mismatch pointer construction unit includes:

[0049] A searching unit, used for searching a parent node of a pending node, wherein the pending node is a secondary node contained in the dictionary tree;

[0050] A judging unit, used for judging the relationship between the character corresponding to the edge of the pending node pointing to the parent node and other secondary nodes in the dictionary tree;

[0051] A first construction unit is used to define the designated secondary node as a candidate node of the pending node, and construct a mismatch pointer from the pending node to the candidate node when the character corresponding to the edge of the pending node pointing to the parent node is the same as the designated secondary node in the dictionary tree, and the designated secondary node is the last node of the suffix string of the longest current string among the characters represented by the pending node;

[0052] The second construction unit is used to construct a mismatch pointer from the pending node to the root node when the character corresponding to the edge of the pending node pointing to the parent node is different from other secondary nodes in the dictionary tree.

[0053] In some embodiments of the present application, based on the above technical solution, the detection module includes:

[0054] A preprocessing unit, used for preprocessing the code to be detected to obtain a signature code group;

[0055] An input unit, used to input the characters of the signature encoding group into the whitelist multi-mode matching automaton in order for matching;

[0056] A matching unit is used for: if the whitelist multi-mode matching automaton outputs a root node and a plurality of secondary nodes in sequence, the code to be detected is successfully matched with the whitelist multi-mode matching automaton.

[0057] In some embodiments of the present application, based on the above technical solution, the preprocessing unit includes:

[0058] A bytecode parsing unit, used for parsing the code to be detected to obtain a bytecode to be detected;

[0059] A signature extraction unit, used to extract signature information of the bytecode to be detected, wherein the signature information includes a package name, a class name, a method name, a return value, and code parameters;

[0060] A computing unit, used for performing a hash operation on the signature information to obtain a signature code;

[0061] The code concatenation unit is used to concatenate the signature codes to form a signature code group.

[0062] According to one aspect of an embodiment of the present application, a computer-readable medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the code detection method in the above technical solution is implemented.

[0063] According to one aspect of an embodiment of the present application, an electronic device is provided, comprising: a processor; and a memory for storing executable instructions of the processor; wherein the processor is configured to execute a code detection method as in the above technical solution by executing the executable instructions.

[0064] According to one aspect of the embodiments of the present application, a computer program product or a computer program is provided, the computer program product or the computer program includes computer instructions, and the computer instructions are stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the computer device performs the code detection method in the above technical solution.

[0065] In the technical solution provided in the embodiment of the present application, the present application obtains a whitelist list and a code to be detected; generates a dictionary tree according to the whitelist list; uses a breadth-first traversal method to traverse each node in the dictionary tree, and constructs a mismatch pointer for each node in the dictionary tree to form a whitelist multi-mode matching automaton; and then pre-processes the code to be detected and inputs it into the whitelist multi-mode matching automaton for matching, and outputs the detection result. Using the method of the present application, a dictionary tree can be generated at one time, and the code to be detected can be matched through the whitelist multi-mode matching automaton, which can achieve one-time multi-mode matching, greatly improve the matching efficiency, and high code detection efficiency.

[0066] Furthermore, the present application obtains the bytecode to be detected by parsing the code to be detected, and extracts the code to be detected by extracting the bytecode. Compared with the method of parsing the abstract syntax tree, the corresponding method of the present application can extract more comprehensive information and has higher extraction efficiency.

[0067] Furthermore, the present application can make the whitelist matching more accurate and further reduce the false alarm rate by extracting the return value and code parameters of the security code in the whitelist.

[0068] It should be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0069] The drawings herein are incorporated into the specification and constitute a part of the specification, illustrate embodiments consistent with the present application, and together with the specification are used to explain the principles of the present application. Obviously, the drawings described below are only some embodiments of the present application, and for ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0070] Figure 1 The exemplary system architecture block diagram applying the technical solution of the present application is schematically shown.

[0071] Figure 2 The flowchart of the code detection method of the present application is schematically shown.

[0072] Figure 3 The flowchart of the method for generating a dictionary tree according to a whitelist list in the present application is schematically shown.

[0073] Figure 4 The diagram schematically shows the dictionary tree diagram established in the present application.

[0074] Figure 5 The flowchart of the mismatch pointer construction method of the present application is schematically shown.

[0075] Figure 6 The schematic diagram of the mismatch pointer constructed in the present application is shown schematically.

[0076] Figure 7 The flowchart of the method for matching the code to be detected in the present application is schematically shown.

[0077] Figure 8 The flowchart of the method for preprocessing the code to be detected in the present application is schematically shown.

[0078] Fig. 9 The structural block diagram of the code detection device of the present application is schematically shown.

[0079] Fig.10 The structure block diagram of a computer system suitable for implementing an electronic device of an embodiment of the present application is schematically shown. DETAILED DESCRIPTION

[0080] Example embodiments will now be described more fully with reference to the accompanying drawings. However, example embodiments can be implemented in a variety of forms and should not be construed as limited to the examples set forth herein; rather, these embodiments are provided so that this application will be more comprehensive and complete and fully convey the concept of the example embodiments to those skilled in the art.

