A method, system, medium, device and terminal for side channel vulnerability detection

Abstract

The present invention belongs to the technical field of side channel vulnerability detection, and discloses a method, system, medium, device and terminal for side channel vulnerability detection, inputs a software program code to be detected; and sequentially executes two detection modules to detect three types of vulnerability variants: a detection module 1 based on a deterministic finite state automaton and a dictionary tree DFA-Trie is designed to detect vulnerability variants 1 and 2, and a detection module 2 based on a long short-term memory neural network classifier LSTM-NNC is designed to detect vulnerability variant 3. In view of the problem of low efficiency in side channel vulnerability detection, the present invention designs a DFA-Trie detection module and a LSTM-NNC detection module, realizes efficient side channel vulnerability detection of large-scale software, can adapt to the scene of frequent exposure of new vulnerabilities in the real world and the detection of side channel vulnerabilities in programs written in multiple programming languages ​​that can be compiled into LLVM IR, and can realize the detection of variants of side channel vulnerabilities.

Description

Technical Field

[0001] The present invention belongs to the technical field of side channel vulnerability detection, and in particular relates to a method, system, medium, device and terminal for side channel vulnerability detection. Background Art

[0002] Currently, side-channel attacks allow attackers to obtain security-sensitive information by observing the external behavior of a system. Meltdown and Spectre demonstrated how security vulnerabilities in modern processors can be exploited to leak confidential information. Although side-channel attacks always use specific hardware as the target of attack, most of the current side-channel vulnerabilities are caused by software defects, that is, the root cause of side-channel vulnerabilities is that there are certain defects in the software running on the hardware. As software side-channel vulnerabilities become an increasingly serious threat, their detection becomes a key challenge in software development.

[0003] Due to the continuous growth of software complexity, traditional rule-based vulnerability detection methods have the problem of low detection efficiency. In addition, a survey of side-channel vulnerability-related literature published in some top academic conferences (such as CCS, ISSTA and ICSE) was conducted, and it was summarized that some program instances that can be called side-channel vulnerability variants can be generated by modifying the code of the source vulnerability instance, and they still have side-channel vulnerabilities. In recent years, researchers have proposed a variety of detection techniques, which can be divided into two categories: static detection techniques and dynamic detection techniques. 1) Static detection techniques include methods based on anti-interference verification, methods based on security information flow analysis, and methods based on automatic resource binding calculation. First, Barthe et al. proposed a self-synthesis technique to prove the anti-interference of the program. Although the self-combination technique can guarantee integrity and a certain degree of accuracy, verifying the anti-interference of the program requires security inspectors to propose complex invariants, which are difficult to infer automatically. Dufay et al. solved this problem by providing invariants using JML annotations, but their proposed method requires tedious work in software development and security analysis. Another technique to prove k-safety (a program safety indicator) is to construct so-called product programs. Similar to the self-assembly technique, the technique for building product programs reduces k-safety to standard safety by building programs containing assertions. Although there are several ways to construct product programs, they all attempt to execute different copies of the program in a lockstep manner. Sousa et al. demonstrated that the product program technique has flexibility issues. Secondly, most of the existing work is conducted on specific single side channel vulnerability instances, analyzing the vulnerability pattern of the specific single instance, judging whether the software program sample meets the extracted vulnerability pattern, and thus identifying the side channel vulnerabilities in the software. As a result, some researchers have proposed detection methods based on secure information flow. For example, Zhang et al. proposed a method for tracking side channel vulnerabilities based on a certain programming language; Pottier et al. proposed an information flow analysis method based on references, exceptions, and polymorphism. Finally, there are currently a series of papers on the automatic calculation of resource boundaries. For example, Gulwani et al., Charbonneau et al., Sinn et al. proposed methods for statically calculating the resource consumption boundaries of command programs based on abstract interpretation, linear programming, and differential constraints, respectively; Flores et al. focused on how to perform boundary analysis on programs written in functional programming languages. 2) Dynamic detection technology is mainly based on symbolic execution methods. For example, Bang et al. proposed a vulnerability detection method based on symbolic execution to quantify specific side channel types. Pasareanu et al. proposed an algorithm based on symbolic execution to generate inputs and maximize side channel metrics, but this method is only applicable to specific types of side channel vulnerabilities and is not suitable for detecting side channel vulnerability variants.In summary, the existing dynamic and static detection methods have the following problems: 1) Low detection efficiency. For example, existing methods are difficult to execute automatically, which greatly affects the detection efficiency, especially for the detection of large-scale complex software; 2) Universality problems. For example, most of the existing methods are only used to detect a specific single side channel vulnerability instance, but cannot detect different side channel vulnerabilities in a universal way; 3) Vulnerability variant detection problems. For example, existing methods ignore the detection of vulnerability variants, which leads to a high false negative rate in the detection results.

[0004] In order to achieve the purpose of automatic and efficient detection, machine learning is applied to software defect detection, which has the advantages of simple implementation, easy maintenance, and high accuracy. However, after investigation, it was found that there are few studies on the application of machine learning to software side channel vulnerability detection. There are three main problems in current research: First, vulnerability detection technology based on traditional machine learning methods requires security experts to define the characteristics of the vulnerability, and then use machine learning algorithms for detection. However, the extraction of software side channel vulnerability features is very difficult, making subsequent work impossible. Secondly, code similarity vulnerability detection technology based on deep learning does not require the definition of vulnerability features, but the two key challenges faced by side channel vulnerability detection methods based on deep learning are the difficulty in accurately defining the similarity between side channel program samples and the lack of high-quality data sets.

[0005] Through the above analysis, the problems and defects of the prior art are as follows:

[0006] (1) Traditional rule-based vulnerability detection methods have the problem of low detection efficiency, while existing dynamic and static detection methods have the problems of low detection efficiency, weak universality, and vulnerability variant detection.

[0007] (2) Currently, there is little research on the application of machine learning to software side-channel vulnerability detection. At the same time, the extraction of software side-channel vulnerability features is very difficult, making it impossible to carry out subsequent work, and the false alarm rate is high.

[0008] (3) Two key challenges faced by existing deep learning-based side channel vulnerability detection methods are the difficulty in accurately defining the similarities between side channel program samples and the lack of high-quality datasets. Summary of the invention

[0009] In view of the problems existing in the prior art, the present invention provides a method, system, medium, device and terminal for side channel vulnerability detection, and in particular, relates to a method, system, medium, device and terminal for side channel vulnerability detection based on similarity calculation and machine learning.

[0010] The present invention is implemented as follows: a method for side channel vulnerability detection, the method comprising: inputting a software program code to be detected; sequentially executing two detection modules to detect three types of vulnerability variants: designing a detection module 1 based on a deterministic finite state automaton and a dictionary tree DFA-Trie to detect vulnerability variants 1 and 2, and designing a detection module 2 based on a long short-term memory neural network classifier LSTM-NNC to detect vulnerability variant 3.

