Overflow vulnerability detection method, device, equipment and medium
By generating CFG graphs and calculating graph structure similarity, overflow vulnerabilities in power IoT terminals are detected, solving the problem of poor performance of existing detection methods and improving the security of power IoT devices.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- Filing Date
- 2022-07-13
- Publication Date
- 2026-03-17
AI Technical Summary
Existing general software vulnerability detection methods are ineffective at detecting buffer overflow vulnerabilities in power IoT terminals, resulting in insufficient security for power IoT devices.
By generating a CFG graph based on a graph node representation structure, assigning weights to vulnerability keywords, calculating the sum of K-hop range weights, filtering out subgraphs with high similarity, and using the Graph Kernel method to calculate similarity, the existence of overflow vulnerabilities can be determined.
It improves the code robustness and security of power IoT terminals, greatly enhancing the security of power IoT devices.
Smart Images
Figure CN115238276B_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of software vulnerability detection technology, and in particular to a method, apparatus, device, and medium for detecting overflow vulnerabilities. Background Technology
[0002] According to 2015 statistics, 90% of IoT devices have weak key vulnerabilities and buffer overflow vulnerabilities. Currently, most programs for power IoT terminal devices are written in C or C++. Since C and C++ lack a garbage collection mechanism like Java, the risk of buffer overflow vulnerabilities increases. Furthermore, because these languages use pointers, hackers can use these pointers to determine the location of critical code in memory. However, existing general software vulnerability detection methods are ineffective at detecting these types of overflow vulnerabilities in power IoT terminals. Therefore, a detection method specifically for source code overflow vulnerabilities in power IoT terminals is urgently needed. Summary of the Invention
[0003] To overcome the shortcomings of existing technologies, one of the objectives of this invention is to provide an overflow vulnerability detection method that accurately determines the vulnerability type by comparing the similarity between the dangerous code graph structure and the standard vulnerability type graph structure.
[0004] One of the objectives of this invention is achieved through the following technical solution:
[0005] A method for detecting overflow vulnerabilities includes the following steps:
[0006] Generate a CFG graph based on a graph node representation structure from the source code to be tested;
[0007] The weighted vulnerability keywords are matched with the nodes in the CFG chart that contain source code keywords, and the nodes are weighted according to the weight of the vulnerability keywords.
[0008] Based on the preset K value, calculate the sum of the K-hop range weights for each weighted processing node containing source code keyword nodes;
[0009] Filter out the N subgraphs with the largest sum of weights and a depth of K;
[0010] The similarity between the subgraph and the graph representation structure formed by the source code of each type of overflow vulnerability is compared. The vulnerability type of the nodes in the subgraph is the vulnerability type corresponding to the graph representation structure with a similarity greater than the threshold.
[0011] Furthermore, the CFG graph includes control flow information and data flow information from the source code.
[0012] Furthermore, the weighting of the vulnerability keywords includes the following steps:
[0013] The source code set of overflow type vulnerabilities is split into keywords, and n keywords related to each vulnerability type are selected based on relevance.
[0014] The keywords are assigned weights, with the keyword with the highest frequency assigned a value of 1, and other keywords are assigned values according to their proportion of the frequency of the keyword with the highest frequency.
[0015] Furthermore, the number of keywords n satisfies: 5 ≤ n ≤ 10.
[0016] Furthermore, the weight of the node is equal to the weight of the vulnerability keyword on the node.
[0017] Furthermore, the preset K value is set to 2-4, and the K-jump range weights are... The calculation formula satisfies: ,in, This represents the weight value of the root node. This represents the weight value of the node that is K distances from the vulnerability keyword node. This is the attenuation coefficient.
[0018] Furthermore, the similarity is calculated using the Graph Kernel method.
[0019] The second objective of this invention is to provide an overflow vulnerability detection device that determines the existence of an overflow vulnerability by comparing structural diagrams.
