Source code vulnerability detection method and device

Abstract

The application discloses a source code vulnerability detection method and device, the method comprises the following steps: analyzing the source code of software through a preset source code vulnerability analysis engine and based on a preset vulnerability rule library to obtain a first vulnerability detection result; matching each vulnerability in the first vulnerability detection result with a preset false positive vulnerability library to obtain suspected false positive vulnerabilities in the first vulnerability detection result; for each suspected false positive vulnerability, analyzing whether there is a dynamic factor having a direct impact on the vulnerability through a preset auxiliary artificial audit module to obtain a false positive analysis result corresponding to each suspected false positive vulnerability; and generating a second vulnerability detection result according to the false positive analysis result. The application improves the accuracy of source code vulnerability detection and significantly improves the efficiency of source code vulnerability detection compared with the existing artificial audit method.

Description

TECHNICAL FIELD

[0001] The present application relates to source code detection, in particular to a source code vulnerability detection method and device. BACKGROUND

[0002] Source code defects refer to intentional or unintentional vulnerabilities generated in the software development process, which exist in different forms in the software source code and can cause damage to the security of software or operating systems if maliciously exploited.

[0003] The prior art usually adopts manual audit, static tool scanning, and a combination of manual audit and static tool scanning to detect defects in the code. Manual audit refers to manual inspection of source code, searching and analyzing according to the characteristics of defects to determine whether defects exist. Manual audit has very high requirements for personnel, and requires relevant personnel to be familiar with software business, able to read source code and have rich security knowledge. Even so, when faced with a huge amount of source code, it is difficult to find all problems within a limited time through manual audit alone, and misjudgment is also likely to occur.

[0004] Therefore, the existing manual audit method has the problems of time-consuming and laborious and easy misjudgment, and the prior art lacks an effective solution to this problem. SUMMARY

[0005] The present application proposes a source code vulnerability detection method and device to solve at least one of the technical problems in the background art.

[0006] In order to achieve the above-mentioned purpose, according to one aspect of the present application, a source code vulnerability detection method is provided, which comprises:

[0007] analyzing the source code of the software through a preset source code vulnerability analysis engine and based on a preset vulnerability rule library to obtain a first vulnerability detection result;

[0008] matching each vulnerability in the first vulnerability detection result with a preset false positive vulnerability library to obtain suspected false positive vulnerabilities in the first vulnerability detection result;

[0009] For each suspected false positive vulnerability, analyzing whether there are dynamic factors having a direct impact on the vulnerability through a preset auxiliary manual audit module to obtain a false positive analysis result corresponding to each suspected false positive vulnerability;

[0010] generating a second vulnerability detection result according to the false positive analysis result.

[0011] Optionally, the vulnerability rule base includes vulnerability cause characteristics and Java statement characteristics corresponding to each vulnerability, and the Java statement characteristics specifically include: dangerous functions and built-in objects that can be used directly without declaration.

[0012] Optionally, the source code vulnerability analysis engine specifically includes: a semantic analysis engine, a control flow analysis engine, a data flow analysis engine, and a configuration analysis engine;

[0013] The semantic analysis engine is used to discover language functions or processes that are vulnerable to attacks;

[0014] The control flow analysis engine is used to track the sequence of business operations and discover software security risks caused by unreasonable code structure;

[0015] The data flow analysis engine is used to obtain information about how data flows along the execution path of the program;

[0016] The configuration analysis engine is used to discover policy loopholes that violate rules in software configuration files.

[0017] Optionally, the source code vulnerability detection method further includes:

[0018] Conduct statistical analysis on false positive vulnerabilities identified through manual audits to identify vulnerabilities with high false positive rates;

[0019] A false positive vulnerability library is established based on the high false positive vulnerabilities.

[0020] Optionally, for each of the suspected false alarm vulnerabilities, a preset auxiliary manual audit module is used to analyze whether there are dynamic factors that have a direct impact on the vulnerability, and obtain a false alarm analysis result corresponding to each of the suspected false alarm vulnerabilities, specifically including:

[0021] The suspected false positive vulnerabilities are sent to the auxiliary manual audit module, so that the auxiliary manual audit module determines the manual audit information that needs attention and review corresponding to each of the suspected false positive vulnerabilities from a preset manual audit information library, and sends the manual audit information that needs attention and review to the auditor, so that the auditor manually reviews each of the suspected false positive vulnerabilities based on the manual audit information that needs attention and review;

[0022] Obtain the false alarm analysis results corresponding to each of the suspected false alarm vulnerabilities sent by the auxiliary manual audit module, wherein the auditor sends the false alarm analysis results corresponding to each of the suspected false alarm vulnerabilities to the auxiliary manual audit module after completing the manual verification.

