Code detection methods and devices, electronic equipment, and storage media

Abstract

The present disclosure provides a code detection method and device, an electronic device, and a storage medium, which relate to the field of information security technology and can be applied to the scenario of taint information flow analysis. The code detection method includes: parsing the grammatical structure of the program code to be detected to obtain program grammar rules and data dependencies; extracting program code that matches the taint marker library in the program code to be detected to obtain taint matching information; abstracting program elements in the program code to be detected that are unrelated to the target taint based on program grammar rules, data dependencies, and taint matching information to generate target abstract code; performing taint information flow analysis on the target abstract code based on program element mutation to obtain the detection result of the program code to be detected. The technical solution of the embodiment of the present disclosure can improve the efficiency of code detection and the accuracy of taint information flow analysis.

Description

Background Art

[0002] Taint analysis is one of the important practical means of information flow analysis. Inaccurate taint analysis results will lead to a large number of false positives in the code information flow analysis results.

[0003] Taint analysis in code detection can be divided into static taint analysis and dynamic taint analysis. Static taint analysis is based on alias detection, which has problems with accuracy and efficiency. Dynamic taint analysis is based on code instrumentation, which relies on program execution and covers a single path, and cannot fully and accurately locate the taint propagation path information of the entire text.

[0004] It should be noted that the information disclosed in the above background technology section is only used to enhance the understanding of the background of the present disclosure, and therefore may include information that does not constitute the prior art known to ordinary technicians in the field. Summary of the invention

[0005] The purpose of the embodiments of the present disclosure is to provide a code detection method, a code detection device, an electronic device, and a computer-readable storage medium, thereby overcoming the problem of low accuracy of stain analysis results in related technologies at least to a certain extent.

[0006] Other features and advantages of the present disclosure will become apparent from the following detailed description, or may be learned in part by the practice of the present disclosure.

[0007] According to a first aspect of an embodiment of the present disclosure, a code detection method is provided, including:

[0008] Analyze the syntax structure of the program code to be tested to obtain the program syntax rules and data dependencies;

[0009] Extracting program codes that match the stain mark library from the program codes to be detected to obtain stain matching information;

[0010] Based on the program syntax rules, the data dependency and the taint matching information, abstract processing is performed on program elements in the program code to be detected that are unrelated to the target taint to generate a target abstract code, wherein the target taint is a program element that meets the characteristics of the taint matching information;

[0011] The target abstract code is subjected to a taint information flow analysis based on program element variation to obtain a detection result of the program code to be detected.

[0012] In some example embodiments of the present disclosure, based on the aforementioned solution, performing taint information flow analysis based on program element variation based on the target abstract code to obtain a detection result of the program code to be detected includes:

[0013] mutating a program element of the target abstract code a set number of times;

[0014] For the target abstract code and the target abstract code after each mutation, verify whether there is an executable path between the taint source to be detected and the taint sink point, and record the verification result;

[0015] Calculating the suspiciousness of the program element based on the verification result;

[0016] The detection result of the program code to be detected is output according to the suspiciousness of the program element.

[0017] In some example embodiments of the present disclosure, based on the above scheme, the target abstract code includes a taint assertion marking the location of the taint convergence point, and for the target abstract code and the target abstract code after each mutation, verifying whether there is an executable path between the taint source to be detected and the taint convergence point includes:

[0018] For the target abstract code and each mutated target abstract code, verify whether the execution result of the program entry parameter satisfies the taint assertion, wherein the program entry parameter is determined based on the taint matching information;

[0019] If satisfied, the verification result is recorded as path reachable;

[0020] If not satisfied, the verification result is recorded as path unreachable.

[0021] In some example embodiments of the present disclosure, based on the foregoing solution, calculating the suspiciousness of the program element based on the verification result includes:

[0022] Based on the verification result, the suspicion of the program element is calculated according to a suspicion calculation formula; the suspicion calculation formula is:

[0023]

[0024] Wherein, m represents any program element, and F m is the suspiciousness of program element m, m1 is the number of times the path corresponding to program element m in the verification result is reachable, m2 is the number of times the path corresponding to program element m in the verification result is unreachable, ∑ m m1 is the total number of times that the paths of all verified program elements of the target abstract code in the verification result are unreachable, ∑ m m2 is the total number of times that all verified program elements of the target abstract code in the verification result can be reached by paths.

[0025] In some example embodiments of the present disclosure, based on the above scheme, the stain mark library includes a stain source mark function, a stain sink mark function and a harmless processing mark function; extracting the program code that matches the stain mark library in the program code to be detected to obtain the stain matching information includes:

[0026] The program code that matches the stain source marking function, the stain convergence point marking function and the harmless processing marking function is extracted from the program code to be detected to obtain stain matching information.