[0011] Input the software program code to be detected, and separate the large software program into multiple function program codes; design a detection module 1 based on deterministic finite state automaton and dictionary tree DFA-Trie, construct a program keyword dictionary tree and a regularized vulnerability library, regularize the test program and match it with the regularized vulnerability library, and detect whether there are vulnerability variants 1 and 2 in the test program; design a detection module 2 based on the long short-term memory neural network classifier LSTM-NNC, expand the data set based on the data type expansion method, compile the program code in the data set into an LLVM IR file by LLVM, convert the LLVM IR file into a numerical vector representation, train the LSTM-NNC based on the expanded and LLVM IR-processed data set, compile the test program by LLVM and process the LLVM IR, and use the trained LSTM-NNC to detect whether the processed test program has vulnerability variant 3; output the detection results of vulnerability variants 1, 2 and 3.

[0012] Furthermore, the method for side channel vulnerability detection comprises the following steps:

[0013] Step 1, sample input: input the software program code sample / test program to be detected; the separation process of the large software program code in step 1 makes the program codes input to the two detection modules in the present invention all be program codes that can retain the minimum function, which is conducive to improving the matching processing efficiency of vulnerability variants 1 and 2 in the detection module 1 and improving the detection accuracy of the two detection modules;

[0014] Step 2, DFA-Trie detection: construct a program keyword dictionary tree and a regularized vulnerability library, regularize the test program, match each function in the regularized test program with the function in the regularized vulnerability library, and detect whether the test program has vulnerability variants 1 and 2; the step 2 DFA-Trie detection can detect whether the test program has vulnerability variants 1 and 2 and newly disclosed additional vulnerability variants 1 and 2; the detection module 1 adopts the program keyword dictionary tree and the regularization processing method, so that the calculation complexity is small when regularizing each function code, thereby improving the detection efficiency of the present invention for vulnerability variants 1 and 2.

[0015] Step three, LSTM-NNC detection: expand the data set and train LSTM-NNC based on the expanded data set, and use the trained NNC to detect whether the test program has vulnerability variant 3; the step three LSTM-NNC detection can detect whether the test program has vulnerability variant 3 and the newly disclosed additional vulnerability variant 3; the detection module two adopts a neural network learning model, and improves the detection efficiency of vulnerability variant 3 by optimizing at the algorithm level; the program vectorization of the detection module two is based on LLVM IR, so that the present invention is suitable for detecting side channel vulnerabilities in programs written in multiple programming languages ​​that can be compiled into LLVM IR, thereby enhancing the universality of the application of the present invention.

[0016] Step 4, result output: output whether the program to be detected has vulnerability variants 1, 2 and 3; the result output of step 4 can output the detection results according to user needs. It can only output the detection results of vulnerability variants 1 and 2, or only output the detection results of vulnerability variant 3, or output the detection results of vulnerability variants 1, 2 and 3.

[0017] Furthermore, the software program code sample to be tested in step 1 includes:

[0018] Before sending all the software program samples to be detected to the detection module, the large software is preliminarily separated into a plurality of functional function code samples.

[0019] Further, the DFA-Trie detection in step 2 includes:

[0020] (1) Setup phase: construct the program keyword dictionary Trie and regularized vulnerability library;

[0021] ① Manually select the program keywords of each vulnerable function and add them to the program keyword set to construct the program keyword dictionary tree;

[0022] ② Select the vulnerable program code set and regularize the vulnerable program code samples to construct a regularized vulnerability library;

[0023] (2) Detection phase: Regularize the test program and match the regularized test program with the regularized vulnerability library;

[0024] ① Regularize the test program based on the deterministic finite state automaton DFA and the program keyword dictionary tree Trie;

[0025] ② Match each function in the regularized test program with each sample in the regularized vulnerability library. If the match is successful, the test program contains vulnerability variant 1 or vulnerability variant 2 in the side channel vulnerability library; if each function in the regularized test program does not match all samples in the regularized vulnerability library, the original test program is sent to the LSTM-NNC detection module for detection by the next module.

[0026] Furthermore, the regularization program code process is completed by the following operations: by determining the finite state automaton DFA to recognize comments, text values, identifiers and separators in the program, filtering out comments, string constants and character constants, and filtering out numbers; identifying and judging the identifier, if it is an identifier, further judging whether it is a program keyword based on the program keyword dictionary tree; if it is not a program keyword, taking the identifier as a user-defined identifier, and using the regularization index corresponding to the user-defined identifier to replace the user-defined identifier; converting the blank characters in the program into a unified blank character; wherein the blank characters include space, newline and tab.

[0027] The regularization test program function code includes: applying a deterministic finite state automaton to identify and extract comments, text values, identifiers and separators from software code, filtering comments, string constants and character constants, identifying identifiers and filtering out numbers, using a dictionary tree to separate user-defined identifiers from program keywords, using the regularization index corresponding to the user-defined identifier to replace the user-defined identifier, and converting the blank characters in the program into a unified blank character.

[0028] Further, the LSTM-NNC detection in step 3 includes:

[0029] (1) Learning phase: data set expansion and LLVM compilation, processing LLVM IR and numerical vector representation conversion, and training LSTM-NNC;

[0030] ①Data set expansion and LLVM compilation processing;

[0031] Data type expansion, using data type expansion to make the data type representation range of a variable wider than the representation range of the corresponding variable in the original code;

[0032] LLVM compilation is performed on the program code, which is to perform compilation operations with different options on each expanded code and compile it into an LLVM IR file;

[0033] The stratified random sampling operation is to divide the entire data set into n categories, and construct the training set, validation set, and test set in the same proportion in each category: n is consistent with the number of output neurons in LSTM-NNC;

[0034] ②Processing LLVM IR and numerical vector representation conversion;

[0035] LLVM IR file preprocessing, that is, removing invalid information including blank lines, comments, metadata, module information, attribute information in LLVM IR files, retaining function information and related data definitions; replacing identifiers in LLVM IR files with %ID, using <int float string>Instead of the immediate value in the LLVM IR file; each structure type data is expanded in the LLVMIR instruction so that the definition of each structure type data is removed from the LLVM IR file to ensure that the structured data is inlined;

[0036] Convert LLVM IR to numerical vector representation. All LLVM IR instructions form a complete set, S = {s1, s2, s3, ...}. Use an NCC pre-trained model to map LLVM IR instructions to numerical vectors. The pre-trained element is a tuple (s, x) consisting of an LLVM IR instruction s and a numerical vector x. The model is formalized as x is a 200-dimensional vector, S′ is a subset of the complete set S of all LLVM IR instructions, and the dimension of the numeric vector is determined by the embedding size of the pre-trained model;

[0037] Each program is formalized as an ordered n-tuple, Porgram i ={stat1,stat2,stat3,…,stat n }, where n∈Z * Program i The number of instructions contained in stat j Indicates that in the program i The jth LLVM IR instruction in stat j =stat k Established;