[0081] In addition, described feature, structure or characteristic can be combined in one or more embodiments in any suitable manner. In the following description, many specific details are provided to provide a full understanding of the embodiments of the present application. However, those skilled in the art will appreciate that the technical scheme of the present application can be put into practice without one or more of the specific details, or other methods, components, devices, steps, etc. can be adopted. In other cases, known methods, devices, realizations or operations are not shown or described in detail to avoid blurring the various aspects of the application.

[0082] The block diagrams shown in the accompanying drawings are merely functional entities and do not necessarily correspond to physically independent entities. That is, these functional entities may be implemented in software form, or in one or more hardware modules or integrated circuits, or in different networks and / or processor devices and / or microcontroller devices.

[0083] The flowcharts shown in the accompanying drawings are only exemplary and do not necessarily include all the contents and operations / steps, nor must they be executed in the order described. For example, some operations / steps can be decomposed, and some operations / steps can be combined or partially combined, so the actual execution order may change according to actual conditions.

[0084] Code detection is mainly used to solve security problems in source code. Currently, commonly used code detection methods include static detection, interactive detection, dynamic detection, etc. However, these methods cannot guarantee 100% accuracy in code detection and false positives are inevitable.

[0085] A false positive means that the code detection method detects a vulnerability in the code, but in fact the code is safe, so the detection result of the code detection method is wrong. The reason for the false positive may be that the code detection tool determines that the detected vulnerability is a potential or possible vulnerability based on one or more code conditions. In addition, due to the lack of dependencies on some third-party packages, false positives may also occur, resulting in the detection results often not matching the actual situation.

[0086] In order to reduce false positives in detection, filtering can be performed through whitelists, rule sets, etc. The whitelist filtering method used in code security detection mainly compares the whitelist (mainly including the defect names, package names, class names, and method names of the security code) with the detection object to filter out the objects in the detection object that are the same as the whitelist, thereby reducing false positives. That is, the code in the detection object that is the same as the whitelist is considered to be a safe code, and no vulnerability alarm is issued.

[0087] However, using this filtering method requires comparing the detection object with the content in the whitelist one by one, which is inefficient and not conducive to code detection.

[0088] In order to solve the above technical problems, the present application discloses a code detection method, a code detection device, a computer-readable medium and an electronic device. The content of the present application will be further explained from various aspects below.

[0089] Figure 1 The exemplary system architecture block diagram applying the technical solution of the present application is schematically shown.

[0090] like Figure 1 As shown, the system architecture 100 may include a terminal device 110, a network 120, and a server 130. The terminal device 110 may include various electronic devices such as a smart phone, a tablet computer, a laptop computer, and a desktop computer. The server 130 may be an independent physical server, or a server cluster or a distributed system composed of multiple physical servers, or a cloud server providing cloud computing services. The network 120 may be a communication medium of various connection types that can provide a communication link between the terminal device 110 and the server 130, such as a wired communication link or a wireless communication link.

[0091] According to the implementation requirements, the system architecture in the embodiment of the present application can have any number of terminal devices, networks and servers. For example, the server 130 can be a server group composed of multiple server devices. In addition, the technical solution provided in the embodiment of the present application can be applied to the terminal device 110, can also be applied to the server 130, or can be implemented by the terminal device 110 and the server 130 together, and the present application does not make any special restrictions on this.

[0092] In one embodiment of the present application, the present application can obtain a whitelist and a code to be detected through a terminal device 110; then use the terminal device 110 or the server 130 to generate a dictionary tree based on the whitelist; then use the breadth-first traversal method to traverse each node in the dictionary tree, and construct a mismatch pointer for each node in the dictionary tree to form a whitelist multi-mode matching automaton; finally, pre-process the code to be detected and input it into the whitelist multi-mode matching automaton for matching, and output the detection result.

[0093] The above section introduces the contents of an exemplary system architecture that applies the technical solution of the present application. Next, the code detection method of the present application will be introduced.

[0094] like Figure 2 As shown, Figure 2 The flowchart of the code detection method of the present application is schematically shown.

[0095] According to one aspect of an embodiment of the present application, the present application provides a code detection method, including steps S210 to S240.

[0096] In step S210: obtain a whitelist and a code to be detected.

[0097] The whitelist and the code to be detected of the present application may come from the terminal device 110 or from the server 130. The user may upload the whitelist and the code to be detected to the server 130 through the network via the terminal device 110. The whitelist of the present application may also be automatically loaded according to the historical records uploaded in the past or the pre-stored whitelist, without the need for the user to upload it.