[0020] The second objective of this invention is achieved by the following technical solution:
[0021] An overflow vulnerability detection device, comprising:
[0022] The icon generation module is used to generate CFG charts based on graph node representation structures from the source code under test.
[0023] The calculation module is used to match the weighted vulnerability keywords with the nodes containing source code keywords in the CFG graph, perform weighting processing on the nodes according to the weight of the vulnerability keywords, and calculate the sum of the K-hop range weights of each weighted node containing the vulnerability keywords according to a preset K value; and filter out the N subgraphs with the largest weight sums and a depth of K.
[0024] The determination module is used to compare the similarity between the subgraph and the graph representation structure formed by the source code of each type of overflow vulnerability. The vulnerability type of the nodes in the subgraph is the vulnerability type corresponding to the graph representation structure with a similarity greater than the threshold.
[0025] Furthermore, the CFG graph includes control flow information and data flow information from the source code.
[0026] Furthermore, the weighting of the vulnerability keywords includes the following steps:
[0027] The source code set of overflow type vulnerabilities is split into keywords, and n keywords related to each vulnerability type are selected based on relevance.
[0028] The keywords are assigned weights, with the keyword with the highest frequency assigned a value of 1, and other keywords are assigned values according to their proportion of the frequency of the keyword with the highest frequency.
[0029] Furthermore, the number of keywords n satisfies: 5 ≤ n ≤ 10.
[0030] Furthermore, the weight of the node is equal to the weight of the vulnerability keyword on the node.
[0031] Furthermore, the preset K value is set to 2-4, and the K-jump range weights are... The calculation formula satisfies: ,in, This represents the weight value of the root node. This represents the weight value of the node that is K distances from the vulnerability keyword node. This is the attenuation coefficient.
[0032] Furthermore, the similarity is calculated using the Graph Kernel method.
[0033] A third objective of this invention is to provide an electronic device that performs one of the objectives of the invention, comprising a processor, a storage medium, and a computer program, wherein the computer program is stored in the storage medium and, when executed by the processor, implements the aforementioned overflow vulnerability detection method.
[0034] A fourth objective of this invention is to provide a computer-readable storage medium that stores one of the objectives of the invention, having stored thereon a computer program that, when executed by a processor, implements the aforementioned overflow vulnerability detection method.
[0035] Compared with the prior art, the beneficial effects of the present invention are as follows:
[0036] To address the security issues of power IoT terminal devices in the era of smart grids with massive, diverse, and heterogeneous power terminal devices, this invention proposes a method for detecting source code overflow vulnerabilities in power IoT terminals. The method determines the presence of such vulnerabilities by comparing the graph structure formed by dangerous code segments in the source code with the graph structure converted from a standard overflow vulnerability, overcoming the cumbersome drawbacks of traditional manual review. This graph structure similarity detection method ensures the robustness and reliability of the code at the source code level, significantly improving the security of power IoT terminals. Attached Figure Description
[0037] Figure 1 This is a flowchart of the overflow vulnerability detection method in Implementation Example 1;
[0038] Figure 2 This is a schematic diagram of the K-hop range of the vulnerability keyword node in Example 1;
[0039] Figure 3 This is a structural block diagram of overflow vulnerability detection in Example 2;
[0040] Figure 4 This is a structural block diagram of the electronic device in Embodiment 3. Detailed Implementation
[0041] The present invention will now be described in more detail with reference to the accompanying drawings. It should be noted that the following description of the present invention with reference to the accompanying drawings is merely illustrative and not restrictive. Various embodiments can be combined with each other to form other embodiments not shown in the following description.
[0042] Example 1
[0043] Example 1 provides a method for detecting overflow vulnerabilities, which aims to determine whether there are overflow vulnerabilities and their specific types in the source code by judging the similarity of graph structures.
[0044] Because the integration of power IoT terminal devices breaks down various security boundaries, the consequences of attackers gaining access to the network through these devices are unpredictable. For power IoT terminals, overflow vulnerabilities are the most critical; attackers can exploit these vulnerabilities to control the backend computer and issue dangerous commands.