[0038] For a program, we search for the corresponding LLVM IR instructions in the pre-trained model NCC and use the corresponding 200-dimensional vector to replace the LLVM IR instructions in the program. If the LLVM IR instructions we are looking for are not in the pre-trained model, we use a specific 200-dimensional vector to replace them. After the replacement is completed, the program is formalized as Where n represents the program i The number of instructions in x j represents the numerical vector corresponding to the j-th LLVM IR instruction, x j =x k ;

[0039] ③Training LSTM neural network classifier;

[0040] For a training data set with m programs, a numerical vector representation is obtained through step ② in the learning phase; let X = {X1, X2, X3, ..., X m } is the transformed vector representation corresponding to the training data set, m∈Z * is the number of training samples contained in the training data set; X i represents the i-th program in the training dataset X, which is the input of the LSTM-NNC model; X i There are corresponding ground truth labels, Y i ={y j |y j =0or1,j=1,2,…,n,n≥2,n∈Z * }; If y j =1 means X i Belongs to the jth class; LSTM-NNC has four layers, namely LSTM layer, including LSTM units; BN layer, dense layer and output layer.

[0041] Before the LSTM layer, the input to the model is: X i ∈R maxlen×200 ;

[0042] After the LSTM layer:

[0043] After the BN layer:

[0044] After the dense layer:

[0045] In the output layer: is the LSTM neural network classifier model output;

[0046] Select the cross entropy loss function as the loss function for training the LSTM neural network classifier model:

[0047]

[0048] Among them, maxlen represents the maximum length of the input program vector sequence s, which is determined by the specific input program; LSTM 1，2 Represents a two-layer LSTM unit, compressed matrix X i into a fixed-length vector H; BN represents batch normalization operation; ReLU and softmax are two activation functions; W D and W Y is a weighted matrix parameter; dense_size represents the number of units (neurons) in the dense layer and is a hyperparameter; n is the number of units in the output layer and is set according to the specific scenario; n=2 means that the LSTM-NNC model divides the input test program into vulnerability and non-vulnerability categories, and n>2 means that the LSTM-NNC model divides the input test program into corresponding vulnerability categories;

[0049] (2) Detection phase: test program compilation and LLVM IR processing, and use the trained LSTM-NNC to detect vulnerability variant 3;

[0050] ①LLVM IR compilation, file preprocessing and conversion of LLVM IR into numerical vector representation;

[0051] LLVM compilation, which performs compilation operations with different options on each function code of the program to be detected and compiles it into LLVM IR files;

[0052] LLVM IR file preprocessing, that is, removing invalid information including blank lines, comments, metadata, module information, attribute information in LLVM IR files, retaining function information and related data definitions; replacing identifiers in LLVM IR files with %ID, using <int float string>Instead of the immediate value in the LLVM IR file; each structure type data is expanded in the LLVMIR instruction so that the definition of each structure type data is removed from the LLVM IR file to ensure that the structured data is inlined;

[0053] Convert LLVM IR to numerical vector representation. All LLVM IR instructions form a complete set, S = {s1, s2, s3, ...}. Use an NCC pre-trained model to map LLVM IR instructions to numerical vectors. The pre-trained element is a tuple (s, x) consisting of an LLVM IR instruction s and a numerical vector x. The model is formalized as x is a 200-dimensional vector, S′ is a subset of the complete set S of all LLVM IR instructions, and the dimension of the numeric vector is determined by the embedding size of the pre-trained model;

[0054] Each program is formalized as an ordered n-tuple, Program i ={stat1,stat2,stat3,...,stat n }, where n∈Z * Program i The number of instructions contained in stat j Indicates that in the program i The jth LLVM IR instruction in ; stat j =stat k Established;

[0055] For a program, we search for the corresponding LLVM IR instructions in the pre-trained model NCC and use the corresponding 200-dimensional vector to replace the LLVM IR instructions in the program. If the LLVM IR instructions we are looking for are not in the pre-trained model, we use a specific 200-dimensional vector to replace them. After the replacement is completed, the program is formalized as X i ={x1, x2, x3, ..., x n }, Where n represents the program i The number of instructions in x j represents the vector corresponding to the jth LLVM IR instruction, x j =x k ;

[0056] ②Use the LSTM-NNC model trained in step ③ of the learning phase to predict the test results of the test program;

[0057] Use the output of step ③ in the learning phase, that is, the neural network classifier with the LSTM learning model parameters added and use the output of step ① in the detection phase as the input x of the LSTM-NNC model prog , we get the following result: A test program whether there is a vulnerability variant 3; Formally, Xprog is the input, is the output; and n is the number of side channel vulnerability instance categories in the training dataset; Represents X prog Belongs to the jth category.

[0058] Another object of the present invention is to provide a system for side channel vulnerability detection using the side channel vulnerability detection method, the system for side channel vulnerability detection comprising:

[0059] A sample input module, used to input function code samples;

[0060] DFA-Trie detection module, used to construct a program keyword dictionary tree and a regularized vulnerability library, match the regularized vulnerability library with the function code samples in the regularized test program, and use similarity to detect whether the function code samples contain vulnerability variants 1 and 2;

[0061] LSTM-NNC detection module, used to expand the data set and train the LSTM-NNC model based on the expanded data set, and use the trained LSTM-NNC model to detect whether the program code sample contains vulnerability variant 3;

[0062] The result output module is used to output whether the test program code has vulnerability variants 1, 2 and 3.

[0063] Another object of the present invention is to provide a computer device, the computer device comprising a memory and a processor, the memory storing a computer program, and when the computer program is executed by the processor, the processor performs the following steps:

[0064] Input the software program code to be detected; execute two detection modules sequentially to detect three types of vulnerability variants: design a detection module 1 based on deterministic finite state automaton and dictionary tree DFA-Trie to detect vulnerability variants 1 and 2, and design a detection module 2 based on long short-term memory neural network classifier LSTM-NNC to detect vulnerability variant 3.

[0065] Another object of the present invention is to provide a computer-readable storage medium storing a computer program, wherein when the computer program is executed by a processor, the processor executes the following steps:

[0066] Input the software program code to be detected; execute two detection modules sequentially to detect three types of vulnerability variants: design a detection module 1 based on deterministic finite state automaton and dictionary tree DFA-Trie to detect vulnerability variants 1 and 2, and design a detection module 2 based on long short-term memory neural network classifier LSTM-NNC to detect vulnerability variant 3.

[0067] Another object of the present invention is to provide an information data processing terminal, which is used to implement the side channel vulnerability detection system.

