A method for supplementing missing semantics of static analysis based on a network framework

Abstract

The application discloses a method for supplementing missing semantics in static analysis based on a network framework, which comprises the following steps: obtaining an execution log of a target network application, wherein the target network application is generated based on a target network framework; extracting configuration marks from the target network application based on the execution log; performing correlation analysis on the configuration marks to obtain supplemented semantics; and supplementing the missing semantics in static analysis based on the supplemented semantics. By automatically mining the execution log at runtime to obtain configuration marks, and then performing correlation analysis to accurately, quickly and effectively obtain the missing semantics for supplement, the application effectively improves the analysis capability of a static analysis tool, and compared with the manual writing mode of researchers, the application not only efficiently solves the problem of missing semantics caused by network framework configuration in static analysis, but also saves a large amount of time and human resources.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network service, and in particular to a method for supplementing missing semantics in static analysis based on a network framework. BACKGROUND

[0002] Modern web applications are built based on one or more web frameworks. These frameworks usually provide multiple forms of configuration for the user, and rely on dynamic language features in the implementation of the framework, so it is difficult to perform static analysis on the entire program or only on the application code. Existing methods enhance the ability of static analysis based on web framework applications by adding mapping rules of framework configuration to static analysis semantics to simulate the potential behavior of the framework. The concept of static program analysis affected by web frameworks can be divided into two categories, one is the missing behavior semantics caused by the active call of the framework to the application code, and the other is the missing object semantics caused by the object management of the framework at runtime. Both concepts describe the information required for static analysis, but it is usually not directly obtained through pure code analysis. In the prior art, manual configuration by technical personnel not only faces the problem of configuration amount caused by different types and version updates of the framework, but also requires certain professional knowledge of the characteristics of different frameworks and the field of static analysis, which makes it a highly demanding and time-consuming work to manually supplement the missing semantics in the static analysis process according to the network framework configuration. SUMMARY

[0003] Therefore, the embodiments of the present application provide a method for supplementing missing semantics in static analysis based on a network framework, to solve the problem of low efficiency of supplementing missing semantics in static analysis in the prior art.

[0004] To achieve the above object, the present application provides the following technical scheme:

[0005] The embodiments of the present application provide a method for supplementing missing semantics in static analysis based on a network framework, comprising:

[0006] obtaining an execution log of a target network application, wherein the target network application is generated based on a target network framework;

[0007] extracting a configuration mark corresponding to a preset missing semantics from the target network application based on the execution log;

[0008] performing correlation analysis on the configuration mark to obtain a supplemented semantics;

[0009] supplementing the missing semantics in static analysis based on the supplemented semantics.

[0010] Optionally, the obtaining of the execution log of the target network application comprises:

[0011] matching the target network application with a preset instrumentation tool;

[0012] The preset instrumentation tool inserts multiple recorders into the target network application according to the matching result, records running information during running after the target network application is started, and generates a running log.

[0013] Optionally, the extracting, from the target network application, a configuration marker corresponding to the preset missing semantics based on the execution log comprises:

[0014] performing semantic analysis on the execution log to obtain program execution semantics;

[0015] obtaining a program code segment corresponding to the program execution semantics according to a correspondence between the program execution semantics and program code in the target network application;

[0016] matching the program code segment with a code segment of the preset missing semantics, and establishing a mapping between the preset missing semantics and the program code segment according to a matching result;

[0017] extracting, from the target network application, a configuration marker corresponding to the program code segment.

[0018] Optionally, the performing semantic analysis on the execution log to obtain program execution semantics comprises:

[0019] extracting execution order information and call point information from the execution log to construct a dynamic call graph with attached information, the attached information being information reflecting a mapping relationship between a call point and a call target in the execution log;

[0020] extracting entry point semantics and non-entry point semantics according to the call relationship by traversing the dynamic call graph;

[0021] extracting indirect call semantics according to the attached information by traversing the dynamic call graph;

[0022] extracting running information related to field semantics from the execution log to obtain injected field semantics and ordinary field semantics.