[0027] In some example embodiments of the present disclosure, based on the above solution, parsing the grammatical structure of the program code to be detected to obtain program grammar rules and data dependency relationships includes:

[0028] Performing lexical analysis and grammatical analysis on the program code to be detected to generate an abstract syntax tree;

[0029] Generate program grammar rules based on the abstract syntax tree;

[0030] A program call relationship graph is generated based on the abstract syntax tree, and data dependency is extracted from the program call relationship graph.

[0031] In some example embodiments of the present disclosure, based on the aforementioned solution, the abstract processing of program elements unrelated to the target stain in the program code to be detected based on the program grammar rules, the data dependency relationship and the stain matching information to generate the target abstract code includes:

[0032] Based on the program syntax rules, the data dependency and the taint matching information, and in combination with the abstract syntax tree and the program call relationship graph, program elements unrelated to the target taint in the program code to be detected are removed to obtain an abstract code to be processed;

[0033] A taint assertion marking the location of the taint convergence point is added to the abstract code to be processed to obtain a target abstract code.

[0034] According to a second aspect of an embodiment of the present disclosure, there is provided a code detection device, including:

[0035] A parsing module is used to parse the syntax structure of the program code to be tested and obtain the program syntax rules and data dependency;

[0036] An extraction module is used to extract program codes that match the stain mark library in the program code to be detected to obtain stain matching information;

[0037] An abstract processing module is used to perform abstract processing on program elements in the program code to be detected that are unrelated to a target stain based on the program syntax rules, the data dependency and the stain matching information to generate a target abstract code, wherein the target stain is a program element that meets the characteristics of the stain matching information;

[0038] The analysis module is used to perform taint information flow analysis on the target abstract code to obtain the detection result of the program code to be detected.

[0039] According to a third aspect of an embodiment of the present disclosure, there is provided an electronic device, comprising: a processor; and a memory, wherein the memory stores computer-readable instructions, and when the computer-readable instructions are executed by the processor, any one of the above-mentioned code detection methods is implemented.

[0040] According to a fourth aspect of an embodiment of the present disclosure, there is provided a computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the code detection method according to any one of the above items is implemented.

[0041] The code detection method, code detection device, electronic device and computer-readable storage medium provided by the embodiment of the present disclosure obtain program syntax rules and data dependencies by parsing the syntax structure of the program code to be detected, and extract the program code that matches the taint tag library in the program code to be detected to obtain taint matching information, and then perform abstract processing on the program elements in the program code to be detected that are irrelevant to the target taint based on the program syntax rules, data dependencies and taint matching information to generate the target abstract code, and then perform taint information flow analysis based on program element variation on the target abstract code to obtain the detection result of the program code to be detected, thereby realizing the detection of the program code to be detected. On the one hand, by parsing and abstracting the program code to be detected, irrelevant paths and program statements in the program code to be detected can be eliminated, the complexity of taint information flow analysis can be reduced, and the efficiency of code detection can be improved; on the other hand, by performing taint information flow analysis based on program element variation on the extracted target abstract code, multiple program element verification analysis can be performed on the target abstract code, and the program code to be detected can be comprehensively analyzed and the taint path can be located from different paths, thereby improving the accuracy of taint information flow analysis in code detection.

[0042] It is to be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] The drawings herein are incorporated into the specification and constitute a part of the specification, showing embodiments consistent with the present disclosure, and together with the specification, are used to explain the principles of the present disclosure. Obviously, the drawings described below are only some embodiments of the present disclosure, and for ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work. In the drawings:

[0044] Figure 1 A schematic diagram schematically shows a code detection method process according to some embodiments of the present disclosure;

[0045] Figure 2 A schematic diagram schematically illustrates a program call relationship diagram according to some embodiments of the present disclosure;

[0046] Figure 3 A schematic diagram schematically shows a schematic diagram of performing taint information flow analysis based on program element variation on a target abstract code according to some embodiments of the present disclosure;

[0047] Figure 4 A schematic diagram schematically shows a code detection device according to some embodiments of the present disclosure;

[0048] Figure 5 The structure diagram of the electronic device according to some embodiments of the present disclosure is schematically shown;

[0049] Figure 6 A schematic diagram of a computer-readable storage medium according to some embodiments of the present disclosure is schematically shown.

[0050] In the drawings, the same or corresponding reference numerals represent the same or corresponding parts. DETAILED DESCRIPTION

[0051] Example embodiments will now be described more fully with reference to the accompanying drawings. However, example embodiments can be implemented in a variety of forms and should not be construed as limited to the examples set forth herein; rather, these embodiments are provided so that this disclosure will be more comprehensive and complete and will fully convey the concept of the example embodiments to those skilled in the art.

