A vulnerability detection method and device, electronic equipment and storage medium

Abstract

The present disclosure relates to a vulnerability detection method and device, electronic equipment and storage medium. The method comprises: obtaining a code to be detected; in the case that a target function exists in the code to be detected, backtracking the parameters of the target function to obtain a backtracking result, and determining whether the code to be detected has a vulnerability based on the backtracking result. In the case that a target function exists in the code to be detected, the parameters of the target function are backtracked to determine the source of the parameters, further determine whether the code to be detected has a vulnerability, and improve the accuracy of vulnerability detection.

Description

Technical Field

[0001] This disclosure relates to the field of cybersecurity technology, and in particular to a vulnerability detection method, apparatus, electronic device, and storage medium. Background Technology

[0002] During the design and development of application systems, factors such as incomplete or poorly implemented development standards and varying skill levels among developers can easily lead to security vulnerabilities in the developed code. These vulnerabilities include common ones such as Structured Query Language (SQL) injection vulnerabilities, Cross-Site Scripting (CSS) vulnerabilities, buffer overflow vulnerabilities, and vulnerabilities that leak sensitive information in configuration files. If these vulnerabilities are not detected and addressed promptly, they can pose significant security risks to the deployed application system.

[0003] In terms of discovering and detecting code vulnerabilities, the relevant technologies rely on manual searching for vulnerabilities in the code, resulting in a low accuracy rate for vulnerability detection. Summary of the Invention

[0004] This disclosure provides a vulnerability detection method, apparatus, electronic device, and storage medium.

[0005] According to a first aspect of this disclosure, a vulnerability detection method is provided, the method comprising: acquiring code to be detected;

[0006] If a target function exists in the code to be tested, the parameters of the target function are backtracked to obtain the backtracking results, and the presence of vulnerabilities in the code to be tested is determined based on the backtracking results.

[0007] According to a second aspect of this disclosure, a vulnerability detection device is provided, the device comprising: an acquisition module for acquiring code to be detected; and a detection module for, if a target function exists in the code to be detected, backtracking the parameters of the target function to obtain a backtracking result, and determining whether the code to be detected has a vulnerability based on the backtracking result.

[0008] According to a third aspect of this disclosure, an electronic device is provided, comprising: a memory and a processor, wherein the memory stores a computer program, and the processor executes the program to implement the method described above.

[0009] According to a fourth aspect of this disclosure, a computer-readable storage medium is provided having a computer program stored thereon that, when executed by a processor, implements the methods described above.

[0010] The vulnerability detection method, apparatus, electronic device, and storage medium provided in this disclosure improve the accuracy of vulnerability detection by acquiring the code to be detected and, if the code to be detected contains a target function, by tracing back the parameters of the target function to determine the source of the parameters and further determining whether the code to be detected has a vulnerability. Attached Figure Description

[0011] Further details, features, and advantages of this disclosure are disclosed in the following description of exemplary embodiments in conjunction with the accompanying drawings, in which:

[0012] Figure 1 A flowchart illustrating an exemplary embodiment of this disclosure;

[0013] Figure 2 A schematic block diagram of the functional modules of a vulnerability detection apparatus provided in an exemplary embodiment of this disclosure;

[0014] Figure 3 A structural block diagram of an electronic device provided as an exemplary embodiment of this disclosure;

[0015] Figure 4 A block diagram of a computer system provided for an exemplary embodiment of this disclosure. Detailed Implementation

[0016] Embodiments of this disclosure will now be described in more detail with reference to the accompanying drawings. While some embodiments of this disclosure are shown in the drawings, it should be understood that this disclosure can be implemented in various forms and should not be construed as limited to the embodiments set forth herein. Rather, these embodiments are provided to provide a more thorough and complete understanding of this disclosure. It should be understood that the accompanying drawings and embodiments of this disclosure are for illustrative purposes only and are not intended to limit the scope of protection of this disclosure.