[0098] The whitelist of this application includes several security codes. Security codes are defined as codes that are safe and have no vulnerabilities. Even if vulnerabilities are detected by code detection tools, security codes are still considered safe and can be used. Among them, the signature information of the security code of this application includes at least one of the following: package name, class name, method name, return value, and code parameter. Since the security code is relatively complex, this application can perform string matching and concatenation of each security code when obtaining it, and the strings and security codes will correspond one to one. For example, a whitelist includes seven security codes, which are matched and concatenated as follows. Code 1: c, a, b, int, <int>; Code 2: a, a, c, v; Code 3: a, a, c, string<int,boolean> ; Code 4: c, a, b, char; Code 5: b, m, a, v; Code 6: c, a, d, int,<int,char> ; Code 7: a, a, c.

[0099] The code to be tested refers to the code that needs to be tested for security. There may be secure code and unsafe code with vulnerabilities in the code to be tested. Therefore, it is necessary to find the unsafe code through testing to ensure the normal execution of the code.

[0100] When the whitelist and the code to be detected are obtained, step S220 can be performed.

[0101] In step S220: a dictionary tree is generated according to the whitelist.

[0102] The present application can directly use the security codes in the whitelist to generate a dictionary tree (trie tree). That is, a root node can be constructed, with the root node as the starting node and each signature information of the security code as the edge to construct a dictionary tree. Since there are many types of signature information of the security code, the dictionary tree constructed using this method is relatively complex. The present application also discloses the following method to generate a dictionary tree based on the whitelist.

[0103] like Figure 3 As shown, Figure 3 The flowchart of the method for generating a dictionary tree according to a whitelist list in the present application is schematically shown.

[0104] In one embodiment of the present application, a method for generating a dictionary tree according to a whitelist includes steps S310 to S340.

[0105] Step S310: extracting the character string in the whitelist.

[0106] The whitelist of the present application includes several security codes, and by matching and concatenating the strings of the various security codes, the strings corresponding to the various security codes can be obtained.

[0107] Among them, the white list of the present application includes a number of security codes, and these security codes can be saved in the white list in the form of code strings.

[0108] In one embodiment of the present application, when performing string matching, the present application can match based on the signature information of the security code. The signature information includes at least one of the following: package name, class name, method name, return value, and code parameter. For example, a security code has a package name of c, a class name of a, a method name of b, a return value of int, and a code parameter of <int>, the corresponding string is c, a, b, int, <int>.

[0109] When extracting the whitelist, this application extracts the return value and code parameters of the security code, which can make the whitelist match more accurate and further reduce the false positive rate. Compared with the existing solution that only extracts the package name or class name, this application extracts more factors, and the corresponding security code matching is more accurate.

[0110] At the same time, when extracting security codes, this application extracts security codes through bytecode, the extracted information is more comprehensive, the extraction efficiency is higher, and it avoids using abstract syntax trees to obtain data flow information, which is not comprehensive enough.

[0111] Step S320: Perform a hash operation on the string to obtain a string code.

[0112] The string obtained in step S310 is hashed to obtain a string code. The hash operation can generate a code called a message digest using text. For example, the present application can directly use the first letter of each signature information in the corresponding string as the character content of the signature information to establish a string and obtain a string code. For example, the string "c, a, b, int, <int>"Through hash operation, we get the string encoding "c, a, b, i, i".

[0113] Step S330: concatenate the string codes to form a string group.

[0114] The string codes obtained in step S320 are concatenated to obtain a string group. For example, a whitelist includes seven security codes, and the string matching and concatenation are as follows. Code 1: c, a, b, int, <int>; Code 2: a, a, c, v; Code 3: a, a, c, string<int,boolean> ; Code 4: c, a, b, char; Code 5: b, m, a, v; Code 6: c, a, d, int,<int,char> ; Code 7: a, a, c. The hash operations and concatenations form the following string groups: Code 1: cabii; Code 2: aacv; Code 3: aacsib; Code 4: cabc; Code 5: bmav; Code 6: cadiic; Code 7: aac.

[0115] Step S340: Create a dictionary tree according to the string group.

[0116] In one embodiment of the present application, a method for establishing a dictionary tree according to a string group includes:

[0117] Construct a blank node as the root node; construct a dictionary tree with the root node as the starting node, the characters of the string group as edges, and the prefix of the characters of the string group as secondary nodes.

[0118] Continuing with the formation of a string group in step S330 as an example, a dictionary tree is constructed. Figure 4 As shown, Figure 4 The diagram schematically shows the dictionary tree diagram established in the present application.

[0119] Construct a blank node as the root node, that is Figure 4 Node 0 in, then take the root node as the starting node, take each character of the string group as the edge, take the prefix composed of the characters of the string group as the secondary node, and build a dictionary tree. The seven string groups in step S330 are built respectively. First, the string group cabii of code 1 is built to form nodes 1-node 5, the string group aacv of code 2 is built to form nodes 8-node 11, the string group aacsib of code 3 is built to form nodes 8-node 10 and nodes 12-node 14, the string group cabc of code 4 is built to form nodes 1-node 3 and node 15, the string group bmav of code 5 is built to form nodes 18-node 21, the string group cadiic of code 6 is built to form nodes 1-node 2 and nodes 22-node 25, and the string group aac of code 7 is built to form nodes 8-node 10. Wherein, except the root node node 0, the other nodes are secondary nodes. Each secondary node represents a group of character group words. For example, node 1 is c, node 2 is ca, and node 23 is cadi. Among them, this application will share the prefix when constructing the dictionary tree. When inserting a new string, it is determined whether the prefix exists. If the prefix exists, it is shared. If the prefix does not exist, the corresponding edge and node are created separately. Figure 4 In the example, each edge corresponds to a letter and each node corresponds to a prefix.

