Method and system for improving storage vulnerability detection efficiency

Abstract

The present invention discloses a method and system for improving the efficiency of storage vulnerability detection. The method includes: confirming whether tainted data matches a preset data label set, the data label set including one or more standard data labels. If so, the tainted data is defined as first-category target data. If not, judging whether the tainted data meets the screening rules according to a preset judgment model. If so, the tainted data is defined as second-category target data; performing vulnerability detection on an application based on the current first-category target data or the second-category target data and a preset storage vulnerability detection method; if the application has a storage vulnerability based on the second-category target data, generating a derived data label that matches the data rule of the second-category target data, and adding the derived data label to the data label set; the above technical solution of the present invention can effectively improve the targeting of storage vulnerability detection, thereby improving detection efficiency.

Description

Technical Field

[0001] The present invention relates to the technical field of application storage vulnerability detection technology, and in particular to a method and system for improving storage vulnerability detection efficiency. Background Art

[0002] With the development of the Internet, there are more and more applications, and common web vulnerabilities are also detected and protected by SAST and DAST tools. Storage vulnerabilities are a special type of vulnerability in applications. If a storage vulnerability exists in an application, the attacker stores the attack data in the database through interface A, and then uses interface B (which may be the next request or the request sent a few days later) to obtain the previously sent attack data from the database for a coordinated attack. For this type of storage vulnerability, since conventional detection methods can only intercept and verify based on a single request, some people have gradually developed dedicated storage vulnerability detection tools. However, due to the large number of request data types that cause storage vulnerabilities, the targeting of such professional detection tools is not strong, resulting in less than ideal detection efficiency.

[0003] Based on this, the market has put forward new demands on the detection efficiency of storage vulnerabilities in applications. Summary of the Invention

[0004] The purpose of the present invention is to provide a method and system for improving storage vulnerability detection efficiency, which is specifically used for detecting storage vulnerabilities in applications and effectively improves detection efficiency.

[0005] To achieve the above objectives, the present invention discloses a method for improving the efficiency of storage vulnerability detection, which includes:

[0006] Confirm whether the tainted data entering the application to be tested matches a preset data tag set, wherein the data tag set includes one or more standard data tags, and the standard data tags describe a class of standard data rules corresponding to one or more vulnerability types. If yes, then define the tainted data as the first type of target data; if not, then,

[0007] Parsing the tainted data to obtain a parsing result including a data type and a data value of the tainted data, and determining whether the parsing result meets a screening rule according to a preset judgment model; if so, defining the tainted data as second-category target data;

[0008] Performing vulnerability detection on the application based on the current first-category target data or the second-category target data and a preset storage-type vulnerability detection method;

[0009] If the application has a storage vulnerability and is detected based on the second type of target data, a derived data tag matching the data rule of the second type of target data is generated, and the derived data tag is added to the data tag set.

[0010] Preferably, for the taint data whose analysis results are determined by the judgment model to meet the screening rules, before defining it as the second category of target data, it is first determined whether the frequency of the taint data entering the application and / or being executed in the application within a continuous time period exceeds a preset frequency threshold. If so, the taint data is defined as the second category of target data.

[0011] Preferably, the method for the judgment model to judge whether the tainted data meets the screening rules includes:

[0012] Parse tainted data into key-value pairs;

[0013] Determine whether the data type and data length of the tainted data meet the screening rules. If yes,

[0014] It is further determined whether the keywords in the tainted data meet the screening rules. If so, the current tainted data meets the screening rules.

[0015] Preferably, the storage vulnerability detection method includes:

[0016] Use IAST instrumentation tools to instrument the application under test to weave data flow tracking programs into the application under test;

[0017] When tainted data entering the application to be tested requires the application to perform a data storage operation event, obtaining location information of the data stored in the database for the tainted data and storing the location information to obtain a reference data table;

[0018] When the tainted data entering the application to be tested requires the application to perform a data query operation event, it is determined whether the query content matches the content recorded in the reference data table. If so, the current query content is marked with a feature using the marking information;

[0019] Track the data flow of the tainted data and determine whether the query content with the tag information appears in the output stage or reaches the output stage via the propagation stage. If so, the current application has a storage vulnerability.