[0017] It should be understood that the steps described in the method embodiments of this disclosure may be performed in different orders and / or in parallel. Furthermore, the method embodiments may include additional steps and / or omit the steps shown. The scope of this disclosure is not limited in this respect.

[0018] The term "comprising" and its variations as used herein are open-ended, meaning "including but not limited to". The term "based on" means "at least partially based on". The term "one embodiment" means "at least one embodiment"; the term "another embodiment" means "at least one additional embodiment"; the term "some embodiments" means "at least some embodiments". Definitions of other terms will be given in the description below. It should be noted that the concepts of "first", "second", etc., used in this disclosure are only used to distinguish different devices, modules, or units, and are not intended to limit the order of functions performed by these devices, modules, or units or their interdependencies.

[0019] It should be noted that the terms "a" and "a plurality of" used in this disclosure are illustrative rather than restrictive, and those skilled in the art should understand that, unless otherwise expressly indicated in the context, they should be understood as "one or more".

[0020] The names of messages or information exchanged between multiple devices in the embodiments of this disclosure are for illustrative purposes only and are not intended to limit the scope of such messages or information.

[0021] It is understood that before using the technical solutions disclosed in the various embodiments of this disclosure, users should be informed of the types, scope of use, and usage scenarios of the personal information involved in this disclosure in an appropriate manner in accordance with relevant laws and regulations, and user authorization should be obtained.

[0022] For example, upon receiving a user's active request, a prompt message is sent to the user to explicitly inform them that the requested operation will require the acquisition and use of the user's personal information. This allows the user to independently choose whether to provide personal information to the software or hardware, such as the electronic device, application, server, or storage medium performing the operations of this disclosed technical solution, based on the prompt message.

[0023] As an optional but non-limiting implementation, in response to a user's active request, sending a prompt message to the user can be done via a pop-up window, where the prompt message can be presented in text format. Furthermore, the pop-up window can also include a selection control allowing the user to choose "agree" or "disagree" to provide personal information to the electronic device. It is understood that the above notification and user authorization process is merely illustrative and does not constitute a limitation on the implementation of this disclosure; other methods that comply with relevant laws and regulations may also be applied to the implementation of this disclosure.

[0024] This disclosure provides a vulnerability detection method, as follows:

[0025] First, we collect enough common defect patterns from code analysis experience and abstract them into rule bases for different vulnerability types. In the scanning engine, we pre-sort out functions that can cause harm, i.e. sink functions, and locate all places in the code where such harmful functions appear. Then, based on Lex (Lexical Analyzer Generator) and Yacc (Yet another compiler compiler), we parse the corresponding source code into AST (Abstract Syntax Tree). Based on the abstract syntax tree, we backtrack and analyze whether the parameters of the harmful functions are controllable to determine whether a vulnerability exists.

[0026] This method includes two detection approaches. One involves matching static code text with strings (regular expression matching mode) to detect relatively simple vulnerabilities such as hard-coded vulnerabilities, vulnerabilities using insecure random number functions, or vulnerabilities using insecure encryption algorithms. The other approach involves locating the sink function, tracing its parameters, and determining whether the parameters are controllable (controllable parameter mode) to identify vulnerabilities. This method can detect vulnerabilities such as SQL injection and command injection. By using both detection modes together, most common vulnerability types can be detected.

[0027] In one possible implementation, the scanning engine is written in Python. The engine implements processes such as rule preprocessing (classifying rules), finding sink functions, and backtracking parameters. It uses the pure Python library javalang, which is dedicated to processing Java source code. javalang provides a lexical analyzer and parser for Java 8.

[0028] The rule base is written in XML. Vulnerability information is derived from publicly available CVEs and the principles behind vulnerability occurrence. Each rule includes: vulnerability name, programming language, scan mode, tainted functions (sinks), severity level, and code example (test), with corresponding matching rules set based on the scan mode. In addition to individual rules for each vulnerability type, a general Source function table is created. This table contains functions used in web application development to retrieve various information from the front end, such as the getParameter() function. The engine continuously calls the Source file during the scanning process to determine if a vulnerability exists.