[0023] Optionally, the extracting entry point semantics and non-entry point semantics according to the call relationship by traversing the dynamic call graph comprises:

[0024] performing node analysis on the dynamic call graph to obtain root nodes and non-root nodes;

[0025] extracting an entry point semantic from the target network application through the root node, and extracting a non-entry point semantic from the target network application based on the non-root node.

[0026] Optionally, the association analysis on the configuration mark obtains a supplementary semantic, comprising:

[0027] extracting a predicted missing semantic associated with each configuration mark from a preset association database;

[0028] comparing the association degree between the predicted missing semantic and the corresponding configuration mark with a preset threshold, and taking the predicted missing semantic with the association degree higher than the preset threshold as the supplementary semantic.

[0029] Optionally, the method further comprises:

[0030] obtaining historical execution logs of a plurality of network applications and extracting historical configuration marks corresponding to preset missing semantics from the plurality of network applications based on the historical execution logs;

[0031] extracting key configuration marks from the historical configuration marks according to the occurrence frequency of the configuration marks;

[0032] calculating the association degrees of all preset missing semantics based on the key configuration marks;

[0033] establishing the association database based on the calculated association degrees between the historical configuration marks.

[0034] The embodiment of the application further provides a device for supplementing missing semantics in static analysis based on a network framework, comprising:

[0035] an obtaining module, configured to obtain an execution log of a target network application, wherein the target network application is generated based on a target network framework;

[0036] an extracting module, configured to extract configuration marks corresponding to preset missing semantics from the target network application based on the execution log;

[0037] an analyzing module, configured to perform association analysis on the configuration marks to obtain a supplementary semantic;

[0038] a supplementing module, configured to supplement missing semantics in static analysis based on the supplementary semantic.

[0039] The embodiment of the application further provides an electronic device, comprising:

[0040] A memory and a processor are connected in communication with each other, the memory stores computer instructions, and the processor executes the computer instructions to perform the method for supplementing missing semantics of static analysis based on a network framework according to an embodiment of the present application.

[0041] The embodiment of the present application further provides a computer readable storage medium storing computer instructions for causing a computer to execute the method for supplementing missing semantics of static analysis based on a network framework according to an embodiment of the present application.

[0042] The technical scheme of the present application has the following advantages:

[0043] The present application provides a method for supplementing missing semantics of static analysis based on a network framework, which comprises the following steps: obtaining an execution log of a target network application program, the target network application program being generated based on a target network framework; extracting a configuration mark from the target network application program based on the execution log; performing correlation analysis on the configuration mark to obtain supplemental semantics; and supplementing missing semantics in static analysis based on the supplemental semantics. BRIEF DESCRIPTION OF DRAWINGS

[0044] In order to more clearly illustrate the technical scheme in the specific embodiments of the present application or the prior art, the drawings needed in the following description of the specific embodiments or the prior art will be briefly introduced. Obviously, the drawings in the following description are some embodiments of the present application, and those skilled in the art can also obtain other drawings according to these drawings without creative labor.

[0045] Figure 1 The flowchart of the method for supplementing missing semantics of static analysis based on a network framework in the embodiment of the present application;

[0046] Figure 2 The flowchart of generating a running log according to the embodiment of the present application;

[0047] Figure 3 The flowchart of extracting a configuration mark from a target network application program according to the embodiment of the present application;

[0048] Figure 4 The flowchart of analyzing to obtain program execution semantics according to the embodiment of the present application;

[0049] Figure 5 A flow chart for extracting entry point semantics and non-entry point semantics according to an embodiment of the present application;

[0050] Figure 6 A flow chart for obtaining supplementary semantics through correlation analysis according to an embodiment of the present application;

[0051] Figure 7 A flow chart for establishing a correlation database according to an embodiment of the present application;

[0052] Figure 8 A structural schematic diagram of a device for supplementing missing semantics of static analysis based on a network framework according to an embodiment of the present application;

[0053] Figure 9 A structural schematic diagram of an electronic device according to an embodiment of the present application. DETAILED DESCRIPTION

[0054] In order to make the objects, technical solutions and advantages of the embodiments of the present application clearer, the technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are some but not all of the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by a person of ordinary skill in the art without creative work fall within the protection scope of the present application.

