Application detection method and system based on taint data flow tracking
By creating a trust database in the IAST tool to record application information and generate trust levels, the problems of high false alarm rate and low efficiency of the IAST tool when detecting applications are solved, and more efficient and accurate security detection is achieved.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- SECZONE TECH CO LTD
- Filing Date
- 2023-07-26
- Publication Date
- 2026-08-04
AI Technical Summary
Existing IAST tools suffer from high false positive rates and low detection efficiency when detecting application security, especially when the requested data comes from a trusted data domain, making it impossible to accurately determine whether a security vulnerability exists.
Create a trust database, weave detection logic into the application using instrumentation tools, record application information and generate trust levels through the trust database, and determine the security of request information based on the trust levels to avoid subsequent tracking and detection.
It improves the accuracy and efficiency of application detection, reduces false alarms, and enhances detection precision.
Smart Images
Figure CN117272307B_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of application security detection technology, and in particular to an application detection method and system based on tainted data stream tracing. Background Technology
[0002] As applications grow larger, more complex, and more numerous, the number of vulnerabilities also increases, leading to more severe damage. Common security vulnerabilities arise from user-inputted tainted data entering sensitive functions without proper security validation or encoding. Therefore, most commercially available IAST tools determine the presence of security vulnerabilities by tracing the data flow of tainted data (e.g., the web application test data flow tracing method and system disclosed in Chinese invention patent CN111046396A). IAST detection technology defaults to treating all input data as five-point data. When performing security testing on applications based on tainted data analysis flow technology, the taint tracking phase is divided into four stages: input, propagation, cleansing, and output. In other words, the request must be traced through all four stages to determine the existence of security issues.
[0003] However, during actual testing using the IAST tool, it was found that in the pre-output stage, such as the input stage, if the requested data comes from a trusted data domain, such as automated script task calls or backend administrator service calls, these data domains have generally already performed trust processing on the data and will not lead to vulnerability exploitation. However, the output results often indicate the existence of vulnerabilities, which requires staff to manually screen out such vulnerability prompts. As a result, the accuracy of application security checks based on the IAST tool is not ideal, and false alarms are prone to occur. Moreover, the inspection efficiency cannot meet the needs of users. Summary of the Invention
[0004] The purpose of this invention is to provide an application detection method and system based on tainted data stream tracing that can effectively improve the accuracy and detection efficiency of application inspection based on data stream tracing.
[0005] To achieve the above objectives, this invention discloses an application detection method based on tainted data stream tracing. This application detection method performs security detection on applications based on tainted data stream tracing. The application detection method includes:
[0006] Based on instrumentation tools, detection logic is woven into the current application and all called applications;
[0007] Create a trust database that supports the registration of application information, generates corresponding trust levels based on the registration information of the application information, and supports the modification of the trust level;
[0008] When any application is invoked, the instrumentation-based detection logic obtains the request information from the invoked application.
[0009] The request information is parsed to obtain the request header and request body, and the calling application information of the current called application frontend is stored in the parameter information of the request header;
[0010] In any of the input, propagation, and cleanup phases of the tainted data stream tracing, obtain the parameter information of the request header in the request information, and register the currently invoked application information and the invoked application information recorded in the parameter information into the trust database.
[0011] When the trust level of the calling application is greater than that of the called application, the request information is classified as trusted security information.
[0012] Preferably, the application information of the calling application stored in the request header is obtained based on the command-line parameters when the called application starts or through the environment path of the request information.
[0013] Preferably, if the application registered in the trust database uses an HTTP protocol architecture, the initial trust level of the application is defined as a low trust level; if the application registered in the trust database uses an HTTPS protocol architecture, the initial trust level of the application is defined as a medium trust level; and if the application registered in the trust database uses the Dubbo microservice protocol, the initial trust level of the application is defined as a high trust level.
[0014] Preferably, if the currently called application is called multiple times, all calling applications in the call chain are obtained, and all calling applications are placed in the request header of the request information; when the trust level of all calling applications before the currently called application or the last calling application in the call chain is greater than that of the called application, the request information is positioned as trusted security information.