[0023] Optionally, the dynamic factors specifically include: third-party frameworks and versions, filters, interceptors, custom filter functions, business logic, and program external conditions.

[0024] To achieve the above object, according to another aspect of the present application, a source code vulnerability detection device is provided, which comprises:

[0025] a vulnerability preliminary detection unit configured to analyze the source code of the software by using a preset source code vulnerability analysis engine and based on a preset vulnerability rule library, and obtain a first vulnerability detection result;

[0026] a suspected false positive vulnerability determination unit configured to match each vulnerability in the first vulnerability detection result with a preset false positive vulnerability library, and obtain suspected false positive vulnerabilities in the first vulnerability detection result;

[0027] a false positive vulnerability analysis unit configured to, for each suspected false positive vulnerability, analyze whether there is a dynamic factor having a direct impact on the vulnerability by using a preset auxiliary manual audit module, and obtain a false positive analysis result corresponding to each suspected false positive vulnerability;

[0028] a vulnerability detection result generation unit configured to generate a second vulnerability detection result according to the false positive analysis result.

[0029] Optionally, the source code vulnerability detection device further comprises:

[0030] a high false positive vulnerability determination unit configured to statistically analyze false positive vulnerabilities identified by manual audit, and determine high false positive vulnerabilities;

[0031] a false positive vulnerability library establishment unit configured to establish a false positive vulnerability library according to the high false positive vulnerabilities.

[0032] Optionally, the false positive vulnerability analysis unit specifically comprises:

[0033] a data sending module configured to send the suspected false positive vulnerabilities to the auxiliary manual audit module, so that the auxiliary manual audit module determines information that needs to be paid attention to and checked by manual audit for each suspected false positive vulnerability from a preset manual audit information library, and sends the information that needs to be paid attention to and checked by manual audit to an audit personnel, so that the audit personnel manually checks each suspected false positive vulnerability according to the information that needs to be paid attention to and checked by manual audit;

[0034] a false positive analysis result acquisition module configured to acquire the false positive analysis result corresponding to each suspected false positive vulnerability sent by the auxiliary manual audit module, wherein the audit personnel sends the false positive analysis result corresponding to each suspected false positive vulnerability to the auxiliary manual audit module after completing manual checking.

[0035] In order to achieve the above-mentioned purpose, according to another aspect of the present invention, a computer device is further provided, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the above-mentioned source code vulnerability detection method when executing the computer program.

[0036] To achieve the above objectives, according to another aspect of the present invention, a computer-readable storage medium is provided, on which a computer program / instruction is stored. When the computer program / instruction is executed by a processor, the steps of the above-mentioned source code vulnerability detection method are implemented.

[0037] To achieve the above object, according to another aspect of the present invention, a computer program product is provided, comprising a computer program / instruction, which implements the steps of the above source code vulnerability detection method when executed by a processor.

[0038] The beneficial effects of the present invention are:

[0039] The embodiment of the present invention uses a preset source code vulnerability analysis engine and analyzes the source code of the software based on a preset vulnerability rule library to obtain a first vulnerability detection result, and then matches each vulnerability in the first vulnerability detection result with a preset false alarm vulnerability library to obtain suspected false alarm vulnerabilities in the first vulnerability detection result. Then, for each of the suspected false alarm vulnerabilities, a preset auxiliary manual audit module is used to analyze whether there are dynamic factors that have a direct impact on the vulnerability, and a false alarm analysis result corresponding to each of the suspected false alarm vulnerabilities is obtained. Finally, a second vulnerability detection result is generated based on the false alarm analysis result, thereby improving the accuracy of source code vulnerability detection and significantly improving the efficiency of source code vulnerability detection compared to existing manual audit methods. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative work. In the drawings:

[0041] Figure 1 This is a first flow chart of a source code vulnerability detection method according to an embodiment of the present invention;

