A Java Deserialization Vulnerability Detection Method and System

Abstract

The present invention discloses a Java deserialization vulnerability detection method and system, which relates to the field of computer network security. Combining code property graph technology, static analysis technology, and dynamic instrumentation technology, the system performs static analysis at the source code level to extract program semantic information. By designing three subgraphs of different dimensions, the Java project source code is converted into a linear intermediate representation, and a code property graph is jointly constructed. On this basis, taint analysis is performed to automatically mine Java deserialization vulnerability exploit chains. Furthermore, the system combines Java dynamic instrumentation technology to implant detection probes for secondary detection in the dynamic dimension, supplemented by dynamic instrumentation technology for real-time monitoring. The present invention solves the problems of the existing technology's inability to detect potential Java deserialization vulnerabilities in Java Web application components and its low detection efficiency.

Description

Technical Field

[0001] The present invention relates to the field of computer network security, and in particular to a Java deserialization vulnerability detection method and system based on function call chains. Background Art

[0002] With the development of the internet, Java web applications have become increasingly important, becoming a key driver of online businesses in numerous sectors, including finance, healthcare, and education. However, as application functional interfaces become increasingly complex, many enterprises have reduced their security maintenance coverage for Java web applications, leading to an increasing number of potential security vulnerabilities in application components. In recent years, serious Java deserialization vulnerabilities have been exposed in an increasing number of Java web application components. This vulnerability has become a hot topic in security research, with each outbreak impacting critical businesses across numerous industries.

[0003] The key cause of Java deserialization vulnerabilities is the potential existence of a sensitive function call chain within an application. When exploiting this vulnerability, an attacker injects an attack payload. This payload is received by the application's business interface and automatically deserialized. This payload then flows through the sensitive function call chain, participating in each function call layer until it reaches the sensitive function, achieving the desired attack. Attackers can exploit this vulnerability to construct specialized attack payloads, achieving remote code execution and other attacks.

[0004] These vulnerabilities are difficult to effectively detect through manual auditing. Security testers need to conduct a detailed and thorough audit of the application component's source code to identify these vulnerabilities. However, due to the polymorphic nature of the Java language, the source code contains highly complex program semantics, making it difficult for security testers to quickly grasp the call relationships of numerous functions. This makes it difficult to ensure the completeness of code audits, resulting in low efficiency and poor results. Furthermore, existing detection methods and tools for this type of vulnerability are limited, making them ineffective in achieving meaningful results in actual detection scenarios and limiting their practicality.

[0005] Patent CN104778413A discloses a software vulnerability detection method based on simulated attacks. This patent uses a static disassembly tool to obtain function information related to sensitive operations and utilizes a dynamic instrumentation platform to implement monitoring, simulated attacks, and attack impact analysis. Although this patent involves both static and dynamic analysis, its method is used to reinforce and protect ELF files. The input is an ELF file, and a symbolic link attack is used to simulate an attack on the program. The corresponding vulnerability type is a file access vulnerability, and it cannot be used for code security detection of Jar package files.

[0006] Patent CN104794401A discloses a static analysis-assisted symbolic execution vulnerability detection method. This method constrains the symbolic execution process to vulnerability-related paths through a scoring mechanism, enabling more vulnerabilities to be detected within limited time and resources. This patented method takes a symbolic representation of a program as input and simulates attacks through symbolic execution at the intermediate representation level of the LLVM framework using the KLEE tool. However, this method is not suitable for Java deserialization vulnerability detection.

[0007] Patent CN109829312A discloses a Java vulnerability detection method and system based on call chains. This method processes JAR packages to generate a function call relationship graph. A collection and generation rule library configures the sink methods of various software sensitive call points in the corresponding vulnerability audit module. A depth-first search algorithm is used to create call chains, which are then displayed to auditors for screening, facilitating their analysis and vulnerability reproduction. This patented method only mines sensitive function call chains at the control flow graph level, resulting in significant time and space overhead. Furthermore, it uses only static analysis techniques to print the mined sensitive function call chains and submit them to security personnel for audit, resulting in high manual audit costs.