[0052] In addition, the described features, structures or characteristics may be combined in one or more embodiments in any suitable manner. In the following description, many specific details are provided to provide a full understanding of the embodiments of the present disclosure. However, those skilled in the art will appreciate that the technical solutions of the present disclosure may be practiced without one or more of the specific details, or other methods, components, devices, steps, etc. may be adopted. In other cases, known methods, devices, implementations or operations are not shown or described in detail to avoid blurring the various aspects of the present disclosure.

[0053] Furthermore, the drawings are only schematic illustrations and are not necessarily drawn to scale. The block diagrams shown in the drawings are only functional entities and do not necessarily correspond to physically separate entities. That is, these functional entities may be implemented in software form, or in one or more hardware modules or integrated circuits, or in different networks and / or processor devices and / or microcontroller devices.

[0054] In this example embodiment, a code detection method is first provided. The code detection method can be applied to terminal devices, such as mobile phones, computers and other electronic devices. Figure 1 The following is a schematic diagram of a code detection method flow according to some embodiments of the present disclosure. Figure 1 As shown, the code detection method may include the following steps:

[0055] Step S110, parsing the syntax structure of the program code to be detected to obtain program syntax rules and data dependency relationships;

[0056] Step S120, extracting program codes that match the stain mark library from the program codes to be detected to obtain stain matching information;

[0057] Step S130, abstracting program elements in the program code to be detected that are unrelated to the target stain based on program syntax rules, data dependency and stain matching information to generate target abstract code, wherein the target stain is a program element that meets the characteristics of the stain matching information;

[0058] Step S140 , performing taint information flow analysis based on program element variation on the target abstract code to obtain a detection result of the program code to be detected.

[0059] According to the code detection method in this example embodiment, on the one hand, by parsing and abstracting the program code to be detected, irrelevant paths and program statements in the program code to be detected can be eliminated, reducing the complexity of the taint information flow analysis and improving the efficiency of code detection; on the other hand, by performing taint information flow analysis based on program element mutation on the extracted target abstract code, multiple program element verification analyses can be performed on the target abstract code, and the program code to be detected can be comprehensively analyzed from different paths and the taint paths can be located, thereby improving the accuracy of taint information flow analysis in code detection.

[0060] The code detection method in this example embodiment will be further described below.

[0061] In step S110, the grammatical structure of the program code to be detected is parsed to obtain program grammar rules and data dependency relationships.

[0062] Exemplarily, for the program code to be tested, lexical analysis and syntactic analysis can be performed on it first to generate an abstract syntax tree, and then program syntax rules are generated based on the abstract syntax tree, and a program call relationship graph is generated based on the abstract syntax tree, and data dependencies are extracted from the program call relationship graph.

[0063] For example, the content of a program code file to be tested is as follows:

[0064]

[0065] The program code to be tested can be subjected to lexical analysis and grammatical analysis, and each grammatical structure in the program code to be tested can be represented by a node on a tree, and an abstract syntax tree can be generated. Based on the abstract syntax tree, the expression, characters and other information of the program code to be tested can be defined according to the syntax expansion to generate program syntax rules. For example, based on the abstract syntax tree, an expression Expr can be obtained, and the expression Expr can be expanded to define expressions Expr+Expr, Expr-Expr, Expr*Expr, etc., and the characters therein, such as the character "s", can be obtained based on the abstract syntax tree. These expression definitions and character definitions are aggregated together to generate program syntax rules.

[0066] After the abstract syntax tree is generated, a program call relationship graph may be generated based on the abstract syntax tree. For example, the program call relationship graph may be generated based on the function call relationship in the abstract syntax tree. Figure 2 The program call relationship diagram of the above program code to be detected is schematically shown. Figure 2 The program call relationship diagram shown in the figure can extract data dependencies as shown by the dotted arrows in the figure. For example, the character "s" in the input program code can be transmitted to the function String source = source (s) through path ①, and there is a data dependency relationship between "s" and "String source = source (s)"; after that, "s" can be transmitted along paths ②, ③ and ④ respectively through source to form data dependencies on each path.

[0067] In step S120, program codes that match the stain mark library in the program code to be detected are extracted to obtain stain matching information.

[0068] A stain mark library can be pre-set, and the stain mark library can include a stain source mark function, a stain convergence point mark function and a harmless processing mark function, which can indicate which functions may be stain sources, stain convergence points or harmless processing functions. Based on the stain mark library, program code that matches the stain source mark function, the stain convergence point mark function and the harmless processing mark function can be extracted from the program code to be detected to obtain stain matching information. The program code in the stain matching information may include at least one of a possible stain source, a possible stain convergence point and a possible harmless processing function. Exemplarily, stain matching information can be extracted from the program code to be detected based on the known marking functions and program entry parameter features in the stain mark library.

