Static detection accuracy improvement method based on false alarm feedback, computing device and readable storage medium

Abstract

The present application provides a method for improving the accuracy of static detection based on false alarm feedback, a computing device, and a readable storage medium, the improvement method comprising: obtaining false alarm information based on the defect description in the static detection result; capturing the path blocking binary based on the false alarm information; and updating the detection logic of the static detection engine based on the path blocking binary. The present application scheme collects false alarm information to obtain the path blocking binary, updates the detection logic of the static detection, and thus reduces the false alarm rate of static code analysis. At the same time, the present scheme allows testers to eliminate the false alarm results obtained by the static analysis tool without being familiar with the underlying detection code, thereby reducing the cost of adjusting the detection layer code of the static analysis tool, and also shortening the time wasted by relevant personnel in checking a large number of false alarms in the static analysis results, thereby improving the efficiency of testing using static code analysis tools.

Description

Technical Field

[0001] The present application relates to the field of computer science and technology, and in particular to a static detection accuracy improvement method based on false alarm feedback, a computing device, and a readable storage medium. Background Art

[0002] Static code analysis technology is a code analysis technology that does not actually run the program. It analyzes the source code, bytecode or binary code of the program to detect defects, security vulnerabilities, coding standard errors, etc. The characteristics of today's static code analysis technology are low false negatives and high false positives.

[0003] The complexity of modern software systems continues to increase, with huge amounts of code, numerous modules, and complex logic. Therefore, excessive false positives will cause developers to spend a lot of time verifying and eliminating false positives, thereby reducing development efficiency.

[0004] Static analysis technology may encounter difficulties in understanding complex business logic and algorithms. For example, modern applications often rely on a large number of third-party libraries and frameworks. Static analysis technology cannot fully understand the internal working principles of these libraries during code analysis, resulting in false positives. On the other hand, as compilers continue to upgrade, the detection rules that static code analysis relies on are too conservative and cannot adapt to new coding styles or structures, resulting in false positives. Summary of the invention

[0005] The purpose of this application is to provide a static detection accuracy improvement method based on false positive feedback, a computing device and a readable storage medium, which are used to solve the technical problems in the prior art that static analysis technology cannot understand the library or framework work during the code analysis process, resulting in false positives, and the detection logic of static code analysis is too conservative, resulting in false positives.

[0006] To achieve the above objectives, this application provides the following solutions:

[0007] In a first aspect, the present application provides a static detection accuracy improvement method based on false alarm feedback, comprising:

[0008] Obtain false positive information based on the defect description in the static detection results;

[0009] capturing a path blocking binary group based on the false alarm information;

[0010] The detection logic of the static detection engine is updated based on the path blocking tuple.

[0011] Preferably, the step of obtaining false alarm information based on the defect description in the static detection result includes:

[0012] Analyzing and verifying the defect description in the static detection result;

[0013] Defect descriptions that are verified through analysis are identified as false positives.

[0014] Preferably, the step of obtaining a path blocking binary group based on the false alarm information includes:

[0015] Determine a corresponding matching rule based on the false positive information;

[0016] Acquire a corresponding path sequence based on the false alarm information;

[0017] The matching rule and the corresponding path sequence are used to generate a path blocking tuple.

[0018] Preferably, the matching rule includes at least one of the following: inclusive matching, complete matching, and head-to-tail matching.

[0019] Preferably, the step of updating the detection logic of the detection engine based on the path blocking tuple includes:

[0020] Parsing the path blocking binary group to obtain a matching rule and a path node sequence of the path blocking binary group;

[0021] Establishing a working node stack and a set of vulnerable paths, and adding the path source node to the working node stack;

[0022] When the working node stack is not empty, popping the top node of the stack;

[0023] Compare the pop-up node with the node corresponding to the offset of the path blocking binary sequence;

[0024] The vulnerability path set is updated according to the matching rules and comparison results.