[0042] Figure 2 is a second flow chart of the source code vulnerability detection method according to an embodiment of the present invention;

[0043] Figure 3is a third flow chart of the source code vulnerability detection method according to an embodiment of the present invention;

[0044] Figure 4 This is a first structural block diagram of a source code vulnerability detection device according to an embodiment of the present invention;

[0045] Figure 5 This is a second structural block diagram of the source code vulnerability detection device according to an embodiment of the present invention;

[0046] Figure 6 This is a third structural block diagram of the source code vulnerability detection device according to an embodiment of the present invention;

[0047] Figure 7 Schematic diagram of a computer device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0048] In order to enable those skilled in the art to better understand the solutions of the present invention, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the embodiments described are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts should fall within the scope of protection of the present invention.

[0049] It will be understood by those skilled in the art that embodiments of the present invention may be provided as methods, systems, or computer program products. Thus, the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware. Furthermore, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0050] It should be noted that the terms "including" and "having" and any variations thereof in the specification and claims of the present invention and the above-mentioned drawings are intended to cover non-exclusive inclusions. For example, a process, method, system, product or apparatus comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or are inherent to these processes, methods, products or apparatuses.

[0051] It should be noted that, in the absence of conflict, the embodiments and features of the embodiments of the present invention can be combined with each other. The present invention will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0052] It should be noted that the acquisition, storage, use, and processing of data in the technical solution of this application comply with the relevant provisions of national laws and regulations.

[0053] It should be noted that the source code vulnerability detection method and device of the present invention can be used in various technical fields, and the application fields of the source code vulnerability detection method and device of the present invention are not limited.

[0054] The present invention proposes a WEB source code vulnerability detection method and device developed based on JAVA. In this vulnerability detection method, non-static situations such as third-party frameworks, filters, interceptors, custom filter functions, and business logic of the software are detected, thereby reducing the false positive rate of the tool scanning results and improving the efficiency of manual auditing.

[0055] Figure 1 This is a first flow chart of the source code vulnerability detection method according to an embodiment of the present invention. Figure 1 As shown, in one embodiment of the present invention, the source code vulnerability detection method of the present invention includes steps S101 to S104.

[0056] Step S101 : Analyze the source code of the software using a preset source code vulnerability analysis engine and based on a preset vulnerability rule library to obtain a first vulnerability detection result.

[0057] The present invention analyzes the causes of various vulnerability defects in source code and the lexical and semantic features of JAVA, extracts feature data of source code vulnerabilities, and thus establishes a vulnerability rule library.

[0058] In one embodiment of the present invention, the vulnerability rule base includes vulnerability cause characteristics and Java statement characteristics corresponding to each vulnerability. The Java statement characteristics specifically include: dangerous functions and built-in objects that can be used directly without declaration.

[0059] In one embodiment of the present invention, built-in objects that can be used directly without declaration include: request, session, config, response, application, page, pageContext, out, exception. Dangerous functions include: getParameter(), getheaders(), password(), getcookies(), Runtime.exec(), upload(), getQueryString(), logger.info(), download().

[0060] The present invention preprocesses the input software source code, invokes a source code vulnerability analysis engine to analyze the preprocessed source code, and then matches it with a vulnerability rule library to generate a first vulnerability detection result. This first vulnerability detection result is a preliminary vulnerability detection result, and its accuracy can be improved. The following steps of the present invention determine the final vulnerability detection result based on the preliminary vulnerability detection result.

[0061] Step S102: Match each vulnerability in the first vulnerability detection result with a preset false alarm vulnerability library to obtain suspected false alarm vulnerabilities in the first vulnerability detection result.

[0062] In one embodiment of the present invention, a large number of software source code samples are tested for vulnerabilities and manually analyzed to identify false positive vulnerabilities. A statistical analysis method is then used to identify high false positive vulnerabilities, and a false positive vulnerability library is established based on these high false positive vulnerabilities. If a vulnerability in the false positive vulnerability library appears in any code test result, the vulnerability is identified as a suspected false positive and requires further audit.

[0063] Step S103 , for each of the suspected false alarm vulnerabilities, a preset auxiliary manual audit module is used to analyze whether there are dynamic factors that have a direct impact on the vulnerability, and obtain a false alarm analysis result corresponding to each of the suspected false alarm vulnerabilities.