[0069] For example, for the program code to be detected in the above step S110, after matching it with the taint mark library, it can be matched that the function source() may be the taint source, and the function sink() may be the taint sink point, then the program code associated with source() and sink() can be extracted to obtain the taint matching information.

[0070] In step S130, program elements in the program code to be detected that are unrelated to the target stain are abstracted based on program syntax rules, data dependency and stain matching information to generate target abstract code.

[0071] The target taint is a program element that meets the taint matching information. For example, if the taint matching information includes source(), source. and sink() in the above steps, the program element including source(), source. and sink() can be used as the target taint.

[0072] Exemplarily, based on the program syntax rules and data dependencies obtained in the above step S110 and the taint matching information obtained in step S120, and in combination with the abstract syntax tree and program call relationship diagram obtained in the above step S110, program elements in the program code to be detected that are not related to the target taint can be eliminated to obtain the abstract code to be processed, and then taint assertions marking the positions of taint convergence points can be added to the abstract code to be processed to obtain the target abstract code.

[0073] For example, for the above program code to be detected, the target abstract code obtained can be expressed as follows:

[0074]

[0075] It retains the program code related to source(), source. and sink(), and ignores the judgment condition "if(source.length()>MAX)" and branch condition "else{doSomethingElse();}" in the program code to be tested, thereby eliminating irrelevant paths and irrelevant program statements, and reducing the complexity of subsequent information flow analysis. If there are multiple branch paths in the program code to be tested, they can be abstracted separately according to different path combinations.

[0076] The sink (sink) is a possible taint outbreak point, that is, a taint convergence point. An assertion assert (true) can be added at the location of the possible taint convergence point.

[0077] In step S140, a taint information flow analysis based on program element variation is performed on the target abstract code to obtain a detection result of the program code to be detected.

[0078] After obtaining the target abstract code, the program entry parameters can be input into the target abstract code, and the dynamic symbolic execution technology can be used to verify whether there is a reachable path between the program entry and the taint convergence point, and the verification result can be recorded.

[0079] Exemplarily, the possible taint source in the program code to be detected can be obtained through the matching process of step S120, and the relevant program entry parameters can be input into the target abstract code according to the entry parameter characteristics of the possible taint source.

[0080] Next, the program elements of the target abstract code may be mutated a set number of times, and based on the mutated target abstract code, it is re-verified whether there is an executable path between the taint source to be detected and the taint sink point, and the verification result is recorded.

[0081] In an exemplary embodiment of the present disclosure, referring to Figure 3 As shown, step S140 may include steps S310 to S360.

[0082] In step S310, program entry parameters are input into the target abstract code.

[0083] In step S320, it is verified whether there is a reachable path between the program entry and the taint convergence point based on the program entry parameters, and the verification result is recorded.

[0084] In step S330 , the program elements of the target abstract code are mutated a set number of times.

[0085] Exemplarily, the program elements in the target abstract code may be mutated a set number of times according to the program syntax rules and taint matching information in the above steps S110 and S120. The program elements may include entry parameters of functions in the code and program statements in the code. Accordingly, the mutation of the program elements may be to mutate the entry parameters, or to mutate the conditional statements in the program, or to mutate both the entry parameters and the conditional statements.

[0086] For example, the value of the input parameter of the function in the taint matching information can be changed, or the type of the input parameter can be modified, etc. For another example, when the program code to be detected is abstracted, some conditional statements such as judgment conditions and loop conditions are ignored. These conditional statements are recorded in the program syntax rules. When the program elements are mutated, these conditional statements can be appropriately changed or restored according to the records of the program syntax rules.

[0087] By mutating the program elements in the target abstract code a set number of times, different execution paths and combined abstractions can be selected to verify the execution path of the target abstract code. Multiple tests can be performed to verify whether the program can execute normally to the taint convergence point. This allows for a comprehensive analysis of the program code to be detected and the location of the taint path, effectively improving the accuracy of taint information flow analysis in code detection and reducing the false alarm rate of detection results.

[0088] In step S340, for each mutated target abstract code, it is verified whether there is an executable path between the taint source to be detected and the taint sink point, and the verification result is recorded.

[0089] Exemplarily, the target abstract code may include a taint assertion marking the location of the taint convergence point, and the following method may be used to verify whether there is an executable path between the taint source and the taint convergence point in the target abstract code and the target abstract code after each mutation: for the target abstract code and the target abstract code after each mutation, verify whether the execution result of its program entry parameter satisfies the taint assertion; if satisfied, it means that this program entry parameter may pose a threat to the program and should be regarded as a pollution source, and the verification result is recorded as path reachable; if not satisfied, it means that this program entry parameter may not pose a threat to the program and is not a pollution source, and the verification result is recorded as path unreachable. The program entry parameter can be determined based on the taint matching information, for example, it can be determined based on the entry parameter characteristics of the possible taint source in the taint matching information.