[0020] The present invention also discloses a system for improving storage vulnerability detection efficiency, which includes:

[0021] a first data screening module, configured to define tainted data entering the application to be tested and matching a preset data tag set as first-category target data; the data tag set includes one or more standard data tags, each of which describes a standard data rule corresponding to one or more vulnerability types;

[0022] A second data screening module is configured to screen tainted data that does not match a preset data label set according to a preset judgment model, and define the screened tainted data as second-category target data. The judgment model is configured to determine whether the data type and data value of the tainted data meet the screening rules;

[0023] a vulnerability detection module, configured to perform vulnerability detection on the application based on the current first-category target data or the second-category target data and a preset storage-type vulnerability detection method;

[0024] A data label update module is used to generate a derived data label that matches the data rules of the second type of target data when the vulnerability detection module detects that the application has a storage vulnerability and detects it based on the second type of target data, and add the derived data label to the data label set.

[0025] Preferably, for the tainted data whose parsing results are judged to meet the screening rules by the judgment model, before defining it as the second category target data, the second data screening module also screens the second category target data based on the frequency of the tainted data entering the application and / or being executed in the application within a continuous time period.

[0026] Preferably, the second data screening module screens the second type of target data by determining whether the data type, data length and keywords of the tainted data meet the screening rules.

[0027] Preferably, the vulnerability detection module includes:

[0028] An instrumentation module, which is used to instrument the application under test using the IAST instrumentation tool to weave a data flow tracking program into the application under test;

[0029] A reference data acquisition module is used to obtain the location information of the data stored in the database when the tainted data entering the application to be tested requires the application to perform a data storage operation event, and store the location information to obtain a reference data table;

[0030] a marking module for, when tainted data entering the application under test requires the application to perform a data query operation event, determining whether the query content matches the content recorded in the reference data table, and using marking information to feature the current query content;

[0031] The confirmation module is used to confirm whether the current application has a storage vulnerability by judging whether the query content with the marking information appears in the output stage of the data flow of the tainted data or reaches the output stage via the propagation stage.

[0032] The present invention also discloses another system for improving the efficiency of storage vulnerability detection, which includes:

[0033] one or more processors;

[0034] Memory;

[0035] and one or more programs, wherein the one or more programs are stored in the memory and configured to be executed by the one or more processors, the programs including instructions for executing the method for improving the efficiency of storage-type vulnerability detection as described above.

[0036] The present invention also discloses a computer-readable storage medium, which includes a computer program. The computer program can be executed by a processor to implement the method for improving the efficiency of storage vulnerability detection as described above.

[0037] Compared with the prior art, the above technical solution of the present invention performs vulnerability detection on the application through a preset detection method specifically for storage-type vulnerability detection. During the detection, the tainted data will first be screened through a preset data label set, thereby quickly screening out high-risk first-category target data, thereby improving the targeting of storage-type vulnerability detection and further improving the detection efficiency; secondly, the tainted data that does not conform to the data label set is parsed, and the parsed content is screened for a second time, and the screened data is defined as second-category target data. If a storage-type vulnerability is detected through the second-category target data, a derivative data label is generated based on the second-category target data and added to the data label set, thereby ensuring the comprehensiveness of storage-type vulnerability detection and avoiding missed detections; in addition, through the second screening, a portion of tainted data with extremely low correlation with storage-type vulnerabilities is also screened out, thereby further improving the detection efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] Figure 1 This is a flow chart of a method for improving the efficiency of storage vulnerability detection in an embodiment of the present invention.

[0039] Figure 2 This is a flow chart of a storage vulnerability detection method according to an embodiment of the present invention.

[0040] Figure 3 This is a storage structure diagram of a reference data table in an embodiment of the present invention.

[0041] Figure 4This is a schematic diagram of the system principle structure for improving the efficiency of storage vulnerability detection in an embodiment of the present invention. DETAILED DESCRIPTION

[0042] In order to explain the technical content, structural features, achieved objectives and effects of the present invention in detail, the following is a detailed description in conjunction with the embodiments and the accompanying drawings.