[0120] Among them, Figure 4 In the example, the corresponding nodes 5, 15, 25, 14, 10, 11 and 21 are also special. These seven nodes also represent pattern strings. Indicates the pattern corresponding to the security code.

[0121] Therefore, by using the dictionary tree of the present application, all codes can be built into a dictionary tree at one time, thereby improving the efficiency of creating the dictionary tree when matching the code to be detected, avoiding the method of establishing rule sets one by one using the safe codes in the whitelist, and improving the efficiency of code detection.

[0122] After the dictionary tree is generated through the above steps, proceed to step S230.

[0123] In step S230: each node in the dictionary tree is traversed using a breadth-first traversal method, and a mismatch pointer of each node in the dictionary tree is constructed to form a whitelist multi-pattern matching automaton.

[0124] The breadth-first traversal method starts from a node, traverses the nodes from top to bottom according to the hierarchy, and traverses the nodes from left to right in the same layer. Figure 4 , the breadth-first traversal method first visits the root node 0, and then visits the secondary nodes with a distance of 1 from the root node 0. For example Figure 4 Node 1, Node 8, Node 18 in the tree. The depth optimization search will visit these 3 nodes after visiting the root node. After visiting the node with a distance of 1 from the root node, it will be taken out and the same process will be repeated. Continue to traverse downward until all nodes have been visited.

[0125] While traversing, this application also constructs a mismatch pointer (fail pointer) for each node in the dictionary tree to form a whitelist multi-mode matching automaton (AC automaton: Aho-Corasick automation).

[0126] AC automaton is a multi-mode matching algorithm. Before introducing multi-mode, we can first understand single mode. Single mode matching is to give a word and then a string, and ask whether the word has appeared in this string (whether it matches). This problem can be solved with a string matching algorithm (kmp algorithm) at a relatively high efficiency. However, if a lot of words are given, and then a string is given, it is necessary to determine how many words have appeared in this string. If the kmp algorithm is used for each word on the string, the complexity is relatively high. Therefore, the AC automaton of this application can be used naturally. The AC automaton of this application can match multiple modes without matching each word, which improves the matching efficiency. The construction method of the mismatch pointer (fail pointer) in the AC automaton of this application is specifically disclosed below.

[0127] like Figure 5 As shown, Figure 5 The flowchart of the mismatch pointer construction method of the present application is schematically shown.

[0128] In one embodiment of the present application, a method for constructing a mismatch pointer for each node in a dictionary tree includes steps S510 to S540:

[0129] Step S510: Find the parent node of the pending node, where the pending node is a secondary node contained in the dictionary tree.

[0130] The present application can use a breadth-first traversal method to traverse each node in the dictionary tree, first traverse the root node 0, and let the root node enter the queue. Then continue to traverse other secondary nodes, where the pending node represents any secondary node that has been traversed.

[0131] Step S520: Determine the relationship between the character corresponding to the edge of the pending node pointing to the parent node and other secondary nodes in the dictionary tree.

[0132] Determine whether the character corresponding to the edge of the pending node pointing to the parent node is the same as the characters corresponding to other secondary nodes in the dictionary tree.

[0133] Step S530: When the character corresponding to the edge of the pending node pointing to the parent node is the same as the specified secondary node in the dictionary tree, and the specified secondary node is the last node of the suffix string of the longest current string among the characters represented by the pending node, the specified secondary node is defined as a candidate node of the pending node, and a mismatch pointer from the pending node to the candidate node is constructed.

[0134] like Figure 6 As shown, Figure 6 The schematic diagram of the mismatch pointer constructed in the present application is shown schematically.

[0135] by Figure 6 Take node 15 in the dictionary tree as an example. The parent node of node 15 is node 3. The character corresponding to the edge of node 15 pointing to the parent node is c. The complete character represented by node 15 is cabc. At this time, it is necessary to determine whether the characters corresponding to node 15 and other secondary nodes in the dictionary tree are the same. Figure 6 , the other nodes whose corresponding symbol of the edge pointing to the parent node is also c are node 1, node 25 and node 10. However, the complete character of node 1 is c, the complete character of node 25 is cadiic, the complete character of node 10 is aac, and the designated secondary node is the last node of the suffix string of the longest current string represented by node 15. For node 15, the current strings represented by the characters include abc, bc, c respectively. Since in Figure 6 Among the corresponding secondary nodes, except for node 15, there are no secondary nodes corresponding to the suffixes of abc and bc. Therefore, the last node of the suffix string of the longest current string among the characters represented by the corresponding node 15 is node 1. Therefore, node 1 is the candidate node of node 15, and a mismatch pointer from the pending node to the candidate node is constructed.

