A reflection-guided java deserialization call chain mining method and system

Abstract

The application discloses a reflection-guided Java deserialization call chain mining method, a method attribute graph of deserialization perception is constructed by mining the call relationship in a to-be-detected project through static analysis, and omission during call chain search caused by Java dynamic characteristics is avoided, meanwhile, based on the Java reflection mechanism, an executable utilization object is generated to verify the identified suspicious call chain, and the test efficiency and accuracy are improved, and the application also provides a reflection-guided Java deserialization call chain mining system.

Description

TECHNICAL FIELD

[0001] The application relates to the field of software security, and in particular to a reflection-guided Java deserialization call chain mining method and system. BACKGROUND

[0002] The Java deserialization mechanism is a process of restoring an abstract byte stream into an object, which often leads to a series of malignant vulnerabilities such as remote code execution, expression injection and system resource access. Therefore, how to accurately and efficiently detect potential Java deserialization vulnerability call chains has become a challenging task. Existing Java deserialization vulnerability mining work is mostly based on program static analysis technology to model the call relationship between methods, identify potential magic methods and dangerous call sites in the program, and mine potential vulnerability call chains through methods such as depth-first search. However, due to the dynamic characteristics of the Java language, such as reflection, polymorphism, dynamic class loading, etc., the false positive rate of the call graph constructed by most static analysis methods is high, and it is difficult to meet the demand for call chain mining accuracy and efficiency in practical applications, and the manual cost is large. SUMMARY

[0003] The purpose of the application is to provide a reflection-guided Java deserialization call chain mining method, which avoids omissions during dynamic calls and improves test accuracy. The application also provides a reflection-guided Java deserialization call chain mining system, which also avoids omissions during dynamic calls and improves test accuracy.

[0004] Technical scheme: The application provides a reflection-guided Java deserialization call chain mining method, which comprises the following steps:

[0005] 1) Perform static analysis on the to-be-detected project to construct a deserialization-aware method attribute graph;

[0006] 2) Customize a call chain query script to mine suspicious call chains;

[0007] 3) Generate an executable exploit object and dynamically execute the to-be-detected project to verify whether the suspicious call chain can be maliciously exploited.

[0008] Further, in step 1), the deserialization-aware method attribute graph is constructed, comprising the following steps:

[0009] 1.1) Based on the Java static program analysis tool Soot, perform pointer analysis and call relationship analysis on the JAR / WAR / CLASS files of the to-be-detected project to construct a method alias graph and a method call graph;

[0010] 1.2) fuse the method alias graph and the method call graph to build a deserialization-aware method attribute graph, wherein the nodes in the deserialization-aware method attribute graph represent various methods in the program, including alias methods and call methods, and the edges between the nodes in the deserialization-aware method attribute graph represent the calling relationship and the alias relationship between various methods in the program.

[0011] Further, in step 2), a customized call chain query script is used to mine suspicious call chains, including the following steps:

[0012] 2.1) store the built deserialization-aware method attribute graph into a graph database;

[0013] 2.2) customize a call chain query script based on the known magic methods and dangerous calling sites in the original configuration file of Java;

[0014] 2.3) query all suspicious call chains composed of magic methods and dangerous calling sites based on the reachability of the deserialization-aware method attribute graph, for further dynamic verification of the call chains.

[0015] Further, in step 3), the suspicious call chains are verified to determine whether they can be maliciously exploited, including the following steps:

[0016] 3.1) use the Unsafe class method in Java to instantiate the class object to which the magic method belongs, as an initial exploitation object;

[0017] 3.2) based on the reflection mechanism of Java, instantiate and assign the class to which the alias method pointed by the edge between the nodes in the suspicious call chain to the initial exploitation object, and iteratively update the execution path of the exploitation object;

[0018] 3.3) dynamically execute the exploitation object in the project to be detected to determine whether the dangerous calling site is reachable;

[0019] 3.4) use the attribute-based Java object fuzz tester to test whether the exploitation object has controllable attributes, so that the malicious code logic can be triggered, and output the call chain that simultaneously satisfies the dangerous calling site reachability, the controllable attribute, and the exploitability as a vulnerability call chain.

[0020] The application also provides a reflection-guided Java deserialization call chain mining system, which includes an attribute graph construction module, a suspicious call chain mining module, and a vulnerability call chain verification module.

[0021] The attribute graph construction module is used to perform static analysis on the project to be detected and build a deserialization-aware method attribute graph.

[0022] The suspicious call chain mining module is used to customize a call chain query script to further mine suspicious call chains.

[0023] The vulnerability call chain verification module is configured to generate an executable exploit object and dynamically execute the to-be-detected item, and verify whether the suspicious call chain can be maliciously exploited.

[0024] Further, the attribute graph construction module comprises a compiling unit and a representation unit.