[0068] In combination with the above technical solutions and the technical problems solved, please analyze the advantages and positive effects of the technical solutions to be protected by the present invention from the following aspects:

[0069] First, in view of the technical problems existing in the above-mentioned prior art and the difficulty of solving the problems, the technical solutions to be protected by the present invention and the results and data during the research and development process are closely combined to analyze in detail and deeply how the technical solutions of the present invention solve the technical problems, and some creative technical effects brought about after solving the problems. The specific description is as follows:

[0070] (1) In order to solve the problem of low detection efficiency of side channel vulnerabilities, the present invention designs two vulnerability variant detection modules that are executed sequentially: DFA-Trie detection module and LSTM-NNC detection module. On the one hand, in the DFA-Trie detection module, a program keyword dictionary tree and a regularized vulnerability library are constructed, so that the computational complexity cost of regularizing a program with n characters is O(n). This is of particular value for processing large code corpora. On the other hand, for the LSTM-NNC detection module, the prediction process of the neural network classifier is essentially the forward propagation process of the input data in the neural network. Modern computer architecture has made a series of optimizations to matrix operations; at the same time, because the underlying mathematical operation library supported by the deep learning engine is optimized at the algorithm level, the matrix operation speed is faster, thereby improving the detection efficiency.

[0071] (2) With regard to the problem of weak universality of the prior art, the present invention determines whether the test program has a side channel vulnerability based on the principle of determining whether the function code in the test program is similar to the samples in the side channel vulnerability library. When a new vulnerability is disclosed, the detection method only needs to regularize the newly disclosed vulnerability and add it to the regularized vulnerability library to detect variants 1 and 2 of the newly added vulnerability. For the detection of variant 3 of the newly disclosed vulnerability, the detection method only needs to reconstruct the data set according to the data type enhancement method proposed in this article and train a model that can detect variant 3 of the new vulnerability. In addition, the program vectorization of the present invention is based on LLVM IR, so this module is suitable for detecting side channel vulnerabilities in programs written in multiple programming languages ​​that can be compiled into LLVM IR.

[0072] (3) Regarding the detection problem of vulnerability variants, the DFA-Trie detection module designed by the present invention will not be affected by the vulnerability variants. The reason is that in the LSTM-NNC detection module, a procedure called data type expansion is used to construct a training data set to train a model that can detect vulnerability variant 3.

[0073] Second, considering the technical solution as a whole or from the perspective of the product, the technical effects and advantages of the technical solution to be protected by the present invention are described in detail as follows:

[0074] The input of the present invention is a software program code sample to be detected; three types of vulnerability variants are detected by using two detection modules executed in sequence: the DFA-Trie detection module detects vulnerability variants 1 and 2, and the LSTM-NNC detection module detects vulnerability variant 3; and the output is whether there are samples similar to the checked samples in the vulnerability library, where the similarity is vulnerability variants 1, 2 and 3. The present invention can efficiently detect known side channel vulnerabilities and their variants, and the present invention can be generally applied to detecting side channel vulnerabilities and their variants in programs written in multiple programming languages ​​that can be compiled into LLVM IR.

[0075] The present invention realizes efficient side-channel vulnerability detection of large-scale software, can adapt to the detection of scenarios where new vulnerabilities are frequently exposed in the real world, and can be generally applicable to detecting side-channel vulnerabilities in programs written in multiple programming languages ​​that can be compiled into LLVM IR, and can realize the detection of variants of side-channel vulnerabilities.

[0076] Third, as auxiliary evidence of the inventiveness of the claims of the present invention, it is also reflected in the following important aspects:

[0077] (1) The technical solution of the present invention fills the technical gap in the industry at home and abroad: In the research of side channel vulnerability detection, the variants of the source vulnerability program are often ignored. The present invention adopts a two-module detection method to detect three types of vulnerability variants, which fills the gap in the research of detecting side channel vulnerability variants at home and abroad.

[0078] (2) The technical solution of the present invention solves the technical problem that people have been eager to solve but have never been able to solve successfully: the LSTM-NNC detection module in the present invention expands the data set, so that the data type int is expanded to include multiple integer types such as unsigned int, long int and unsigned long long int; the data type string is expanded to include wstring_t string; the data type char is expanded to include wchar_t character; the data type float is expanded to include double and longdouble double-precision floating point numbers. By expanding the data type, a large number of variants of the source vulnerability code can be obtained, and using these variants as training sets overcomes the problem of lack of training data sets in real research. BRIEF DESCRIPTION OF THE DRAWINGS

[0079] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for use in the embodiments of the present invention. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0080] Figure 1 is a flow chart of a method for side channel vulnerability detection provided by an embodiment of the present invention;

[0081] Figure 2 is a system structure block diagram of side channel vulnerability detection provided by an embodiment of the present invention;

[0082] Figure 3 is a work flow diagram of a DFA-Trie detection module provided by an embodiment of the present invention;

[0083] Figure 4 is a workflow diagram of the LSTM-NNC detection module provided in an embodiment of the present invention;

[0084] In the figure: 1. Sample input module; 2. DFA-Trie detection module; 3. LSTM-NNC detection module; 4. Result output module. DETAILED DESCRIPTION

[0085] In order to make the purpose, technical solution and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention.

[0086] In view of the problems existing in the prior art, the present invention provides a method, system, medium, device and terminal for side channel vulnerability detection. The present invention is described in detail below with reference to the accompanying drawings.

[0087] 1. Explanatory Examples In order to enable those skilled in the art to fully understand how to implement the present invention, this section provides an illustrative example that expands and describes the technical solution of the claims.

[0088] Definition of terms:

[0089] The definition of vulnerability variants is shown in Table 1, which references the definition of code clones.

[0090] Table 1 Definition of three vulnerability variants

[0091]

[0092]

[0093] Abbreviations and definitions of terms are shown in Table 2.

[0094] Table 2 Abbreviations and definitions of terms

[0095]

[0096] Aiming at the problems of low detection efficiency of current detection technology; weak universality of existing technology in application; lack of detection of vulnerability variants, resulting in high false negative detection. The present invention proposes two detection modules based on similarity and machine learning to detect three types of vulnerability variants (vulnerability variants 1, 2 and 3), adding regularized new vulnerabilities to the vulnerability library to realize the detection of newly added vulnerability variants 1 and 2; constructing a program keyword dictionary tree and a regularized vulnerability library to reduce the computational complexity of regularized program code; for the detection module based on neural network, the detection efficiency is improved by optimizing the algorithm level; based on LLVM IR vectorized program code, the LSTM-NNC detection module can be generally used to detect side channel vulnerabilities in programs written in multiple programming languages ​​that can be compiled into LLVM IR; the data types in the data set are expanded, and the model trained based on the expanded data set can detect vulnerability variant 3.

[0097] like Figure 1 As shown, the method for side channel vulnerability detection provided by the embodiment of the present invention includes the following steps:

[0098] S101, inputting a software program code sample / test program to be tested;

[0099] S102, constructing a program keyword dictionary tree and a regularized vulnerability library, regularizing the test program, matching each function in the regularized test program with the function in the regularized vulnerability library, and detecting whether the test program has vulnerability variants 1 and 2;

[0100] S103, expanding the data set and training the LSTM-NNC based on the expanded data set, and using the trained NNC to detect whether the test program has vulnerability variant 3;

[0101] S104, output whether the program to be detected has vulnerability variants 1, 2 and 3.