[0029] The steps for detecting the code are as follows:

[0030] Once the scan begins, the scanning engine reads the rule base one rule at a time to determine which scanning mode should be used for the current rule. If it is a regular expression matching mode, it only matches the code content based on the regular expression in the rule; if a match is found, the code is considered to have a vulnerability. If the current rule is a parameter-controlled mode, then a parameter-controlled mode scan is performed.

[0031] In one possible implementation, during the parameter-controllable mode scan, the existence of a sink function in the code is checked. If a sink function exists, the parameters of the sink function are backtracked.

[0032] When a sink function is detected in a custom function within the code, the parameters of the sink function inside the custom function are traced back, using the function declaration as the boundary. If the traceback leads back to the source function within the custom function, the parameters are determined to be user-controllable, confirming the existence of a vulnerability. If the traceback reaches the function declaration but still does not find the source function, the existence of a vulnerability cannot be determined. It is necessary to check whether the parameters of the custom function include the parameters of the sink function. If they do not include them, the current traceback stops, indicating that the vulnerability does not exist. If they do include them, it indicates that the custom function may be called elsewhere, causing a vulnerability. Therefore, the custom function needs to be added to the original sink function list, and the sink point and backtracking parameters need to be relocated.

[0033] In one possible implementation, functions with the same name might exist in different codebases, potentially leading to numerous false positives. Therefore, when adding a custom function to the initial sink function list, it is renamed based on the file package it resides in, ensuring the uniqueness of each sink function's name. This process is repeated for multi-level calls until all sink functions and their parameters have been traced back.

[0034] During the backtracking process of the sink function's parameters, the corresponding source code is parsed into an Abstract Syntax Tree (AST) based on Lex and Yacc. Backtracking is then performed based on the AST, and when program control blocks such as jumps, loops, and branches are detected, CFG (Control Flow Graph) analysis is introduced. Specifically, the control flow analysis uses the soot framework to transform the code into an IR (Intermediate Representation). Soot uses a Body to represent the code of a method block, and each Body generates a control flow graph according to the Backward Flow Analysis pattern. The control flow graph stores each node and its predecessor and successor nodes, which can be represented as follows:

[0035] front-wheel drive

[0036]

[0037] successor

[0038]

[0039] Where b represents the current node, Pred(b) represents the predecessor node of node b, N represents all nodes within the basic block containing b, and E represents all flows within that basic block. Predecessor nodes refer to other nodes that flow to the current node b, and successor nodes refer to other nodes that flow from the current node b. If there exists a node n belonging to N and a flow direction e belonging to E, where the direction of e is from n to b, then node n is the predecessor node of b. If there exists a node n belonging to N and a flow direction e belonging to E, where the direction of e is from b to n, then node n is the successor node of b.

[0040] During the backtracking process, if a basic block containing control statements is encountered, the predecessor and successor nodes of that basic block are first identified. Then, the Directed Graph interface of soot is used to find the flow of nodes within the corresponding block, thereby listing all jumps, loops, and branches within the block one by one, and backtracking them one by one. Finally, the existence of a vulnerability is determined by checking whether the parameters of the sink function are controllable.

[0041] The above method can detect whether a sink function exists in the code. If a sink function exists, its parameters are backtracked. If a control statement is detected, a control flow graph is generated based on the control statement, and then each branch of the control statement is backtracked. This reduces false positives and false negatives, improves the accuracy of vulnerability detection, and the efficiency of vulnerability detection is improved by introducing control flow analysis only when a control statement is detected.

[0042] Based on the above embodiments, in another embodiment provided in this disclosure, a vulnerability detection method is also provided, such as... Figure 1 As shown, the method may include the following steps:

[0043] In step S100, the code to be detected is obtained.