[0136] Similarly, mismatch pointers of other nodes can be constructed. Figure 6 In the corresponding dictionary tree, each node has a mismatch pointer, where the mismatch pointer of the root node points to itself.

[0137] Step S540: When the character corresponding to the edge of the pending node pointing to the parent node is different from that of other secondary nodes in the dictionary tree, a mismatch pointer from the pending node to the root node is constructed.

[0138] For example, continue to refer to Figure 6 , Taking node 19 as an example, the character corresponding to the edge of node 19 pointing to the parent node is m, which is different from other secondary nodes, and the corresponding mismatch pointer from the pending node to the root node is constructed.

[0139] The following is a detailed introduction to the construction process of all control pointers in this application.

[0140] First, the node 0 corresponding to the root node points to itself, corresponding to the mismatch pointer (0). Then the first breadth-first traversal loop begins. In the first loop, the characters connected to the root node are processed, that is, the first characters c, a, and b of each word, corresponding to nodes 1, 8, and 18, respectively. Because the first character does not match and needs to be re-matched, the first character points to the root node, corresponding to the mismatch pointer (1), mismatch pointer (2), and mismatch pointer (3).

[0141] Then the secondary loop starts. For node 2, the corresponding suffix is ​​ca. Since the suffix of node 8 is a, node 8 is a candidate node for node 2. Node 2 is pointed to node 8, forming a mismatch pointer (2). The corresponding suffix of node 9 is aa. Since the suffix of node 8 is a, node 8 is a candidate node for node 9. Node 9 is pointed to node 8, forming a mismatch pointer (9). The corresponding suffix of node 19 is bm. Since m does not exist in all other secondary nodes, node 19 directly points to the root node 0, forming a mismatch pointer (19).

[0142] Then continue the third loop. For node 3, the suffix represented is cab. Since there is no secondary node with the suffix ab in other secondary nodes, and since the suffix represented by node 18 is b, node 18 is a candidate node for node 3. Node 3 is pointed to node 18 to form a mismatch pointer (3). For node 10, the suffix represented is aac. Since the suffix represented by node 1 is c, node 1 is a candidate node for node 10. Node 10 is pointed to node 1 to form a mismatch pointer (10). For node 20, the suffix represented is bma. Since there is no secondary node with the suffix ma in other secondary nodes, and since the suffix represented by node 8 is a, node 8 is a candidate node for node 20. Node 20 is pointed to node 8 to form a mismatch pointer (20).

[0143] Follow the same method to traverse downwards and form Figure 6 The schematic diagram of the mismatch pointer is shown. Continue to step S240.

[0144] In step S240: the code to be detected is pre-processed and then input into the whitelist multi-mode matching automaton for matching, and the detection result is output.

[0145] like Figure 7 As shown, Figure 7 The flowchart of the method for matching the code to be detected in the present application is schematically shown.

[0146] In one embodiment of the present application, a method for preprocessing a code to be detected and inputting it into a whitelist multi-mode matching automaton for matching includes steps S710 to S720.

[0147] In step S710: the code to be detected is preprocessed to obtain a signature code group.

[0148] like Figure 8 As shown, Figure 8 The flowchart of the method for preprocessing the code to be detected in the present application is schematically shown. In one embodiment of the present application, the method for preprocessing the code to be detected to obtain a signature code group includes steps S810 to S840.

[0149] Step S810: Parse the code to be detected to obtain the bytecode to be detected;

[0150] Step S820: extracting the signature information of the bytecode to be detected, the signature information includes package name, class name, method name, return value and code parameters;

[0151] Step S830: Perform a hash operation on the signature information to obtain a signature code;

[0152] Step S840: concatenate the signature codes to form a signature code group.

[0153] The contents of steps S810 to S840 may refer to those of steps S310 to S320 , and the code encoded here is the code to be detected.

[0154] In step S720: the characters of the signature encoding group are sequentially input into the whitelist multi-pattern matching automaton for matching.

[0155] Among them, the matching process is to match according to multiple patterns, and the characters of the signature coding group are input into the whitelist multi-pattern matching automaton in sequence. The matching process is divided into two cases: the first is the current character matching, which means that there is a path from the current node along the tree edge to the characters of the signature coding group. At this time, you only need to go along the path to the next node to continue matching, and the target string pointer moves to the next character to continue matching. The second result is that the current character does not match, then the character pointed to by the mismatch pointer of the current node continues to match, and the matching process ends when the pointer points to the root node. Repeat the matching of the characters of the signature coding group until the pattern string reaches the end.