[0015] This invention also discloses an application detection system based on tainted data stream tracing. This system performs security testing on applications using tainted data stream tracing. The application detection system includes:
[0016] Instrumentation module, which is used to weave detection logic into the current application and all invoked applications;
[0017] The trust definition module is used to create a trust database, which supports the registration of application information, generates corresponding trust levels based on the registration information of the application information, and supports the modification of the trust level.
[0018] The request retrieval module is used to retrieve request information from the called application based on instrumentation detection logic when any application is invoked.
[0019] The parsing module is used to parse the request information to obtain the request header and request body, and to store the calling application information of the current called application frontend into the parameter information of the request header;
[0020] The registration module is used to obtain the parameter information of the request header in the request information at any stage of the input stage, propagation stage and purification stage based on tainted data stream tracing, and register the currently called application information and the calling application information recorded in the parameter information into the trust database.
[0021] The security verification module is used to identify the request information as trusted security information when the trust level of the calling application is greater than that of the called application.
[0022] Preferably, the parsing module obtains the application information of the calling application stored in the request header based on the command-line parameters when the called application starts or through the environment path of the request information.
[0023] Preferably, for the trust definition module, if the application registered in the trust database is an HTTP protocol architecture, then the initial trust level of the application is defined as a low trust level; if the application registered in the trust database is an HTTPS protocol architecture, then the initial trust level of the application is defined as a medium trust level; if the application registered in the trust database is a Dubbo microservice protocol, then the initial trust level of the application is defined as a high trust level.
[0024] Preferably, if the currently called application is called multiple times, the parsing module obtains all calling applications on the call chain and places all calling applications into the request header of the request information; when the trust level of all calling applications before the currently called application or the last calling application on the call chain is greater than that of the called application, the security confirmation module positions the request information as trusted security information.
[0025] This invention also discloses another application detection system based on taint data stream tracking, which includes:
[0026] One or more processors;
[0027] Memory;
[0028] And one or more programs, wherein the one or more programs are stored in the memory and configured to be executed by the one or more processors, the programs including instructions for performing the application detection method based on taint data stream tracing as described above.
[0029] The present invention also discloses a computer-readable storage medium comprising a computer program that can be executed by a processor to perform the application detection method based on tainted data stream tracing as described above.
[0030] Compared with existing technologies, the technical solution disclosed in this invention creates a trust database. When performing security testing on applications using the tainted data stream tracing method based on IAST, the application information of both the called application and the calling application is registered in the trust database at the called application end, and a trust level corresponding to each application is generated. Thus, at any stage before the output stage of data stream tracing, such as the input stage, the trust level of the calling application and the trust level of the called application can be obtained from the trust database. Based on the relationship between the two trust levels, it is determined whether the request information currently entering the called application belongs to trusted security information. If so, no further tracing and testing is required, and the output result is directly recognized as secure. Therefore, the above solution can effectively improve the accuracy and efficiency of application testing using the tainted data stream tracing method. Attached Figure Description
[0031] Figure 1 This is a flowchart illustrating the detection method used in an embodiment of the present invention.
[0032] Figure 2 This is a structural diagram of the detection system used in an embodiment of the present invention. Detailed Implementation
[0033] To illustrate the technical content, structural features, objectives, and effects of the present invention in detail, the following description is provided in conjunction with the embodiments and accompanying drawings.
[0034] This embodiment discloses an application detection method based on tainted data stream tracing. It should be noted that the application detection method in this embodiment is an improvement on the traditional detection method based on tainted data stream tracing, in order to improve the accuracy of vulnerability detection.