[0025] Preferably, when the matching rule is a rule that includes a match, the step of updating the detection logic includes:

[0026] Initialize the blocking node offset, and set the blocking node offset to 1;

[0027] When the pop-up node is the same as the node corresponding to the offset of the path node sequence, the blocking node offset is increased by 1;

[0028] When the blocking node offset is greater than the maximum length of the path node sequence, the current pop-up node path traversal is blocked, and the blocking node offset is reduced by 1;

[0029] When the pop-up node is the same as the destination node in the path node sequence, the nodes in the stack are arranged into a vulnerability path in order from the bottom of the stack to the top of the stack, and the vulnerability path is added to the vulnerability path set;

[0030] When the pop-up node is different from the destination node in the path node sequence, the subsequent nodes of the current pop-up node are sequentially added to the top of the working node stack, and the current pop-up node is compared with the node corresponding to the offset of the blocking binary sequence;

[0031] If they are the same node, the blocking node offset is reduced by 1.

[0032] Preferably, when the matching rule is a completely matching rule, the step of updating the detection logic includes:

[0033] Set the blocking node offset to 1;

[0034] When the pop-up node is the same as the node corresponding to the offset of the path node sequence, the blocking node offset is increased by 1;

[0035] When the pop-up node and the node corresponding to the offset of the path node sequence are different nodes, the blocking node offset offset is initialized and the blocking node offset offset is set to 1;

[0036] When the blocking node offset is greater than the maximum length of the path node sequence, the current path traversal is blocked and the blocking node offset is set to 1;

[0037] When the pop-up node is the same as the destination node in the path node sequence, the nodes in the stack are arranged into a vulnerability path in order from the bottom of the stack to the top of the stack, the vulnerability path is added to the vulnerability path set, and the blocking node offset is initialized;

[0038] When the pop-up node is different from the destination node in the path node sequence, the subsequent nodes of the current pop-up node are sequentially added to the top of the working node stack, and the current pop-up node is compared with the node corresponding to the offset of the blocking binary sequence;

[0039] If they are the same node, the blocking node offset is reduced by 1.

[0040] Preferably, when the matching rule is a head-to-tail matching rule, the step of updating the detection logic includes:

[0041] Mark the path node sequence length as k and initialize the blocking node offset;

[0042] When the pop-up node is the same as the node corresponding to the offset of the path node sequence, the value of the blocking node offset is determined;

[0043] When the blocking node offset is 1, the blocking node offset is set to k;

[0044] When the blocking node offset is k, the blocking node offset is increased by 1;

[0045] When the increased blocking node offset is greater than k, the current pop-up node path traversal is blocked and the blocking node offset is initialized;

[0046] When the pop-up node is the same as the sink node in the path node sequence, a vulnerability path is formed according to the nodes in the working node stack, and the vulnerability path is added to the vulnerability path set;

[0047] When the pop-up node is different from the destination node in the path node sequence, the subsequent nodes of the current pop-up node are sequentially added to the top of the working node stack, and the pop-up node is compared with the node corresponding to the offset of the current path node sequence;

[0048] If they are the same node, the blocking node offset is initialized.

[0049] Preferably, the static detection accuracy improvement method further includes:

[0050] The detection engine based on the updated detection logic verifies the static detection results of the new items to be tested;

[0051] If the same false alarm information does not exist in the static detection result, it is determined that the verification is passed.

[0052] In a second aspect, the present application provides a computing device, comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, the steps of the static detection accuracy improvement method based on false alarm feedback as described above are implemented.

[0053] A third aspect: The present application provides a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, the steps of the static detection accuracy improvement method based on false alarm feedback as described above are implemented.

[0054] According to the specific embodiments provided in this application, this application discloses the following technical effects:

[0055] The present application provides a static detection accuracy improvement method based on false positive feedback, a computing device, and a readable storage medium. By collecting false positive information to obtain path blocking tuples, the detection logic of static detection is updated, thereby reducing the false positive rate of static code analysis. At the same time, this solution allows testers to eliminate false positive results obtained by static analysis tools without being familiar with the underlying detection code, reducing the cost of adjusting the detection layer code of the static analysis tool, and shortening the time wasted by relevant personnel in checking a large number of false positives in static analysis results, thereby improving the efficiency of testing using static code analysis tools. BRIEF DESCRIPTION OF THE DRAWINGS