[0064] In one embodiment of the present invention, the false alarm analysis result specifically includes: a false alarm vulnerability and a non-false alarm vulnerability.

[0065] The present invention establishes an auxiliary manual audit module for manually auditing vulnerabilities. The manual audit process of the source code can check and judge dynamic factors that cannot be solidified in the vulnerability rule library but have a direct impact on whether the vulnerability exists.

[0066] In one embodiment of the present invention, the dynamic factors specifically include: third-party frameworks and versions, filters, interceptors, custom filter functions, business logic, and external program conditions. The above information cannot be detected by static detection tools and requires manual verification by experienced auditors.

[0067] Step S104: Generate a second vulnerability detection result according to the false alarm analysis result.

[0068] In one embodiment of the present invention, this step determines non-false positive vulnerabilities among the suspected false positive vulnerabilities based on the false positive analysis results corresponding to each of the suspected false positive vulnerabilities, and then generates a second vulnerability detection result based on the non-false positive vulnerabilities and all other vulnerabilities in the first vulnerability detection result excluding the suspected false positive vulnerabilities. The second vulnerability detection result is the final detection result.

[0069] In one embodiment of the present invention, after the above step S104, the present invention further generates a detection report according to the second vulnerability detection result and implements a report export function.

[0070] In one embodiment of the present invention, the source code vulnerability analysis engine specifically includes: a semantic analysis engine, a control flow analysis engine, a data flow analysis engine, and a configuration analysis engine.

[0071] The semantic analysis engine is used to discover language functions or processes that are vulnerable to attacks; the control flow analysis engine is used to track the sequence of business operations and discover software security risks caused by unreasonable code structure; the data flow analysis engine is used to obtain information on how data flows on the execution path of the program; and the configuration analysis engine is used to discover policy vulnerabilities that violate rules in the software configuration file.

[0072] like Figure 2 As shown, in one embodiment of the present invention, the source code vulnerability detection method of the present invention further includes step S201 and step S202.

[0073] Step S201 : Statistically analyze the false positive vulnerabilities identified through manual auditing to determine high false positive vulnerabilities.

[0074] In one embodiment of the present invention, the present invention obtains the false alarm rate of each false alarm vulnerability through statistical analysis, and then determines the vulnerability with a false alarm rate higher than a preset value as a high false alarm vulnerability.

[0075] Step S202: establishing a false alarm vulnerability library based on the high false alarm vulnerabilities.

[0076] like Figure 3 As shown, in one embodiment of the present invention, the above step S103 specifically includes step S301 and step S302.

[0077] In step S301, the suspected false alarm vulnerabilities are sent to the auxiliary manual audit module, so that the auxiliary manual audit module determines the information that needs to be paid attention to and checked by the manual audit corresponding to each of the suspected false alarm vulnerabilities from the preset manual audit information library, and sends the information that needs to be paid attention to and checked by the manual audit to the auditor, so that the auditor can manually check each of the suspected false alarm vulnerabilities according to the information that needs to be paid attention to and checked by the manual audit.

[0078] In one embodiment of the present invention, the auxiliary manual audit module, based on expert audit experience, summarizes the information that requires attention and review for each type of high-false-positive vulnerability audit and establishes a manual audit information database. Based on the prompts provided by the manual audit information database, personnel can manually audit the source code and identify false positives.

[0079] Step S302: Obtain the false alarm analysis result corresponding to each of the suspected false alarm vulnerabilities sent by the auxiliary manual audit module, wherein the auditor sends the false alarm analysis result corresponding to each of the suspected false alarm vulnerabilities to the auxiliary manual audit module after completing the manual verification.

[0080] The source code vulnerability detection method of the present invention will be described below with reference to a specific example:

[0081] In the automated detection of source code, the false positive rate of SQL injection vulnerabilities is high. The main reason is that the tool cannot trace whether the source parameters have been filtered and intercepted. The SQL injection vulnerability audit process is used as an example. After the source code is automatically detected, the scan results show that there is a high-risk SQL injection vulnerability in the source code. According to the tool's false positive prediction module, the SQL injection vulnerability is determined to be a high false positive vulnerability and enters the auxiliary manual audit module. The auxiliary manual audit module will first prompt the reviewer to check the framework used by the program. For example, if it is confirmed through manual inspection that the Spring+Struts2+Hibernate framework is used, it will further prompt the Struts2 version and corresponding vulnerability information as well as the correct preprocessing method for Hibernate. Example of Struts2 version and corresponding vulnerability information:

[0082] S2-048 CVE-2017-9791 Struts 2.3.X

[0083] S2-046 CVE-2017-5638 Struts 2.3.5-2.3.31, Struts 2.5-2.5.10

[0084] S2-045 CVE-2017-5638 Struts 2.3.5-2.3.31, Struts 2.5-2.5.10

[0085] S2-037 CVE-2016-4438 Struts 2.3.20-2.3.28.1

[0086] S2-032 CVE-2016-3081 Struts 2.3.18-2.3.28

[0087] S2-020 CVE-2014-0094 Struts 2.0.0-2.3.16

[0088] S2-019 CVE-2013-4316 Struts 2.0.0-2.3.15.1

[0089] S2-016 CVE-2013-2251 Struts 2.0.0-2.3.15

[0090] S2-013 CVE-2013-1966 Struts 2.0.0-2.3.14

[0091] S2-009 CVE-2011-3923 Struts 2.0.0-2.3.1.1

[0092] S2-005 CVE-2010-1870 Struts 2.0.0-2.1.8.1

[0093] Hibernate preprocessing prompt information example:

[0094] Use the ? placeholder method for preprocessing:

[0095] String hql="select e from Tfequipmentfaultdetails e wheree.equipmentnumber=?";

[0096] Query query=session.createQuery(hql);

[0097] query.setString(0,repairNumber.trim());

[0098] query.setCacheable(true);

[0099] At the same time, the auxiliary manual audit module prompts you to check the filter configuration information in web.xml and the custom filter function inside the program. Example of filter configuration information in web.xml:

[0100]

[0101]

[0102] Follow the instructions above to review the relevant information in the program. If the program correctly preprocesses input parameters, properly configures filters, and uses custom filter functions, the SQL injection vulnerability in the automated scan results is a false positive. Otherwise, the vulnerability is real. You can also determine whether the corresponding CVE vulnerability exists based on the Struts 2 version.

[0103] It can be seen from the above embodiments that the source code vulnerability detection method of the present invention achieves at least the following beneficial effects:

[0104] 1. When establishing the vulnerability rule base, the present invention not only considers the principles and characteristic elements of vulnerability generation, but also analyzes dangerous functions in JAVA and built-in objects that can be used directly without declaration. It comprehensively defines the source code vulnerability rule base from the perspectives of the vulnerability itself and JAVA syntax characteristics, making the rule base more complete.

[0105] 2. The present invention defines a source code vulnerability initial inspection false alarm prediction module, performs expert manual analysis on the initial matching results based on the vulnerability rule library, and after testing and manual analysis of a large number of samples, uses statistical analysis methods to determine the high false alarm vulnerability library, laying the foundation for the next step of screening out false alarms.

[0106] 3. The present invention establishes an auxiliary manual audit module, summarizes the information that needs to be paid attention to and checked in the manual audit of each high false positive vulnerability, establishes a manual audit information database, improves the efficiency of manual audit, and at the same time provides guidance for the code audit work of people who lack audit experience, thereby improving work efficiency.

[0107] 4. When establishing a manual audit module, the present invention primarily considers dynamic factors that directly influence the existence of software vulnerabilities, including third-party frameworks and versions, filters, interceptors, custom filter functions, business logic, and external program conditions. Based on batch scanning and analysis based on a rule base, the present invention achieves precise identification of factors influencing vulnerability audit results, such as program filters and custom functions, thereby reducing the false positive rate.

[0108] It should be noted that the steps shown in the flowcharts of the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions, and that, although a logical order is shown in the flowcharts, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0109] Based on the same inventive concept, an embodiment of the present invention also provides a source code vulnerability detection device, which can be used to implement the source code vulnerability detection method described in the above embodiment, as described in the following embodiment. Since the principle of solving the problem by the source code vulnerability detection device is similar to that of the source code vulnerability detection method, the embodiment of the source code vulnerability detection device can refer to the embodiment of the source code vulnerability detection method, and the repeated parts will not be repeated. As used below, the term "unit" or "module" can be a combination of software and / or hardware that implements a predetermined function. Although the device described in the following embodiments is preferably implemented in software, implementation by hardware, or a combination of software and hardware, is also possible and conceived.

