A method for joint detection of taint analysis and symbolic execution based on human-computer cooperation
By combining human-machine collaborative taint analysis with symbolic execution detection, the problems of low efficiency and low accuracy in software interface misuse detection are solved, achieving efficient and accurate software interface defect detection and improving software robustness and security.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- NO 30 INST OF CHINA ELECTRONIC TECH GRP CORP
- Filing Date
- 2023-08-21
- Publication Date
- 2026-05-22
Smart Images
Figure CN116860655B_ABST
Abstract
Description
Technical Field
[0001] This invention belongs to the field of network security technology and is applied to the process of software interface defect detection. Specifically, it is a method for joint detection of taint analysis and symbolic execution based on human-machine collaboration. Background Technology
[0002] With the rapid development of information technology, while a large number of software programs enrich people's lives, their source code defects can also bring incalculable security risks. Misuse of software interfaces is one of the common causes of software code defects. Studies show that 17% of software defects are caused by software interface misuse, which can seriously affect software security. Currently, software interface misuse detection technology mainly relies on static detection based on software interface specifications. These specifications are primarily divided into two types: those based on manual definition and those based on pattern reasoning. For example, tools like Semmle, Sys, and IMchecker allow users to define software interface specifications, detecting misuse by checking whether the interface violates these specifications. Tools like APISAN and JADET mine software interface rules from the source code based on predefined patterns and then perform classification and matching.
[0003] Of the two methods mentioned above, the former relies primarily on manual implementation by experts. Writing specifications requires specialized knowledge and time, and since a significant amount of time is often spent on less frequently used software interfaces, it suffers from slow detection speed and low efficiency. Furthermore, the tool's effectiveness depends on the quality of the specifications written by the experts. The latter method relies on predefined patterns to perform statistical impulsive analysis, requiring a large, correctly used code corpus for statistical analysis. This approach suffers from low detection accuracy, a high false positive rate, and is difficult to apply to all software interface defect detection processes.
[0004] With the success of artificial intelligence technology in areas such as malware analysis, spam classification, and intrusion detection, current research is beginning to explore applying machine learning to software code defect detection. This aims to automatically discover and fix source code defects, ensuring the secure operation of software systems. However, due to the lack of large-scale, labeled samples of real-world engineering code defects, existing machine learning-based detection methods suffer from low accuracy and poor practicality in real-world code detection. Therefore, further in-depth research is needed in this area to improve the detection process for software code and interfaces.
[0005] Currently, the issue of software interface misuse in software code defects has been gradually clarified. In the research process of efficient automatic detection technology, the problems that are focused on and aimed to solve mainly fall into the following two categories:
[0006] 1. How to find potentially defective software interfaces in large-scale software, thereby solving the problem of interface localization in defective software;
[0007] 2. How to achieve human-machine collaboration, solve the problems of machine learning updates and iterations and intelligent enhancement, and realize a batch, efficient, and accurate process for detecting software interface misuse defects. Summary of the Invention
[0008] To address the current state of software detection processes in the background art, this invention proposes a joint detection method based on human-machine collaboration of taint analysis and symbolic execution. First, taint analysis identifies potentially defective software interface functions. Then, symbolic execution analyzes the changes in state characteristics along the execution path before and after the execution of these software interface functions. Next, a small subset of software interface function execution paths are selected as samples, allowing users to determine whether the samples are misused based on these characteristic changes, thus achieving a human-machine collaborative process. Finally, an active learning algorithm is used to analyze all code calling the software interface function in batches, continuously iterating to improve the accuracy of software interface misuse detection.
[0009] The method of this invention can effectively solve two main problems in the prior art: it can detect code defects at various stages of the software development life cycle, which is conducive to the early discovery and repair of related defects; and it can analyze the software code interface specifications to effectively discover defects in the software code during calls, which helps to improve the robustness and security of the software.
[0010] The present invention employs the following technical solutions to achieve its objective:
[0011] A method for joint detection of taint analysis and symbolic execution based on human-machine collaboration, the method comprising the following steps:
[0012] S1. Software Defect Interface Identification: Preliminary analysis of software code, extraction of interface functions suspected of having defects in the software code based on taint analysis method;
[0013] S2. Software Interface Execution Path Analysis: Based on the extracted interface functions, a path to the software interface call point is generated. This path is encoded and used as a symbolic execution path to represent the characteristics after the software interface call.
