A software backdoor detection method based on taint tracking and constraint solving

Abstract

The present invention relates to a software backdoor detection method based on taint tracking and constraint solving, and belongs to the field of software security. In order to detect complex and hidden backdoors that are difficult to find by traditional methods, the present invention can locate sensitive behaviors in program logic and discover suspicious software backdoors by performing taint tracking analysis on software source code. The constraint solving technology is combined in the process, which can filter the non-triggerable paths in the detection results and improve the accuracy and efficiency of detection.

Description

Technical Field

[0001] The present invention belongs to the field of software security, and in particular relates to a software backdoor detection method based on taint tracking and constraint solving. Background Art

[0002] As software systems continue to grow and become more complex, software security issues are becoming increasingly important. Software backdoors, as malicious code hidden in normal software functions, can be exploited by attackers to steal data, damage systems, or gain unauthorized access. Traditional backdoor detection techniques usually rely on signature matching or behavioral analysis, but these methods have obvious limitations in the face of increasingly complex and hidden backdoor technologies.

[0003] Taint propagation analysis is an effective security analysis technique used to track the flow of sensitive data in a program. By marking and tracking specific data ("taints"), it is possible to find out how the data flows in a program and whether there are potential security risks. However, simply tracking the flow of data is not enough to accurately identify complex backdoor behaviors, because backdoors usually involve complex conditional judgments and control flow paths. Summary of the invention

[0004] 1. Technical issues to be resolved

[0005] The technical problem to be solved by the present invention is to provide a software backdoor detection method for detecting complex and hidden backdoors that are difficult to detect with traditional methods, thereby effectively improving the accuracy of the backdoor detection algorithm.

[0006] (II) Technical solution

[0007] In order to solve the above technical problems, the present invention provides a software backdoor detection method based on taint tracking and constraint solving, comprising the following steps:

[0008] Step 1: Construct the abstract syntax tree AST of the source code;

[0009] Step 2: Based on AST, construct the control flow graph CFG;

[0010] Step 3: Based on CFG, construct the value flow graph VFG;

[0011] Step 4: Map the branch conditions in CFG to VFG, expressed as expression model BoolExpr;

[0012] Step 5: Solve the constraints of BoolExpr in VFG;

[0013] Step 6: Update the numerical transfer conditions in VFG according to the solution results;

[0014] Step 7: Perform taint tracking in VFG and find a program path in VFG that is satisfactory and meets the backdoor characteristics.

[0015] Preferably, the first step is to extract source code from the software project under test, generate AST by parsing the source code, and identify key structures in the program, including loops, conditional statements, and function calls.

[0016] Preferably, the CFG constructed in the second step describes the control flow relationship between various blocks in the program and shows the possible paths of program execution.

[0017] Preferably, the VFG constructed in the third step describes the numerical value transfer relationship between statements in the program, so as to intuitively represent the flow of data.

[0018] Preferably, in the fourth step, the conditions corresponding to the branch nodes in the CFG are mapped to the data transfer of the VFG, thereby obtaining the triggering conditions of the data transfer process, which are expressed as the corresponding expression model BoolExpr.

[0019] Preferably, in the fifth step, BoolExpr is passed to the constraint solver for analysis to determine satisfiability, and there may be three results: a solution SAT that satisfies the constraint is found, a situation where there is no satisfying solution UNSAT, and a situation where it cannot be determined UNKNOWN.

[0020] Preferably, in the sixth step, the trigger conditions in the VFG are marked according to the solution results. If the solution result is UNSAT, it proves that the numerical transfer path cannot be triggered and no related backdoor will be generated, and the numerical transfer path will be marked as false; if the solution result is SAT, it proves that the numerical transfer path may be triggered, and the numerical transfer path does not need to be marked; if the solution result is UNKNOWN, it means that the constraints in the numerical transfer path are relatively complex and exceed the processing capability of the constraint solver, that is, the constraint solver cannot determine whether the numerical transfer path may be triggered, but the program path still has a backdoor risk, and the numerical transfer path will be marked as review, which requires further manual verification.

[0021] Preferably, in the seventh step, when taint tracking is performed in VFG, a search is performed according to the flow direction of the value. If a value transfer path marked as false is encountered, it proves that the corresponding value transfer will not occur, and the related software backdoor will not exist, and the value transfer path can be skipped; if a value transfer path is marked as review, it means that there is a backdoor risk in the value transfer path, but because the complexity of the conditional expression exceeds the processing capability of the constraint solver, it is necessary to further determine the software backdoor manually; if all conditions in a value transfer path are met and meet the characteristics of a software backdoor, it is determined to be a software backdoor, and at this time, a program path that is satisfactory and meets the backdoor characteristics is found in the VFG.