[0110] Figure 4 This is a first structural block diagram of a source code vulnerability detection device according to an embodiment of the present invention. Figure 4As shown, in one embodiment of the present invention, the source code vulnerability detection device of the present invention includes:

[0111] The vulnerability initial detection unit 1 is used to analyze the source code of the software through a preset source code vulnerability analysis engine and based on a preset vulnerability rule library to obtain a first vulnerability detection result;

[0112] Suspected false alarm vulnerability determination unit 2, configured to match each vulnerability in the first vulnerability detection result with a preset false alarm vulnerability library to obtain suspected false alarm vulnerabilities in the first vulnerability detection result;

[0113] The false alarm vulnerability analysis unit 3 is used to analyze, for each of the suspected false alarm vulnerabilities, whether there are dynamic factors that have a direct impact on the vulnerability through a preset auxiliary manual audit module, and obtain a false alarm analysis result corresponding to each of the suspected false alarm vulnerabilities;

[0114] The vulnerability detection result generating unit 4 is configured to generate a second vulnerability detection result according to the false alarm analysis result.

[0115] Figure 5 This is a second structural block diagram of the source code vulnerability detection device according to an embodiment of the present invention. Figure 5 As shown, in one embodiment of the present invention, the source code vulnerability detection device of the present invention further includes:

[0116] A high false positive vulnerability determination unit 5 is used to perform statistical analysis on the false positive vulnerabilities identified through manual auditing to determine high false positive vulnerabilities;

[0117] The false alarm vulnerability library establishing unit 6 is configured to establish a false alarm vulnerability library according to the high false alarm vulnerabilities.

[0118] like Figure 6 As shown, in one embodiment of the present invention, the false alarm vulnerability analysis unit 3 specifically includes:

[0119] The data sending module 301 is configured to send the suspected false alarm vulnerabilities to the auxiliary manual audit module, so that the auxiliary manual audit module determines the manual audit information that needs to be paid attention to and checked corresponding to each suspected false alarm vulnerability from a preset manual audit information library, and sends the manual audit information that needs to be paid attention to and checked to the auditor, so that the auditor can manually check each suspected false alarm vulnerability based on the manual audit information that needs to be paid attention to and checked;

[0120] The false alarm analysis result acquisition module 302 is used to obtain the false alarm analysis results corresponding to each of the suspected false alarm vulnerabilities sent by the auxiliary manual audit module, wherein the auditor sends the false alarm analysis results corresponding to each of the suspected false alarm vulnerabilities to the auxiliary manual audit module after completing the manual verification.

[0121] In order to achieve the above object, according to another aspect of the present application, a computer device is also provided. Figure 7 As shown, the computer device includes a memory, a processor, a communication interface and a communication bus. The memory stores a computer program that can be run on the processor. When the processor executes the computer program, the steps in the above embodiment method are implemented.

[0122] The processor may be a central processing unit (CPU). The processor may also be other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, or a combination of the above chips.

[0123] Memory, as a non-transitory computer-readable storage medium, can be used to store non-transitory software programs, non-transitory computer-executable programs, and units, such as the corresponding program units in the above-described method embodiments of the present invention. The processor executes the non-transitory software programs, instructions, and modules stored in memory to perform various processor functions and work data processing, thereby implementing the methods in the above-described method embodiments.

[0124] The memory may include a program storage area and a data storage area, wherein the program storage area may store an operating system, an application required for at least one function; the data storage area may store data created by the processor, etc. In addition, the memory may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one disk storage device, a flash memory device, or other non-volatile solid-state storage device. In some embodiments, the memory may optionally include a memory remotely located relative to the processor, and these remote memories may be connected to the processor via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0125] The one or more units are stored in the memory, and when executed by the processor, perform the method in the above embodiment.

[0126] The specific details of the above-mentioned computer device can be understood by referring to the corresponding descriptions and effects in the above-mentioned embodiments, and will not be repeated here.