[0102] like Figure 2 As shown, the system for side channel vulnerability detection provided by an embodiment of the present invention includes:

[0103] The sample input module 1 is used to input a software program code sample to be tested;

[0104] DFA-Trie detection module 2, used to detect vulnerability variants 1 and 2;

[0105] LSTM-NNC detection module 3, used to detect vulnerability variant 3;

[0106] The result output module 4 is used to output the result of whether the program to be detected has vulnerability variants 1, 2 and 3.

[0107] The side channel vulnerability detection method based on similarity calculation and machine learning provided by the embodiment of the present invention includes the following steps:

[0108] S1: Input the software program code sample to be tested and separate the large software into multiple functional function codes;

[0109] S2: Construct a keyword dictionary tree and a regularized vulnerability library, regularize the program to be detected, match each function in the regularized program to be detected with the function sample in the regularized vulnerability library, and detect whether the program to be detected has vulnerability variants 1 and 2;

[0110] S2: Expand the data set, convert the data set into a numerical vector representation, train the LSTM-NNC model, compile the program to be tested and convert it into a numerical vector representation, and use the trained LSTM-NNC model to detect whether the test program has vulnerability variant 3;

[0111] S4: Output the detection result, that is, whether vulnerability variants 1, 2, and 3 exist in the test program.

[0112] A side channel vulnerability detection method based on similarity calculation and machine learning provided by an embodiment of the present invention specifically includes the following steps:

[0113] Step 1: Input;

[0114] Input a code sample of the software program to be tested; if the input is a large software program, the large software will be automatically separated into multiple functional functions by running a script program.

[0115] Step 2: DFA-Trie detection module, such as Figure 3 As shown;

[0116] (1) Setup phase: constructing a program keyword dictionary tree and a regularized vulnerability library;

[0117] ① Construct a program keyword dictionary tree: The construction process is similar to the construction process of a standard string dictionary tree. Manually select program keywords in each vulnerable function and add them to the program keyword set to construct a program keyword dictionary tree (Trie);

[0118] ② Regularized vulnerability library: Select a set of vulnerability function codes, regularize all vulnerability function codes, add the regularized vulnerability functions into the regularized vulnerability library one by one, and construct a regularized vulnerability library;

[0119] The process of regularizing program code is completed by the following operations: identifying comments, text values, identifiers and separators in the program through deterministic finite automata (DFA), filtering out comments, string constants and character constants, and filtering out numbers; identifying and judging identifiers, if it is an identifier, further judging whether it is a program keyword based on the program keyword dictionary tree, if it is not a program keyword, it is used as a user-defined identifier, and the user-defined identifier is replaced with the regularized index corresponding to the user-defined identifier; converting blank characters (spaces, line breaks, tabs, etc.) in the program into a unified blank character;

[0120] (2) In the detection phase, the function code of the regularized test program is matched with the function samples in the regularized vulnerability library to detect vulnerability variants 1 and 2.

[0121] ① Regularization test program function code: Apply deterministic finite state automata to identify and extract comments, text values, identifiers and separators from the software code, filter comments, string constants and character constants, identify identifiers and filter out numbers (numbers include 0 to 9, and can also contain letters, such as hexadecimal numbers), use dictionary trees to separate user-defined identifiers from program keywords, use the regularization index corresponding to the user-defined identifier to replace the user-defined identifier, and convert the blank characters (spaces, newlines, tabs, etc.) in the program into a unified blank character to ensure that there are no consecutive blank characters in the regularization output;

[0122] ② Match the regularized test program with the regularized vulnerability library: Match each regularized test program function with all function samples in the regularized vulnerability library. If the match is successful, the test program has vulnerability variants 1 and 2; if all function samples in the vulnerability library do not match any function in the test program, then enter the next detection module. In this embodiment, the hash value of the test program function is matched with the hash value of the sample in the vulnerability library.

[0123] Step 3: LSTM-NNC detection module, such as Figure 4 As shown;

[0124] (1) In the learning phase, the data set is expanded and LLVM compilation is performed, LLVM IR and numerical vector representation conversion are processed, and the LSTM-NNC model is trained;

[0125] ①Data set expansion and LLVM compilation processing;

[0126] Data type expansion: the data type int is expanded to multiple integer types including unsigned int, long int and unsigned longlong int; the data type string is expanded to include wstring_t strings; the data type char is expanded to include wchar_t characters; the data type float is expanded to include double and long double double-precision floating point numbers;

[0127] LLVM compilation, for each code obtained after data type expansion, use different options to perform compilation and compile it into LLVM IR files. For example, use Clang++ (an LLVM C++ compiler) to compile a cpp source code. The compilation options are used to expand the cpp source code. Example options include optimization level, -ffast-math option, and -march=native option; if there are four optimization levels, a cpp source code can be compiled to get 4×2×2=16 LLVM IR files;

[0128] Stratified random sampling, according to the detection requirements, the entire data set is divided into n categories, that is, category 1, ... category n. The parameter n is consistent with the number of neurons in the output layer of the LSTM-NNC model used in the embodiment. In each category, the training set, validation set and test set are constructed in the same proportion;

[0129] ②Processing LLVM IR and numerical vector representation conversion;

[0130] LLVM IR file preprocessing, removes invalid information including blank lines, comments, metadata, module information, attribute information in LLVM IR files, retains function information and related data definitions; replaces identifiers in LLVM IR files with %ID, and replaces them with <int float string>Instead of the immediate value in the LLVM IR file; each structure type data is expanded in the LLVMIR instruction so that the definition of each structure type data is removed from the LLVM IR file to ensure that the structured data is inlined;

[0131] Convert LLVM IR to numerical vector representation. All LLVM IR instructions form a complete set, S = {s1, s2, s3, ...}. Use an NCC pre-trained model to map LLVM IR instructions to numerical vectors. The pre-trained element is a tuple (s, x) consisting of an LLVM IR instruction s and a numerical vector x. The model is formalized as x is a 200-dimensional vector, S′ is a subset of the complete set S of all LLVM IR instructions, and the dimension of the numeric vector is determined by the embedding size of the pre-trained model;

[0132] Each program can be formalized as an ordered n-tuple, Program i ={stat1,stat2,stat3,...,stat n }, where n∈Z * Program i The number of instructions contained in stat j Indicates that in the program i The jth LLVM IR instruction in . stat j =stat k Established;

[0133] For a program, we search for the corresponding LLVM IR instructions in the pre-trained model NCC and replace the LLVM IR instructions in the program with the corresponding 200-dimensional vector. If the LLVM IR instruction we are looking for is not in the pre-trained model, we use a specific 200-dimensional vector to replace it. After the replacement is completed, the program can be formalized as X i ={x1, x2, x3, ..., x n }, Where n still represents the program i The number of instructions in x j represents the vector corresponding to the jth LLVM IR instruction. Similarly,

[0134] ③Training LSTM neural network classifier;

[0135] For a training data set with m programs, a numerical vector representation is obtained through step ② in the learning phase. Let X = {X1, X2, X3, ..., X m } is the transformed vector representation corresponding to the training data set, m∈Z * X is the number of training samples contained in the training data set. i represents the i-th program in the training dataset X, which is the input of the LSTM-NNC model. i There are corresponding ground truth labels, Y i ={y j |y j =0or1,j=1,2,…,n,n≥2,n∈Z * }. If y j =1 means X i Belongs to the jth class. The LSTM-NNC model has four layers, namely the LSTM layer (including LSTM units), the BN layer, the dense layer, and the output layer.