[0055] According to an embodiment of the present application, a method embodiment for supplementing missing semantics of static analysis based on a network framework is provided. It should be noted that the steps shown in the flow chart of the drawings can be executed in a computer system such as a group of computer executable instructions, and although a logical order is shown in the flow chart, in some cases, the steps shown or described herein can be executed in an order different from that shown herein.

[0056] In the present embodiment, a method for supplementing missing semantics of static analysis based on a network framework is provided, which can be used in the terminal device described above, such as a computer, etc. Figure 1 As shown in the figure, the method for supplementing missing semantics of static analysis based on a network framework includes the following steps:

[0057] Step S1: Obtain an execution log of a target network application, the target network application being generated based on a target network framework.

[0058] Step S2: Extract configuration markers corresponding to preset missing semantics from the target network application based on the execution log.

[0059] Step S3: Obtain supplementary semantics through correlation analysis of the configuration markers.

[0060] Step S4: supplementing the missing semantics in static analysis based on supplementary semantics.

[0061] Through the above steps S1 to S4, the method for supplementing missing semantics in static analysis based on a network framework provided by the embodiment of the present application, by automatically mining the execution log at runtime to obtain the configuration identifier, and then accurately, quickly and effectively obtaining the missing semantics for supplement through correlation analysis, effectively improves the analysis capability of the static analysis tool, and compared with the manual writing method of the researchers, not only efficiently solves the problem of semantic missing caused by network framework configuration in static analysis, but also saves a lot of time and human resources.

[0062] Specifically, in an embodiment, the above step S1 specifically includes the following steps as shown in the following table: Figure 2

[0063] Step S11: matching the target network application program with the preset instrumentation tool. Specifically, input the web application archive (.war) or the runnable Java archive file (.jar) into the preset instrumentation tool, and install multiple recorders at specific positions of the program through the preset instrumentation tool.

[0064] Step S12: inserting multiple recorders into the target network application program according to the matching result by the preset instrumentation tool, recording the running information in the running process after the target network application program is started, and generating the running log. Specifically, the running information represents the real program running state, and the key tracking is recorded by using special tags. High-performance bytecode tools such as Javassist tools can be used to operate Java bytecode, so that class modification can be performed when the class is loaded by the JVM (Java Virtual Machine). The positions of the inserted special recorders are as follows:

[0065] • The entry point and the exit point of each application method.

[0066] • All call points and return points of each application method.

[0067] • All field access instructions (read / write) in each application method.

[0068] In addition to the special identifier representing the position, the runtime thread number is also needed to ensure the sequence. Each recorder will record the declaration information of the instruction and the value of the object used at runtime. In particular, for the starting position of the program, if the program is not static, the runtime information of all fields belonging to the current (this) object will also be recorded when the program is executed.

[0069] ​Specifically, in an embodiment, before step S2, the method further comprises: traversing each record in the execution log, and deleting the abnormal record which needs to be identified or eliminated. Specifically, the abnormal record can be deleted by using the bracket matching method. By deleting the abnormal record, the reliability of the log content can be enhanced, and the subsequent information processing accuracy can be improved.

[0070] obtaining a thread identification number of each row record in the execution log; grouping the row records according to the thread identification number to obtain a plurality of record sets; and sorting the record sets according to the size of the thread identification number. Specifically, the execution log contains runtime call and pointing information, and each row of runtime information recorded herein is a record. Since the records under multiple runtime tracking and different threads can be interlaced, the original output of the execution log can be chaotic. The record interlacing problem can be solved by grouping the records according to the thread identification number, and these ordered records under the same thread are regarded as a record set. The record set describes the characteristics of the application code triggered by the framework or external action. By using all runtime tracking to construct a dynamic call graph (DCG) of the application program, subsequent convenience and analysis can be more facilitated, wherein each node represents an application program, and the directed edge represents the call of the program. In the call graph, even if the call target adopts the same call method, they are regarded as different call targets. The call point, return point and field read / write information belonging to the program are also recorded in each node, and all call methods will be different due to the call point. The root of the call graph or the child nodes of the same node are arranged in order, and the order depends on the runtime order.