[0156] For example, the character of the signature coding group is cadiic, and the corresponding character matching in the first case above, starting from the root node, along nodes 1, node 2, node 22, node 23, node 24 and node 25, can reach the character of the signature coding group. Of course, not all characters of the signature coding group can be matched. When the character of the signature coding group is cabm, it corresponds to the second case. When starting from the root node, along nodes 1, node 2, to node 3, it is found that the character pointed to by the mismatch pointer of node 3 is node 18. At this time, it can continue to match down to node 19, thereby matching and completing cabm. Using this method, there is no need to return to the root node and then to node 18 for matching, so matching can be performed directly, saving time.

[0157] Step S730: If the whitelist multi-pattern matching automaton outputs a root node and a plurality of secondary nodes in sequence, the code to be detected successfully matches the whitelist multi-pattern matching automaton.

[0158] When the present application can output the root node and multiple secondary nodes that match the code to be detected, including the secondary node jumped from the mismatch pointer, it means that the code to be detected successfully matches the whitelist multi-mode matching automaton, indicating that the code to be detected is safe and can be trusted. Therefore, the detection result can be output to indicate that the detection code is safe. On the contrary, if the code to be detected cannot successfully match the whitelist multi-mode matching automaton, it means that the code is unsafe and has vulnerabilities.

[0159] In the technical solution provided in the embodiment of the present application, the present application obtains a whitelist list and a code to be detected; generates a dictionary tree according to the whitelist list; traverses each node in the dictionary tree using a breadth-first traversal method, and constructs a mismatch pointer for each node in the dictionary tree to form a whitelist multi-mode matching automaton; and then pre-processes the code to be detected and inputs it into the whitelist multi-mode matching automaton for matching, and outputs the detection result. Using the method of the present application, a dictionary tree can be generated at one time, and the code to be detected can be matched through the whitelist multi-mode matching automaton, which can achieve one-time multi-mode matching, greatly improve the matching efficiency, and high code detection efficiency.

[0160] It should be noted that although the steps of the method in the present application are described in a specific order in the drawings, this does not require or imply that the steps must be performed in this specific order, or that all the steps shown must be performed to achieve the desired results. Additionally or alternatively, some steps may be omitted, multiple steps may be combined into one step, and / or one step may be decomposed into multiple steps, etc.

[0161] The above part introduces the content of the data code detection method of this application, and the following part will continue to introduce the content of the code detection device of this application.

[0162] The following introduces an apparatus embodiment of the present application, which can be used to execute the code detection method in the above-mentioned embodiment of the present application. Fig. 9 The structure block diagram of the code detection device provided in the embodiment of the present application is schematically shown. Fig. 9 As shown,

[0163] According to one aspect of an embodiment of the present application, a code detection device 900 is provided, including:

[0164] An acquisition module 910 is used to acquire a whitelist and a code to be detected;

[0165] A dictionary tree module 920, used to generate a dictionary tree according to the white list;

[0166] A construction module 930 is used to traverse each node in the dictionary tree using a breadth-first traversal method, and to construct a mismatch pointer for each node in the dictionary tree to form a whitelist multi-pattern matching automaton;

[0167] The detection module 940 is used to pre-process the code to be detected and input it into the whitelist multi-mode matching automaton for matching, and output the detection result.

[0168] In some embodiments of the present application, based on the above technical solution, the dictionary tree module 910 includes:

[0169] An extraction unit, used for extracting strings from a whitelist;

[0170] The encoding unit is used to perform a hash operation on a string to obtain a string encoding;

[0171] A concatenation unit, used for concatenating string codes to form a string group;

[0172] The dictionary tree building unit is used to build a dictionary tree according to the string group.

[0173] In some embodiments of the present application, based on the above technical solution, the whitelist list includes multiple security codes; the extraction unit is used to extract the signature information of the security code, and the signature information includes at least one of the following: package name, class name, method name, return value and code parameter.

[0174] In some embodiments of the present application, based on the above technical solution, the dictionary tree establishment unit is also used to construct a blank node as the root node; and use the root node as the starting node, the characters of the string group as edges, and the prefix of the characters of the string group as secondary nodes to construct the dictionary tree.

[0175] In some embodiments of the present application, based on the above technical solution, the construction module 930 includes a mismatch pointer construction unit, and the mismatch pointer construction unit includes:

[0176] A search unit is used to find the parent node of the pending node, and the pending node is a secondary node contained in the dictionary tree;

[0177] A judgment unit, used to judge the relationship between the character corresponding to the edge of the pending node pointing to the parent node and other secondary nodes in the dictionary tree;

[0178] A first construction unit is used to define the designated secondary node as a candidate node of the pending node, and construct a mismatch pointer from the pending node to the candidate node when the character corresponding to the edge of the pending node pointing to the parent node is the same as the designated secondary node in the dictionary tree, and the designated secondary node is the last node of the suffix string of the longest current string among the characters represented by the pending node;

[0179] The second construction unit is used to construct a mismatch pointer from the pending node to the root node when the character corresponding to the edge of the pending node pointing to the parent node is different from other secondary nodes in the dictionary tree.

