Application vulnerability detection method and system based on data flow tracking

Abstract

The application discloses a kind of application program vulnerability detection method and system based on data stream tracking, the detection method includes: using IAST to insert the application program to be measured with the tool and inserts the vulnerability detection logic into application program;Obtain the position information of JSON analysis function return object in current application program;Extract and store the mapping relationship of field name, field type, field value in JSON object returned by JSON analysis function analysis tainted data, to obtain the original data set of instantiation;Extract the default data in the entity class mapped by JSON object to obtain the reference data set;Remove the same data in the original data set and the reference data set to obtain the target data set for detection logic tracking;Through the above technical solutions, the default data generated automatically in JSON object can be excluded, so that the detection logic based on data stream tracking only tracks according to the tainted data input by the user, thereby avoiding false positives and improving the accuracy of vulnerability detection.

Description

Technical Field

[0001] This invention relates to the field of application detection technology, and in particular to an application vulnerability detection method and system based on data flow tracing. Background Technology

[0002] As applications grow larger, more complex, and more numerous, the number of vulnerabilities also increases, leading to more severe damage. Common security vulnerabilities arise from user-inputted tainted data entering sensitive functions without proper security validation or encoding. Therefore, most IAST tools on the market determine the existence of security vulnerabilities by tracing the data flow of tainted data (e.g., the web application testing data flow tracing method and system disclosed in Chinese invention patent CN111046396A). When the application under test transmits data via queryString or form, the IAST tool can obtain the return value (i.e., tainted data) using functions such as getParameter(“key”). In this case, the tainted data can be associated with its key value, allowing developers to quickly locate problematic areas based on the tainted data's key value. However, with the continuous development of technology, more and more applications are using JSON request bodies to pass data parameters. Although common IAST tools can trace the entire JSON request body, when parsing the JSON request body, they will add all the data of the entity class mapped by the JSON object to the tracing logic. Some of this data is default data automatically generated by the entity class and is not input from the request. At this time, the vulnerability detection process will recognize this default data as illegal external data, thus generating false alarms. Summary of the Invention

[0003] The purpose of this invention is to provide an application vulnerability detection method and system based on data flow tracing, so as to eliminate the default data generated when parsing JSON request bodies and thus avoid false alarms.

[0004] To achieve the above objectives, this invention discloses an application vulnerability detection method based on data flow tracing, wherein the application uses a JSON framework for data storage and parameter transmission. The detection method includes:

[0005] The application under test is instrumented using the IAST instrumentation tool to weave vulnerability detection logic into the application. The vulnerability detection logic performs vulnerability detection by tracking the propagation path of tainted data in the application.

[0006] Retrieve the location information of the object returned by the JSON parsing function in the current application;

[0007] When the test tainted data enters the application, the mapping relationship of field names, field types, and field values ​​in the JSON object returned by the JSON parsing function is extracted and stored to obtain the instantiated original dataset;

[0008] Extract the automatically generated default data from the entity classes mapped by the JSON object to obtain a reference dataset;

[0009] Remove the data in the original dataset that is identical to the reference dataset to obtain the target dataset;

[0010] The vulnerability detection logic performs vulnerability detection by tracking the data propagation path of the target dataset.

[0011] Preferably, the IAST tool is used to instrument the JSON parsing function in the application to obtain the location information of the object returned by the JSON parsing function.

[0012] Preferably, a function library is created that includes JSON parsing functions of several known parsing types, and it is determined whether any JSON class function in the current application exists in the function library. If it does, the JSON class function is directly instrumented through the IAST tool.

[0013] If not, the JSON parsing function used to parse the JSON object is inferred based on the input parameters and return value of each JSON class function in the application.

[0014] This invention also discloses an application vulnerability detection system based on data flow tracing, wherein the application uses a JSON framework for data storage and parameter transmission, and the detection system includes:

[0015] The vulnerability detection module uses the IAST instrumentation tool to instrument the application under test to weave vulnerability detection logic into the application. The vulnerability detection logic performs vulnerability detection by tracking the propagation path of tainted data in the application.

[0016] A location information acquisition module, which is used to acquire the location information of the object returned by the JSON parsing function in the current application;

[0017] The first data extraction module is used to extract and store the mapping relationship of field names, field types and field values ​​in the JSON object returned by the JSON parsing function after the test tainted data enters the application, so as to obtain the original dataset;

[0018] The second data extraction module is used to extract the automatically generated default data from the entity class mapped by the JSON object in order to obtain a reference dataset;

[0019] The data filtering module is used to remove data from the original dataset that is identical to the reference dataset to obtain the target dataset, so that the vulnerability detection logic can perform vulnerability detection by tracing the data propagation path in the target dataset.