[0071] Specifically, in an embodiment, step S2 comprises the following steps as shown in Figure 3

[0072] Step S21: performing semantic analysis on the execution log to obtain program execution semantics.

[0073] Step S22: obtaining a program code segment corresponding to the program execution semantics according to the correspondence between the program execution semantics and the program code in the target network application program. Specifically, since the semantics correspond to the program code segment, the program corresponds to the network framework configuration, and the existing static analysis method usually does not consider the network framework characteristics and the network framework itself is difficult to be directly statically analyzed, thereby causing the lack of semantics caused by the framework during analysis and affecting the static analysis ability.

[0074] Step S23: matching the program code segment with the preset missing semantic code segment, and establishing a mapping between the preset missing semantics and the program code segment according to the matching result. Specifically, the preset missing semantics is defined in advance according to the existing work and the object-oriented language characteristics, and can be supplemented according to the actual situation.​

[0075] Step S24: Extracting configuration markers corresponding to program code fragments from target network application. Specifically, configuration marker types include annotations and external files (e.g., XML format external files). In the absence of the above configurations, extending framework functionality by subclassing will also be taken into account. Annotation and subclassing configuration markers and values can be obtained directly, while XML configuration markers and values can be obtained by traversing the XML node structure. By using static analysis framework, a dynamic call graph is constructed from the input binary file by class hierarchy algorithm. For entry node semantics and non-entry node semantics, corresponding program code fragments are searched, and corresponding configuration markers are extracted according to the program code fragments. The form of an entry point marker is: .

[0076] The positive set is the set of associations between entry node semantics and call configuration markers, and the negative set is the set of associations between non-entry node semantics and call configuration markers.

[0077] The normal field configuration marker set is obtained according to the configuration markers on the program fragments corresponding to each normal field semantics. The form of each configuration marker is {x | x ∈ mark_field}. The injected field configuration marker set is obtained according to the configuration markers on the program fragments corresponding to each injected field semantics.

[0078] The relationship between field references and objects can be solved by querying the mapping of each field to all its possible runtime types. For each field and runtime type pair (such as <field, type runtime>), find the connection between the field and the class in the feature set shown in Table I. When there is any pair of features on the field and features on the class that match, it is considered to have a connection. For each injected field, if a connection is found, the connection will be a pointer marker. By extracting the marker on the field and recording the marker with the matching feature value, the form is: .

[0079] At the same time, the matching feature on the class is considered as an alias marker. If no connection is found, but the field belongs to the injected field set, only record the marker directly on the field. For fields that are not injected but have a connection found, the connection does not belong to the pointer marker.

[0080] Table I Configuration features related to fields and classes

[0081]

[0082] Specifically, in an embodiment, the above-mentioned step S21, as shown in Figure 4 , specifically includes the following steps:

[0083] Step S211: Extracting execution order information and call site information from the execution log to construct a dynamic call graph with attached information, which is the information in the execution log reflecting the mapping relationship between the call site and the call target. Specifically, each node in the dynamic call graph represents an application function, and the directed edge represents the call of the program. In the call graph, even if the same signature node appears multiple times, they are considered as different nodes because their call context is different. The attached information is the call site, return site, field read / write information recorded on each node.

[0084] Step S212: According to the call relationship, the dynamic call graph is traversed to extract the entry point semantics and non-entry point semantics.