[0136] Before the LSTM layer, the input to the model is: X i ∈R maxlen×200 ;

[0137] After the LSTM layer:

[0138] After the BN layer:

[0139] After the dense layer:

[0140] In the output layer: is the output of the LSTM neural network classifier model;

[0141] Select the cross entropy loss function as the loss function for training the LSTM neural network classifier model:

[0142]

[0143] Among them, maxlen represents the maximum length of the input program vector sequence s, which is determined by the specific input program; LSTM 1，2 Represents a two-layer LSTM unit, compressed matrix X i into a fixed-length vector H; BN represents batch normalization operation; ReLU and softmax are two activation functions; W D and W Y is a weighted matrix parameter; dense_size represents the number of units (neurons) in the dense layer and is a hyperparameter; n is the number of units in the output layer and is set according to the specific scenario; n=2 means that the LSTM-NNC model divides the input test program into vulnerability and non-vulnerability categories, and n>2 means that the LSTM-NNC model divides the input test program into corresponding vulnerability categories;

[0144] (2) In the detection phase, the program to be detected is compiled and processed by LLVM IR, and the trained LSTM-NNC is used to detect vulnerability variant 3;

[0145] ①LLVM IR compilation, file preprocessing and conversion of LLVM IR into numerical vector representation;

[0146] LLVM compilation, which performs compilation operations with different options on each function code of the program to be detected and compiles it into LLVM IR files;

[0147] LLVM IR file preprocessing, removes invalid information including blank lines, comments, metadata, module information, attribute information in LLVM IR files, retains function information and related data definitions; replaces identifiers in LLVM IR files with %ID, and replaces them with <int float string>Instead of the immediate value in the LLVM IR file; each structure type data is expanded in the LLVMIR instruction so that the definition of each structure type data is removed from the LLVM IR file to ensure that the structured data is inlined;

[0148] Convert LLVM IR to numerical vector representation. All LLVM IR instructions form a complete set, S = {s1, s2, s3, ...}. Use an NCC pre-trained model to map LLVM IR instructions to numerical vectors. The pre-trained element is a tuple (s, x) consisting of an LLVM IR instruction s and a numerical vector x. The model is formalized as x is a 200-dimensional vector, S′ is a subset of the complete set S of all LLVM IR instructions, and the dimension of the numeric vector is determined by the embedding size of the pre-trained model;

[0149] Each program can be formalized as an ordered n-tuple, Program i ={stat1,stat2,stat3,...,stat n }, where n∈Z * Program i The number of instructions contained in stat j Indicates that in the program i The jth LLVM IR instruction in . stat j =stat k Established;

[0150] For a program, we search for the corresponding LLVM IR instructions in the pre-trained model NCC and replace the LLVM IR instructions in the program with the corresponding 200-dimensional vector. If the LLVM IR instruction we are looking for is not in the pre-trained model, we use a specific 200-dimensional vector to replace it. After the replacement is completed, the program can be formalized as X i ={x1, x2, x3, ..., x n }, Where n still represents the program i The number of instructions in x j represents the vector corresponding to the jth LLVM IR instruction. Similarly,

[0151] ②Use the LSTM-NNC model trained in step ③ of the learning phase to predict the test results of the test program;

[0152] Use the output of step ③ in the learning phase (i.e., the neural network classifier with the LSTM learning model parameters added) and the output of step ① in the detection phase as the input X of the LSTM-NNC model prog , we can get the following result: whether a test program has vulnerability variant 3. Formally, X prog is the input, is the output. and n is the number of side channel vulnerability instance categories in the training dataset. Represents X prog Belongs to the jth category.

[0153] Step 4: Output the detection results and check whether the test program has vulnerability variants 1, 2, and 3.

[0154] 2. Application Examples: In order to prove the creativity and technical value of the technical solution of the present invention, this section provides application examples of the technical solution of the claims on specific products or related technologies.

[0155] The present invention selects 22 test channel vulnerability instances, and according to the definitions of vulnerability variants 1, 2 and 3, constructs 132 test programs based on the following five principles:

[0156] 1) Randomly insert any number of spaces, line breaks, and tabs at any position in the original vulnerability instance;

[0157] 2) Randomly insert line comments and block comments with different contents at any position of the original vulnerability instance;

[0158] 3) Randomly modify the text content in the original vulnerability instance. The modification method is to replace the numeric constants, character constants and string constants in the instance with other different text contents;

[0159] 4) Adjust the style of blank lines and code indentation between codes;

[0160] 5) Randomly replace the user-defined identifier with other different identifiers.

[0161] The present invention example performs detection based on 132 test programs obtained by the above operations.

[0162] 3. Evidence of the effects of the embodiments. The embodiments of the present invention have achieved some positive effects during the development or use process, and indeed have great advantages over the prior art. The following content is described in conjunction with the data, charts, etc. of the test process.

[0163] The present invention uses a laptop simulation detection program, and the laptop is configured with an Intel Core i7-10510U CPU, 8GB RAM, and an Intel Optane 477GB SSD.

[0164] For the DFA-Trie detection module, the test samples include 22 side channel vulnerability code samples, and 42 program keywords are extracted. 132 test data sets are constructed with these 22 vulnerability code samples, which include 88 vulnerability variants 1 and 44 vulnerability variants 2. The experimental simulation results of this detection module are as follows: the average time to detect each test program is 56 microseconds; the detection accuracy for variant 1 is 100%, and the detection accuracy for variant 2 is 88.6%.

[0165] For the LSTM-NNC detection module, the input is set to contain 200 neurons without parameters; two LSTM sublayers, each of which contains 200 LSTM neurons and 320800 parameters; the BN layer contains 200 BN neurons and 800 parameters; the dense layer contains 32 neurons and 6432 parameters; the output layer contains 3 neurons and 99 parameters. The ratio of training set, validation set and test set is 5:1:2. The simulation results of this module are as follows: the original training set is constructed with three types of side channel vulnerability samples, array, loopAndbranch and passwordEq. The number of samples of the three types of vulnerabilities is 16. After the data set expansion method proposed in this embodiment is used to expand the data set, 6144 test samples are obtained. This module can achieve an F1-score of 92.59% to 98.26% for the detection of vulnerability variant 3. The detection time for the above three types of vulnerability variants can reach 0.0225s, which is much less than the existing detection technology.