[0045] Please refer to Figure 1 As shown, a method for detecting overflow vulnerabilities includes the following steps:
[0046] S1. Generate a CFG graph based on the graph node representation structure from the source code to be tested;
[0047] In S1, the source code under test refers to the source code of the power IoT terminal, and the CFG graph refers to the control flow graph. The CFG graph retains the control flow and data flow information of the source code to increase the accuracy of vulnerability analysis. Generating the CFG graph is a conventional technique, and this embodiment will not elaborate on the generation process.
[0048] S2. Match the weighted vulnerability keywords with the nodes in the CFG chart that contain source code keywords, and weight the nodes according to the weight of the vulnerability keywords.
[0049] In this embodiment, the weight assignment of the vulnerability keywords includes the following steps:
[0050] The source code set of overflow type vulnerabilities is split into keywords, and n keywords related to each vulnerability type are selected based on relevance.
[0051] The keywords are assigned weights, with the keyword with the highest frequency assigned a value of 1, and other keywords are assigned values according to their proportion of the frequency of the keyword with the highest frequency.
[0052] The aforementioned vulnerability keywords refer to the n keywords that are most closely related to a certain type of overflow vulnerability. In this embodiment, the number of keywords selected is 5-10.
[0053] Specifically, since vulnerability datasets categorize vulnerability texts, the formation of a particular type of vulnerability is inevitably caused by certain specific keywords. For example, `memcpy` is highly likely to lead to overflow vulnerabilities. The usual method is to segment the code text that constitutes the vulnerability dataset, including the following steps:
[0054] First, we need to use regular expressions to remove punctuation marks and some special characters, such as semicolons and curly braces.
[0055] Because the code involves case sensitivity, all letters need to be converted to lowercase.
[0056] In addition, word form restoration is also required. For example, the singular and plural forms of a noun should be considered as the same keyword, and the base form, -ing form, and present participle form of a verb should also be considered as the same keyword.
[0057] Finally, filter out words irrelevant to the vulnerability text (stop words). Stop words include common return types like void, frequently used prepositions and articles, and reserved keywords such as if else.
[0058] The remaining words are the keywords with the highest relevance to the vulnerabilities mentioned above, and the number of times each keyword appears is the word frequency mentioned above. Of course, since the number of selected keywords may exceed n, you can select n keywords based on word frequency from highest to lowest, or you can select the most relevant n keywords based on some existing vulnerability keyword reference data.
[0059] In this embodiment, the weight assignment above assigns a value of 1 to the keyword with the highest word frequency. For example, the keyword with the highest word frequency is assigned a value of 1, and the keyword with a word frequency of half that is assigned a value of 0.5.
[0060] In S2, the weight of the node is equal to the weight of the vulnerability keyword on the node.
[0061] S3. Based on the preset K value, calculate the sum of the K-hop range weights for each weighted processing node containing the vulnerability keyword;
[0062] The preset K value is 2-4. If the K value is too small, the vulnerability features cannot be reflected in the graph structure. If the K value is too large, the graph network will be too complex due to the excessive depth, making it difficult to calculate the similarity.
[0063] K-jump range weights starting from the root node of the vulnerability keyword The calculation formula satisfies: ,in, This represents the weight value of the root node. This represents the weight value of the node that is K distance from the vulnerability keyword node. Since the CFG graph of the code is a directed graph, j = 1 indicates that the node is K distance from this node, and j = 2 indicates that the node is K distance from this node. This is a decay factor, indicating that nodes farther from the root node contribute less to the creation of the vulnerability. The value is usually set to 2, but it can be dynamically adjusted based on experimental results. Since the vulnerability keywords in the vulnerability corpus are categorized according to different overflow types, keywords of the same type contribute more to that category of vulnerability. Keywords of different types contribute differently depending on the underlying principles of the vulnerability's formation. Specific weighted contribution coefficients are set between 0.5 and 1.