[0008] Patent CN109992970A discloses a JAVA deserialization vulnerability detection system and method, which generates deserialization vulnerability reports through three different methods: black box, white box, and gray box. However, its disadvantage is that it only scans the configuration file of the project to be detected and selects the attack payload from a pre-prepared gadget pattern database to launch an attack. Once the attack is successful, it indicates that the project to be detected has a Java deserialization vulnerability. This method relies heavily on the timeliness of the gadget pattern database and requires high manual maintenance costs.

[0009] Patent CN111859388A discloses a multi-layered hybrid automatic vulnerability discovery method. This method uses static analysis techniques to analyze pointer allocation and assignment within a program, recording the memory addresses pointed to by all pointers. Alias analysis techniques are used to obtain the destination operands of CMP instructions and identify the jump addresses of the target program. S2: Static instrumentation of intermediate code is used to insert monitoring code into key locations within the target program. This patented method analyzes binary executable files and uses static instrumentation of intermediate code to insert detection code into key locations within the target program. It is not suitable for Java deserialization vulnerability detection.

[0010] Patent CN113010899A discloses a method for detecting PHP deserialization vulnerability exploit chains. This method uses predefined rules to obtain source code information from the PHP file to be tested. Deserialization vulnerability exploit chain detection is performed based on these rules, improving the accuracy of PHP deserialization vulnerability exploit chain detection and reducing the labor required for manual audits. This patented method analyzes PHP files and recursively detects exploit chains for magic methods and custom functions within classes at the source code level. This method detects deserialization exploit chains in the PHP language solely through static analysis, without employing dynamic analysis techniques. It is also not applicable to Java deserialization vulnerability detection.

[0011] Patent CN113139184A discloses a static analysis-based method for detecting Binder communication overload vulnerabilities. This method uses static program analysis to determine the transmission object by establishing data inclusion relationships across the entire application, achieving the technical effect of detecting Binder communication overload vulnerabilities. This patented method analyzes the Android framework Binder and detects Binder communication overload vulnerabilities in Android applications by hooking open interfaces provided by some Android frameworks. This method cannot be used to detect Java deserialization vulnerabilities.

[0012] CN113360915A discloses a smart contract multi-vulnerability detection method and system based on source code graph representation learning. This method, combined with the smart contract's abstract syntax tree and semantic information, uses a function-granularity code attribute graph to characterize the smart contract source code. Slicing criteria are defined based on the grammatical features of different types of smart contract vulnerabilities. Program slicing technology is used to reduce noise in the smart contract graph representation, and a gated graph neural network is used for feature extraction. Vulnerability prediction is performed based on the extracted features. This patented method analyzes the smart contract source code and constructs a function-granularity code attribute graph on the abstract syntax tree. However, due to different attribute graph construction methods, it cannot be used for Java deserialization vulnerability detection.

[0013] From the above, we can see that there is currently no efficient and usable Java deserialization vulnerability detection method, and this problem needs to be solved urgently. Summary of the Invention

[0014] To address the above problems, the present invention proposes a Java deserialization vulnerability detection method and system based on function call chain to solve the problems that the existing technology cannot detect potential Java deserialization vulnerabilities in Java Web application components and has low detection efficiency.

[0015] In order to achieve the above object, the specific technical solution adopted by the present invention is:

[0016] A Java deserialization vulnerability detection method includes the following steps:

[0017] 1) Obtain the Java Web component source code to be analyzed, extract the program semantic information in the source code, obtain semantic nodes and relationship edges, and construct a code attribute graph;

[0018] 2) Build a rule base and use taint analysis technology based on static analysis on the code attribute graph to mine sensitive function call chains in the source code and save them;

[0019] 3) Write a Java dynamic proxy plug-in and use Java dynamic instrumentation technology to implant detection probes at sensitive function points in the sensitive function call chain to capture the call chain in actual business scenarios;

[0020] 4) Through dynamic detection of Java deserialization vulnerabilities, the attack payload constructed by the attacker is detected in real time. The function call chain captured in step 3) is compared with the sensitive function call chain mined in step 2). Once a hit is found, it proves that the Java deserialization vulnerability exists in the component currently being analyzed, and the attack is intercepted and alerted in a timely manner.

[0021] Furthermore, the method for extracting program semantic information is to convert the source code into an intermediate representation of Jimple language through the Soot framework, and extract semantic nodes and relationship edges in the intermediate representation.