[0044] In step S200, if a target function exists in the code to be detected, the parameters of the target function are backtracked to obtain the backtracking result, and the vulnerability of the code to be detected is determined based on the backtracking result.

[0045] The target function is the sink function, which is a function that may trigger security issues, such as the eval function in PHP or the run function in Java.

[0046] In one possible implementation, the sink function can consist of a package name, class name, return value, function name, parameters, the location that can be infected, and the vulnerability type.

[0047] The above method enables us to trace back the parameters of the target function when the code under test contains the target function, thereby determining the source of the parameters and further judging whether the code under test has vulnerabilities, thus improving the accuracy of vulnerability detection.

[0048] To more clearly illustrate this disclosure, based on the above embodiments, step S200 further includes:

[0049] In step S210, if there are control statements in the code to be detected, control flow information is generated based on the control statements to determine multiple control branches corresponding to the control statements, and each of the multiple control branches is traversed for backtracking.

[0050] Among them, control flow information includes control flow graphs, which are abstract representations of a process or program. They represent all the paths that a program will traverse during execution. They use a graph to represent the possible flow of execution of all basic blocks within a process and can also reflect the real-time execution process of a program.

[0051] In one possible implementation, control flow analysis is introduced when a control statement is detected during the backtracking of the parameters of the objective function. This control flow analysis uses the soot framework to transform the code into an intermediate representation. Soot uses a Body to represent the code of a method block, and each Body generates a control flow graph according to the Backward Flow Analysis pattern.

[0052] The above method enables the generation of a control flow graph based on control statements during the backtracking process, when control statements are detected. This allows for backtracking of each branch of the control statements, avoiding the omission of certain conditional branches that could lead to false or false reports of vulnerabilities. This improves the accuracy of vulnerability detection. Furthermore, the introduction of control flow analysis only when control statements are detected enhances the efficiency of vulnerability detection.

[0053] To illustrate this disclosure more clearly, based on the above embodiments, the method further includes the following steps:

[0054] In step S300, if the source function corresponding to the objective function is not traced back, it is determined whether the parameters of the first function to which the objective function belongs include the parameters of the objective function.

[0055] The source function is a function that can be manually input into the program. It consists of a package name, class name, return value, function name, and parameter identifiers. The first function is the function in the code to be tested that contains the target function. It can be a user-defined function or another type of function; this disclosure does not limit the type of the first function.

[0056] In one possible implementation, if the backtracking does not reach the source function corresponding to the parameters of the sink function, and the parameters of the first function do not include the parameters of the sink function, it indicates that the first function in the code to be tested does not have a vulnerability, and the backtracking stops.

[0057] In step S400, if the parameters of the first function include the parameters of the target function, the first function is used as the new target function and added to the target function list.

[0058] The objective function list is the initial sink function list.

[0059] In one possible implementation, if the first function has a sink function but does not backtrack to the source function corresponding to the sink function, it is determined whether the parameters of the first function include the parameters of the sink function. If they do, it indicates that the first function may be called elsewhere, causing a vulnerability. Therefore, the first function is used as a new sink function and added to the initial sink function list.

[0060] When adding a new sink function to the initial sink function list, the function name and its associated file information, including the package name, are retrieved. The new sink function is named based on its function name and package name; for example, it can be named in the format of "package name" + "function name". During subsequent scanning, the first function is searched and backtracked through the entire codebase. While searching for the first function, the import package names of the files calling the first function are automatically analyzed, as well as whether the content of those files contains the function name. Optionally, in cases of multi-level call relationships, the search and backtracking of the first function is repeated until all values ​​of the first function in the initial sink function list have been searched and backtracked.

[0061] By implementing the above method, when a target function exists but its corresponding source function cannot be traced back, the function to which the target function belongs is added as a new target function to the target function list. In subsequent detection, vulnerabilities caused by functions containing the target function being called by different files can be discovered, further improving the accuracy of vulnerability detection. Furthermore, when adding a new target function to the target function list, it can be named based on the new sink function's name and its associated file package name, ensuring the uniqueness of sink function names in the initial sink function list and reducing false positives caused by identical function names.