[0127] In order to achieve the above-mentioned purpose, according to another aspect of the present application, a computer-readable storage medium is further provided, wherein the computer-readable storage medium stores a computer program, and the computer program implements the steps in the above-mentioned source code vulnerability detection method when executed in a computer processor. It can be understood by those skilled in the art that all or part of the processes in the above-mentioned embodiment method can be implemented by instructing the relevant hardware through a computer program, and the program can be stored in a computer-readable storage medium, and when the program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, the storage medium can be a magnetic disk, an optical disk, a read-only memory (ROM), a random access memory (RAM), a flash memory (Flash Memory), a hard disk drive (HDD) or a solid-state drive (SSD), etc.; the storage medium can also include a combination of the above-mentioned types of memory.

[0128] In order to achieve the above-mentioned purpose, according to another aspect of the present application, a computer program product is further provided, comprising a computer program / instruction, which implements the steps of the above-mentioned source code vulnerability detection method when executed by a processor.

[0129] Obviously, those skilled in the art will appreciate that the modules or steps of the present invention described above can be implemented using a general-purpose computing device. They can be centralized on a single computing device or distributed across a network of multiple computing devices. Alternatively, they can be implemented using program code executable by a computing device, which can then be stored in a storage device and executed by the computing device. Alternatively, they can be fabricated into separate integrated circuit modules, or multiple modules or steps can be fabricated into a single integrated circuit module for implementation. Thus, the present invention is not limited to any specific combination of hardware and software.

[0130] The foregoing description is merely a preferred embodiment of the present invention and is not intended to limit the present invention. Those skilled in the art will readily appreciate that various modifications and variations of the present invention are possible. Any modifications, equivalent substitutions, or improvements made within the spirit and principles of the present invention are intended to be within the scope of protection of the present invention.

Claims

1. A source code vulnerability detection method, characterized in that: Used to detect vulnerabilities in WEB source code developed based on JAVA, the method includes: The software source code is analyzed by a preset source code vulnerability analysis engine and based on a preset vulnerability rule library to obtain a first vulnerability detection result; the vulnerability rule library contains vulnerability cause characteristics and Java statement characteristics corresponding to each vulnerability, and the Java statement characteristics specifically include: dangerous functions and built-in objects that are directly used without declaration; the source code vulnerability analysis engine specifically includes: a semantic analysis engine, a control flow analysis engine, a data flow analysis engine and a configuration analysis engine; the semantic analysis engine is used to discover language functions or procedures that are vulnerable to attacks; the control flow analysis engine is used to track the sequence of business operations and discover software security risks caused by unreasonable code structure; the data flow analysis engine is used to obtain information on how data flows on the execution path of the program; the configuration analysis engine is used to discover policy vulnerabilities that violate rules in the software configuration file; Matching each vulnerability in the first vulnerability detection result with a preset false positive vulnerability library to obtain suspected false positive vulnerabilities in the first vulnerability detection result; For each of the suspected false positive vulnerabilities, a preset auxiliary manual audit module is used to analyze the dynamic factors that have a direct impact on whether the vulnerability exists, and obtain the false positive analysis results corresponding to each of the suspected false positive vulnerabilities. The auxiliary manual audit module is used to manually check and judge the dynamic factors that cannot be solidified in the vulnerability rule library but have a direct impact on whether the vulnerability exists. The dynamic factors specifically include: third-party frameworks and versions, filters, interceptors, custom filter functions, business logic, and external conditions of the program. The dynamic factors cannot be detected by static detection tools; the auxiliary manual audit module summarizes the information that needs to be paid attention to and checked for manual audits of each high false positive vulnerability based on expert audit experience, establishes a manual audit information database, and personnel manually audit the source code and make false positive judgments based on the prompt information provided by the manual audit information database; A second vulnerability detection result is generated according to the false alarm analysis result.

2. The source code vulnerability detection method according to claim 1, characterized in that: Also includes: Conduct statistical analysis on false positive vulnerabilities identified through manual audits to identify vulnerabilities with high false positive rates; A false positive vulnerability library is established based on the high false positive vulnerabilities.

3. The source code vulnerability detection method according to claim 1, characterized in that: For each of the suspected false alarm vulnerabilities, a preset auxiliary manual audit module is used to analyze whether there are dynamic factors that have a direct impact on the vulnerability, and obtain the false alarm analysis results corresponding to each of the suspected false alarm vulnerabilities, specifically including: The suspected false positive vulnerabilities are sent to the auxiliary manual audit module, so that the auxiliary manual audit module determines the manual audit information that needs attention and review corresponding to each of the suspected false positive vulnerabilities from a preset manual audit information library, and sends the manual audit information that needs attention and review to the auditor, so that the auditor manually reviews each of the suspected false positive vulnerabilities based on the manual audit information that needs attention and review; Obtain the false alarm analysis results corresponding to each of the suspected false alarm vulnerabilities sent by the auxiliary manual audit module, wherein the auditor sends the false alarm analysis results corresponding to each of the suspected false alarm vulnerabilities to the auxiliary manual audit module after completing the manual verification.