[0166] It should be noted that the embodiments of the present invention can be implemented by hardware, software, or a combination of software and hardware. The hardware part can be implemented using dedicated logic; the software part can be stored in a memory and executed by an appropriate instruction execution system, such as a microprocessor or dedicated design hardware. It can be understood by a person of ordinary skill in the art that the above-mentioned devices and methods can be implemented using computer executable instructions and / or contained in a processor control code, such as a carrier medium such as a disk, CD or DVD-ROM, a programmable memory such as a read-only memory (firmware), or a data carrier such as an optical or electronic signal carrier. Such code is provided on the carrier medium. The device and its modules of the present invention can be implemented by hardware circuits such as very large-scale integrated circuits or gate arrays, semiconductors such as logic chips, transistors, etc., or programmable hardware devices such as field programmable gate arrays, programmable logic devices, etc., can also be implemented by software executed by various types of processors, and can also be implemented by a combination of the above-mentioned hardware circuits and software, such as firmware.

[0167] The above description is only a specific implementation mode of the present invention, but the protection scope of the present invention is not limited thereto. Any modifications, equivalent substitutions and improvements made by any technician familiar with the technical field within the technical scope disclosed by the present invention and within the spirit and principle of the present invention should be covered by the protection scope of the present invention.< / int> < / int> < / int> < / int>

Claims

1. A method for detecting side channel vulnerabilities, It is characterized in that The method for side channel vulnerability detection comprises: inputting a software program code to be detected; sequentially executing two detection modules to detect three types of vulnerability variants: designing a detection module 1 based on a deterministic finite state automaton and a dictionary tree DFA-Trie to detect vulnerability variants 1 and 2, and designing a detection module 2 based on a long short-term memory neural network classifier LSTM-NNC to detect vulnerability variant 3; The method for side channel vulnerability detection comprises the following steps: Step 1: Sample input: input the software program code sample / test program to be tested; Step 2, DFA-Trie detection: construct a program keyword dictionary tree and a regularized vulnerability library, regularize the test program, match each function in the regularized test program with the function in the regularized vulnerability library, and detect whether the test program has vulnerability variants 1 and 2; Step 3, LSTM-NNC detection: expand the data set and train LSTM-NNC based on the expanded data set, and use the trained NNC to detect whether the test program has vulnerability variant 3; Step 4: Result output: output whether the program to be tested has vulnerability variants 1, 2, and 3; The DFA-Trie detection in step 2 includes: (1) Setup phase: construct the program keyword dictionary Trie and regularized vulnerability library; ① Manually select the program keywords of each vulnerable function and add them to the program keyword set to construct the program keyword dictionary tree; ② Select the vulnerable program code set and regularize the vulnerable program code samples to construct a regularized vulnerability library; (2) Detection phase: Regularize the test program and match the regularized test program with the regularized vulnerability library; ① Regularize the test program based on the deterministic finite state automaton DFA and the program keyword dictionary tree Trie; ② Match each function in the regularized test program with each sample in the regularized vulnerability library. If the match is successful, the test program contains vulnerability variant 1 or vulnerability variant 2 in the side channel vulnerability library. If each function in the regularized test program does not match all samples in the regularized vulnerability library, the original test program is sent to the LSTM-NNC detection module for detection in the next module. The regularization program code process is completed by the following operations: by determining the finite automaton DFA to identify the comments, text values, identifiers and separators in the program, filtering out the comments, string constants and character constants, and filtering out numbers; identifying and judging the identifier, if it is an identifier, further judging whether it is a program keyword according to the program keyword dictionary tree; if it is not a program keyword, taking the identifier as a user-defined identifier, and using the regularization index corresponding to the user-defined identifier to replace the user-defined identifier; converting the blank characters in the program into a unified blank character; wherein the blank characters include space, line break and tab; The regularization test program function code includes: applying a deterministic finite state automaton to identify and extract comments, text values, identifiers and separators from software codes, filtering comments, string constants and character constants, identifying identifiers and filtering out numbers, using a dictionary tree to separate user-defined identifiers from program keywords, replacing user-defined identifiers with regularization indexes corresponding to user-defined identifiers, and converting blank characters in the program into a unified blank character; The LSTM-NNC detection in step 3 includes: (1) Learning phase: data set expansion and LLVM compilation, processing LLVM IR and numerical vector representation conversion, and training the LSTM-NNC model; ①Data set expansion and LLVM compilation processing; Data type expansion, using data type expansion to make the data type representation range of a variable wider than the representation range of the corresponding variable in the original code; LLVM compilation is performed on the program code, which is to perform compilation operations with different options on each expanded code and compile it into an LLVM IR file; The stratified random sampling operation is to divide the entire data set into n categories, and construct the training set, validation set, and test set in the same proportion in each category: n is consistent with the number of output neurons in the LSTM-NNC model; ②Processing LLVM IR and numerical vector representation conversion; LLVM IR file preprocessing, that is, removing invalid information including blank lines, comments, metadata, module information, attribute information in LLVM IR files, retaining function information and related data definitions; replacing identifiers in LLVM IR files with %ID, using <int float string> Instead of the immediate value in the LLVM IR file; each structure type data is expanded in the LLVM IR instruction so that the definition of each structure type data is removed from the LLVM IR file to ensure that the structured data is inlined;< / int> Convert LLVM IR to a numerical vector representation. All LLVM IR instructions form a complete set, S = {s 1 ,s 2 ,s 3 ,…}, an NCC pre-trained model is used to map LLVM IR instructions to numerical vectors; the pre-trained element is a tuple (s,X) consisting of an LLVM IR instruction s and a numerical vector x. The model is formalized as x is a 200-dimensional vector, S′ is a subset of the complete set S of all LLVMIR instructions, and the dimension of the numeric vector is determined by the embedding size of the pre-trained model; Each program is formalized as an ordered n-tuple, Program i ={stat 1 ,stat 2 ,stat 3 ,…,stat n }, where n∈Z * Program i The number of instructions contained in stat j Indicates that in the program i The jth LLVMIR instruction in stat j =stat k Established; For a program, we search for the corresponding LLVM IR instructions in the pre-trained model NCC and use the corresponding 200-dimensional vector to replace the LLVM IR instructions in the program. If the LLVM IR instructions we are looking for are not in the pre-trained model, we use a specific 200-dimensional vector to replace them. After the replacement is completed, the program is formalized as Where n represents the program i The number of instructions in x j represents the vector corresponding to the jth LLVM IR instruction, x j =x k ; ③Training LSTM neural network classifier; For a training data set with m programs, a numerical vector representation is obtained through step ② in the learning phase; let X = {X 1 ,X 2 ,X 3 ,…,X m } is the transformed vector representation corresponding to the training data set, m∈Z * is the number of training samples contained in the training data set; X i represents the i-th program in the training dataset X, which is the input of the LSTM-NNC model; X i There are corresponding ground truth labels, Y i ={y j |y j =0or1,j=1,2,…,n,n≥2,n∈Z * }; If y j =1 means X i Belongs to the jth class; the LSTM-NNC model has four layers, namely, the LSTM layer, which contains LSTM units; the BN layer, the dense layer and the output layer; Before the LSTM layer, the input to the model is: X i ∈R maxlen×200 ; After the LSTM layer: After the BN layer: After the dense layer: In the output layer: is the LSTM neural network classifier model output; Select the cross entropy loss function as the loss function for training the LSTM neural network classifier model: Among them, maxlen represents the maximum length of the input program vector sequence s, which is determined by the specific input program; LSTM 1,2 Represents a two-layer LSTM unit, compressed matrix X i into a fixed-length vector H; BN represents batch normalization operation; ReLU and softmax are two activation functions; W D and W Y is a weighting matrix parameter; dense_size represents the number of units in the dense layer and is a hyperparameter; n is the number of units in the output layer and is set according to the specific scenario; n=2 means that the LSTM-NNC model divides the input test program into vulnerability classes and non-vulnerability classes, and n>2 means that the LSTM-NNC model divides the input test program into corresponding vulnerability classes; (2) Detection phase: test program compilation and LLVM IR processing, and use the trained LSTM-NNC to detect vulnerability variant 3; ①LLVM IR compilation, file preprocessing and conversion of LLVM IR into numerical vector representation; LLVM compilation, which performs compilation operations with different options on each function code of the program to be detected and compiles it into LLVM IR files; LLVM IR file preprocessing, that is, removing invalid information including blank lines, comments, metadata, module information, attribute information in LLVM IR files, retaining function information and related data definitions; replacing identifiers in LLVM IR files with %ID, using <int float string> Instead of the immediate value in the LLVM IR file; each structure type data is expanded in the LLVM IR instruction so that the definition of each structure type data is removed from the LLVM IR file to ensure that the structured data is inlined;< / int> Convert LLVM IR to a numerical vector representation. All LLVM IR instructions form a complete set, S = {s 1 ,s 2 ,s 3 ,…}, an NCC pre-trained model is used to map LLVM IR instructions to numerical vectors; the pre-trained element is a tuple (s,X) consisting of an LLVM IR instruction s and a numerical vector x. The model is formalized as x is a 200-dimensional vector, S′ is a subset of the complete set S of all LLVMIR instructions, and the dimension of the numeric vector is determined by the embedding size of the pre-trained model; Each program is formalized as an ordered n-tuple, Program i ={stat 1 ,stat 2 ,stat 3 ,…,stat n }, where n∈Z * Program i The number of instructions contained in stat j Indicates that in the program i The jth LLVMIR instruction in ; stat j =stat k Established; For a program, find the corresponding LLVM IR instructions in the pre-trained model and use the corresponding 200-dimensional vector to replace the LLVM IR instructions in the program; if the LLVM IR instructions being found are not in the pre-trained model, use a specific 200-dimensional vector to replace them; after the replacement is completed, the program is formalized as Where n represents the program i The number of instructions in x j represents the vector corresponding to the jth LLVM IR instruction, x j =x k ; ②Use the LSTM-NNC model trained in step ③ of the learning phase to predict the test results of the test program; Use the output of step ③ in the learning phase, add the neural network classifier with LSTM learning model parameters and the output of step ① in the detection phase as the input X of the LSTM-NNC model prog , and the following results are obtained: whether a test program has vulnerability variant 3; formally, X prog is the input, is the output; and n is the number of side channel vulnerability instance categories in the training dataset; Represents X prog Belongs to the jth category.