[0062] To more clearly illustrate this disclosure, based on the above embodiments, step S210 further includes:

[0063] In step S2101, the predecessor node and successor node of the control statement are obtained, the flow direction information between the predecessor node and the successor node is determined, and multiple control branches corresponding to the control statement are determined based on the flow direction information.

[0064] In one possible implementation, the control flow graph stores each node in the control statement and its predecessor and successor nodes, which can be represented as follows:

[0065] front-wheel drive

[0066]

[0067] successor

[0068]

[0069] Where b represents the current node, Pred(b) represents the predecessor node of node b, N represents all nodes within the basic block containing b, and E represents all flows within that basic block. Predecessor nodes refer to other nodes that flow to the current node b, and successor nodes refer to other nodes that flow from the current node b. If there exists a node n belonging to N and a flow direction e belonging to E, where the direction of e is from n to b, then node n is the predecessor node of b. This indicates that there exists a node n belonging to N and a flow direction e belonging to E, where the direction of e is from b to n. In this case, node n is the successor node of b.

[0070] After determining the predecessor and successor nodes of the control statement, the Directed Graph interface of soot can be used to find the flow between the nodes inside the basic block of the control statement, thereby listing all jumps, loops and branches inside the basic block one by one and backtracking them one by one.

[0071] To illustrate this disclosure more clearly, based on the above embodiments, the method further includes the following steps:

[0072] In step S500, an abstract syntax tree is constructed based on the code to be detected.

[0073] For example, the code to be tested is parsed into functions, basic blocks, expressions, and operands. Functions include the main function and other functions, and expressions include operands and operators. Specifically, the code to be tested is divided into a main function and a set of other functions. Each function (Func) consists of a basic block (Block); the basic block contains sequentially executed statements, each statement is called an expression (Op); each expression consists of different variables and operators, each variable is called an operand (Operand). Thus, for any web application's code, four objects—Func, Block, Op, and Operand—are parsed out.

[0074] Multiple Blocks form a Func, which links to all Ops under the basic block. Each Op then links to multiple Operands, ultimately connecting the code of the entire web application. For each used variable Operand, its defined Op can be found, so Operands can be linked to their valid definitions by adding an Ops attribute to the Operand, pointing to the Op that defines the variable. Then, using the open-source PHP-Parser, the operands of the expression are used as leaves of the tree structure, and the operators of the expression are used as roots of the tree structure, and the abstract syntax tree is constructed iteratively.

[0075] For example, the basic blocks that make up the function are linked to the corresponding expressions; the expressions are linked to the corresponding operands; based on PHP-Parser, the operands are used as leaves of the tree structure and the operators are used as roots of the tree structure, and the abstract syntax tree is constructed in a loop.

[0076] In step S600, the parameters of the objective function are backtracked based on the abstract syntax tree.

[0077] In one possible implementation, all nodes, declarations, and assignment relationships in the code are obtained based on the abstract syntax tree. Each node in the abstract syntax tree is traversed, and the process is backtracked upwards based on the assignment relationships of the variables corresponding to the parameters.

[0078] To illustrate this disclosure more clearly, based on the above embodiments, the method further includes:

[0079] In step S700, if the source function corresponding to the parameter of the target function is traced back, it is determined that the code to be detected has a vulnerability.

[0080] Optionally, if it is determined that the code to be detected has a vulnerability, a vulnerability alert is generated. The vulnerability alert may include the name of the sink function that caused the vulnerability, the location of the vulnerability, and the file information that calls the function.