4. A source code vulnerability detection device, characterized in that: Used to detect vulnerabilities in WEB source code developed based on JAVA, the device includes: The vulnerability initial detection unit is used to analyze the source code of the software through a preset source code vulnerability analysis engine and based on a preset vulnerability rule library to obtain a first vulnerability detection result; the vulnerability rule library contains vulnerability cause characteristics and Java statement characteristics corresponding to each vulnerability, and the Java statement characteristics specifically include: dangerous functions and built-in objects that are directly used without declaration; the source code vulnerability analysis engine specifically includes: a semantic analysis engine, a control flow analysis engine, a data flow analysis engine and a configuration analysis engine; the semantic analysis engine is used to discover language functions or procedures that are vulnerable to attack; the control flow analysis engine is used to track the sequence of business operations and discover software security risks caused by unreasonable code structure; the data flow analysis engine is used to obtain information on how data flows on the execution path of the program; the configuration analysis engine is used to discover policy vulnerabilities that violate rules in the software configuration file; a suspected false alarm vulnerability determination unit, configured to match each vulnerability in the first vulnerability detection result with a preset false alarm vulnerability library to obtain the suspected false alarm vulnerabilities in the first vulnerability detection result; The false alarm vulnerability analysis unit is used to analyze, for each of the suspected false alarm vulnerabilities, the dynamic factors that have a direct impact on the existence of the vulnerability through a preset auxiliary manual audit module, and obtain the false alarm analysis results corresponding to each of the suspected false alarm vulnerabilities. The auxiliary manual audit module is used to manually check and judge the dynamic factors that cannot be solidified in the vulnerability rule library but have a direct impact on the existence of the vulnerability. The dynamic factors specifically include: third-party frameworks and versions, filters, interceptors, custom filter functions, business logic, and external conditions of the program. The dynamic factors cannot be detected by static detection tools; the auxiliary manual audit module summarizes the information that needs to be paid attention to and checked for manual audit of each high false alarm vulnerability based on expert audit experience, establishes a manual audit information library, and personnel manually audit the source code and make false alarm judgments based on the prompt information provided by the manual audit information library; The vulnerability detection result generating unit is used to generate a second vulnerability detection result according to the false alarm analysis result.

5. The source code vulnerability detection device according to claim 4, characterized in that: Also includes: A high false positive vulnerability determination unit is used to perform statistical analysis on false positive vulnerabilities identified through manual audits to determine high false positive vulnerabilities; The false alarm vulnerability library establishing unit is used to establish a false alarm vulnerability library according to the high false alarm vulnerabilities.

6. The source code vulnerability detection device according to claim 4, characterized in that: The false alarm vulnerability analysis unit specifically includes: a data sending module, configured to send the suspected false positive vulnerabilities to the auxiliary manual audit module, so that the auxiliary manual audit module determines, from a preset manual audit information database, information that requires attention and review in the manual audit corresponding to each of the suspected false positive vulnerabilities, and sends the information that requires attention and review in the manual audit to the auditor, so that the auditor performs manual review on each of the suspected false positive vulnerabilities based on the information that requires attention and review in the manual audit; The false alarm analysis result acquisition module is used to obtain the false alarm analysis results corresponding to each of the suspected false alarm vulnerabilities sent by the auxiliary manual audit module, wherein the auditor sends the false alarm analysis results corresponding to each of the suspected false alarm vulnerabilities to the auxiliary manual audit module after completing the manual verification.

7. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 3 are implemented.

8. A computer-readable storage medium having a computer program / instruction stored thereon, characterized in that: When the computer program / instructions are executed by a processor, the steps of the method according to any one of claims 1 to 3 are implemented.

9. A computer program product comprising a computer program / instructions, characterized in that When the computer program / instructions are executed by a processor, the steps of the method according to any one of claims 1 to 3 are implemented.

Images