[0014] S3. Defect detection through human-machine collaboration: Based on the features after a software interface call, the user judges whether the interface is misused and uses the judgment result as a machine learning sample. The machine learning algorithm actively learns and calculates the probability of misuse of the software interface call point based on the features represented by the symbolic execution path when the software interface is misused, and iteratively searches for the software interface with the highest probability of being defective.
[0015] Furthermore, in step S1, software defect interface identification is used as a preliminary identification process, which is carried out using static taint analysis. First, an abstract syntax tree (AST) is generated based on the source code of the software program. Then, a control flow graph (CFG) and a function call graph are constructed based on the AST. Subsequently, based on the AST, CFG, and function call graph, a taint analysis process is performed. The taint analysis rules are used to match whether there is defect information in the software program corresponding to the detected source code.
[0016] Specifically, the taint analysis rules are designed based on x86 instructions. The designed taint propagation rule instructions include assignment instruction set, arithmetic instruction set, logical instruction set, and comparison instruction set. In each instruction set, changes to arithmetic and logical instructions, changes to flag bits, and changes to the machine status word are all used as the basis for matching taint analysis rules.
[0017] Furthermore, in step S2, the software interface execution path analysis includes two processes: execution path generation and symbolic representation. In the execution path generation process, the software source code is compiled using LLVM to generate intermediate files, and the interface functions suspected of having defects obtained in step S1 are used as input to generate the execution paths of all the call points of the software interface functions. In the symbolic representation process, a general encoding method is used to symbolically encode the execution paths to represent the symbolic execution path characteristics.
[0018] Preferably, during the symbol representation process, the execution path is symbolically encoded to obtain a feature list; the feature list provides a user interface for users to add custom features, and the symbolic execution path is converted into feature information through the feature list. The feature information is mainly divided into four categories, including return value, input parameters, causal relationship and loop.
[0019] Furthermore, in step S3, the human-machine collaborative defect detection includes two processes: user interaction classification and active learning iteration. Through the process of user-machine interaction, the feature information corresponding to the unverified symbolic execution path and the context of the software interface call point are used as input samples. Based on the state changes of the symbolic execution path feature information before and after the software interface call, the user judges whether there is a defect in the input sample. Machine learning iteratively learns this judgment process, and after the iteration is completed, it automatically identifies and detects all defects in the software interface.
[0020] Preferably, during the user interaction classification process, the user randomly selects any software interface call point as a sample, judges whether there is any abnormality in the corresponding path and marks it; in each interaction, an unmarked sample is judged, and the results of multiple judgments are used as input samples for machine learning. The machine learning model actively iterates and learns, and updates its own model by relearning, so as to integrate manually labeled data into the machine learning model.
[0021] Specifically, during the active learning iteration process, the context information of unlabeled software interface call points and symbolic execution path feature information are used as input samples after user classification to train the machine learning model. When the first sample is input, the machine learning model classifies the unlabeled samples based on their distance from the input sample, and adds the valuable samples closest to the labeled samples in the classification results to its existing training sample set. When the iterative learning accuracy or the number of supplemented samples reaches a preset standard, the iteration process is completed.
[0022] In summary, due to the adoption of this technical solution, the beneficial effects of this invention are as follows:
[0023] This invention employs a combination of taint analysis and symbolic execution, utilizing a human-computer collaborative approach to detect defects in misused software interfaces within source code, effectively improving the accuracy of software code defect detection. Compared to existing technologies, the advantages of this invention are:
[0024] 1. By combining multiple methods such as taint analysis and symbolic execution, taint analysis is first used to find suspected software defect interfaces in large-scale software, and then symbolic execution is used to perform precise analysis and verification of the software interfaces, which can improve the efficiency of code defect detection.
[0025] 2. Based on active learning algorithms, it continuously integrates learning and iterates, reducing the burden on manual labor while achieving efficient and accurate detection of software defect codes. Attached Figure Description
[0026] Figure 1 This is a schematic diagram of the overall process of the method of the present invention;
[0027] Figure 2 A schematic diagram illustrating the principle framework for software defect interface identification;
[0028] Figure 3 A schematic diagram illustrating the principle framework for software interface execution path analysis;
[0029] Figure 4 A schematic diagram illustrating the principle framework of the human-machine collaborative defect detection process;
[0030] Figure 5 This is a flowchart illustrating the process of proactive learning and iteration. Detailed Implementation
[0031] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Generally, the various parts and detailed processes of the embodiments of the present invention described and shown in the accompanying drawings can be arranged and designed in various different configurations.