[0022] Furthermore, the semantic nodes include two types, namely class nodes and method nodes;

[0023] There are five types of relationship edges:

[0024] Possess relationship edge: represents the fields and function nodes owned by the class node itself, emphasizing the ownership relationship;

[0025] Implements relationship edge: represents the implementation relationship between the class and the interface in the source code;

[0026] Extends relationship edge: represents the inheritance relationship between the subclass and the parent class in the source code;

[0027] Alias relationship edge: represents the alias relationship between functions in the source code (the polymorphic nature of the Java language can lead to alias relationships between functions);

[0028] Call relationship edge: represents the calling relationship between functions in the source code.

[0029] Furthermore, the code attribute graph includes the following three subgraphs of different dimensions:

[0030] Semantic node graph: summarizes the semantic information of all semantic nodes in the Java language and the semantic information between nodes;

[0031] Alias function graph: Based on the semantic node graph, it focuses on analyzing polymorphic behaviors within the program and capturing the alias relationships between function nodes;

[0032] Function call graph: generated when extracting program semantic information, representing the calling relationship between functions.

[0033] Furthermore, the rule base includes three components: the entry function library Source, the sensitive function library Sink, and the experience function library Known. The three components are all derived from the vulnerability information that has been disclosed in the current Java security field;

[0034] The entry function library Source is the primary component of the rule library. For conventional Java Web applications, the entry function is often the interface for receiving data passed by users. Common examples include the function point (entry function) for processing GET request parameters, the function point for receiving POST data, and the function point for verifying the content of HTTP data packet cookie parameters.

[0035] The sensitive function library Sink is a key component of the rule library. It classifies sensitive functions based on common Java language vulnerabilities into five categories: code injection, command execution, file operation, protocol injection, and remote connection.

[0036] The empirical function library Known is a special component of the rule library, all of which are designed to improve the analysis efficiency of subsequent static analysis. It consists of a class of tool functions that often appear in programs. These functions usually come from native Java functions and often participate in data flow transmission. They have fixed behavior patterns. For example, the getHeader method of the HttpServletRequest class fixedly returns the Header field information of the Http data packet. By storing the behavior patterns of such functions in advance, the efficiency of subsequent analysis can be significantly improved.

[0037] Furthermore, taint analysis is a program security analysis technique within the field of data flow analysis, used to capture the propagation path of tainted data within program statements. The core form of taint analysis can be represented as an abstract triple consisting of Source, Sink, and Sanitizer. Source represents the taint introduction source, indicating the direct introduction of user-controllable, untrusted data into the program. Such introduced data is considered tainted data. Sink represents the taint sink, representing a class of sensitive functions. Once tainted data flows through this point, it means there is a high possibility of security risks. Sanitizer represents data decontamination processing, which means eliminating the propagation of tainted data through cutting, transferring, and other means. In the Java deserialization vulnerability model, the attack payload uploaded by the attacker can be considered tainted data. Taint analysis technology can accurately and completely capture the flow of tainted data within the program.

[0038] Since the Source function varies greatly among various components, the time and space overhead of mining the sensitive function call chain from the Source function to the Sink function is large and the efficiency is low. Therefore, the present invention chooses to mine the sensitive function call chain by searching from the Sink function to the Source function. Specifically, each Sink function in the rule base has function summary information, which indicates the exploitable conditions of the current sensitive function. Through heuristic search, it iterates layer by layer to find the upper-level function that meets the exploitable conditions, and updates the exploitable conditions at the same time until the Source function is searched, which proves that a sensitive function call chain has been mined.

[0039] Furthermore, the Java dynamic proxy plug-in uses Java dynamic instrumentation technology to perform bytecode-level detection; the Java dynamic proxy plug-in is written in combination with the JVMTI interface, and runs on a specific JVM by obtaining the process ID of the target application; it can capture key data in the target virtual machine and store it in multiple ways.

[0040] Furthermore, the detection probe is implanted using a Java dynamic proxy plugin, which is then injected into a specific JVM. This is then injected into the specific program via a callback mechanism within the JVMTI interface. This entire implantation process occurs only at the JVM level and does not intrude into the application source code.