[0064] Please refer to Figure 2 The diagram showing the K-jump range illustrates the calculation process of the weights. Figure 2The left half of the diagram shows the 3-hop range formed with node 0 as the root node. The symbols u, t, r, v, and a in the nodes represent different types of vulnerability keywords. For root node 0, the sum of its 3-hop range weights is the sum of node 0's own weight and the weight contributions of nodes 1-10 to node 0. Nodes 1, 2, 3, 7, and 9 do not contain vulnerability keywords, so their contribution value is 0. Here, we use nodes 4, 5, 6, 8, and 10 as examples to illustrate the weight calculation formula. Assuming that vulnerability types u and v have similar formation mechanisms, their weight contribution coefficients can be set to 0.9. Since vulnerability types t, r, and a have significantly different formation mechanisms from vulnerability type u, their weight contribution coefficients can be set to 0.5. The calculation of the 3-hop range weights for root node 0 is as follows:
[0065]
[0066] Next, from the set of K-hop range weights calculated from all vulnerability keyword nodes, the top N subgraphs with a forward and backward depth of K based on specific keyword nodes are selected. In this embodiment, the value of N is preferably set to 5-10.
[0067] S4. Filter out the N subgraphs with the largest weight and depth of K;
[0068] In the above embodiment, N is 5-10, but it can be set according to actual needs.
[0069] S5. Compare the similarity between the subgraph and the graph representation structure formed by the source code of each type of overflow vulnerability. The vulnerability type of the node in the subgraph is the vulnerability type corresponding to the graph representation structure with a similarity greater than the threshold.
[0070] In this embodiment, the aforementioned similarity is calculated using the Graph Kernel proposed by Michalis et al. By calling their developed Python toolkit, the similarity between the selected subgraphs and the graph representation structure formed by the source code of a specific vulnerability type is calculated. The calculated similarity is compared with a threshold value. If the similarity between a K-hop node graph composed of a certain node and a vulnerability of a certain overflow type is greater than the threshold, then it is determined that the node location contains a vulnerability of that overflow type. The threshold is typically set to 0.85 and can be dynamically adjusted based on experimental results. For example... Figure 2 As shown, this code segment can be considered to contain an overflow vulnerability of type u.
[0071] In summary, by extracting a subgraph of depth K from the vulnerability keyword node and comparing its similarity to a CFG graph formed from the source code of typical vulnerability types, attacks can be mitigated. Authors of power IoT terminal source code can use the method described in this invention to determine whether their code contains overflow vulnerabilities. The presence of such overflow vulnerabilities is determined by the similarity between the graph structure formed by dangerous code segments in the source code and the graph structure converted from a standard overflow vulnerability. This overcomes the cumbersome drawbacks of traditional manual review. This novel vulnerability detection method using graph structure similarity ensures the robustness and credibility of the code at the source code level, significantly improving the security of power IoT terminals.
[0072] Example 2
[0073] Example 2 discloses an apparatus corresponding to the overflow vulnerability detection method of the above embodiments, which is a virtual device structure of the above embodiments. Please refer to... Figure 3 As shown, it includes:
[0074] The chart generation module 210 is used to generate a CFG chart based on the graph node representation structure according to the source code to be tested.
[0075] The calculation module 220 is used to match the weighted vulnerability keywords with the nodes containing source code keywords in the CFG graph, perform weighted processing on the nodes according to the weight of the vulnerability keywords, and calculate the sum of the K-hop range weights of each node containing the vulnerability keywords after weighted processing according to a preset K value; and filter out the N subgraphs with the largest weight sums and a depth of K.
[0076] The determination module 230 is used to compare the similarity between the subgraph and the graph representation structure formed by the source code of each type of overflow vulnerability. The vulnerability type of the nodes in the subgraph is the vulnerability type corresponding to the graph representation structure with a similarity greater than the threshold.
[0077] Preferably, the CFG graph includes control flow information and data flow information of the source code.