[0032] Therefore, the following detailed description of the embodiments of the invention provided in the accompanying drawings is not intended to limit the scope of the claimed invention, but merely to illustrate selected embodiments of the invention. All other embodiments obtained by those skilled in the art based on the embodiments of the invention without inventive effort are within the scope of protection of the invention.
[0033] Example
[0034] In each stage of the software development lifecycle, source code defect detection helps to discover and fix related defects as early as possible; software interface misuse detection analyzes the software code interface specifications, which can effectively uncover defects in the software code during calls, thereby improving robustness and security.
[0035] This embodiment proposes a joint taint analysis and symbolic execution detection method based on human-machine collaboration. The overall process of this method consists of three steps, which can be viewed simultaneously. Figure 1 The illustration shows that this method combines taint analysis and symbolic execution techniques with a human-machine collaborative machine learning process, achieving an efficient, accurate, and secure detection process for software code defects.
[0036] The three steps are as follows: 1. Software defect interface identification: preliminary analysis of the software code to extract interface functions suspected of having defects; 2. Software interface execution path analysis: efficient generation of all paths leading to the software interface call points, treating them as symbolic execution paths, and encoding them using a general method to represent the characteristics after the software interface call; 3. Human-machine collaborative defect detection: users judge whether the software interface is misused, and the judgment result is used as a sample for the machine learning model. The machine learning algorithm actively learns and calculates the probability of misuse of all interface call points of the software based on the symbolic execution path characteristics when the software interface is misused, and continuously iterates to improve the accuracy of the search, ultimately finding the software interface most likely to have defects.
[0037] This embodiment will provide a detailed explanation of the three steps described above.
[0038] I. Software Defect Interface Identification.
[0039] Software defect interface identification is suitable for large-scale software code projects. Its purpose is to perform preliminary analysis of software code and identify potentially defective interface functions. Preliminary identification of software defect interfaces is achieved using static taint analysis, which is primarily based on abstract syntax trees, function call graphs, and control flow graphs. For example... Figure 2 As shown, firstly, an abstract syntax tree (AST) is generated based on the source code of the software program. Then, a function call graph (CQG) and a control flow graph (CFG) are constructed based on the AST. Finally, taint analysis is performed based on the CFG, AST, and function call graph. By using rule matching, the presence of defect information in the software program is detected.
[0040] Since the accuracy of the initial identification is not high, after initially identifying the defective software interface, the suspected defective software interface function is further analyzed through software interface execution path analysis and human-computer collaborative defect detection.
[0041] In step one, the taint propagation analysis involves analyzing tainted data using a data flow approach to study its propagation path within the software program, thereby detecting whether tainted data can propagate from the taint source to the taint convergence point. This process locates all contaminated data, analyzes it using data flow, and matches it according to taint analysis rules to detect whether the data flow in the software program is contaminated, thus determining whether there are defects in the software code.
[0042] In this embodiment, taint marking uses a bitmap to indicate whether a memory location is tainted. If it is, the bit corresponding to that memory address is marked as 1, otherwise it is marked as 0. For input data at the source point, if it is tainted, it is marked as tainted source data. This tainted source data includes external data from the network, files, and user input.
[0043] If input data is marked as tainted, the propagation process of this tainted data needs to be tracked during software program execution. If tainted data is copied to other buffers or subjected to related operations, it will cause other memory data to become untrusted, and these untrusted data will be marked as "tainted". For example, for the instruction MOV dst src, if src contains tainted data, after the instruction is executed, dst will also contain tainted data, so the taint status of dst needs to be marked.
[0044] After taint marking and taint propagation, misuse detection of tainted data needs to be performed at the sink point, that is, to detect whether there is any illegal use of tainted data in the software program. Common detection methods include detecting jump address attacks, format string attacks, and buffer overflows. If illegal use is detected, the software program is terminated and suspected defect information is reported.
[0045] The taint analysis rules are described as follows: Based on the characteristics of x86 instructions, all instructions are divided into assignment instruction set, arithmetic instruction set, logic instruction set, comparison instruction set and program transfer instruction set; however, in this embodiment, in order to maintain the fast taint analysis effect, the influence of the program transfer instruction set is eliminated, and the taint propagation rules shown in Table 1 below are designed.