[0043] This embodiment discloses a method for improving the efficiency of storage vulnerability detection, which is used for detecting storage vulnerabilities in applications and solves the problem that the detection of storage vulnerabilities in applications is not targeted enough and thus inefficient. Figure 1 The method for improving the efficiency of storage vulnerability detection in this embodiment includes the following steps:

[0044] S10: Confirm whether the tainted data entering the application to be tested (i.e., the request data input by the user) matches a preset data tag set, where the data tag set includes one or more standard data tags, and the standard data tags describe a class of standard data rules corresponding to one or more vulnerability types. If yes, proceed to step S11; if not, skip step S11 and proceed to step S12.

[0045] S11: define the tainted data as the first type of target data, skip steps S12 to S14 and directly proceed to step S15.

[0046] S12: Parse the tainted data to obtain a parsing result including the data type and data value of the tainted data.

[0047] S13: Determine whether the parsing result meets the screening rules according to the preset judgment model. If yes, proceed to the following step S14. If no, discard the tainted data and give up the detection of storage vulnerabilities based on the tainted data.

[0048] S14: Define the tainted data as the second type of target data.

[0049] S15: Perform vulnerability detection on the current application based on the current first-category target data or the second-category target data and a preset storage-type vulnerability detection method.

[0050] S16: Confirm whether a storage vulnerability is detected. If not, end the process. If yes, proceed to the following step S17.

[0051] S17: Confirm whether the storage vulnerability is detected based on the second type of target data. If not, end; if yes, proceed to the following step S18.

[0052] S18: Generate a derivative data label that matches the data rule of the second type of target data, and add the derivative data label to the above data label set, so as to update and improve the data label set.

[0053] In this embodiment, first, the taint data entering the application is screened for the first time through the data label set to screen out the test data with high correlation with the stored vulnerability, that is, the first type of target data. For example, for the taint data A that is likely to cause an "unsafe redirect vulnerability", it is generally of the uri or url type, and uri and url data are prone to stored ssrf vulnerabilities. If the uri data label ( / * / **) and the url data label (http: / / * / **) are configured in the data label set. Then, after the taint data A enters the input stage of the application, it will be matched with the label data set, so as to match the uri data label or the url data label, and then define the taint data A as the first type of target data and mark its features. Furthermore, for the taint data B that is likely to cause a "stored XSS vulnerability", it is generally of the rich text type. At this time, if the rich text label ([<br|<div|<script]?) is configured in the data label set, then after the taint data B enters the application, it will also be defined as the first type of target data and mark its features.

[0054] In addition, if there is contextPath=baidu in the queryString of an http request, the taint data C "baidu" does not conform to any data labels in the configured label data set (such as uri or rich text, etc.), so the taint data C is parsed to obtain its data type as character type (non-pure number), and there is a request-related keyword contextPath in the key of the taint data C. By judging the model, it is concluded that the taint data C may have an "unsafe redirect vulnerability", so the taint data C is defined as the second type of target data and its features are marked.

[0055] Optionally, to ensure the accuracy of the judgment of the judgment model, the judgment model in this embodiment is constructed based on the neural network architecture of the machine learning algorithm. In this way, the judgment model can continuously optimize itself according to the final vulnerability detection result, so as to improve its judgment accuracy.

[0056] Specifically, the method for the judgment model to judge whether the taint data conforms to the screening rule includes:

[0057] Parse the taint data into key-value pairs;

[0058] Determine whether the data type and data length of the tainted data meet the screening rules. If so, further determine whether the keywords in the tainted data meet the screening rules. If so, the current tainted data meets the screening rules. For example, for the tainted data C in the above embodiment, the data type is a string, the string length is 5, both of which meet the preset rules (assumptions), and the keyword in the key value of the key-value pair is contextPath. This keyword meets the semantics related to the storage vulnerability trigger condition. Therefore, the tainted data is defined as the second type of target data.

[0059] Furthermore, in order to further improve the performance of the server and thus improve the detection efficiency, for the taint data whose analysis results are judged by the judgment model to meet the screening rules, before defining it as the second type of target data, it is first determined whether the frequency of the taint data entering the application and / or being executed in the application within a continuous time period exceeds a preset frequency threshold. If so, the taint data is defined as the second type of target data. If not, the vulnerability detection based on the taint data is abandoned.