[0180] In some embodiments of the present application, based on the above technical solution, the detection module 940 includes:

[0181] A preprocessing unit, used for preprocessing the code to be detected to obtain a signature code group;

[0182] An input unit, used for inputting characters of the signature encoding group into the whitelist multi-pattern matching automaton in order for matching;

[0183] The matching unit is used for if the whitelist multi-mode matching automaton outputs a root node and a plurality of secondary nodes in sequence, then the code to be detected successfully matches the whitelist multi-mode matching automaton.

[0184] In some embodiments of the present application, based on the above technical solution, the preprocessing unit includes:

[0185] A bytecode parsing unit, used for parsing the code to be detected to obtain the bytecode to be detected;

[0186] A signature extraction unit is used to extract the signature information of the bytecode to be detected, where the signature information includes the package name, class name, method name, return value and code parameters;

[0187] A computing unit, used to perform a hash operation on the signature information to obtain a signature code;

[0188] The code concatenation unit is used to concatenate the signature codes to form a signature code group.

[0189] The specific details of the code detection device provided in each embodiment of the present application have been described in detail in the corresponding method embodiment and will not be repeated here.

[0190] The above part introduces the content of the code detection device of this application, and the following will continue to introduce other aspects of this application.

[0191] According to one aspect of an embodiment of the present application, a computer-readable medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the code detection method in the above technical solution is implemented.

[0192] According to one aspect of an embodiment of the present application, an electronic device is provided, comprising: a processor; and a memory for storing executable instructions of the processor; wherein the processor is configured to execute a code detection method as in the above technical solution by executing the executable instructions.

[0193] According to one aspect of the embodiments of the present application, a computer program product or a computer program is provided, the computer program product or the computer program includes computer instructions, and the computer instructions are stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the computer device performs the code detection method in the above technical solution.

[0194] Furthermore, the present application obtains the bytecode to be detected by parsing the code to be detected, and extracts the code to be detected by extracting the bytecode. Compared with the method of parsing the abstract syntax tree, the corresponding method of the present application can extract more comprehensive information and has higher extraction efficiency.

[0195] Furthermore, the present application can make the whitelist matching more accurate and further reduce the false alarm rate by extracting the return value and code parameters of the security code in the whitelist.

[0196] Fig.10 The structure block diagram of a computer system for implementing an electronic device according to an embodiment of the present application is schematically shown.

[0197] It should be noted that Fig.10 The computer system 1000 of the electronic device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0198] like Fig.10 As shown, the computer system 1000 includes a central processing unit 1001 (CPU), which can perform various appropriate actions and processes according to the program stored in the read-only memory 1002 (ROM) or the program loaded from the storage part 1008 to the random access memory 1003 (RAM). Various programs and data required for system operation are also stored in the random access memory 1003. The central processing unit 1001, the read-only memory 1002 and the random access memory 1003 are connected to each other through a bus 1004. The input / output interface 1005 (Input / Output interface, i.e., I / O interface) is also connected to the bus 1004.

[0199] The following components are connected to the input / output interface 1005: an input section 1006 including a keyboard, a mouse, etc.; an output section 1007 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 1008 including a hard disk, etc.; and a communication section 1009 including a network interface card such as a LAN card, a modem, etc. The communication section 1009 performs communication processing via a network such as the Internet. A drive 1010 is also connected to the input / output interface 1005 as needed. A removable medium 1011, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 1010 as needed, so that a computer program read therefrom is installed into the storage section 1008 as needed.

[0200] In particular, according to an embodiment of the present application, the process described in each method flow chart can be implemented as a computer software program. For example, an embodiment of the present application includes a computer program product, which includes a computer program carried on a computer readable medium, and the computer program contains a program code for executing the method shown in the flow chart. In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 1009, and / or installed from the removable medium 1011. When the computer program is executed by the central processor 1001, various functions defined in the system of the present application are executed.

[0201] It should be noted that the computer-readable medium shown in the embodiment of the present application may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM), a flash memory, an optical fiber, a portable compact disk read-only memory (CompDisc Read-Only Memory, CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present application, a computer-readable storage medium may be any tangible medium containing or storing a program, which may be used by an instruction execution system, device or device or used in combination with it. In the present application, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, wherein a computer-readable program code is carried. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Computer readable signal media may also be any computer readable medium other than computer readable storage media, which may send, propagate, or transmit programs for use by or in conjunction with an instruction execution system, apparatus, or device. The program code contained on the computer readable medium may be transmitted using any appropriate medium, including but not limited to: wireless, wired, etc., or any suitable combination of the above.

[0202] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present application. In this regard, each box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the above-mentioned module, program segment or a part of a code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flow chart, and the combination of the boxes in the block diagram or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0203] It should be noted that, although several modules or units of the equipment for action execution are mentioned in the above detailed description, this division is not mandatory. In fact, according to the embodiments of the present application, the features and functions of two or more modules or units described above can be embodied in one module or unit. On the contrary, the features and functions of one module or unit described above can be further divided into being embodied by multiple modules or units.