[0022] The present invention also provides a system for implementing the method.

[0023] The invention also provides a network security analysis method implemented based on the method.

[0024] (III) Beneficial effects

[0025] The present invention can locate sensitive behaviors in program logic and discover suspicious software backdoors by performing taint tracing analysis on software source code. The process combines constraint solving technology to filter out triggerable paths in detection results and improve detection accuracy and efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] Figure 1 It is the overall flow chart of software backdoor detection based on taint tracking and constraint solving of the present invention. It is necessary to build a series of models such as AST, CFG, VFG, and then map the branch conditions in CFG to VFG and express them as BoolExpr models. Then, the constraint solver is used to analyze BoolExpr, and the unsatisfiable expressions are updated to VFG. Finally, taint tracking calculations are performed in VFG according to program conditions.

[0027] Figure 2 It is a code screenshot used to illustrate the effect of taint analysis based on constraint solving;

[0028] Figure 3 The VFG model is generated by modeling the embodiment code. The figure only shows the nodes related to the software backdoor, including the input point of external data and the trigger point of the backdoor. The corresponding program statement, the function and line number of the statement are marked inside the node, and the directed edge between the nodes marks the transmission condition of the value, which is also the trigger condition of the software backdoor. DETAILED DESCRIPTION

[0029] In order to make the purpose, content and advantages of the present invention more clear, the specific implementation methods of the present invention are further described in detail below in conjunction with the drawings and examples.

[0030] According to the analysis of the inventors of the present invention, constraint solving technology can analyze conditional expressions on the program execution path and determine under what circumstances these expressions will be true. By combining taint propagation analysis, constraint solving can be used to determine whether there is a certain input or environment configuration that can trigger potential backdoor behavior. The advantage of this method is that it can not only track the flow of data, but also analyze the complex logical conditions on the flow path, thereby more accurately identifying and locating potential software backdoors.

[0031] Therefore, the present invention proposes a method that combines taint propagation analysis and constraint solving. This method is particularly suitable for detecting complex and hidden backdoors that are difficult to detect with traditional methods, effectively improving the accuracy of backdoor detection algorithms, and is expected to play an important role in the field of software security.

[0032] The present invention provides a software backdoor detection method based on taint tracing and constraint solving. A data flow model is established for the software source code, taint tracing analysis is implemented on the model, and patterns related to software backdoors are detected. In this process, constraint solving related technologies are used to improve the accuracy and efficiency of detection.

[0033] refer to Figure 1 , the technical solution of the present invention comprises the following steps:

[0034] Step 1: Construct the Abstract Syntax Tree (AST) of the source code;

[0035] Step 2: Based on AST, construct the control flow graph CFG (Control Flow Graph);

[0036] Step 3: Based on CFG, construct the value flow graph VFG (Value Flow Graph);

[0037] Step 4: Map the branch conditions in CFG to VFG, expressed as expression model BoolExpr;

[0038] Step 5: Solve the constraints of BoolExpr in VFG;

[0039] Step 6: Update the numerical transfer conditions in VFG according to the solution results;

[0040] Step 7: Perform taint tracking in VFG and find a program path in VFG that is satisfactory and meets the backdoor characteristics.

[0041] The first step is to extract source code from the software project under test. By parsing the source code to generate AST, key structures in the program, such as loops, conditional statements, and function calls, can be effectively identified, providing a basis for subsequent taint tracking and constraint solving.

[0042] The CFG constructed in the second step describes the control flow relationship between each block in the program (such as functions and loop bodies), showing the possible paths of program execution. Combined with the program branch nodes in CFG, it is helpful to use constraint solving to determine the reachability of a specific path, especially in scenarios involving complex logic and conditional judgments.

[0043] The VFG constructed in the third step describes the numerical transfer relationship between the statements in the program, which can more intuitively represent the flow of data. Through VFG, taint tracking can more accurately track external input data and use depth-first search to explore the program path.

[0044] The fourth step is to map the conditions corresponding to the branch nodes in CFG to the data transfer of VFG, so as to obtain the triggering conditions of the data transfer process, which are expressed as the corresponding expression model BoolExpr.