[0090] By mutating program elements, the data security of the program code to be tested can be fully and accurately verified, and the status of program elements can be covered through code abstraction.

[0091] In an exemplary embodiment, for each verified program element, its propagation path may be recorded simultaneously.

[0092] In step S350, the suspicion level of the program element is calculated based on the verification result.

[0093] In an exemplary embodiment, the suspicion of a program element may be calculated based on the verification result according to a suspicion calculation formula. Exemplarily, the suspicion calculation formula may be the following formula (1).

[0094]

[0095] In formula (1), m represents any program element, F m is the suspiciousness of program element m, m1 is the number of times the path corresponding to program element m in the verification result is reachable, m2 is the number of times the path corresponding to program element m in the verification result is unreachable, ∑ m m1 is the total number of unreachable paths of all verified program elements of the target abstract code in the verification result, ∑ m m2 is the total number of times that all verified program elements of the target abstract code in the verification result are reachable by paths.

[0096] By calculating the suspiciousness of program elements, the possibility of pollution sources in the program code to be detected can be measured. The higher the suspiciousness of a program element, the higher the possibility that the program input point is a pollution source; the lower the suspiciousness of a program element, the lower the possibility that the program input point is a pollution source.

[0097] In step S360, the detection result of the program code to be detected is output according to the suspiciousness of the program element.

[0098] Finally, the detection result of the program code to be detected can be output according to the suspiciousness of the program element, and the detection result can include the correspondence between the detected taint source, taint convergence point and data propagation path. Exemplarily, the detection result can also include a program element set and its propagation path.

[0099] In an exemplary embodiment of the present disclosure, after performing taint information flow analysis based on program element mutation on the target abstract code, the harmless function identification and processing analysis can be continued, matched with the harmless processing mark function in the taint mark library, and then the detection result can be output. The false positive rate of the taint information flow analysis result can be further reduced through the harmless function identification and processing analysis.

[0100] It should be noted that, although the steps of the method in the present disclosure are described in a specific order in the drawings, this does not require or imply that the steps must be performed in this specific order, or that all the steps shown must be performed to achieve the desired results. Additionally or alternatively, some steps may be omitted, multiple steps may be combined into one step, and / or one step may be decomposed into multiple steps, etc.

[0101] In addition, in this exemplary embodiment, a code detection device is also provided. Figure 4 As shown, the code detection device 400 may include: a parsing module 410, an extraction module 420, an abstract processing module 430, and an analysis module 440. Among them:

[0102] The parsing module 410 may be used to parse the syntax structure of the program code to be detected to obtain program syntax rules and data dependency relationships;

[0103] The extraction module 420 can be used to extract the program code that matches the taint mark library in the program code to be detected to obtain taint matching information;

[0104] The abstract processing module 430 can be used to perform abstract processing on program elements that are unrelated to target stains in the program code to be detected based on program syntax rules, data dependencies, and stain matching information, and generate target abstract code, where the target stain is a program element that meets the characteristics of the stain matching information;

[0105] The analysis module 440 may be used to perform taint information flow analysis on the target abstract code to obtain a detection result of the program code to be detected.

[0106] In an exemplary embodiment of the present disclosure, based on the above solution, the analysis module 340 may include a variation unit, a verification record unit, a calculation unit and an output unit.

[0107] The mutation unit can be used to mutate program elements of the target abstract code a set number of times;

[0108] The verification recording unit can be used to verify whether there is an executable path between the taint source to be detected and the taint sink point for the target abstract code and the target abstract code after each mutation, and record the verification result;

[0109] The calculation unit may be used to calculate the suspiciousness of the program element based on the verification result;

[0110] The output unit can be used to output the detection result of the program code to be detected according to the suspiciousness of the program element.

[0111] In an exemplary embodiment of the present disclosure, based on the aforementioned scheme, the target abstract code may include a taint assertion that marks the location of the taint convergence point, and the verification recording unit may be specifically used to: for the target abstract code and the target abstract code after each mutation, verify whether the execution result of its program entry parameter satisfies the taint assertion, and the program entry parameter is determined based on the taint matching information; if satisfied, the verification result is recorded as the path is reachable; if not satisfied, the verification result is recorded as the path is unreachable.