[0035] Traditional application detection methods based on tainted data flow tracing divide the flow of request data into four stages: input, propagation, cleanup, and output. The flow of request data is tracked and detected during these four stages. However, for some applications known to be secure, traditional detection methods may still identify security vulnerabilities, leading to false positives. To address this, the improved application detection method in this embodiment proposes the following improvement: for applications with high trust levels, in the stages before the output stage, such as the input stage, the trust levels of the current application and the calling application are checked. The decision to continue with complete data flow tracing is based on the relative trust levels of the calling and called applications. For example,... Figure 1 The application detection method in this embodiment includes the following steps:
[0036] S1: Based on instrumentation tools (such as IAST), the detection logic is woven into the current application and all called applications. For example, if the current application is A and the called application is B, meaning that application A needs to call B when it is working, then the detection logic is instrumented into both A and B. It should also be noted that the specific method of inserting detection logic into applications based on IAST is a mature technology in this field and will not be elaborated upon here.
[0037] S2: Create a trust database that supports application registration and generates corresponding trust levels based on the registration information. This trust level can also be modified. For example, when application A registers with the trust database, a trust level A' is generated. When application B registers with the trust database, a trust level B' is generated. Furthermore, the trust level generation method can be based on preset standards for different types of applications, or a trained neural network-based intelligent learning model can be used to judge and process application information to generate the corresponding trust level.
[0038] S3: When any application is invoked, the instrumentation-based detection logic retrieves the request information from the invoked application. For example, when A invokes B, it retrieves the request information Q from application B.
[0039] S4: Parse the request information Q to obtain the request header and request body, and store the information of the calling application A from the front end of the currently called application B into the parameter information of the request header.
[0040] S5: At any stage of the tainted data stream tracing—the input stage, the propagation stage, and the cleanup stage—for example, in the input stage, obtain the parameter information from the request header in the request information Q, and register the information of the currently called application B and the information of the calling application A recorded in the parameter information into the trust database. For example, register A and B into the trust database. Following step S2 above, after registering A and B into the trust database, a trust level corresponding to A and B is automatically generated in the trust database. Additionally, the user can actively modify the trust levels of A and B in the trust database.
[0041] S6: Query the trust database. If the trust level A of the calling application is greater than the trust level B of the called application, then the request information is identified as trusted security information.
[0042] On the other hand, in most cases, the called application does not know the information of the calling application, that is, it is unclear which application called it. Therefore, when the called behavior occurs in any application, such as in application B, the application information of the calling application stored in the request header can be obtained based on the command line parameters when the called application starts or through the environment path of the request information Q.
[0043] On the other hand, in some applications, multiple calls may occur. For example, A calls B, B calls C, and C calls D. A, as the original caller, is then called by the main device (e.g., a browser), with the call relationship being: A←B←C←D. Therefore, for the called application C, which is called multiple times, it is called by A through B. Thus, both A and B can be considered calling applications of C. In this embodiment, if the currently called application is called multiple times, all calling applications in the call chain are retrieved, and all calling applications are placed in the request header of the request information. When the trust level of all calling applications preceding the currently called application or the last calling application in the call chain is greater than that of the currently called application, the request information is positioned as trusted security information.
[0044] In the above example, when the called application C triggers the detection logic, both A and B are included as calling applications in the request header of the current request information. Thus, after A, B, and C are all registered in the trust database, the trust levels A', B', and C' of A, B, and C are read from the trust database. If B' is greater than C' (regardless of the value of A'), then the request information generated in the current application C is safe and does not require further tracking and detection. Conversely, if A' is greater than C' and B' is also greater than C', then the conclusion is that the request information generated in the current application C is safe and does not require further tracking and detection.
[0045] On the other hand, the method for generating corresponding trust levels based on different types of applications according to preset standards includes: if the application registered in the trust database is an HTTP protocol architecture, then the initial trust level of the application is defined as a low trust level value (such as 1, or an optional range near 1); if the application registered in the trust database is an HTTPS protocol architecture, then the initial trust level of the application is defined as a medium trust level value (such as 2, or an optional range near 2); if the application registered in the trust database is a Dubbo microservice protocol, then the initial trust level of the application is defined as a high trust level value (such as 3, or an optional range near 1).