[0085] Step S213: According to the attached information, the dynamic call graph is traversed to extract the indirect call semantics. Specifically, the call site and call target pairs are extracted from the attached information of the dynamic call graph, and the call semantics in which the call site is the framework interface is filtered out. Indirect call is the process that the framework API triggers the indirect call of the application: by finding the corresponding indirect call log record matching the pattern pair (application invoke framework and framework invoke application); extracting the configuration of the program to which the framework call belongs, the framework call statement and the configuration of the indirect target; the caller configuration, the call statement and the target configuration constitute the indirect call configuration. The process of application code calling framework API can be obtained through the call site record in the execution log. The application triggered by calling the framework API will meet the following conditions:

[0086] • In the execution path, the target called after a framework API call site and before its call return.

[0087] • The target has no matching call site.

[0088] Step S214: Extracting field semantics related running information from the execution log to obtain injected field semantics and ordinary field semantics. Specifically, by analyzing the execution log, the configuration markers of the field pointing to the target are determined: the reference injected by the framework and the object injected by the field. By determining the configuration connection between the reference and the injected object, it is indicated that the object is injected into the field. Extract the configuration markers on the to-be-injected field and the to-be-injected object as the candidate semantic marker set. And distinguish the framework injected field and the ordinary field in order to carry out the subsequent key configuration marker mining. All field access (read / write) records and field runtime information can be collected by establishing a dynamic call graph and traversing the dynamic call graph. In the execution log, the injected field may be reflected in the following cases:

[0089] • The field is used at runtime, or its reference does not point to null value;

[0090] • At runtime, the method to set the field value is called by the framework or never.

[0091] Collect all fields that meet the above conditions, and then map each field to all possible runtime types by performing record. Similarly, a normal field indicating that the field is not injected by the framework will meet any of the following conditions:

[0092] • The field reference always points to null value at runtime.

[0093] • There is at least one method to set the field value called by the application code, so that the field points to an object.

[0094] The objects created and managed by the framework not only include base class objects and parameter of entry method, but also include objects bound to references. Considering that the configuration may support user-defined names of classes, methods or fields, the concept of alias is used to describe different representations of a target.

[0095] Specifically, in an embodiment, the above-mentioned step S212, as shown in Figure 5 , specifically includes the following steps:

[0096] Step S2121: Node analysis is performed on the dynamic call graph to obtain root nodes and non-root nodes. Specifically, node information and the corresponding call situation of each node can be obtained through the actual call situation of the call point in the dynamic call graph. When the call point and the called party share the same method signature, or the class of the called party is a subclass or implementation class of the call point declaration class, it is considered that the call point matches the called party. The root node of the dynamic call graph is the entry node, and the non-root node has no matching call point information.

[0097] Step S2122: The entry point semantics are extracted from the target network application through the root node, and the non-entry point semantics are extracted from the target network application based on the non-root node.

[0098] Specifically, in an embodiment, the above-mentioned step S3, as shown in Figure 6 , specifically includes the following steps:

[0099] Step S31: Extract the predicted missing semantics associated with each configuration marker from the preset association database.

[0100] Step S32: Compare the association degree between the predicted missing semantics and the corresponding configuration marker with the preset threshold, and take the predicted missing semantics with an association degree higher than the preset threshold as the supplementary semantics.

[0101] Specifically, according to the correlation degree, the predicted configuration markers associated with each configuration marker can be obtained, and then the missing semantics with a large possibility of appearing can be accurately screened out as the supplementary semantics by comparing with a preset threshold.

[0102] Specifically, in an embodiment, the step S3 described above specifically includes the following steps: Figure 7 As shown in the figure, specifically includes the following steps:

[0103] Step S301: Obtain the historical execution logs of a plurality of network application programs and extract the historical configuration markers corresponding to the preset missing semantics from the plurality of network application programs based on the historical execution logs. Specifically, the process can refer to the processes of steps S1 and S2, which will not be described here again.