[0025] The compiling unit is configured to perform pointer analysis and call relationship analysis on JAR / WAR / CLASS files of the to-be-detected item based on a Java static program analysis tool Soot, and construct a method alias graph and a method call graph.

[0026] The representation unit is configured to fuse the method alias graph and the method call graph, and construct a deserialization-aware method attribute graph, wherein a node in the deserialization-aware method attribute graph represents various methods in a program, including alias methods and call methods, and an edge between nodes in the deserialization-aware method attribute graph represents a call relationship and an alias relationship between various methods in the program.

[0027] Further, the suspicious call chain mining module comprises a storage unit, a script customization unit, and a query unit.

[0028] The storage unit is configured to store the constructed deserialization-aware method attribute graph into a graph database.

[0029] The script customization unit is configured to customize a call chain query script based on known magic methods and dangerous call sites in a Java original configuration file.

[0030] The query unit is configured to query all suspicious call chains composed of the magic methods and the dangerous call sites based on reachability of the deserialization-aware method attribute graph, and further perform call chain dynamic verification.

[0031] Further, the vulnerability call chain verification module comprises an initialization unit, an updating unit, a reachability determination unit, and an exploitability determination unit.

[0032] The initialization unit is configured to instantiate a class object to which the magic method belongs by using an Unsafe class method in Java, as an initial exploit object.

[0033] The updating unit is configured to instantiate and assign a class to which an alias method pointed by an edge between nodes in the suspicious call chain belongs to the initial exploit object based on a reflection mechanism of Java, and iteratively update an execution path of the exploit object.

[0034] The reachability determination unit is configured to dynamically execute the exploit object in the to-be-detected item, and determine whether the dangerous call site is reachable.

[0035] The exploitability judging unit is used to test whether the exploit object has controllable attributes by using the attribute-based Java object fuzz tester, so that malicious code logic can be triggered, and the call chain that meets the dangerous call site reachability, controllable attributes and exploitability at the same time is output as a vulnerability call chain.

[0036] Advantages: Compared with the prior art, the present application has the following significant features: the calling relationship in the to-be-detected project is mined by static analysis, and a method attribute graph for deserialization awareness is constructed according to the calling relationship, so as to avoid the omission of the calling chain search caused by the dynamic characteristics of Java; and the suspicious call chain identified is verified by using an executable exploit object based on the Java reflection mechanism, so as to improve the test efficiency and accuracy. BRIEF DESCRIPTION OF DRAWINGS

[0037] Figure 1 is a flowchart of the present application;

[0038] Figure 2 is a method attribute graph for deserialization awareness in the present application. DETAILED DESCRIPTION

[0039] The present application will be further explained and described below in combination with the drawings and specific embodiments.

[0040] Embodiment 1

[0041] Referring to Figure 1 and Figure 2 , the present application provides a reflection-guided Java deserialization call chain mining method, which comprises the following steps:

[0042] 1) performing static analysis on the to-be-detected project to construct a method attribute graph for deserialization awareness;

[0043] 1.1) based on the Java static program analysis tool Soot, performing pointer analysis and calling relationship analysis on the JAR / WAR / CLASS file of the to-be-detected project to construct a method alias graph and a method call graph;

[0044] 1.2) fuse the method alias graph and the method call graph to build a deserialization-aware method attribute graph, wherein the nodes in the deserialization-aware method attribute graph represent various methods in the program, the compareTo node represents the compareTo method in the JAR file to be tested for comparing the sizes of two attribute values; similarly, the equals node represents the equals method in the JAR file to be tested for judging whether two objects are the same; the str node represents the str method in the JAR file to be tested for comparing the sizes of two attribute values; the keys node represents the keys method in the JAR file to be tested for obtaining attribute values; the get node represents the get method in the JAR file to be tested for obtaining the class name to which an object belongs; the getFromHashTable node represents the getFromHashTable method in the JAR file to be tested for obtaining the hash value corresponding to an attribute from a hash table; the CreateValue node represents the createValue method in the JAR file to be tested for instantiating an object, and the edges between the nodes in the deserialization-aware method attribute graph represent the calling relationship and the alias relationship between various methods in the program, the CALL edge represents the calling relationship between the methods, and the ALIAS edge represents the alias relationship between the methods.

[0045] 2) customize a call chain query script to further mine suspicious call chains;

[0046] 2.1) store the deserialization-aware method attribute graph that has been built into a graph database;

[0047] 2.2) customize a call chain query script based on the known magic methods and dangerous call sites in the original configuration file of Java, wherein the known magic methods and dangerous call sites are shown in Table 1:

[0048] Table 1

[0049]

[0050] 2.3) query all suspicious call chains composed of magic methods and dangerous call sites based on the reachability of the deserialization-aware method attribute graph, to further dynamically verify the suspicious call chains.