[0020] Preferably, the location information acquisition module instrumentes the JSON parsing function in the application using the IAST tool to obtain the location information of the object returned by the JSON parsing function.

[0021] Preferably, the location information acquisition module includes a function library creation module, a matching module, an instrumentation module, and an inference module;

[0022] The function library creation module is used to create a function library that includes JSON parsing functions for several known parsing types;

[0023] The matching module is used to match any JSON-type function in the current application with the functions in the function library to identify the JSON parsing function in the application.

[0024] The inference module is used to infer the JSON parsing function used to parse JSON objects based on the input parameters and return values ​​of each JSON-type function in the application when the matching module confirms that no JSON-type function in the current application matches the function in the function library.

[0025] The instrumentation module is used to instrument the JSON parsing function using the IAST tool.

[0026] This invention also discloses an application vulnerability detection system based on data flow tracing, which includes:

[0027] One or more processors;

[0028] Memory;

[0029] and one or more programs, wherein the one or more programs are stored in the memory and configured to be executed by the one or more processors, the programs including instructions for performing the application vulnerability detection method based on data flow tracing as described above.

[0030] The present invention also discloses a computer-readable storage medium comprising a computer program that can be executed by a processor to perform the application vulnerability detection method based on data flow tracing as described above.

[0031] Compared with existing technologies, the above-mentioned technical solution of the present invention uses tainted data stream tracing to perform vulnerability detection on applications, thereby locating problem points at the code line, function, and parameter levels. Specifically, the location information of the object returned by the JSON parsing function in the application under test is obtained in advance. Thus, when tainted test data enters the application, the JSON object returned by the JSON parsing function in the application can be obtained. An instantiated raw dataset is extracted from this JSON object, and the automatically generated default data in the JSON object is filtered to generate a target dataset that excludes the default data. Therefore, when the vulnerability detection logic performs vulnerability detection by tracing the data propagation path in this target dataset, it can effectively avoid false positives caused by default data in the JSON object, thereby improving the accuracy of vulnerability detection. Attached Figure Description

[0032] Figure 1 This is a flowchart of the detection method in an embodiment of the present invention. Detailed Implementation

[0033] To illustrate the technical content, structural features, objectives, and effects of the present invention in detail, the following description is provided in conjunction with the embodiments and accompanying drawings.

[0034] This embodiment discloses an application vulnerability detection method based on data flow tracing for application-based vulnerability detection. The application in this embodiment uses a JSON framework for data storage and parameter passing. To avoid false positives caused by including all data of the entity classes mapped to the JSON object in the tracing and detection logic during JSON request body parsing, such as... Figure 1 The detection method in this embodiment includes the following steps:

[0035] S1: The IAST instrumentation tool is used to instrument the application under test to weave vulnerability detection logic into the application. The vulnerability detection logic performs vulnerability detection by tracking the propagation path of tainted data in the application.

[0036] S2: Get the location information of the object returned by the JSON parsing function in the current application.

[0037] S3: When the test tainted data enters the application, based on the location information of the object returned by the JSON parsing function obtained in step S2, extract and store the mapping relationship of field names, field types and field values ​​in the JSON object returned by the JSON parsing function to parse the tainted data, so as to obtain the instantiated original dataset.

[0038] S4: Extract the automatically generated default data from the entity classes of the JSON object mapping to obtain a reference dataset.

[0039] The following entity classes:

[0040]

[0041] The reference dataset extracted from it is {"sort":"desc"}.

[0042] S5: Remove identical data from the original dataset and the reference dataset to obtain the target dataset. It's worth noting that removing identical data from the original dataset and the reference dataset includes deleting identical data or marking it with a security flag. Taking the specific entity class mentioned above as an example, when the user-inputted tainted data is {"page":1,"size":10}, then the original dataset instantiated in the JSON object is {"page":1,"size":10,"sort":"desc"}. Therefore, by comparing this original dataset with the reference dataset extracted in step S4, the default data {"sort":"desc"} in the original dataset can be removed, thus obtaining the target dataset {"page":1,"size":10}. Therefore, all data in this target dataset consists of user-inputted tainted data.

[0043] S6: The vulnerability detection logic performs vulnerability detection by tracking the data propagation path of the target dataset.

[0044] According to the detection method disclosed in the above embodiments, since the application is vulnerabilities detected by tainted data stream tracing, problems can be located at the line of code, function, and parameter levels. Specifically, the location information of the object returned by the JSON parsing function in the application under test is obtained in advance. Thus, when tainted test data enters the application, the JSON object returned by the JSON parsing function in the application can be obtained. The instantiated raw dataset is extracted from this JSON object, and the automatically generated default data in the JSON object is filtered to generate a target dataset that excludes the default data. Therefore, when the vulnerability detection logic performs vulnerability detection by tracing the data propagation path in this target dataset, false positives caused by default data in the JSON object can be effectively avoided, thereby improving the accuracy of vulnerability detection.