[0046] Table 1 Rules for the Transmission of Stains
[0047]
[0048] In Table 1, T(op) → represents the operand pointed to by op, →BOOL indicates whether it points to tainted data; PSW represents the machine status word; μ(op, PSW) → Z-type rules indicate the position in PSW where the op operation causes changes. For example, the ADD operation will cause changes in the C, P, A, Z, S and O flags; arithmetic and logical instructions such as ADD and AND will affect the value of PSW and need to be considered in the taint propagation rules. Jump instructions such as JNE also depend on the value of PSW.
[0049] II. Software Interface Execution Path Analysis.
[0050] In this step, the software's source code is first compiled using LLVM to generate intermediate files. Taking potentially defective interface functions as input, symbolic execution paths for all call points of these interface functions are generated and encoded to represent the characteristics of the symbolic execution paths in a generic way. The relevant process can be found in [link to relevant documentation]. Figure 3 This is an illustration. Due to path explosion and software engineering limitations, it is impossible to enumerate all execution paths. In addition to the default data, this embodiment can analyze some paths based on user judgment during actual application.
[0051] The purpose of execution path generation is to generate all execution paths that call the software interface functions. During generation, the execution trajectory of the target software program is tracked, relevant instructions and context information are recorded, and a Trace file is generated.
[0052] When searching for software interface context information, assuming the target software interface has a call point k in function f, a program call graph G, and a context depth d, the software interface context S is defined as follows: Where g is the entry function. Since these are the input parameters, the set of software interface contexts is therefore Sk.
[0053] During the search, a reverse breadth-first search (BFS) is first performed from F to G to find all functions F within a distance D. For each function g in F, a breadth-first search (BFS) is then used to find all reachable functions within a depth of 2d. all The set of K represents the possible contextual information of K.
[0054] When performing unconstrained symbolic execution on the software interface function f, symbolic execution begins at the call point k and the entry function g, using symbolic variables as function parameters; during function calls, if it is in If a function is called, the call is executed; otherwise, the call instruction is ignored, and a symbolic value is generated as the return value of the call. Symbolic variables are used to initialize each byte of memory, and the execution path is formed by looping and recording the trace of each execution.
[0055] In the symbolic representation process, the execution path is encoded to form a feature list. This feature list covers symbolic execution path features that are misused by the software interface, and allows users to add their own features through the user interface. The symbolic execution path is then converted into feature information using this feature list. These features are mainly divided into the following four categories:
[0056] Return value: The return value functionality relates to how the return value is used. This set of characteristics is generated if the target function has a non-void return type;
[0057] The input parameters and parameter features correspond to the symbol type and the preconditions and postconditions of the parameters. If the target API method has m parameters, then m parameter feature sets are generated, one for each parameter.
[0058] Cause and effect relationship, in function calls such as lock / unlock, fopen / fclose;
[0059] Looping features, while not API-dependent, can describe the structure of a trace and reduce false positives.
[0060] The symbol feature encoding rules referenced are shown in Table 2 below.
[0061] Table 2 Symbol Feature Encoding Rules
[0062]
[0063] III. Defect detection through human-machine collaboration.
[0064] This step involves human-machine interaction, using unverified symbolic execution path feature information and software interface call point context as input samples. The user judges whether there are defects in the samples based on the changes in the symbolic execution path feature state before and after the software interface call; the machine actively learns and iterates continuously, thereby identifying all defects in the software interface. (See also: [link to relevant documentation]). Figure 4 The illustration.
[0065] This step includes two processes: user interaction classification and active learning iteration. For the user interaction classification process, traditional software defect detection requires a large number of samples for learning, and these samples must contain both positive and negative samples. However, in reality, when the sample size is small, the sample set may not contain both positive and negative samples simultaneously. In this embodiment, a human-machine collaborative approach is adopted, with software program experts acting as users, and the judgment results made by users serving as the basic samples to realize the learning process of the machine learning model.
[0066] The user selects a specific software interface call point as a sample. Based on the context information of the call point and the feature information generated after symbolic execution path encoding, the system determines whether there are any anomalies in the path and labels them accordingly. In each interaction, the user makes judgments on the unlabeled samples. The results of multiple judgments are used as samples for active learning, which is then used by the active learning model to learn and update the model. This process integrates manually labeled data into the learning model, improving its effectiveness.
[0067] The main purpose of active learning iteration is to minimize the cost of manual annotation during the user interaction classification stage while ensuring that the accuracy of the classifier in the model is not reduced. Active learning uses the original unlabeled software call point context information and symbolic execution path features as samples in the sample set after user classification. The machine learning model actively learns from these samples to achieve strong generalization ability with minimal annotation costs, thereby detecting software code defects with higher confidence. The active learning iteration process is as follows: Figure 5 As shown.