[0112] In an exemplary embodiment of the present disclosure, based on the above-mentioned solution, the calculation unit may be specifically used to: calculate the suspicion of the program element based on the verification result according to a suspicion calculation formula; the suspicion calculation formula is:

[0113]

[0114] Where m represents any program element, F m is the suspiciousness of program element m, m1 is the number of times the path corresponding to program element m in the verification result is reachable, m2 is the number of times the path corresponding to program element m in the verification result is unreachable, ∑ m m1 is the total number of unreachable paths of all verified program elements of the target abstract code in the verification result, ∑ m m2 is the total number of times that all verified program elements of the target abstract code in the verification result are reachable by paths.

[0115] In an exemplary embodiment of the present disclosure, based on the aforementioned scheme, the stain marking library may include a stain source marking function, a stain convergence point marking function and a harmless processing marking function; the extraction module 420 may be specifically used to extract program code that matches the stain source marking function, the stain convergence point marking function and the harmless processing marking function from the program code to be detected to obtain stain matching information.

[0116] In an exemplary embodiment of the present disclosure, based on the above solution, the parsing module 410 may include an analysis unit, a first generation unit and a second generation unit.

[0117] The analysis unit can be used to perform lexical analysis and syntax analysis on the program code to be tested and generate an abstract syntax tree;

[0118] The first generation unit may be used to generate program grammar rules based on the abstract syntax tree;

[0119] The second generating unit may be used to generate a program call relationship graph based on the abstract syntax tree, and extract data dependency relationships from the program call relationship graph.

[0120] In an exemplary embodiment of the present disclosure, based on the above solution, the abstract processing module 430 may include an element removal unit and an addition unit, wherein:

[0121] The element removal unit can be used to remove program elements that are not related to the target taint in the program code to be detected based on program syntax rules, data dependencies and taint matching information, combined with the abstract syntax tree and program call relationship graph, to obtain the abstract code to be processed;

[0122] The adding unit can be used to add a taint assertion marking the location of the taint convergence point in the abstract code to be processed, so as to obtain the target abstract code.

[0123] The specific details of each module of the above-mentioned code detection device have been described in detail in the corresponding code detection method, so they will not be repeated here.

[0124] It should be noted that, although several modules or units of the code detection device are mentioned in the above detailed description, this division is not mandatory. In fact, according to the embodiments of the present disclosure, the features and functions of two or more modules or units described above can be concretized in one module or unit. On the contrary, the features and functions of one module or unit described above can be further divided into being concretized by multiple modules or units.

[0125] In addition, in an exemplary embodiment of the present disclosure, an electronic device capable of implementing the above code detection method is also provided.

[0126] Those skilled in the art will appreciate that various aspects of the present disclosure may be implemented as systems, methods or program products. Therefore, various aspects of the present disclosure may be specifically implemented in the following forms, namely: complete hardware embodiments, complete software embodiments (including firmware, microcode, etc.), or embodiments combining hardware and software aspects, which may be collectively referred to herein as "circuits", "modules" or "systems".

[0127] Refer to the following Figure 5 hereinafter describes an electronic device 500 according to such an embodiment of the present disclosure. Figure 5 The electronic device 500 shown is merely an example and should not bring any limitation to the functions and scope of use of the embodiments of the present disclosure.

[0128] like Figure 5 As shown, the electronic device 500 is in the form of a general computing device. The components of the electronic device 500 may include but are not limited to: at least one processing unit 510, at least one storage unit 520, a bus 530 connecting different system components (including the storage unit 520 and the processing unit 510), and a display unit 540.

[0129] The storage unit stores program codes, which can be executed by the processing unit 510, so that the processing unit 510 performs the steps according to various exemplary embodiments of the present disclosure described in the above “Exemplary Method” section of this specification. For example, the processing unit 510 can perform the following steps: Figure 1 The steps shown in: Step S110, parsing the grammatical structure of the program code to be detected to obtain program grammatical rules and data dependencies; Step S120, extracting the program code that matches the taint tag library in the program code to be detected to obtain taint matching information; Step S130, abstracting the program elements in the program code to be detected that are unrelated to the target taint based on the program grammar rules, data dependencies and taint matching information to generate a target abstract code, where the target taint is a program element that meets the characteristics of the taint matching information; Step S140, performing taint information flow analysis on the target abstract code based on program element variation to obtain a detection result of the program code to be detected.

[0130] The storage unit 520 may include a readable medium in the form of a volatile storage unit, such as a random access memory unit (RAM) 521 and / or a cache memory unit 522 , and may further include a read-only memory unit (ROM) 523 .

[0131] The storage unit 520 may also include a program / utility 524 having a set (at least one) of program modules 525, such program modules 525 including but not limited to: an operating system, one or more application programs, other program modules, and program data, each of which or some combination may include an implementation of a network environment.

[0132] Bus 530 may represent one or more of several types of bus structures, including a memory unit bus or memory unit controller, a peripheral bus, an accelerated graphics port, a processing unit, or a local bus using any of a variety of bus architectures.