[0041] Furthermore, the attack payload constructed by the attacker is detected in real time, which means that after the application to be detected is running, the Java dynamic proxy plug-in captures the process ID of the application to be analyzed and injects itself into the target JVM; thereafter, once an attacker attacks the application with a Java deserialization vulnerability, the function call chain generated by the injected attack payload inside the application will be automatically captured by the Java dynamic proxy plug-in; by matching the function call chain captured in the dynamic stage with the results obtained by static analysis, once the result set obtained by static analysis contains the function call chain captured in the dynamic stage, it means that the current application has a Java deserialization vulnerability and the sensitive function call chain is being used by the attacker, and the corresponding attack behavior is intercepted and alerted.

[0042] A Java deserialization vulnerability detection system, comprising:

[0043] The code property graph generation module uses the Soot framework to convert the source code of the application to be analyzed into an intermediate representation of the Jimple language, extracts the program semantic information, and constructs a code property graph;

[0044] The automated mining module for sensitive function call chains summarizes existing knowledge in the Java security field to build a rule base. Based on this, it uses static taint analysis technology to perform backward taint analysis at the intermediate representation level to search for sensitive function call chains that may pose security risks.

[0045] The detection probe implantation module uses the JVMTI interface to write a Java dynamic proxy plug-in, injecting a detection probe with information collection capabilities into the target JVM to capture function call chains in the dynamic dimension.

[0046] The pattern matching module detects potential Java deserialization vulnerabilities in applications by comparing the sensitive function call chains captured in the dynamic dimension with the static analysis results.

[0047] The beneficial effects of the present invention are as follows:

[0048] Since the present invention proposes a detection method that combines both static and dynamic dimensions, it fully considers the characteristics of the Java language itself and the characteristics of Java deserialization vulnerabilities, adds a feature comparison for Java deserialization vulnerability models, and compensates for the defect that existing detection methods cannot effectively and efficiently detect this type of vulnerability. Nowadays, Java Web application technology is developing rapidly, and more and more applications and their components are facing security risks. The present invention combines code property graph technology, static analysis technology, and dynamic instrumentation technology. First, static analysis is performed at the source code level to extract program semantic information. Then, by designing three subgraphs of different dimensions (semantic node graph, alias function graph, and function call graph), the Java project source code is converted into a linear intermediate representation, and a code property graph is jointly constructed. These three subgraphs can efficiently and intuitively reflect the flow path of data between source code statements. On this basis, taint analysis is performed to automatically mine Java deserialization vulnerability exploit chains. Finally, Java dynamic instrumentation technology is combined with the method of implanting detection probes to perform secondary detection in the dynamic dimension, supplemented by dynamic instrumentation technology for real-time monitoring, reducing labor costs and time costs. BRIEF DESCRIPTION OF THE DRAWINGS

[0049] Figure 1 It is a flow chart of the overall structure of the solution of the present invention.

[0050] Figure 2 It is a flowchart for constructing the alias function graph.

[0051] Figure 3 This is the core flow chart of stain analysis.

[0052] Figure 4 It is the core flow chart of dynamic detection.

[0053] Figure 5 This is an example diagram of a Java deserialization vulnerability. DETAILED DESCRIPTION

[0054] In order to enable those skilled in the art to better understand the technical solutions in the embodiments of the present invention and to make the objects, features and advantages of the present invention more obvious and easy to understand, the technical core of the present invention is further described in detail below with reference to the accompanying drawings and examples.

[0055] This embodiment provides a Java deserialization vulnerability detection method, such as Figure 1 As shown, the specific steps include:

[0056] Step 100: Obtain the source code of the Java Web application to be tested, configure the Soot framework, and generate the intermediate expression code in the Jimple language.

[0057] Step 200: Extract program semantic information from the Java web application source code to be inspected, and summarize it into two types of semantic nodes and five types of edges: class nodes and method nodes. The five types of edges include Possess, Implements, Extends, Alias, and Call edges. Based on this information, construct three different code attribute graphs: a semantic node graph, an alias function graph, and a function call graph.

[0058] Step 300: Import the rule library related to Java code security detection. In the method node combination, mark the function corresponding to the source library as the entry function, mark the function corresponding to the sensitive function library Sink as the sensitive function, and mark the function corresponding to the experience function library Known as the harmless function.