[0045] Furthermore, the location information of the object returned by the JSON parsing function in the IAST tool instrumentation application is obtained.

[0046] Therefore, in practical applications, if we want to automatically instrument JSON parsing functions in an application using the IAST tool, the IAST tool must first be able to identify which function in the application is the JSON parsing function; otherwise, manual instrumentation will be necessary, which is time-consuming. To solve this problem, the location method in this embodiment further includes:

[0047] Create a function library containing JSON parsing functions of several known parsing types, and determine whether any JSON class function in the current application exists in the function library. If it does, directly instrument the JSON class function using the IAST tool.

[0048] If not, the JSON parsing function used to parse JSON objects is inferred based on the input parameters and return values ​​of each JSON-class function in the application, thereby identifying the JSON parsing function in the application. Then, the JSON parsing function identified by the IAST tool can be instrumented.

[0049] Specifically, the request body containing a JSON-like function is as follows:

[0050]

[0051] In the request body mentioned above, since the JSON class function "readValue" is pre-defined in the function library, the JSON parsing function (i.e., readValue) in the request body can be quickly matched by comparing it with the various JSON parsing functions in the function library. Then, the readValue function in ObjectMapper can be instrumented, and the return value can be marked.

[0052] Another request body containing a JSON-like function is as follows:

[0053]

[0054] Within the request body, a comparison with function libraries containing multiple JSON parsing functions revealed no JSON class function with the same known parsing type as the function in question. Therefore, since normal JSON parsing functions typically take two parameters: a string or byte stream as the carrier of the JSON data, and the type of the JSON parsing object (e.g., returning an Object or a type identical to the JSON parsing object in Java), the JSON parsing function used to parse the JSON object, i.e., `parseObject`, can be inferred based on the input parameters and return value of each JSON class function in the request body. Then, the `parseObject` function can be instrumented using the IAST instrumentation tool.

[0055] In addition, JSON parsing objects generally returns either a class or an object type. The former clearly indicates the object type, while the latter requires further techniques such as reflection to obtain the object type.

[0056] In the example above, for Person.class, in step S3, the field names in the object can be obtained first using techniques such as reflection. The specific execution statement is as follows:

[0057]

[0058] At this point, the extracted field names, field values, field types, and other mapping relationships can be stored, such as {"key":"name","value":"Zhang San","type":"string"}. It should be noted that the value attribute here stores a value carrying a memory address, meaning that two identical strings "Zhang San" will have different memory addresses.

[0059] In another preferred embodiment of the present invention, an application vulnerability detection system based on data flow tracing is also disclosed. The application uses a JSON framework for data storage and parameter transmission. The detection system includes:

[0060] The vulnerability detection module uses the IAST instrumentation tool to instrument the application under test, so as to weave the vulnerability detection logic into the application. The vulnerability detection logic performs vulnerability detection by tracking the propagation path of tainted data in the application.

[0061] The location information acquisition module is used to obtain the location information of the object returned by the JSON parsing function in the current application;

[0062] The first data extraction module is used to extract and store the mapping relationship of field names, field types and field values ​​in the JSON object returned by the JSON parsing function after the test tainted data enters the application, so as to obtain the original dataset.

[0063] The second data extraction module is used to extract the default data automatically generated in the entity class of the JSON object mapping to obtain a reference dataset;

[0064] The data filtering module is used to remove identical data from the original dataset and the reference dataset to obtain the target dataset, so that the vulnerability detection logic can perform vulnerability detection by tracing the data propagation path in the target dataset.

[0065] Furthermore, the location information acquisition module obtains the location information of the object returned by the JSON parsing function in the IAST tool instrumentation application.

[0066] Furthermore, the location information acquisition module includes a function library creation module, a matching module, an instrumentation module, and an inference module.

[0067] The function library creation module is used to create function libraries that include JSON parsing functions for several known parsing types;

[0068] The matching module is used to match any JSON-type function in the current application with functions in the function library to identify the JSON parsing function in the application;

[0069] The inference module is used to infer the JSON parsing function used to parse JSON objects based on the input parameters and return values ​​of each JSON-type function in the application when the matching module confirms that no JSON-type function in the current application matches the function in the function library.

[0070] The instrumentation module is used to instrument JSON parsing functions using the IAST tool.