[0104] Step S302: Extract the key configuration markers from the historical configuration markers according to the occurrence frequency of the configuration markers. Specifically, the Apriori algorithm can be used for frequent item set mining calculation. The Apriori algorithm takes a given database as input and uses k-itemset to mine k+1-itemset. Through layer-by-layer search, the search space is reduced by using the Apriori characteristic, and finally the frequent item set is generated. The configuration markers with high occurrence frequency are screened as the key configuration markers. The screening process can be performed by comparing the occurrence frequency of all configuration markers with a threshold in a preset frequency threshold manner.

[0105] Step S303: Calculate the correlation degree of all preset missing semantics based on the key configuration markers.

[0106] Step S304: Establish an association database based on the correlation degree between the historical configuration markers calculated. Specifically, establishing an association database is a process of discovering various related information behind a large amount of data. For example, an association rule is an expression of meaning, denoted as A B, which reflects the relationship between elements in the database. Support and confidence are two key indicators in association rule mining. Support represents the frequency of the item set appearing in the data set. Confidence represents the percentage of all transactions that meet A and B at the same time.

[0107] For example, Table II is a database containing 5 transactions. The support is set to 0.5, and the frequent item sets are {A}, {B}, {C}, {D}, {A, B} and {A, D}. For the frequent item set {A, B}, the support is 0.6, that is, the probability of A and B appearing at the same time is 0.6. This frequent item set has two association rules, denoted as A B and B A. The confidence (A B) = 0.75 means that the probability of B appearing is 0.75 when A appears. For the second rule, the confidence is 1, which means that A will appear when B appears.

[0108] Table II Mining example database

[0109]

[0110] The association rules can effectively reflect the relationship between the configuration marks. By establishing the association database, each configuration mark can be found more quickly and accurately in the subsequent query process.

[0111] By analyzing the historical execution logs of multiple network application programs and establishing a preset configuration database according to the semantic correspondence between the historical configuration marks and the code fragments, the framework configuration corresponding to the missing semantics can be extracted from the preset configuration database based on the missing semantics when the missing semantics is found, so as to supplement the configuration of the target network framework.

[0112] Specifically, in an embodiment, the method further includes: constructing a configuration specification according to the configuration marks. Specifically, through each entity in the positive / negative configuration set, the entity is marked with an "IS" tag or a "NOT" tag according to the source of the entity. Each entity in the positive / negative configuration set is used for mining.

[0113] • The minimum support used in the Apriori algorithm is set to 1 / len(marks set), so as to ensure that all item combinations are relevant and these combinations appear at least once in the database.

[0114] • Calculate the frequent item set and the association rule: extract all item sets containing "IS", and calculate all possible association rules between the item sets. The form of the association rule will be similar to:

[0115]

[0116] When the left constraint condition is satisfied, the given concept will be satisfied. For each generated association rule, the confidence thereof needs to be calculated and recorded.

[0117] • Query the configuration specification: after mining the frequent item set and the association rule of each concept, the configuration specification containing the mapping of the analysis concept to the configuration mark is queried. The user can select the confidence value according to the requirement. The higher the confidence value, the fewer the filtered results. After the confidence value is selected, the association rule "{x | x e marks} IS" configuration specification that satisfies the confidence under each semantic is filtered out. Wherein each concept is generated and its configuration mark:

[0118] • Entry point attention association rule, contains: "IS" and the configuration tag corresponding to the semantics. Filtered out the tag and the key configuration tag of the entry point semantics under the given confidence condition.

[0119] • Field injection and pointing concept, used to represent the form of injection field and pointing pair will be similar to <{x | x ∈ markinject}, {y | y ∈ markpoints to}>, determined by selecting association rules, such as "{x, y} IS". When a rule meets the given confidence, x represents that the framework will inject a field with such configuration tag. At the same time, the configuration y means that the field reference will point to the target configured in the tag.

[0120] • Indirect call, the form (mcallee, API, mtarget) represents the framework API, the configuration tag of the method calling the API and the method triggered by the API.

[0121] • Call sequence, need to filter <mpre, mlater> to obtain the configuration tag of the call sequence with the given confidence.

[0122] • Others: for alias and framework management class semantics, due to the simplicity of the set composition, the tag can be directly calculated as the final result.