[0060] Specifically, if tainted data does not qualify as first-category target data and passes the screening of the aforementioned judgment model, it will not be subject to vulnerability detection if it appears or executes for the first time, meaning it will not be defined as second-category target data. Only when the tainted data enters an application or executes within the application three or more times within thirty minutes will it be defined as second-category target data. Furthermore, before defining tainted data as second-category target data, the current server system resource usage may be considered. If system resources are limited, the data will not be defined as second-category target data.

[0061] According to the technical solution disclosed in the above embodiment, vulnerability detection is performed on the application program through a preset detection method specifically for storage-type vulnerability detection. During the detection, the tainted data is firstly screened through a preset data label set, thereby quickly screening out high-risk first-category target data, thereby improving the targeting of storage-type vulnerability detection and further improving the detection efficiency; secondly, the tainted data that does not conform to the data label set is parsed, and the parsed content is screened for a second time, and the screened data is defined as second-category target data. If a storage-type vulnerability is detected through the second-category target data, a derivative data label is generated based on the second-category target data and added to the data label set, thereby ensuring the comprehensiveness of storage-type vulnerability detection and avoiding missed detections; in addition, through the second screening, a portion of tainted data with extremely low correlation with storage-type vulnerabilities is also screened out, thereby further improving the detection efficiency.

[0062] In another preferred embodiment of the present invention, Figure 2,The storage vulnerability detection method includes the following steps:

[0063] S20: Use the IAST instrumentation tool to instrument the application to be tested to weave a data flow tracking program into the application to be tested. Based on the data flow tracking program, the data flow of the tainted data in the application can be tracked.

[0064] S21: Based on the data flow tracking program, obtain the data flow of the tainted data (i.e., the first type of target data or the second type of target data) in the application, and determine whether the current tainted data requires the application to perform a data storage operation event based on the database interaction function entered by the tainted data. If so, proceed to the following step S30. If not, it means that the current tainted data requires the application to perform a data query operation event, then proceed to the following step S40.

[0065] Specifically, through the instrumented database interaction function such as java.sql.Connection#prepareStatement(java.lang.String), the input parameter information, that is, the SQL statement, is obtained. Then, through the keywords in the SQL statement, such as select, update, delete, insert, etc., the action of the current application through the database interaction function is judged. If it is insert or update, it means it is a data storage operation, and if it is select, it is a database query operation.

[0066] S30: Obtain the location information of the tainted data stored in the database and store the location information to obtain a reference data table. Specifically, the location information in this embodiment includes the database name, data table name and column name to which the tainted data is stored in the application database.

[0067] S40: Determine whether the query content matches the content recorded in the reference data table. If so, it means that the data to be extracted from the current taint data is data from user input stored in other previous requests, then go to step S41. If not, do not perform any operation on the current query content.

[0068] S41: Using the tag information to perform feature tagging on the current query content.

[0069] S42: Track the data flow of the tainted data and determine whether the query content with the marking information appears in the output stage or reaches the output stage via the propagation stage. If so, it is confirmed that the current application has a storage vulnerability. If not, the process ends.

[0070] The vulnerability operation scenario applicable to the storage vulnerability detection method disclosed in the above embodiment is: a prior request stores a tainted data into the database, but it is not executed, and a subsequent request takes the tainted data of the prior request out of the database and executes it. If this operation scenario occurs, it means that the current application has a storage vulnerability. Therefore, the inventive concept of the storage vulnerability detection method in the above embodiment is: to judge whether the application has a storage vulnerability based on the following two conditions: first, the data extracted from the database in the subsequent request is the data stored in the prior request input by the user; second, after the subsequent request extracts the data stored in the prior request from the database, the data is passed into the sensitive function (such as SQL execution, command line execution), and then output. Therefore, through this method, most storage vulnerability attack scenarios in the application can be detected, and the detection efficiency is high.