[0045] In the fifth step, BoolExpr is passed to the constraint solver for analysis to determine its satisfiability. There are three possible results: a solution that satisfies the constraint is found (SAT), there is no satisfying solution (UNSAT), and it cannot be determined (UNKNOWN).

[0046] In the sixth step, the trigger conditions in the VFG are marked according to the solution results. If the solution result is UNSAT, it proves that the numerical transfer path cannot be triggered and no related backdoor will be generated. The numerical transfer path will be marked as false; if the solution result is SAT, it proves that the numerical transfer path may be triggered and the numerical transfer path does not need to be marked; if the solution result is UNKNOWN, it means that the constraints in the numerical transfer path are more complex and exceed the processing capability of the constraint solver, that is, the constraint solver cannot determine whether the numerical transfer path may be triggered, but the program path still has a backdoor risk. The numerical transfer path will be marked as review and requires further manual verification.

[0047] In the seventh step, when taint tracking is performed in VFG, a search is performed according to the flow of values. If a value transfer path marked as false is encountered, it proves that the corresponding value transfer will not occur, and the related software backdoor will not exist, and the value transfer path can be skipped; if a value transfer path is marked as review, it means that there is a backdoor risk in the value transfer path, but because the complexity of the conditional expression exceeds the processing capability of the constraint solver, it is necessary to further determine the software backdoor manually; if all conditions in a value transfer path are satisfied (SAT) and meet the characteristics of a software backdoor, such as external input data being executed as instructions, it can be determined as a software backdoor. At this time, a program path that is satisfactory and meets the backdoor characteristics is found in VFG.

[0048] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the technical principles of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A software backdoor detection method based on taint tracking and constraint solving, characterized in that: The following steps are involved: Step 1: Construct the abstract syntax tree AST of the source code; Step 2: Based on AST, construct the control flow graph CFG; Step 3: Based on CFG, construct the value flow graph VFG; Step 4: Map the branch conditions in CFG to VFG, expressed as expression model BoolExpr; Step 5: Solve the constraints of BoolExpr in VFG; Step 6: Update the numerical transfer conditions in VFG according to the solution results; Step 7: Perform taint tracking in VFG and find a program path in VFG that is satisfactory and meets the backdoor characteristics; The fourth step is to map the conditions corresponding to the branch nodes in CFG to the data transfer of VFG, so as to obtain the triggering conditions of the data transfer process, which are expressed as the corresponding expression model BoolExpr; In the fifth step, BoolExpr is passed to the constraint solver for analysis to determine satisfiability. There are three possible results: SAT, which satisfies the constraint; UNSAT, which does not satisfy the constraint; and UNKNOWN, which cannot be determined. In the sixth step, the trigger conditions in the VFG are marked according to the solution results. If the solution result is UNSAT, it proves that the numerical transfer path cannot be triggered and no related backdoor will be generated. The numerical transfer path will be marked as false; if the solution result is SAT, it proves that the numerical transfer path may be triggered and the numerical transfer path does not need to be marked; if the solution result is UNKNOWN, it means that the constraints in the numerical transfer path are more complex and exceed the processing capacity of the constraint solver, that is, the constraint solver cannot determine whether the numerical transfer path may be triggered, but the program path still has a backdoor risk. The numerical transfer path will be marked as review and requires further manual verification; Step 7: When taint tracking is performed in VFG, search according to the flow direction of the value. If a value transfer path marked as false is encountered, it proves that the corresponding value transfer will not occur, and the related software backdoor will not exist. The value transfer path can be skipped; If a value transfer path is marked as review, it means that there is a backdoor risk in the value transfer path. However, because the complexity of the conditional expression exceeds the processing capability of the constraint solver, it is necessary to further determine the software backdoor manually. If all conditions in a certain value transfer path are met and meet the characteristics of a software backdoor, it is determined to be a software backdoor. At this time, a program path that is satisfactory and meets the backdoor characteristics is found in the VFG.

2. The method according to claim 1, characterized in that The first step is to extract source code from the software project under test, generate AST by parsing the source code, and identify key structures in the program, including loops, conditional statements, and function calls.

3. The method according to claim 1, characterized in that The CFG constructed in the second step describes the control flow relationship between the blocks in the program and shows the possible paths of program execution.

4. The method according to claim 1, characterized in that The VFG constructed in the third step describes the numerical transfer relationship between statements in the program, which is used to intuitively represent the flow of data.

Images