[0123] The reflection of the analysis level concept in the framework configuration can be derived by specific implementation. In actual application, only when the application program is deployed on the relevant framework, the method in the embodiment of the application is used to generate the specification, without reading and understanding the lengthy framework reference.

[0124] In the embodiment, a device for supplementing missing semantics of static analysis based on a network framework is also provided, which is used to implement the above-mentioned embodiments and preferred embodiments, and details are not described herein. As used below, the term "module" can be a combination of software and / or hardware that implements a predetermined function. Although the device described in the following embodiments is preferably implemented in software, hardware, or a combination of software and hardware is also possible and is contemplated.

[0125] The embodiment provides a device for supplementing missing semantics of static analysis based on a network framework, as shown in Figure 8 , comprising:

[0126] The acquisition module 101 is configured to acquire an execution log of a target network application program, the target network application program being generated based on a target network framework, and details are described in the related description of step S1 in the above-mentioned method embodiment, which will not be described herein.

[0127] The extraction module 102 is used to extract configuration tags corresponding to preset missing semantics from the target network application based on the execution log. For details, please refer to the relevant description of step S2 in the above method embodiment, which will not be repeated here.

[0128] Analysis module 103 is used to perform association analysis on configuration tags to obtain supplementary semantics. For details, please refer to the relevant description of step S3 in the above method embodiment, which will not be repeated here.

[0129] The supplementary module 104 is used to supplement the missing semantics in the static analysis based on the supplementary semantics. For details, please refer to the relevant description of step S4 in the above method embodiment, which will not be repeated here.

[0130] In this embodiment, the device for supplementing missing semantics in static analysis based on a network framework is presented in the form of a functional unit. Here, a unit refers to an ASIC circuit, a processor and memory that execute one or more software or fixed programs, and / or other devices that can provide the above functions.

[0131] Further functional descriptions of the above modules are the same as those in the corresponding embodiments described above, and will not be repeated here.

[0132] According to embodiments of the present invention, an electronic device is also provided, such as... Figure 9 As shown, the electronic device may include a processor 901 and a memory 902, wherein the processor 901 and the memory 902 may be connected via a bus or other means. Figure 9 Taking the example of a connection between China and Israel via a bus.

[0133] Processor 901 can be a central processing unit (CPU). Processor 901 can also be other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, or combinations of the above types of chips.

[0134] The memory 902, as a non-transitory computer readable storage medium, can be used to store non-transitory software programs, non-transitory computer executable programs and modules, such as program instructions / modules corresponding to the methods in the method embodiments of the present application. The processor 901 performs various functional applications and data processing of the processor by running the non-transitory software programs, instructions and modules stored in the memory 902, that is, implements the methods in the above method embodiments.

[0135] The memory 902 can include a program storage area and a data storage area, wherein the program storage area can store an operating system, application programs required by at least one function; and the data storage area can store data created by the processor 901 and the like. In addition, the memory 902 can include a high-speed random access memory, and can also include a non-transitory memory, such as at least one magnetic disk storage device, a flash memory device, or other non-transitory solid-state memory device. In some embodiments, the memory 902 can optionally include a memory disposed remotely with respect to the processor 901, which can be connected to the processor 901 through a network. Examples of the above network include but are not limited to the Internet, an intranet, a local area network, a mobile communication network, and a combination thereof.

[0136] One or more modules are stored in the memory 902, and when executed by the processor 901, perform the methods in the above method embodiments.

[0137] The above electronic device specific details can be understood in correspondence with the above method embodiments corresponding to the relevant description and effects, which will not be described here.

[0138] Those skilled in the art can understand that all or part of the processes in the above method embodiments can be completed by a computer program instructing related hardware, and the program can be stored in a computer readable storage medium. When the program is executed, it can include the processes of the above method embodiments. The storage medium can be a magnetic disk, an optical disk, a read-only memory (ROM), a random access memory (RAM), a flash memory, a hard disk drive (HDD) or a solid state drive (SSD), etc. The storage medium can also include a combination of the above types of memories.