[0081] The method provided in this disclosure enables the acquisition of code to be detected. If a target function exists within the code, the parameters of the target function are backtracked. During this backtracking process, when a control statement is detected, control flow analysis is introduced. Based on the control flow graph, each branch of the control statement is backtracked, preventing missed branches and thus avoiding false positives or negatives, thereby improving the accuracy of vulnerability detection. Furthermore, when a target function exists but its corresponding source function is not traced back, the function to which the target function belongs is added as a new target function to the target function list. In subsequent detection, vulnerabilities caused by functions containing the target function being called by different files can be discovered, further improving the accuracy of vulnerability detection.

[0082] By dividing each functional module according to its corresponding function, this disclosure provides a vulnerability detection device, which can be a server or a chip applied to a server. Figure 2 This is a schematic block diagram of the functional modules of a vulnerability detection apparatus provided as an exemplary embodiment of this disclosure. Figure 2 As shown, the vulnerability detection device includes:

[0083] Module 201 is used to obtain the code to be detected.

[0084] The detection module 202 is used to backtrack the parameters of the target function when the target function exists in the code to be detected, obtain the backtracking result, and determine whether there is a vulnerability in the code to be detected based on the backtracking result.

[0085] In one possible implementation, the above apparatus further includes: a determination module, configured to generate control flow information based on the control statements when the code to be detected contains control statements, to determine multiple control branches corresponding to the control statements, and to backtrack through each of the multiple control branches.

[0086] In one possible implementation, the detection module 202 is further configured to: determine whether the parameters of the first function to which the target function belongs contain the parameters of the target function if the source function corresponding to the target function has not been traced back; and if the parameters of the first function contain the parameters of the target function, add the first function and its corresponding file package name as new target functions to the target function list.

[0087] In one possible implementation, the acquisition module 201 is further configured to: acquire the file package name to which the function name of the first function belongs, and the above-mentioned apparatus further includes: a naming module, configured to name a new target function based on the function name and the file package name.

[0088] In one possible implementation, the aforementioned determining module is further configured to: obtain the predecessor and successor nodes of the control statement, determine the flow direction information between the predecessor and successor nodes, and determine multiple control branches corresponding to the control statement based on the flow direction information of the nodes.

[0089] In one possible implementation, the above-mentioned apparatus further includes a construction module for constructing an abstract syntax tree based on the code to be detected; the detection module 202 is also used to backtrack the parameters of the target function based on the abstract syntax tree.

[0090] In one possible implementation, the detection module 202 is also used to: determine that the code to be detected has a vulnerability when tracing back to the source function corresponding to the parameter of the target function.

[0091] This disclosure also provides an electronic device, including: at least one processor; a memory for storing processor-executable instructions; wherein the at least one processor is configured to execute the instructions to implement the methods disclosed in this disclosure.

[0092] Figure 3 This is a schematic diagram of the structure of an electronic device provided as an exemplary embodiment of this disclosure. For example... Figure 3 As shown, the electronic device 1800 includes at least one processor 1801 and a memory 1802 coupled to the processor 1801. The processor 1801 can perform the corresponding steps in the methods disclosed in the embodiments of this disclosure.

[0093] The processor 1801 described above can also be called a central processing unit (CPU), which can be an integrated circuit chip with signal processing capabilities. Each step in the method disclosed in this embodiment can be implemented by the integrated logic circuitry in the processor 1801 or by software instructions. The processor 1801 can be a general-purpose processor, a digital signal processor (DSP), an ASIC, a field-programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the method disclosed in this embodiment can be directly implemented by a hardware decoding processor, or by a combination of hardware and software modules in the decoding processor. The software modules can be located in the memory 1802, such as random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, registers, or other mature storage media in the art. The processor 1801 reads information from the memory 1802 and, in conjunction with its hardware, completes the steps of the method described above.

[0094] Furthermore, various operations / processes according to this disclosure, implemented via software and / or firmware, can be transmitted from a storage medium or network to a computer system with a dedicated hardware architecture, such as... Figure 4 The computer system 1900 shown is equipped with the programs that constitute the software. When various programs are installed, the computer system is able to perform various functions, including those described above. Figure 4 A block diagram of a computer system provided for an exemplary embodiment of this disclosure.