[0051] 3) generate an executable exploit object and dynamically execute the project to be detected to verify whether the suspicious call chain can be maliciously exploited;

[0052] 3.1) use the Unsafe class method in Java to instantiate the class object to which the magic method belongs, as an initial exploit object;

[0053] 3.2) Based on the Java reflection mechanism, the suspicious call chain nodes and the alias method pointed by the edge between the nodes are instantiated and assigned to the initial exploitation object, and the execution path of the exploitation object is iteratively updated;

[0054] 3.3) Dynamically execute the exploitation object in the project to be detected to determine whether the dangerous call site is reachable;

[0055] 3.4) Use the attribute-based Java object fuzz tester to test whether the exploitation object has controllable attributes, so that the malicious code logic can be triggered, and the call chain that meets the dangerous call site reachability, controllable attributes, and exploitability is output as a vulnerability call chain.

[0056] Embodiment 2

[0057] Corresponding to the reflection-guided Java deserialization call chain mining method of Embodiment 1, Embodiment 2 provides a reflection-guided Java deserialization call chain mining system, please refer to Figure 1 and Figure 2 The system includes an attribute graph construction module, a suspicious call chain mining module, and a vulnerability call chain verification module.

[0058] The attribute graph construction module is used to perform static analysis on the project to be detected to construct a deserialization-aware method attribute graph. In the attribute graph construction module, a compilation unit and a representation unit are included.

[0059] The compilation unit is used to perform pointer analysis and call relationship analysis on the JAR / WAR / CLASS files of the project to be detected based on the Java static program analysis tool Soot to construct a method alias graph and a method call graph.

[0060] The characterization unit is configured to fuse the method alias graph and the method call graph to construct a deserialization-aware method attribute graph, wherein the nodes in the deserialization-aware method attribute graph represent various methods in the program, the compareTo node represents a compareTo method in the JAR file to be tested for comparing the sizes of two attribute values; similarly, the equals node represents an equals method in the JAR file to be tested for judging whether two objects are the same; the str node represents an str method in the JAR file to be tested for comparing the sizes of two attribute values; the keys node represents a keys method in the JAR file to be tested for obtaining attribute values; the get node represents a get method in the JAR file to be tested for obtaining the class name of an object; the getFromHashTable node represents a getFromHashTable method in the JAR file to be tested for obtaining the hash value corresponding to an attribute from a hash table; the CreateValue node represents a createValue method in the JAR file to be tested for instantiating an object, and the edges between the nodes in the deserialization-aware method attribute graph represent the calling relationship and alias relationship between various methods in the program, the CALL edge represents the calling relationship between the methods, and the ALIAS edge represents the alias relationship between the methods.

[0061] The suspicious call chain mining module is configured to customize a call chain query script to mine suspicious call chains, and the suspicious call chain mining module comprises a storage unit, a script customization unit and a query unit.

[0062] The storage unit is configured to store the constructed deserialization-aware method attribute graph into a graph database.

[0063] The script customization unit is configured to customize a call chain query script based on known magic methods and dangerous calling sites in a Java original configuration file, wherein the known magic methods and dangerous calling sites are shown in Table 1 of Embodiment One.

[0064] The query unit is configured to query all suspicious call chains composed of magic methods and dangerous calling sites based on the reachability of the deserialization-aware method attribute graph, to further dynamically verify the call chains.

[0065] The vulnerability call chain verification module is configured to generate an executable exploit object and dynamically execute the item to be detected to verify whether the suspicious call chain can be maliciously exploited, and the vulnerability call chain verification module comprises an initialization unit, an updating unit, a reachability determination unit and a exploitability determination unit.

[0066] The initialization unit is configured to instantiate a class object to which the magic method belongs by using an Unsafe class method in Java as an initial exploit object.

[0067] The updating unit is used to instantiate and assign the suspicious calling chain with the class to which the alias method pointed by the edge between the nodes is belonged based on the Java reflection mechanism, and to update the execution path of the initial exploitation object iteratively;

[0068] The reachability judging unit is used to execute the exploitation object dynamically in the to-be-detected project, and to judge whether the dangerous calling site is reachable;

[0069] The exploitability judging unit is used to test whether the controllable attribute exists in the exploitation object by using the attribute-based Java object fuzz tester, so that the malicious code logic can be triggered, and the calling chain which satisfies the dangerous calling site reachability, the controllable attribute and the exploitability at the same time is output as a vulnerability calling chain.

[0070] The application avoids the omission in the calling chain search caused by the Java dynamic characteristics by mining the calling relationship in the to-be-detected project through static analysis, and constructs the method attribute graph with the serialization awareness, and simultaneously proposes the executable exploitation object based on the Java reflection mechanism to generate the suspicious calling chain for verification, and improves the test efficiency and accuracy.