[0071] In the above embodiment, the database interaction function will perform data storage operations or data query operations based on the input parameter information (SQL statement). For example, when the input SQL statement is insert into users(name, sex) values(request.getParameter("name"), request.getParameter("sex")), the execution statement is:

[0072]

[0073] Accordingly, when the database interaction function performs a data query operation, its specific execution statement is:

[0074]

[0075]

[0076] Therefore, by parsing the input parameter information currently entering the database interaction function, the data table name and column name to which the data currently to be stored or extracted belongs in the database can be obtained. By parsing the object in the current database interaction function (Connection in the above execution statement), the database name information (test in the above execution statement) to which the data currently to be stored or extracted belongs in the database can be obtained.

[0077] Based on this, in this embodiment, the method for obtaining the location information of data stored in the data specifically includes:

[0078] First, trace the data flow of the tainted data and obtain the storage statements (SQL statements) and execution statements that the application interacts with the database.

[0079] Then, the storage statement is parsed to obtain the data table name and column name, and the execution statement is parsed to obtain the database name. According to the specific storage statement and corresponding execution statement disclosed in the above embodiment, the data table name is users, the column names are name and sex, and the database name is test.

[0080] After obtaining the location information, store it in the reference data table, such as Figure 3 As shown, the data in the reference data table is stored in a tree structure.

[0081] Accordingly, the method for determining whether the query content matches the content recorded in the reference data table includes:

[0082] First, trace the data flow of the tainted data and obtain the query statements (SQL statements) and execution statements used by the application to interact with the database.

[0083] Then, the query statement and the execution statement are parsed to obtain the target location where the current application accesses the database.

[0084] Next, a polling method is used to query whether the target location matches the location information in the reference data table. If so, it indicates that the query content returned by the query statement matches the content recorded in the reference data table.

[0085] In this embodiment, when the query statement is select name,sex from users where name='zhangsan', the table name is users and the column names are name and sex, which are extracted through lexical analysis technology. The Connection object in the execution statement obtained through instrumentation technology is test. Therefore, the target location can match the content recorded in the reference data table, and the current application has a storage vulnerability.

[0086] Furthermore, in the reference data table, when storing the location information of the tainted data in the database, the tainted data and the thread context information when the data storage operation occurs are associated with the location information and stored. In this way, when a storage vulnerability is detected, the tainted data and thread context information stored in the current and reference data tables can be combined to accurately locate the source and outbreak point of the storage vulnerability.

[0087] In another preferred embodiment of the present invention, Figure 4 , also discloses a system for improving the efficiency of storage vulnerability detection, which includes a first data screening module, a second data screening module, a vulnerability detection module and a data label update module.

[0088] The first data screening module is used to define the tainted data that enters the application to be tested and matches a preset data tag set as the first type of target data; the data tag set includes one or more standard data tags, and the standard data tags describe a class of standard data rules corresponding to one or more vulnerability types.

[0089] The second data screening module is used to screen the tainted data that does not match the preset data label set according to a preset judgment model, and define the screened tainted data as the second type of target data. The judgment model is used to determine whether the data type and data value of the tainted data meet the screening rules.

[0090] The vulnerability detection module is used to perform vulnerability detection on the application based on the current first-category target data or the second-category target data and a preset storage-type vulnerability detection method.

[0091] A data label update module is used to generate a derived data label that matches the data rules of the second type of target data when the vulnerability detection module detects that the application has a storage vulnerability and detects it based on the second type of target data, and add the derived data label to the data label set.

[0092] Furthermore, for the tainted data whose analysis results are judged by the judgment model to meet the screening rules, before defining it as the second category target data, the second data screening module also filters the second category target data based on the frequency of the tainted data entering the application and / or being executed in the application within a continuous time period.

[0093] Furthermore, the second data screening module screens the second type of target data by determining whether the data type, data length and keywords of the tainted data meet the screening rules.

[0094] Furthermore, the vulnerability detection module includes an instrumentation module, a reference data collection module, a marking module, and a confirmation module.

[0095] The instrumentation module is used to instrument the application under test using the IAST instrumentation tool to weave a data flow tracking program into the application under test.

[0096] The reference data acquisition module is used to obtain the location information of the tainted data stored in the database when the tainted data entering the application to be tested requires the application to perform a data storage operation event, and store the location information to obtain a reference data table.