[0078] Preferably, the weight assignment of the vulnerability keywords includes the following steps:
[0079] The source code set of overflow type vulnerabilities is split into keywords, and n keywords related to each vulnerability type are selected based on relevance.
[0080] The keywords are assigned weights, with the keyword with the highest frequency assigned a value of 1, and other keywords are assigned values according to their proportion of the frequency of the keyword with the highest frequency.
[0081] Preferably, the number n of the keywords satisfies: 5 ≤ n ≤ 10.
[0082] Preferably, the weight of the node is equal to the weight of the vulnerability keyword on the node.
[0083] Preferably, the preset K value is set to 2-4, and the K jump range weights are... The calculation formula satisfies: ,in, This represents the weight value of the root node. This represents the weight value of the node that is K distances from the vulnerability keyword node. This is the attenuation coefficient.
[0084] Preferably, the similarity is calculated using the Graph Kernel method.
[0085] Example 3
[0086] Figure 4 This is a schematic diagram of the structure of an electronic device provided in Embodiment 3 of the present invention, as shown below. Figure 4 As shown, the electronic device includes a processor 310, a memory 320, an input device 330, and an output device 340; the number of processors 310 in the computer device can be one or more. Figure 4 Taking a processor 310 as an example; the processor 310, memory 320, input device 330, and output device 340 in the electronic device can be connected via a bus or other means. Figure 4 Taking the example of a connection between China and Israel via a bus.
[0087] The memory 320, as a computer-readable storage medium, can be used to store software programs, computer-executable programs, and modules, such as the program instructions / modules corresponding to the overflow vulnerability detection method in this embodiment of the invention (e.g., the graph generation module 210, calculation module 220, and judgment module 230 in the overflow vulnerability detection method apparatus). The processor 310 executes various functional applications and data processing of the electronic device by running the software programs, instructions, and modules stored in the memory 320, thereby implementing the overflow vulnerability detection method of Embodiment 1 above.
[0088] The memory 320 may primarily include a program storage area and a data storage area. The program storage area may store the operating system and at least one application program required for a given function; the data storage area may store data created based on terminal usage. Furthermore, the memory 320 may include high-speed random access memory and non-volatile memory, such as at least one disk storage device, flash memory device, or other non-volatile solid-state storage device. In some instances, the memory 320 may further include memory remotely located relative to the processor 310, which can be connected to the electronic device via a network. Examples of such networks include, but are not limited to, the Internet, intranets, local area networks, mobile communication networks, and combinations thereof.
[0089] The input device 330 can be used to receive input user identity information, source code to be tested, and source code sets of overflow type vulnerabilities, etc. The output device 340 may include a display device such as a screen.
[0090] Example 4
[0091] Embodiment 4 of the present invention also provides a storage medium containing computer-executable instructions, which can be used by a computer to execute an overflow vulnerability detection method, the method comprising:
[0092] Generate a CFG graph based on a graph node representation structure from the source code to be tested;
[0093] The weighted vulnerability keywords are matched with the nodes in the CFG chart that contain source code keywords, and the nodes are then weighted.
[0094] Based on the preset K value, calculate the sum of the K-hop range weights for each node containing source code keywords;
[0095] Filter out the N subgraphs with the largest sum of weights and a depth of K;
[0096] The similarity between the subgraph and the graph representation structure formed by the source code of each type of overflow vulnerability is compared. The vulnerability type of the nodes in the subgraph is the vulnerability type corresponding to the graph representation structure with a similarity greater than the threshold.
[0097] Of course, the computer-executable instructions provided in the embodiments of the present invention are not limited to the method operations described above, but can also perform related operations in the overflow vulnerability detection method provided in any embodiment of the present invention.
[0098] Based on the above description of the implementation methods, those skilled in the art can clearly understand that the present invention can be implemented using software and necessary general-purpose hardware, and of course, it can also be implemented using hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as a computer floppy disk, read-only memory (ROM), random access memory (RAM), flash memory, hard disk, or optical disk, etc., including several instructions to cause an electronic device (which may be a mobile phone, personal computer, server, or network device, etc.) to execute the methods described in the various embodiments of the present invention.