[0059] Step 400: Using backward taint analysis starting from the sink function and ending at the source function, automatically deduce inter-procedural function calls that conform to the taint propagation rules. Using a heuristic search, the search iterates through adjacent layers until the source function is reached. The captured sensitive function call chains are stored.

[0060] Step 500: Write a Java dynamic proxy plug-in in conjunction with the JVMTI interface, and implant the detection probe into the JVM where the application is running to implement dynamic detection at the bytecode level.

[0061] Step 600: When an attacker attacks the application for a Java deserialization vulnerability, the detection probe collects the function call chain in the dynamic dimension and performs pattern matching with the static analysis result set. If a match is found, it indicates that the current application has a Java deserialization vulnerability.

[0062] Figure 2 The following is a flowchart of the construction of the alias function graph, which is described in detail as follows:

[0063] Step 210: In the Java language, each function has all classes. In the present invention, the mapping form is that each method node has a corresponding class node, which is represented by a Possess relationship edge. Based on the function node obtained by traversal, its corresponding class node is obtained in the code semantic graph.

[0064] Step 220: If the current class object inherits the parent class or implements the interface, it is necessary to obtain in the semantic node whether there is a function of the same mode in its corresponding class node.

[0065] Step 230: If a function with the same method signature exists in the parent class or interface, then the function being analyzed has an alias function, which will be used to construct the alias function graph. If no alias function is found, the search continues to determine if there is inherited behavior in the parent class, and the search for alias functions continues.

[0066] Step 240: For two function nodes that are in an alias relationship with each other, an Alias relationship edge is constructed between the two, which will be used as part of the alias function graph.

[0067] Figure 3 The following is the core flow chart of the stain analysis:

[0068] Step 310: traverse the sensitive function library Sink set, obtain the function summary information of the current Sink function, and obtain the function set that calls the current Sink function.

[0069] Step 320: For the function that meets the effective taint propagation rule in the result obtained in step 310, it is necessary to deduce the effective taint propagation rule of the current function so as to continue searching the Source function with it as the starting point next time.

[0070] Step 330: If the current function has been called, it indicates that further analysis is required and the next round of search is performed. If the current function has not been called, it is determined whether the Source function has been reached.

[0071] Step 340: Store the mined sensitive function call chain for subsequent call pattern matching.

[0072] Figure 4 The following is the core flow chart of dynamic detection. The specific process is as follows:

[0073] Step 410: Write a Java dynamic proxy plug-in in combination with the JVMTI interface for subsequent implantation of detection probes.

[0074] Step 420: implant the detection probe into the JVM of the target application, perform bytecode conversion on it, and add information collection function to it.

[0075] Step 430: Compare the function call chains captured during the dynamic phase with the results from the static analysis phase. Compare each feature in turn. A matching function call chain indicates a potential Java deserialization vulnerability in the program under test.

[0076] Step 440: If the match is successful, it indicates that the data packet received by the application is a malicious attack payload, the attack is intercepted and an alarm is issued, and the detection result is output.

[0077] Figure 5The figure shows an example of a Java deserialization vulnerability. The Source function is the taint introduction point, which is the readObject function in this example; the Sink function is the taint sink point, which is the invoke function in this example. This figure clearly shows the propagation path of tainted data during the function call process.

[0078] Finally, it should be noted that the above implementation cases are only used to illustrate the technical solution of the present invention and are not limiting. Although the present invention is described in detail using examples, ordinary technicians in this field should understand that the technical solution of the present invention can be modified or replaced by equivalents without departing from the spirit and scope of the technical solution of the present invention, which should be included in the scope of the claims of the present invention.