[0046] In summary, based on the method disclosed in the above embodiments, when performing security detection on applications using the tainted data stream tracing method based on IAST, at the called application end, both the application information of the called application and the calling application are registered in the trust database, and a trust level corresponding to each application is generated. Thus, at any stage before the output stage of data stream tracing, such as the input stage, the trust level of the calling application and the trust level of the called application can be obtained from the trust database. Based on the relationship between the two trust levels, it is determined whether the request information currently entering the called application belongs to trusted security information. If so, no further tracing detection is required, and the output result is directly recognized as secure. Therefore, it can be seen that the above scheme can effectively improve the accuracy and efficiency of detection when detecting applications using the tainted data stream tracing method.
[0047] In another preferred embodiment of the present invention, an application detection system based on tainted data stream tracing is also disclosed. This application detection system performs security detection on applications based on tainted data stream tracing. The application detection system includes:
[0048] Instrumentation module 10 is used to weave detection logic into the current application and all invoked applications;
[0049] The trust definition module 50 is used to create a trust database, which supports the registration of application information, generates corresponding trust levels based on the registration information of the application information, and supports the modification of the trust level.
[0050] The request acquisition module 20 is used to acquire request information in the called application based on instrumentation detection logic when any application is invoked.
[0051] The parsing module 30 is used to parse the request information to obtain the request header and request body, and to store the calling application information of the current called application frontend into the parameter information of the request header;
[0052] The registration module 40 is used to obtain the parameter information of the request header in the request information at any stage of the input stage, propagation stage and purification stage based on tainted data stream tracing, and register the currently called application information and the calling application information recorded in the parameter information into the trust database.
[0053] The security verification module 60 is used to identify the request information as trusted security information when the trust level of the calling application is greater than that of the called application.
[0054] Furthermore, the parsing module 30 obtains the application information of the calling application stored in the request header based on the command-line parameters when the called application starts or through the environment path of the request information.
[0055] Furthermore, for the trust definition module 50, if the application registered in the trust database is an HTTP protocol architecture, then the initial trust level of the application is defined as a low trust level; if the application registered in the trust database is an HTTPS protocol architecture, then the initial trust level of the application is defined as a medium trust level; if the application registered in the trust database is a Dubbo microservice protocol, then the initial trust level of the application is defined as a high trust level.
[0056] Furthermore, if the currently called application is called multiple times, the parsing module 30 obtains all calling applications on the call chain and places all calling applications into the request header of the request information; when the trust level of all calling applications before the currently called application or the last calling application on the call chain is greater than that of the called application, the security confirmation module 60 positions the request information as trusted security information.
[0057] For details on the working principle and operation mode of the detection system applied in this embodiment, please refer to the above-mentioned application detection method, which will not be repeated here.
[0058] The present invention also discloses another application detection system, which includes one or more processors, a memory, and one or more programs, wherein the one or more programs are stored in the memory and configured to be executed by the one or more processors, the programs including instructions for performing the application detection method as described above. The processor may be a general-purpose central processing unit (CPU), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits, used to execute the relevant programs to implement the functions required by the modules in the application detection system of the embodiments of this application, or to execute the application detection method of the method embodiments of this application.
[0059] This invention also discloses a computer-readable storage medium comprising a computer program executable by a processor to perform the application detection method described above. The computer-readable storage medium can be any available medium accessible to a computer or a data storage device such as a server or data center integrating one or more available media. The available medium can be read-only memory (ROM), random access memory (RAM), or magnetic media, such as floppy disks, hard disks, magnetic tapes, magnetic disks, or optical media, such as digital versatile discs (DVDs), or semiconductor media, such as solid-state drives (SSDs).
[0060] This application also discloses a computer program product or computer program, which includes computer instructions stored in a computer-readable storage medium. The processor of an electronic device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the electronic device to perform the aforementioned application detection method.
[0061] The above-disclosed embodiments are merely preferred embodiments of the present invention and should not be construed as limiting the scope of the present invention. Therefore, any equivalent variations made in accordance with the claims of the present invention are still within the scope of the present invention.