[0204] Through the description of the above implementation methods, it is easy for those skilled in the art to understand that the example implementation methods described here can be implemented by software or by combining software with necessary hardware. Therefore, the technical solution according to the implementation methods of the present application can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.) or on a network, and includes several instructions to enable a computing device (which can be a personal computer, a server, a touch terminal, or a network device, etc.) to execute the method according to the implementation methods of the present application.

[0205] Those skilled in the art will readily appreciate other embodiments of the present application after considering the specification and practicing the invention disclosed herein. The present application is intended to cover any modification, use or adaptation of the present application, which follows the general principles of the present application and includes common knowledge or customary technical means in the art that are not disclosed in the present application.

[0206] It should be understood that the present application is not limited to the precise structures that have been described above and shown in the drawings, and that various modifications and changes may be made without departing from the scope thereof. The scope of the present application is limited only by the appended claims.< / int> < / int> < / int> < / int> < / int>

Claims

1. A code detection method, characterized in that: include: Get the whitelist and the code to be detected; Generate a dictionary tree according to the whitelist; Using a breadth-first traversal method to traverse each node in the dictionary tree, and constructing a mismatch pointer for each node in the dictionary tree to form a whitelist multi-mode matching automaton; The code to be detected is pre-processed and then input into the whitelist multi-mode matching automaton for matching, and the detection result is output; Generating a dictionary tree according to the whitelist includes: extracting the character strings in the whitelist; performing a hash operation on the character strings to obtain character string codes; concatenating the character string codes to form a character string group; constructing a blank node as a root node; constructing a dictionary tree with the root node as a starting node, the characters of the character string group as edges, and the prefix of the characters of the character string group as a secondary node; The whitelist includes multiple security codes; extracting the character string in the whitelist includes: extracting signature information of the security code, and the signature information includes: package name, class name, method name, return value and code parameter.

2. The code detection method according to claim 1, characterized in that: Constructing a mismatch pointer for each node in the dictionary tree, including: Finding a parent node of a pending node, wherein the pending node is a secondary node contained in the dictionary tree; Determine the relationship between the character corresponding to the edge of the pending node pointing to the parent node and other secondary nodes in the dictionary tree; When the character corresponding to the edge of the pending node pointing to the parent node is the same as the designated secondary node in the dictionary tree, and the designated secondary node is the last node of the suffix string of the longest current string among the characters represented by the pending node, the designated secondary node is defined as a candidate node of the pending node, and a mismatch pointer from the pending node to the candidate node is constructed; When the character corresponding to the edge of the pending node pointing to the parent node is different from that of other secondary nodes in the dictionary tree, a mismatch pointer from the pending node to the root node is constructed.

3. The code detection method according to claim 2, characterized in that: The code to be detected is pre-processed and then input into the whitelist multi-mode matching automaton for matching, including: Preprocessing the code to be detected to obtain a signature code group; Inputting the characters of the signature encoding group into the whitelist multi-pattern matching automaton in order for matching; If the whitelist multi-mode matching automaton outputs a root node and a plurality of secondary nodes in sequence, the code to be detected is successfully matched with the whitelist multi-mode matching automaton.

4. The code detection method according to claim 3, characterized in that: The code to be detected is preprocessed to obtain a signature code group, including: Parsing the code to be detected to obtain the bytecode to be detected; Extracting signature information of the bytecode to be detected, wherein the signature information includes package name, class name, method name, return value and code parameters; Performing a hash operation on the signature information to obtain a signature code; The signature codes are concatenated to form a signature code group.

5. A code detection device, characterized in that: include: Acquisition module, used to obtain the whitelist and the code to be detected; A dictionary tree module, used for generating a dictionary tree according to the white list; A construction module is used to traverse each node in the dictionary tree using a breadth-first traversal method, and to construct a mismatch pointer for each node in the dictionary tree to form a whitelist multi-pattern matching automaton; A detection module, used for pre-processing the code to be detected and inputting it into the whitelist multi-mode matching automaton for matching, and outputting the detection result; Generating a dictionary tree according to the whitelist includes: extracting the character strings in the whitelist; performing a hash operation on the character strings to obtain character string codes; concatenating the character string codes to form a character string group; constructing a blank node as a root node; constructing a dictionary tree with the root node as a starting node, the characters of the character string group as edges, and the prefix of the characters of the character string group as a secondary node; The whitelist includes multiple security codes; extracting the character string in the whitelist includes: extracting signature information of the security code, and the signature information includes: package name, class name, method name, return value and code parameter.

6. A computer-readable medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the code detection method according to any one of claims 1 to 4.

7. An electronic device, characterized in that: include: processor; as well as A memory, configured to store executable instructions of the processor; The processor is configured to execute the code detection method according to any one of claims 1 to 4 by executing the executable instructions.

Images