2. The method for side channel vulnerability detection as claimed in claim 1, It is characterized in that The method for side channel vulnerability detection inputs the software program code to be detected, and separates a large software program into multiple function program codes; designs a detection module 1 based on a deterministic finite state automaton and a dictionary tree DFA-Trie, constructs a program keyword dictionary tree and a regularized vulnerability library, regularizes a test program and matches it with the regularized vulnerability library, and detects whether vulnerability variants 1 and 2 exist in the test program; designs a detection module 2 based on a long short-term memory neural network classifier LSTM-NNC, expands a data set based on a data type expansion method, performs LLVM compilation processing on the program code in the data set into an LLVM IR file, performs numerical vector representation conversion processing on the LLVM IR file, trains the LSTM-NNC based on the expanded and LLVM IR processed data set, performs LLVM compilation and LLVM IR processing on the test program, and uses the trained LSTM-NNC to detect whether the processed test program has vulnerability variant 3; and outputs the detection results of vulnerability variants 1, 2 and 3.

3. The method for detecting a side channel vulnerability as claimed in claim 1, It is characterized in that The software program code sample to be inputted for detection in step 1 includes: Before sending all the software program samples to be detected to the detection module, the large software is preliminarily separated into a plurality of functional function code samples.

4. A system for side channel vulnerability detection using the side channel vulnerability detection method according to any one of claims 1 to 3, It is characterized in that The side channel vulnerability detection system includes: A sample input module, used to input function code samples; DFA-Trie detection module, used to construct program keyword dictionary tree and regularized vulnerability library, detect the function matching regularized vulnerability library in the regularized test program, and use similarity to detect whether the function code sample contains vulnerability variants 1 and 2; LSTM-NNC detection module, used to expand the data set and train the LSTM-NNC model based on the expanded data set, and use the trained classifier to detect whether the program code sample contains vulnerability variant 3; The result output module is used to output whether the test program code has vulnerability variants 1, 2 and 3.

5. A computer device, It is characterized in that The computer device includes a memory and a processor, the memory stores a computer program, and when the computer program is executed by the processor, the processor executes the method for side channel vulnerability detection according to any one of claims 1 to 3, including the following steps: Input the software program code to be detected; execute two detection modules sequentially to detect three types of vulnerability variants: design a detection module 1 based on deterministic finite state automaton and dictionary tree DFA-Trie to detect vulnerability variants 1 and 2, and design a detection module 2 based on long short-term memory neural network classifier LSTM-NNC to detect vulnerability variant 3.

6. A computer-readable storage medium storing a computer program, wherein when the computer program is executed by a processor, the processor executes the method for detecting a side channel vulnerability according to any one of claims 1 to 3, comprising the following steps: Input the software program code to be detected; execute two detection modules sequentially to detect three types of vulnerability variants: design a detection module 1 based on deterministic finite state automaton and dictionary tree DFA-Trie to detect vulnerability variants 1 and 2, and design a detection module 2 based on long short-term memory neural network classifier LSTM-NNC to detect vulnerability variant 3.

7. An information data processing terminal, It is characterized in that The information data processing terminal is used to implement the side channel vulnerability detection system as described in claim 4.

Images