[0071] This invention also discloses another application vulnerability detection system, which includes one or more processors, a memory, and one or more programs, wherein the one or more programs are stored in the memory and configured to be executed by the one or more processors. The programs include instructions for performing the application vulnerability detection method described above. The processor may be a general-purpose central processing unit (CPU), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits, used to execute the relevant programs to achieve the functions required by the modules in the application vulnerability detection system of this application embodiment, or to execute the application vulnerability detection method of this application method embodiment.

[0072] This invention also discloses a computer-readable storage medium comprising a computer program executable by a processor to perform the application vulnerability detection method described above. The computer-readable storage medium can be any available medium accessible to a computer or a data storage device such as a server or data center that integrates one or more available media. The available medium can be read-only memory (ROM), random access memory (RAM), or magnetic media, such as floppy disks, hard disks, magnetic tapes, magnetic disks, or optical media, such as digital versatile discs (DVDs), or semiconductor media, such as solid-state disks (SSDs).

[0073] This application also discloses a computer program product or computer program, which includes computer instructions stored in a computer-readable storage medium. The processor of an electronic device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the electronic device to perform the aforementioned application vulnerability detection method.

[0074] The above-disclosed embodiments are merely preferred embodiments of the present invention and should not be construed as limiting the scope of the present invention. Therefore, any equivalent variations made in accordance with the claims of the present invention are still within the scope of the present invention.

Claims

1. A method for detecting application vulnerabilities based on data flow tracing, characterized in that, The application uses a JSON framework for data storage and parameter passing, and the detection method includes: The application under test is instrumented using the IAST instrumentation tool to weave vulnerability detection logic into the application. The vulnerability detection logic performs vulnerability detection by tracking the propagation path of tainted data in the application. Retrieve the location information of the object returned by the JSON parsing function in the current application; When the test tainted data enters the application, the mapping relationship of field names, field types, and field values ​​in the JSON object returned by the JSON parsing function is extracted and stored to obtain the instantiated original dataset; Extract the automatically generated default data from the entity classes mapped by the JSON object to obtain a reference dataset; Remove the data in the original dataset that is identical to the reference dataset to obtain the target dataset; The vulnerability detection logic performs vulnerability detection by tracking the data propagation path of the target dataset; and uses the IAST tool to instrument the JSON parsing function in the application to obtain the location information of the object returned by the JSON parsing function.

2. The application vulnerability detection method based on data flow tracing according to claim 1, characterized in that, Create a function library containing JSON parsing functions of several known parsing types, and determine whether any JSON class function in the current application exists in the function library. If it does, directly instrument the JSON class function using the IAST tool. If not, the JSON parsing function used to parse the JSON object is inferred based on the input parameters and return value of each JSON class function in the application.

3. An application vulnerability detection system based on data flow tracing, characterized in that, The application uses a JSON framework for data storage and parameter transmission. The detection system includes: The vulnerability detection module uses the IAST instrumentation tool to instrument the application under test to weave vulnerability detection logic into the application. The vulnerability detection logic performs vulnerability detection by tracking the propagation path of tainted data in the application. A location information acquisition module, which is used to acquire the location information of the object returned by the JSON parsing function in the current application; The first data extraction module is used to extract and store the mapping relationship of field names, field types and field values ​​in the JSON object returned by the JSON parsing function after the test tainted data enters the application, so as to obtain the original dataset; The second data extraction module is used to extract the automatically generated default data from the entity class mapped by the JSON object in order to obtain a reference dataset; The data filtering module is used to remove data that is identical to the reference dataset from the original dataset to obtain the target dataset, so that the vulnerability detection logic can perform vulnerability detection by tracing the data propagation path in the target dataset; the location information acquisition module uses the IAST tool to instrument the JSON parsing function in the application to obtain the location information of the object returned by the JSON parsing function.

4. The application vulnerability detection system based on data flow tracing according to claim 3, characterized in that, The location information acquisition module includes a function library creation module, a matching module, an instrumentation module, and an inference module; The function library creation module is used to create a function library that includes JSON parsing functions for several known parsing types; The matching module is used to match any JSON-type function in the current application with the functions in the function library to identify the JSON parsing function in the application. The inference module is used to infer the JSON parsing function used to parse JSON objects based on the input parameters and return values ​​of each JSON-type function in the application when the matching module confirms that no JSON-type function in the current application matches the function in the function library. The instrumentation module is used to instrument the JSON parsing function using the IAST tool.

5. An application vulnerability detection system based on data flow tracing, characterized in that, include: One or more processors; Memory; And one or more programs, wherein the one or more programs are stored in the memory and configured to be executed by the one or more processors, the programs including instructions for performing the application vulnerability detection method based on data flow tracing as described in any one of claims 1 to 2.

6. A computer-readable storage medium, characterized in that, Includes a computer program that can be executed by a processor to perform the application vulnerability detection method based on data flow tracing as described in any one of claims 1 to 2.

Images