[0099] It is worth noting that in the embodiments of the overflow vulnerability detection method and device described above, the various units and modules included are only divided according to functional logic, but are not limited to the above division, as long as the corresponding functions can be achieved; in addition, the specific names of each functional unit are only for easy differentiation and are not used to limit the scope of protection of the present invention.
[0100] For those skilled in the art, various other corresponding changes and modifications can be made based on the technical solutions and concepts described above, and all such changes and modifications should fall within the protection scope of the claims of this invention.
Claims
1. An overflow vulnerability detection method, characterized by, The method comprises the following steps: generating a CFG graph based on a graph node representation structure according to the source code to be tested; matching the weighted vulnerability keywords with the nodes containing source code keywords in the CFG graph, and performing weighted processing on the nodes according to the weights of the vulnerability keywords; According to a preset K value, a K-hop range weight sum of each weighted processing node containing a vulnerability keyword is calculated; wherein the preset K value is set to 2-4, and the K-hop range weight sum W KRangeSum The calculation formula satisfies: Wherein, W Root represents a weight value of a root node, W ij represents a weight value of a node with a distance of K from the vulnerability keyword node, e -βK is an attenuation coefficient; screening N subgraphs with the maximum weight and K depth; comparing the similarity of the subgraph with the graph representation structures of source codes of each type of overflow vulnerability, and the vulnerability type existing in the nodes in the subgraph is the vulnerability type corresponding to the graph representation structure with a similarity greater than a threshold threshold.
2. The overflow vulnerability detection method of claim 1, wherein, The CFG graph comprises control flow information and data flow information of the source code.
3. The overflow vulnerability detection method of claim 1, wherein, The weight assignment of the vulnerability keywords comprises the following steps: keyword splitting is performed on the source code set of the overflow type vulnerability, and n keywords related to each vulnerability type are screened according to the relevance; weight assignment is performed on the keywords, the keyword with the maximum frequency is assigned a weight of 1, and other keywords are assigned weights according to the proportion of the frequency in the maximum keyword frequency.
4. The overflow vulnerability detection method of claim 3, wherein, The number n of the keywords satisfies 5≤n≤10.
5. The overflow vulnerability detection method of claim 1, wherein, The weight of the node is equal to the weight of the vulnerability keyword on the node.
6. The overflow vulnerability detection method of claim 1, wherein, The similarity is calculated by the Graph Kernel method.
7. An overflow vulnerability detection apparatus characterized by comprising: It comprises: a graph generation module for generating a CFG graph based on a graph node representation structure according to the source code to be tested; a calculation module for matching the weighted vulnerability keywords with the nodes containing source code keywords in the CFG graph, and performing weighted processing on the nodes according to the weights of the vulnerability keywords; According to the preset K value, a K-hop range weight sum of each weighted processing node containing the vulnerability keyword is calculated; N subgraphs with a depth of K and a maximum weight sum are screened out; wherein the preset K value is set to 2-4, and the K-hop range weight sum W KRangeSum The calculation formula satisfies: Wherein, W Root represents the weight value of the root node, W ij represents the weight value of the node with a distance of K from the vulnerability keyword node, e -βK is an attenuation coefficient; a determination module for comparing the similarity of the subgraph with the graph representation structures of source codes of each type of overflow vulnerability, and the vulnerability type existing in the nodes in the subgraph is the vulnerability type corresponding to the graph representation structure with a similarity greater than a threshold threshold.
8. An electronic device comprising a processor, a storage medium, and a computer program stored in the storage medium, characterized in that, The computer program is executed by the processor to realize the overflow vulnerability detection method of any one of claims 1 to 6.
9. A computer-readable storage medium having stored thereon a computer program, characterized in that, The computer program is executed by the processor to realize the overflow vulnerability detection method of any one of claims 1 to 6.