[0133] The electronic device 500 may also communicate with one or more external devices 570 (e.g., keyboards, pointing devices, Bluetooth devices, etc.), may also communicate with one or more devices that enable a user to interact with the electronic device 500, and / or may communicate with any device that enables the electronic device 500 to communicate with one or more other computing devices (e.g., routers, modems, etc.). Such communication may be performed via an input / output (I / O) interface 550. Furthermore, the electronic device 500 may also communicate with one or more networks (e.g., local area networks (LANs), wide area networks (WANs), and / or public networks, such as the Internet) via a network adapter 560. As shown, the network adapter 560 communicates with other modules of the electronic device 500 via a bus 530. It should be understood that, although not shown in the figure, other hardware and / or software modules may be used in conjunction with the electronic device 500, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems, etc.

[0134] Through the description of the above embodiments, it is easy for those skilled in the art to understand that the example embodiments described here can be implemented by software, or by software combined with necessary hardware. Therefore, the technical solution according to the embodiment of the present disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.) or on a network, and includes several instructions to enable a computing device (which can be a personal computer, a server, a terminal device, or a network device, etc.) to execute the method according to the embodiment of the present disclosure.

[0135] In an exemplary embodiment of the present disclosure, a computer-readable storage medium is also provided, on which a program product capable of implementing the above method of the present specification is stored. In some possible embodiments, various aspects of the present disclosure may also be implemented in the form of a program product, which includes a program code, and when the program product is run on a terminal device, the program code is used to enable the terminal device to perform the steps according to various exemplary embodiments of the present disclosure described in the above "Exemplary Method" section of the present specification.

[0136] refer to Figure 6 As shown, a program product 600 for implementing the above-mentioned code detection method according to an embodiment of the present disclosure is described, which can adopt a portable compact disk read-only memory (CD-ROM) and include program code, and can be run on a terminal device, such as a personal computer. However, the program product of the present disclosure is not limited thereto. In this document, a readable storage medium can be any tangible medium containing or storing a program, which can be used by or in combination with an instruction execution system, an apparatus or a device.

[0137] The program product may use any combination of one or more readable media. The readable medium may be a readable signal medium or a readable storage medium. The readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples (non-exhaustive list) of readable storage media include: an electrical connection with one or more wires, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above.

[0138] Computer readable signal media may include data signals propagated in baseband or as part of a carrier wave, in which readable program code is carried. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Readable signal media may also be any readable medium other than a readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with an instruction execution system, apparatus, or device.

[0139] The program code embodied on the readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wired, optical cable, radio frequency (RF), etc., or any suitable combination of the foregoing.

[0140] Program code for performing the operations of the present disclosure may be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java, C++, etc., and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user computing device, partially on the user device, as a separate software package, partially on the user computing device and partially on a remote computing device, or entirely on a remote computing device or server. In cases involving a remote computing device, the remote computing device may be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computing device (e.g., through the Internet using an Internet service provider).

[0141] In addition, the above-mentioned figures are only schematic illustrations of the processes included in the method according to the exemplary embodiments of the present disclosure, and are not intended to be limiting. It is easy to understand that the processes shown in the above-mentioned figures do not indicate or limit the time sequence of these processes. In addition, it is also easy to understand that these processes can be performed synchronously or asynchronously, for example, in multiple modules.

[0142] Through the description of the above embodiments, it is easy for those skilled in the art to understand that the example embodiments described here can be implemented by software, or by software combined with necessary hardware. Therefore, the technical solution according to the embodiment of the present disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.) or on a network, and includes several instructions to enable a computing device (which can be a personal computer, a server, a touch terminal, or a network device, etc.) to execute the method according to the embodiment of the present disclosure.

[0143] Those skilled in the art will readily appreciate other embodiments of the present disclosure after considering the specification and practicing the invention disclosed herein. This application is intended to cover any variations, uses, or adaptations of the present disclosure that follow the general principles of the present disclosure and include common knowledge or customary techniques in the art that are not disclosed in the present disclosure. The specification and examples are to be considered exemplary only, and the true scope and spirit of the present disclosure are indicated by the claims.

[0144] It should be understood that the present disclosure is not limited to the exact structures that have been described above and shown in the drawings, and that various modifications and changes may be made without departing from the scope thereof. The scope of the present disclosure is limited only by the appended claims.