Claims

1. A reflection-guided method for mining Java deserialization call chains, characterized in that, Includes the following steps: 1) Perform static analysis on the project to be detected and construct a method attribute graph for deserialization sensing; including: 1.1) Soot, a Java static program analysis tool, performs pointer analysis and call relationship analysis on the JAR / WAR / CLASS files of the project to be tested, and constructs a method alias graph and a method call graph; 1.2) The method alias graph and the method call graph are merged to construct a deserialization-aware method attribute graph. In the deserialization-aware method attribute graph, the nodes represent various methods in the program, including alias methods and calling methods. The edges between nodes in the deserialization-aware method attribute graph represent the calling relationship and alias relationship between various methods in the program. 2) Customize call chain query scripts to uncover suspicious call chains; 3) Generate an executable exploit object and dynamically execute the project to be tested to verify whether the suspicious call chain can be maliciously exploited, including: 3.1) Instantiate an object of the class to which the magic method belongs using the Unsafe class method in Java, and use it as the initial exploit object; 3.2) Based on Java's reflection mechanism, the class of the alias method pointed to by the edge between nodes in the suspicious call chain is instantiated and assigned to the initial exploit object, and the execution path of the exploit object is updated iteratively. 3.3) Dynamically execute the exploit object in the project to be tested to determine whether the dangerous call site is reachable; 3.4) Use an attribute-based Java object fuzzer to test whether the exploitable object has controllable attributes that allow malicious code logic to be triggered, and output the call chain that simultaneously satisfies the dangerous call site reachability, controllable attributes, and exploitability as the vulnerability call chain.

2. The reflection-guided Java deserialization call chain mining method according to claim 1, characterized in that, Step 2) involves customizing a call chain query script to uncover suspicious call chains, including the following steps: 2.1) Store the constructed deserialization-aware method attribute graph into a graph database; 2.2) Based on the known magic methods and dangerous call sites in the original Java configuration files, a custom call chain query script is developed; 2.3) Based on the reachability query of the method attribute graph of deserialization awareness, all suspicious call chains consisting of magic methods and dangerous call sites are used for further dynamic verification of call chains.

3. A reflection-guided Java deserialization call chain mining system, characterized in that, It includes a property graph construction module, a suspicious call chain mining module, and a vulnerability call chain verification module; The attribute graph construction module is used to perform static analysis on the project to be detected and to construct the method attribute graph of deserialization perception. The attribute graph construction module includes compilation unit and representation unit. The compilation unit uses Soot, a Java static program analysis tool, to perform pointer analysis and call relationship analysis on the JAR / WAR / CLASS files of the project to be tested, and to construct method alias graphs and method call graphs. The representation unit is used to merge the method alias graph and the method call graph to construct a deserialization-aware method attribute graph. In the deserialization-aware method attribute graph, the nodes represent various methods in the program, including alias methods and calling methods. The edges between nodes in the deserialization-aware method attribute graph represent the calling relationship and alias relationship between various methods in the program. The suspicious call chain mining module is used to customize call chain query scripts to discover suspicious call chains; The vulnerability call chain verification module is used to generate an executable exploit object and dynamically execute the project to be tested to verify whether a suspicious call chain can be maliciously exploited. The vulnerability call chain verification module includes an initialization unit, an update unit, a reachability determination unit, and an exploitability determination unit. The initialization unit is used to instantiate an object of the class to which the magic method belongs using the Unsafe class method in Java, as the initial object to be used; The update unit uses Java's reflection mechanism to instantiate the class of the alias method pointed to by the edge between nodes in the suspicious call chain and assign it to the initial exploit object, and iteratively updates the execution path of the exploit object. The reachability determination unit is used to dynamically execute the exploit object in the project to be detected to determine whether the dangerous call site is reachable; The exploitability determination unit uses an attribute-based Java object fuzzer to test whether the exploitable object has controllable attributes that allow malicious code logic to be triggered, and outputs the call chain that simultaneously satisfies the dangerous call site reachability, controllable attributes, and exploitability as the vulnerability call chain.

4. The reflection-guided Java deserialization call chain mining system according to claim 3, characterized in that, The suspicious call chain mining module includes a storage unit, a script customization unit, and a query unit; The storage unit is used to store the constructed deserialization-aware method attribute graph into the graph database; The script customization unit is used to customize call chain query scripts based on the magic methods and dangerous call sites known in the original Java configuration files; The query unit is used to query all suspicious call chains consisting of magic methods and dangerous call sites based on the reachability of the method attribute graph perceived by deserialization, for further dynamic verification of the call chains.

5. A computer device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the steps of the method according to claims 1 to 2.

6. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to claims 1 to 2.

Images