[0097] The marking module is used to mark the current query content with marking information when the tainted data entering the application to be tested requires the application to perform a data query operation event, if the query content matches the content recorded in the reference data table.

[0098] The confirmation module is used to confirm whether the current application has a storage vulnerability by judging whether the query content with the marking information appears in the output stage of the data flow of the tainted data or reaches the output stage via the propagation stage.

[0099] Optionally, the reference data collection module further associates and stores the tainted data with the thread context information and location information when the data storage operation occurs in the reference data table.

[0100] Furthermore, the location information includes the database name, data table name, and column name to which the tainted data is stored in the application database.

[0101] The reference data acquisition module includes a first data acquisition module and a first analysis module.

[0102] The first data acquisition module is used to obtain storage statements and execution statements of the interaction between the application program and the database by tracking the data flow of the tainted data.

[0103] The first parsing module is used to parse the storage statement collected by the first data collection module to obtain the data table name and column name, and parse the execution statement to obtain the database name.

[0104] The marking module includes a second data acquisition module, a second parsing module and a polling module.

[0105] The second data collection module is used to obtain query statements and execution statements of the application program interacting with the database by tracking the data flow of the tainted data.

[0106] The second parsing module is used to parse the query statement and the execution statement to obtain the target location of the database accessed by the current application program.

[0107] The polling module is used to query whether the target location matches the location information in the reference data table in a polling manner to confirm whether the query content returned by the query statement matches the content recorded in the reference data table.

[0108] Furthermore, the vulnerability detection module also includes a data operation judgment module, which is used to judge the operation events of the tainted data currently entering the application on the database through keywords in the SQL statement of the interaction between the application and the database.

[0109] It should also be noted that the working principle and working method of the system for improving storage vulnerability detection efficiency in this embodiment are detailed in the above-mentioned method for improving storage vulnerability detection efficiency, and will not be repeated here.

[0110] The present invention also discloses another system for improving the efficiency of storage vulnerability detection, which includes one or more processors, a memory, and one or more programs, wherein the one or more programs are stored in the memory and are configured to be executed by the one or more processors, and the programs include instructions for executing the method for improving the efficiency of storage vulnerability detection as described above. The processor can adopt a general central processing unit (CPU), a microprocessor, an application specific integrated circuit (ASIC), or one or more integrated circuits to execute relevant programs to implement the functions required to be executed by the modules in the system for improving the efficiency of storage vulnerability detection in the embodiment of the present application, or to execute the method for improving the efficiency of storage vulnerability detection in the embodiment of the method of the present application.

[0111] The present invention also discloses a computer-readable storage medium, which includes a computer program, and the computer program can be executed by a processor to complete the method for improving the efficiency of storage vulnerability detection as described above. The computer-readable storage medium can be any available medium that can be accessed by a computer or a data storage device such as a server or data center that includes one or more available media. The available medium can be a read-only memory (ROM), or a random access memory (RAM), or a magnetic medium, such as a floppy disk, a hard disk, a tape, a magnetic disk, or an optical medium, such as a digital versatile disc (DVD), or a semiconductor medium, such as a solid state disk (SSD).

[0112] The present application also discloses a computer program product or computer program, which includes computer instructions stored in a computer-readable storage medium. A processor of an electronic device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the electronic device to perform the aforementioned method for improving storage vulnerability detection efficiency.

[0113] The above disclosure is only a preferred embodiment of the present invention, which certainly cannot be used to limit the scope of rights of the present invention. Therefore, equivalent changes made according to the scope of the patent application of the present invention are still within the scope covered by the present invention.

Claims

1. A method for improving the efficiency of storage vulnerability detection, characterized in that: include: Confirm whether the tainted data entering the application to be tested matches a preset data tag set, wherein the data tag set includes one or more standard data tags, and the standard data tags describe a class of standard data rules corresponding to one or more vulnerability types. If yes, then define the tainted data as the first type of target data; if not, then, Parsing the tainted data to obtain a parsing result including a data type and a data value of the tainted data, and determining whether the parsing result meets a screening rule according to a preset judgment model; if so, defining the tainted data as second-category target data; Performing vulnerability detection on the application based on the current first-category target data or the second-category target data and a preset storage-type vulnerability detection method; If a storage vulnerability exists in the application and is detected based on the second type of target data, a derived data tag that matches the data rules of the second type of target data is generated, and the derived data tag is added to the data tag set; for the tainted data whose parsing results are judged by the judgment model to meet the screening rules, before defining it as the second type of target data, it is first determined whether the frequency of the tainted data entering the application and / or being executed in the application within a continuous time period exceeds a preset frequency threshold. If so, the tainted data is defined as the second type of target data.