Claims
1. A method for application detection based on taint dataflow tracking, the method for application detection based on taint dataflow tracking performing security detection on an application program, characterized by, The application detection method includes: Based on instrumentation tools, detection logic is woven into the current application and all called applications; Create a trust database that supports the registration of application information, generates corresponding trust levels based on the registration information of the application information, and supports the modification of the trust level; If an application registered in the trust database uses an HTTP protocol architecture, its initial trust level is defined as low trust; if an application registered in the trust database uses an HTTPS protocol architecture, its initial trust level is defined as medium trust; if an application registered in the trust database uses the Dubbo microservice protocol, its initial trust level is defined as high trust. When any application is invoked, the instrumentation-based detection logic obtains the request information from the invoked application. The request information is parsed to obtain the request header and request body, and the calling application information of the current called application frontend is stored in the parameter information of the request header; In any of the input, propagation, and cleanup phases of the tainted data stream tracing, obtain the parameter information of the request header in the request information, and register the currently invoked application information and the invoked application information recorded in the parameter information into the trust database. When the trust level of the calling application is greater than that of the called application, the request information is identified as trusted and secure information, and no further tracking or detection is required; the output result is directly recognized as secure.
2. The application detection method based on taint data flow tracking according to claim 1, characterized in that, The application information of the calling application stored in the request header is obtained based on the command-line parameters when the called application starts or through the environment path of the request information.
3. The application detection method based on taint data flow tracking according to claim 1, characterized in that, If the currently invoked application is invoked multiple times, all invoking applications in the call chain are obtained, and all invoking applications are placed in the request header of the request information; if the trust level of all invoking applications before the currently invoked application or the last invoking application in the call chain is greater than that of the invoked application, the request information is positioned as trusted security information.
4. An application detection system based on taint dataflow tracking, which performs security detection of an application program in a manner based on taint dataflow tracking, characterized by The application detection system includes: Instrumentation module, which is used to weave detection logic into the current application and all invoked applications; The trust definition module is used to create a trust database, which supports the registration of application information, generates corresponding trust levels based on the registration information of the application information, and supports the modification of the trust level. For the trust definition module, if the application registered in the trust database is an HTTP protocol architecture, then the initial trust level of the application is defined as a low trust level; if the application registered in the trust database is an HTTP protocol architecture, then the initial trust level of the application is defined as a medium trust level; if the application registered in the trust database is a Dubbo microservice protocol, then the initial trust level of the application is defined as a high trust level. The request retrieval module is used to retrieve request information from the called application based on instrumentation detection logic when any application is invoked. The parsing module is used to parse the request information to obtain the request header and request body, and to store the calling application information of the current called application frontend into the parameter information of the request header; The registration module is used to obtain the parameter information of the request header in the request information at any stage of the input stage, propagation stage and purification stage based on tainted data stream tracing, and register the currently called application information and the calling application information recorded in the parameter information into the trust database. The security verification module is used to identify the request information as trusted security information when the trust level of the calling application is greater than that of the called application. No further tracking or detection is required, and the output result is directly recognized as safe.
5. The application detection system based on taint dataflow tracking according to claim 4, characterized in that, The parsing module obtains the application information of the calling application stored in the request header based on the command-line parameters when the called application starts or through the environment path of the request information.
6. The application detection system based on taint dataflow tracking according to claim 4, characterized in that, If the currently called application is called multiple times, the parsing module obtains all calling applications on the call chain and places all calling applications into the request header of the request information; when the trust level of all calling applications before the currently called application or the last calling application on the call chain is greater than that of the called application, the security confirmation module positions the request information as trusted security information.
7. An application detection system based on taint data flow tracking, characterized by, include: One or more processors; Memory; And one or more programs, wherein the one or more programs are stored in the memory and configured to be executed by the one or more processors, the programs including instructions for performing the application detection method based on taint data stream tracing as described in any one of claims 1 to 3.
8. A computer-readable storage medium, characterized in that, Includes a computer program that can be executed by a processor to perform the application detection method based on taint data stream tracing as described in any one of claims 1 to 3.