Claims

1. A Java deserialization vulnerability detection method, characterized in that: The following steps are involved: 1) Obtain the Java Web component source code to be analyzed, extract program semantic information from the source code, obtain semantic nodes and relationship edges, and construct a code property graph. The method for extracting program semantic information is to convert the source code into an intermediate representation of the Jimple language using the Soot framework, and extract semantic nodes and relationship edges using this intermediate representation. The code property graph includes three sub-graphs: a semantic node graph, an alias function graph, and a function call graph. The semantic node graph summarizes the semantic information of all semantic nodes in the Java language and the semantic information between nodes. The alias function graph analyzes polymorphic behavior within the program based on the semantic node graph and captures the alias relationships between function nodes. The function call graph is generated during program semantic information extraction and represents the calling relationships between functions. 2) Build a rule library and use taint analysis technology based on static analysis on the code property graph to mine sensitive function call chains in the source code and save them; 3) Write a Java dynamic proxy plug-in and use Java dynamic instrumentation technology to implant detection probes at sensitive function points in the sensitive function call chain to capture the call chain in actual business scenarios; 4) Through dynamic detection of Java deserialization vulnerabilities, the attack payload constructed by the attacker is detected in real time. The function call chain captured in step 3) is compared with the sensitive function call chain mined in step 2). If a hit is found, it proves that the Java deserialization vulnerability exists in the component currently being analyzed, and the attack is intercepted and an alert is issued in a timely manner.

2. The method according to claim 1, wherein The semantic nodes include class nodes and method nodes; the relationship edges include Possess relationship edges, Implements relationship edges, Extends relationship edges, Alias relationship edges and Call relationship edges; among them, the Possess relationship edges represent the fields and function nodes owned by the class node itself, emphasizing the ownership relationship; the Implements relationship edges represent the implementation relationship between the class and the interface in the source code; the Extends relationship edges represent the inheritance relationship between the subclass and the parent class in the source code; the Alias relationship edges represent the alias relationship between functions in the source code; and the Call relationship edges represent the calling relationship between functions in the source code.

3. The method according to claim 1, wherein The rule base includes an entry function library Source, a sensitive function library Sink and an experience function library Known.

4. The method according to claim 3, wherein The taint analysis technology is used to capture the propagation path of tainted data in program statements, which is expressed as a triple consisting of Source1, Sink1 and Sanitizer; Source1 represents the taint introduction source, which means that user-controllable, untrusted data is directly introduced into the program. Such introduced data is considered tainted data; Sink1 represents the taint sink, which represents a type of sensitive function; Sanitizer represents data decontamination processing; it mines sensitive function call chains by searching from the functions in the sensitive function library Sink to the functions in the entry function library Source.

5. The method according to claim 1, wherein The Java dynamic proxy plug-in uses Java dynamic instrumentation technology to perform bytecode-level detection; the Java dynamic proxy plug-in is written in combination with the JVMTI interface, and by obtaining the process id of the target application, it runs on the target JVM and captures key data in the target virtual machine.

6. The method according to claim 5, wherein The method for implanting the detection probe is as follows: writing the detection probe through a bytecode manipulation tool, injecting the detection probe into the target JVM through a Java dynamic proxy plug-in, and then injecting it into the target program through the callback mechanism in the JVMTI interface.

7. The method according to claim 6, wherein The real-time detection of the attack payload constructed by the attacker means that after the application to be analyzed is running, the Java dynamic proxy plug-in captures the process ID of the application to be analyzed and injects itself into the target JVM; If an attacker attacks the application with a Java deserialization vulnerability, the function call chain generated by the injected attack payload within the application will be automatically captured by the Java dynamic proxy plug-in. By matching the function call chain captured in the dynamic phase with the results obtained by static analysis, if the result set obtained by static analysis contains the function call chain captured in the dynamic phase, it means that the current application has a Java deserialization vulnerability and the sensitive function call chain is being used by the attacker, the attack behavior will be intercepted and an alert will be issued.

8. A Java deserialization vulnerability detection system, used to implement the method according to any one of claims 1 to 7, characterized in that: include: The code property graph generation module is used to convert the source code of the application to be analyzed into an intermediate representation of the Jimple language based on the Soot framework, extract the program semantic information therein, and construct a code property graph; An automated mining module for sensitive function call chains, which aggregates existing knowledge in the Java security field to build a rule base. Based on this rule base, it uses static taint analysis technology to perform backward taint analysis at the intermediate representation level to search for sensitive function call chains that pose security risks. The detection probe implantation module is used to write a Java dynamic proxy plug-in in conjunction with the JVMTI interface, inject a detection probe with information collection function into the target JVM, and capture the function call chain in the dynamic dimension; The pattern matching module is used to detect potential Java deserialization vulnerabilities in applications by comparing the sensitive function call chains captured by dynamic dimensions with the sensitive function call chains searched by static taint analysis technology.

Images