2. The method for improving storage vulnerability detection efficiency according to claim 1, characterized in that: The method for the judgment model to determine whether the tainted data meets the screening rules includes: Parse tainted data into key-value pairs; Determine whether the data type and data length of the tainted data meet the screening rules. If yes, It is further determined whether the keywords in the tainted data meet the screening rules. If so, the current tainted data meets the screening rules.

3. The method for improving storage vulnerability detection efficiency according to claim 1, characterized in that: The storage vulnerability detection method includes: Use IAST instrumentation tools to instrument the application under test to weave data flow tracking programs into the application under test; When tainted data entering the application to be tested requires the application to perform a data storage operation event, obtaining location information of the data stored in the database for the tainted data and storing the location information to obtain a reference data table; When the tainted data entering the application to be tested requires the application to perform a data query operation event, it is determined whether the query content matches the content recorded in the reference data table. If so, the current query content is marked with a feature using the marking information; Track the data flow of the tainted data and determine whether the query content with the tag information appears in the output stage or reaches the output stage via the propagation stage. If so, the current application has a storage vulnerability.

4. A system for improving storage vulnerability detection efficiency, characterized in that: include: a first data screening module, configured to define tainted data entering the application to be tested and matching a preset data tag set as first-category target data; the data tag set includes one or more standard data tags, each of which describes a standard data rule corresponding to one or more vulnerability types; A second data screening module is configured to screen tainted data that does not match a preset data label set according to a preset judgment model, and define the screened tainted data as second-category target data. The judgment model is configured to determine whether the data type and data value of the tainted data meet the screening rules; a vulnerability detection module, configured to perform vulnerability detection on the application based on the current first-category target data or the second-category target data and a preset storage-type vulnerability detection method; a data tag updating module configured to generate a derived data tag matching the data rule of the second-category target data when the vulnerability detection module detects that the application has a storage vulnerability and the vulnerability is detected based on the second-category target data, and to add the derived data tag to the data tag set; For the tainted data whose parsing results are judged by the judgment model to meet the screening rules, before defining it as the second-category target data, the second data screening module also screens the second-category target data based on the frequency of the tainted data entering the application and / or being executed in the application within a continuous time period.

5. The system for improving storage vulnerability detection efficiency according to claim 4, characterized in that: The second data screening module screens the second type of target data by determining whether the data type, data length and keywords of the tainted data meet the screening rules.

6. The system for improving storage vulnerability detection efficiency according to claim 4, characterized in that: The vulnerability detection module includes: An instrumentation module, which is used to instrument the application under test using the IAST instrumentation tool to weave a data flow tracking program into the application under test; A reference data acquisition module is used to obtain the location information of the data stored in the database when the tainted data entering the application to be tested requires the application to perform a data storage operation event, and store the location information to obtain a reference data table; a marking module for, when tainted data entering the application under test requires the application to perform a data query operation event, determining whether the query content matches the content recorded in the reference data table, and using marking information to feature the current query content; The confirmation module is used to confirm whether the current application has a storage vulnerability by judging whether the query content with the marking information appears in the output stage of the data flow of the tainted data or reaches the output stage via the propagation stage.

7. A system for improving storage vulnerability detection efficiency, characterized in that: include: one or more processors; Memory; and one or more programs, wherein the one or more programs are stored in the memory and configured to be executed by the one or more processors, the programs including instructions for executing the method for improving the efficiency of storage vulnerability detection as described in any one of claims 1 to 3.

8. A computer-readable storage medium, characterized in that The method comprises a computer program, which can be executed by a processor to implement the method for improving the efficiency of storage vulnerability detection as claimed in any one of claims 1 to 3.

Images