[0095] Computer System 1900 is intended to represent various forms of digital electronic computer devices, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. Electronic devices can also represent various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the present disclosure described and / or claimed herein.

[0096] like Figure 4As shown, the computer system 1900 includes a computing unit 1901, which can perform various appropriate actions and processes based on a computer program stored in a read-only memory (ROM) 1902 or a computer program loaded from a storage unit 1908 into a random access memory (RAM) 1903. The RAM 1903 may also store various programs and data required for the operation of the computer system 1900. The computing unit 1901, ROM 1902, and RAM 1903 are interconnected via a bus 1904. An input / output (I / O) interface 1905 is also connected to the bus 1904.

[0097] Multiple components in computer system 1900 are connected to I / O interface 1905, including: input unit 1906, output unit 1907, storage unit 1908, and communication unit 1909. Input unit 1906 can be any type of device capable of inputting information into computer system 1900. Input unit 1906 can receive input digital or character information and generate key signal inputs related to user settings and / or function control of the electronic device. Output unit 1907 can be any type of device capable of presenting information and may include, but is not limited to, a monitor, speaker, video / audio output terminal, vibrator, and / or printer. Storage unit 1908 may include, but is not limited to, hard disks and optical disks. Communication unit 1909 allows computer system 1900 to exchange information / data with other devices via a network such as the Internet, and may include, but is not limited to, modems, network cards, infrared communication devices, wireless communication transceivers, and / or chipsets, such as Bluetooth™ devices, WiFi devices, WiMax devices, cellular communication devices, and / or the like.

[0098] The computing unit 1901 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of the computing unit 1901 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. The computing unit 1901 performs the various methods and processes described above. For example, in some embodiments, the methods disclosed in this disclosure can be implemented as a computer software program tangibly contained in a machine-readable medium, such as storage unit 1908. In some embodiments, part or all of the computer program can be loaded and / or installed on the electronic device 1900 via ROM 1902 and / or communication unit 1909. In some embodiments, the computing unit 1901 can be configured to perform the methods disclosed in this disclosure by any other suitable means (e.g., by means of firmware).

[0099] This disclosure also provides a computer-readable storage medium, wherein when the instructions in the computer-readable storage medium are executed by a processor of an electronic device, the electronic device is able to perform the methods disclosed in this disclosure.

[0100] The computer-readable storage medium in this disclosure can be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, apparatus, or device. The aforementioned computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination of the foregoing. More specifically, the aforementioned computer-readable storage medium may include electrical connections based on one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0101] The aforementioned computer-readable medium may be included in the aforementioned electronic device; or it may exist independently and not assembled into the electronic device.

[0102] This disclosure also provides a computer program product, including a computer program, wherein the computer program, when executed by a processor, implements the methods disclosed in the embodiments of this disclosure.

[0103] In embodiments of this disclosure, computer program code for performing the operations of this disclosure can be written in one or more programming languages ​​or a combination thereof. These programming languages ​​include, but are not limited to, object-oriented programming languages ​​such as Java, Smalltalk, and C++, as well as conventional procedural programming languages ​​such as the "C" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network (including a local area network (LAN) or a wide area network (WAN)), or it can be connected to an external computer.

[0104] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this disclosure. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0105] The modules, components, or units described in the embodiments of this disclosure can be implemented in software or hardware. The names of the modules, components, or units do not necessarily constitute a limitation on the module, component, or unit itself.

[0106] The functions described above in this document can be performed at least in part by one or more hardware logic components. For example, without limitation, exemplary hardware logic components that can be used include: field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), system-on-a-chip (SoCs), complex programmable logic devices (CPLDs), and so on.