Claims

1. A code detection method, characterized in that: include: Analyze the syntax structure of the program code to be tested to obtain the program syntax rules and data dependencies; Extracting program codes that match the stain mark library from the program codes to be detected to obtain stain matching information; Based on the program syntax rules, the data dependency and the taint matching information, abstract processing is performed on program elements in the program code to be detected that are unrelated to the target taint to generate a target abstract code, wherein the target taint is a program element that conforms to the taint matching information; Performing a taint information flow analysis based on program element variation on the target abstract code to obtain a detection result of the program code to be detected; The target abstract code is subjected to a stain information flow analysis based on program element variation to obtain a detection result of the program code to be detected, including: mutating a program element of the target abstract code a set number of times; For the target abstract code and the target abstract code after each mutation, verify whether there is an executable path between the taint source to be detected and the taint sink point, and record the verification result; The suspiciousness of the program element is calculated based on the verification result; the suspiciousness calculation formula is: Wherein, m represents any program element, and F m is the suspiciousness of program element m, m1 is the number of times the path corresponding to program element m in the verification result is reachable, m2 is the number of times the path corresponding to program element m in the verification result is unreachable, Σ m m1 is the total number of times that the paths of all verified program elements of the target abstract code in the verification result are unreachable, ∑ m m2 is the total number of times that all verified program elements of the target abstract code in the verification result can be reached by paths; The detection result of the program code to be detected is output according to the suspiciousness of the program element.

2. The code detection method according to claim 1, characterized in that: The target abstract code includes a taint assertion marking the location of the taint convergence point, and the step of verifying whether there is an executable path between the taint source to be detected and the taint convergence point for the target abstract code and the target abstract code after each mutation includes: For the target abstract code and each mutated target abstract code, verify whether the execution result of the program entry parameter satisfies the taint assertion, wherein the program entry parameter is determined based on the taint matching information; If satisfied, the verification result is recorded as path reachable; If not satisfied, the verification result is recorded as path unreachable.

3. The code detection method according to claim 1, characterized in that: The stain mark library includes a stain source mark function, a stain sink mark function and a harmless processing mark function; the extracting of the program code to be detected that matches the stain mark library to obtain stain matching information includes: The program code that matches the stain source marking function, the stain convergence point marking function and the harmless processing marking function is extracted from the program code to be detected to obtain stain matching information.

4. The code detection method according to claim 1, characterized in that: The step of parsing the syntax structure of the program code to be detected to obtain program syntax rules and data dependency relationships includes: Performing lexical analysis and grammatical analysis on the program code to be detected to generate an abstract syntax tree; Generate program grammar rules based on the abstract syntax tree; A program call relationship graph is generated based on the abstract syntax tree, and data dependency is extracted from the program call relationship graph.

5. The code detection method according to claim 4, characterized in that: The step of performing abstract processing on program elements unrelated to target stains in the program code to be detected based on the program grammar rules, the data dependency and the stain matching information to generate target abstract code includes: Based on the program syntax rules, the data dependency and the taint matching information, and in combination with the abstract syntax tree and the program call relationship graph, program elements unrelated to the target taint in the program code to be detected are removed to obtain an abstract code to be processed; A taint assertion marking the location of the taint convergence point is added to the abstract code to be processed to obtain a target abstract code.

6. A code detection device, characterized in that: include: A parsing module is used to parse the syntax structure of the program code to be tested and obtain the program syntax rules and data dependency; An extraction module is used to extract program codes that match the stain mark library in the program code to be detected to obtain stain matching information; An abstract processing module is used to perform abstract processing on program elements in the program code to be detected that are unrelated to a target stain based on the program syntax rules, the data dependency and the stain matching information to generate a target abstract code, wherein the target stain is a program element that meets the characteristics of the stain matching information; An analysis module, used for performing taint information flow analysis on the target abstract code to obtain a detection result of the program code to be detected; The target abstract code is subjected to a stain information flow analysis based on program element variation to obtain a detection result of the program code to be detected, including: mutating a program element of the target abstract code a set number of times; For the target abstract code and the target abstract code after each mutation, verify whether there is an executable path between the taint source to be detected and the taint sink point, and record the verification result; The suspiciousness of the program element is calculated based on the verification result; the suspiciousness calculation formula is: Wherein, m represents any program element, and F m is the suspiciousness of program element m, m1 is the number of times the path corresponding to program element m in the verification result is reachable, m2 is the number of times the path corresponding to program element m in the verification result is unreachable, Σ m m1 is the total number of times that the paths of all verified program elements of the target abstract code in the verification result are unreachable, Σ m m2 is the total number of times that all verified program elements of the target abstract code in the verification result can be reached by paths; The detection result of the program code to be detected is output according to the suspiciousness of the program element.

7. An electronic device comprising: processor; as well as A memory having computer-readable instructions stored thereon, wherein the computer-readable instructions, when executed by the processor, implement the code detection method according to any one of claims 1 to 5.

8. A computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the code detection method according to any one of claims 1 to 5.

Images