[0068] In this embodiment, during the initial sample selection, the user randomly selects a portion of unlabeled samples for judgment and labeling. The machine learning model classifies the unlabeled samples based on their distance from the samples, continuously supplementing the existing training sample set with the nearest high-value samples, thereby continuously improving the classifier's performance. The iteration process is completed when the iterative learning accuracy or the number of supplemented samples reaches a preset standard.
[0069] The specific active learning algorithm flow is shown in Table 3 below.
[0070] Table 3. Flowchart of Active Learning Algorithm
[0071]
Claims
1. A method for joint detection of taint analysis and symbolic execution based on human-machine collaboration, characterized in that: The method includes the following steps: S1. Software Defect Interface Identification: Preliminary analysis of software code, extraction of interface functions suspected of having defects in the software code based on taint analysis method; S2. Software Interface Execution Path Analysis: Based on the extracted interface functions, a path to the software interface call point is generated. This path is encoded and used as a symbolic execution path to represent the characteristics after the software interface call. S3. Defect detection through human-machine collaboration: Based on the features after a software interface call, the user judges whether the interface is misused and uses the judgment result as a machine learning sample; the machine learning algorithm actively learns and calculates the probability of misuse of the software interface call point based on the features represented by the symbolic execution path when the software interface is misused, and iteratively searches for the software interface with the highest probability of being defective. In step S1, software defect interface identification is a preliminary identification process, which is carried out using static taint analysis. First, an abstract syntax tree (AST) is generated based on the source code of the software program. Then, a control flow graph (CFG) and a function call graph are constructed based on the AST. Subsequently, based on the AST, CFG, and function call graph, a taint analysis process is performed. The taint analysis rules are used to match whether there is defect information in the software program corresponding to the detected source code. The taint analysis rules are designed based on x86 instructions. The designed taint propagation rule instructions include assignment instruction set, arithmetic instruction set, logical instruction set and comparison instruction set. In each instruction set, changes in arithmetic and logical instructions, changes in flag bits and changes in machine status words are all used as the matching basis for taint analysis rules. In step S2, the software interface execution path analysis includes two processes: execution path generation and symbolic representation. In the execution path generation process, the software source code is compiled using LLVM to generate intermediate files. The interface functions suspected of having defects obtained in step S1 are used as input to generate the execution paths of all the call points of the software interface functions. In the symbolic representation process, a general encoding method is used to symbolically encode the execution paths to represent the symbolic execution path characteristics.
2. The method for joint detection of taint analysis and symbolic execution based on human-machine collaboration according to claim 1, characterized in that: During the symbolic representation process, the execution path is symbolically encoded to obtain a feature list. The feature list provides a user interface for users to add custom features. The symbolic execution path is converted into feature information through the feature list. The feature information includes return values, input parameters, causal relationships, and loops.
3. The method for joint detection of taint analysis and symbolic execution based on human-machine collaboration according to claim 1, characterized in that: In step S3, the human-machine collaborative defect detection includes two processes: user interaction classification and active learning iteration. Through the process of user-machine interaction, the feature information corresponding to the unverified symbolic execution path and the context of the software interface call point are used as input samples. Based on the state changes of the symbolic execution path feature information before and after the software interface call, the user judges whether there is a defect in the input sample. Machine learning iteratively learns the judgment process, and after the iteration is completed, it automatically identifies and detects all defects in the software interface.
4. The method for joint detection of taint analysis and symbolic execution based on human-machine collaboration according to claim 3, characterized in that: During the user interaction classification process, users randomly select any software interface call point as a sample, determine whether there are any anomalies in the corresponding path and label it; in each interaction, an unlabeled sample is judged, and the results of multiple judgments are used as input samples for machine learning. The machine learning model actively iterates and updates its own model to integrate manually labeled data into the machine learning model.
5. The method for joint detection of taint analysis and symbolic execution based on human-machine collaboration according to claim 4, characterized in that: During the active learning iteration process, the context information of unlabeled software interface call points and symbolic execution path feature information are used as input samples after user classification to train the machine learning model. When the first sample is input, the machine learning model classifies the unlabeled samples based on their distance from the input sample, and adds the valuable samples closest to the labeled samples in the classification results to its existing training sample set. The iteration process is completed when the iterative learning accuracy or the number of supplemented samples reaches a preset standard.