[0139] Although the embodiments of the present application are described in conjunction with the accompanying drawings, various modifications and changes can be made by those skilled in the art without departing from the spirit and scope of the present application, and such modifications and changes fall within the scope defined by the appended claims.

Claims

1. A method for supplementing missing semantics in static analysis based on a network framework, characterized in that, include: Obtain the execution logs of the target network application, which is generated based on the target network framework; Based on the execution log, configuration tags corresponding to preset missing semantics are extracted from the target network application; The configuration tags are analyzed to obtain supplementary semantics; The missing semantics in the static analysis are supplemented based on the aforementioned supplementary semantics; The step of extracting configuration tags corresponding to preset missing semantics from the target network application based on the execution log includes: Semantic analysis is performed on the execution log to obtain the program execution semantics; Based on the correspondence between the program execution semantics and the program code in the target network application, the program code fragment corresponding to the program execution semantics is obtained; The program code fragment is matched with the code fragment with the preset missing semantics, and a mapping between the preset missing semantics and the program code fragment is established based on the matching result; Extract the configuration tags corresponding to the program code fragment from the target network application; The semantic analysis of the execution log to obtain program execution semantics includes: Execution order information and call point information are extracted from the execution log to construct a dynamic call graph with supplementary information, wherein the supplementary information is information in the execution log that reflects the mapping relationship between call points and call targets. Perform node analysis on the dynamic call graph to obtain the root node and non-root nodes; Entry point semantics are extracted from the target network application through the root node, and non-entry point semantics are extracted from the target network application based on the non-root nodes; The indirect call semantics are extracted by traversing the dynamic call graph based on the aforementioned supplementary information. Extract runtime information related to field semantics from the execution log to obtain injected field semantics and ordinary field semantics.

2. The method for supplementing missing semantics in static analysis based on a network framework according to claim 1, characterized in that, The acquisition of the target network application's execution logs includes: Match the target network application with a preset instrumentation tool; The preset instrumentation tool inserts multiple recorders into the target network application based on the matching results, and records the running information during the operation of the target network application after it is started, generating a running log.

3. The method for supplementing missing semantics in static analysis based on a network framework according to claim 1, characterized in that, The supplementary semantics obtained by performing association analysis on the configuration tags include: Extract the predicted missing semantics associated with each configuration tag from the preset association database; The correlation between the predicted missing semantics and the corresponding configuration tag is compared with a preset threshold, and the predicted missing semantics with a correlation higher than the preset threshold are used as supplementary semantics.

4. The method for supplementing missing semantics in static analysis based on a network framework according to claim 3, characterized in that, The method further includes: Obtain historical execution logs of multiple network applications and extract historical configuration tags corresponding to preset missing semantics from the multiple network applications based on the historical execution logs; Extract key configuration tags from the historical configuration tags based on their frequency of occurrence; The correlation degree of all preset missing semantics is calculated based on the key configuration tags; The association database is established based on the calculated correlation between each historical configuration tag.

5. An apparatus for supplementing missing semantics in static analysis based on a network framework, applied to the method for supplementing missing semantics in static analysis based on a network framework as described in any one of claims 1-4, characterized in that, include: The acquisition module is used to acquire the execution logs of the target network application, which is generated based on the target network framework; The extraction module is used to extract configuration tags corresponding to preset missing semantics from the target network application based on the execution log; The analysis module is used to perform association analysis on the configuration tags to obtain supplementary semantics; The supplementary module is used to supplement the missing semantics in the static analysis based on the supplementary semantics.

6. An electronic device, characterized in that, include: A memory and a processor are communicatively connected, the memory stores computer instructions, and the processor executes the computer instructions to perform the method for supplementing missing semantics in static analysis based on a network framework, as described in any one of claims 1-4.

7. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions for causing a computer to perform the method for supplementing missing semantics in static analysis based on a network framework, as described in any one of claims 1-4.

Images