[0107] The above description is merely an illustration of some embodiments of this disclosure and the technical principles employed. Those skilled in the art should understand that the scope of this disclosure is not limited to technical solutions formed by specific combinations of the above-described technical features, but should also cover other technical solutions formed by arbitrary combinations of the above-described technical features or their equivalents without departing from the above-described concept. For example, technical solutions formed by substituting the above features with (but not limited to) technical features disclosed in this disclosure that have similar functions.

[0108] While specific embodiments of this disclosure have been described in detail by way of example, those skilled in the art should understand that the examples are for illustrative purposes only and not intended to limit the scope of this disclosure. Those skilled in the art should understand that modifications can be made to the above embodiments without departing from the scope and spirit of this disclosure. The scope of this disclosure is defined by the appended claims.

Claims

1. A vulnerability detection method characterized by, The method comprises: acquiring a code to be detected; scanning the code to be detected by using a dual-mode detection mechanism; the dual-mode detection mechanism comprises a regular matching mode and a parameter controllable mode; the regular matching mode is used to match code text based on a regular expression to obtain a matching result; the parameter controllable mode is used to backtrack parameters of a target function in the code to be detected to obtain a backtracking result; in a case where a source function corresponding to the parameters of the target function is not backtracked, determining whether parameters of a first function to which the target function belongs contain the parameters of the target function; in a case where the parameters of the first function contain the parameters of the target function, taking the first function as a new target function, acquiring a function name of the first function and file information to which the first function belongs; naming the new target function based on the function name and the file information, adding the named new target function to the target function list, and continuing the backtracking process; determining whether the code to be detected has a vulnerability based on the matching result or the backtracking result.

2. The method of claim 1, wherein, The backtracking of the parameters of the target function comprises: in a case where the code to be detected contains a control statement, generating control flow information based on the control statement to determine a plurality of control branches corresponding to the control statement, and backtracking each of the plurality of control branches.

3. The method of claim 2, wherein, The generation of the control flow information based on the control statement to determine the plurality of control branches corresponding to the control statement comprises: acquiring a predecessor node and a successor node of the control statement, determining flow direction information between the predecessor node and the successor node, and determining the plurality of control branches corresponding to the control statement based on the flow direction information.

4. The method of claim 1, wherein, The backtracking of the parameters of the target function further comprises: constructing an abstract syntax tree based on the code to be detected; backtracking the parameters of the target function based on the abstract syntax tree.

5. The method of claim 1, wherein, The determination of whether the code to be detected has a vulnerability based on the backtracking result comprises: in a case where the source function corresponding to the parameters of the target function is backtracked, determining that the code to be detected has a vulnerability.

6. A vulnerability detection apparatus characterized by comprising: The apparatus comprises: an acquisition module configured to acquire a code to be detected; a detection module configured to scan the code to be detected by using a dual-mode detection mechanism; the dual-mode detection mechanism comprises a regular matching mode and a parameter controllable mode; the regular matching mode is used to match code text based on a regular expression to obtain a matching result; the parameter controllable mode is used to backtrack parameters of a target function in the code to be detected to obtain a backtracking result; The detection module is further configured to determine whether parameters of a first function to which the target function belongs contain the parameters of the target function in a case where the parameters of the target function do not backtrack to a source function corresponding to the target function; in a case where the parameters of the first function contain the parameters of the target function, take the first function as a new target function, acquire a function name of the first function and file information to which the first function belongs; name the new target function based on the function name and the file information, add the named new target function to the target function list, and continue the backtracking process. The detection module is further configured to determine whether the to-be-detected code has a vulnerability based on the matching result or the backtracking result.

7. An electronic device, comprising: The computer readable storage medium stores instructions executable by a processor of an electronic device, the instructions comprising: at least one processor; a memory for storing instructions executable by the at least one processor; wherein the at least one processor is configured to execute the instructions to implement the method of any one of claims 1-5.

8. A computer-readable storage medium, characterized in that, When the instructions in the computer readable storage medium are executed by the processor of the electronic device, the electronic device is enabled to perform the method of any one of claims 1-5.

Images