[0056] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0057] Figure 1 A schematic diagram of a flow chart of a method for improving static detection accuracy based on false alarm feedback provided in an embodiment of the present application;

[0058] Figure 2 A schematic diagram of a process for obtaining false alarm information based on static detection results provided in an embodiment of the present application;

[0059] Figure 3 A schematic diagram of a process for obtaining a path blocking binary group based on false alarm information provided in an embodiment of the present application;

[0060] Figure 4 A schematic diagram of a process for updating the detection logic of a detection engine based on a path blocking tuple provided in an embodiment of the present application;

[0061] Figure 5 A flow chart of updating the detection logic when the matching rule provided in one embodiment of the present application is a rule containing a match;

[0062] Figure 6 A schematic diagram of a flow chart for updating the detection logic when the matching rule provided in an embodiment of the present application is a complete matching rule;

[0063] Figure 7 A flowchart of updating the detection logic when the matching rule provided in an embodiment of the present application is a head-to-tail matching rule.

[0064] The realization of the purpose, functional features and advantages of this application will be further described in conjunction with the embodiments and with reference to the accompanying drawings. The above-mentioned drawings have shown clear embodiments of this application, which will be described in more detail later. These drawings and textual descriptions are not intended to limit the scope of the concept of this application in any way, but to illustrate the concept of this application to those skilled in the art by reference to specific embodiments. DETAILED DESCRIPTION

[0065] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The implementations described in the following exemplary embodiments do not represent all implementations consistent with the present application. Instead, they are merely examples of devices and methods consistent with some aspects of the present application as detailed in the appended claims.

[0066] It should be noted that, in this article, the terms "include", "comprises" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also includes other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the sentence "includes a ..." does not exclude the existence of other identical elements in the process, method, article or device including the element. In addition, components, features, and elements with the same name in different embodiments of the present application may have the same meaning or different meanings, and their specific meanings need to be determined by their explanation in the specific embodiment or further combined with the context of the specific embodiment.

[0067] It should be understood that, although the terms first, second, third, etc. may be used to describe various information in this article, these information should not be limited to these terms. These terms are only used to distinguish the same type of information from each other. For example, without departing from the scope of this article, the first information may also be referred to as the second information, and similarly, the second information may also be referred to as the first information. Depending on the context, the word "if" as used herein can be interpreted as "at the time of" or "when" or "in response to determination". Furthermore, as used in this article, the singular forms "one", "one" and "the" are intended to also include plural forms, unless there is an opposite indication in the context. It should be further understood that the terms "comprising" and "including" indicate that there are the described features, steps, operations, elements, components, projects, kinds, and / or groups, but do not exclude the existence, occurrence or addition of one or more other features, steps, operations, elements, components, projects, kinds, and / or groups. The terms "or", "and / or", "including at least one of the following" etc. used in this application can be interpreted as inclusive, or mean any one or any combination. For example, “comprising at least one of the following: A, B, C” means “any of the following: A; B; C; A and B; A and C; B and C; A and B and C”, and for another example, “A, B or C” or “A, B and / or C” means “any of the following: A; B; C; A and B; A and C; B and C; A and B and C”. An exception to this definition will only occur when a combination of elements, functions, steps or operations are inherently mutually exclusive in some manner.

[0068] It should be understood that, although the various steps in the flowchart in the embodiment of the present application are displayed in sequence according to the indication of the arrows, these steps are not necessarily performed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps does not have a strict order restriction, and it can be performed in other orders. Moreover, at least a portion of the steps in the figure may include a plurality of sub-steps or a plurality of stages, and these sub-steps or stages are not necessarily performed at the same time, but can be performed at different times, and their execution order is not necessarily performed in sequence, but can be performed in turn or alternately with other steps or at least a portion of the sub-steps or stages of other steps.

[0069] As used herein, the words "if" and "if" may be interpreted as "at the time of" or "when" or "in response to determining" or "in response to detecting", depending on the context. Similarly, the phrases "if it is determined" or "if (stated condition or event) is detected" may be interpreted as "when it is determined" or "in response to determining" or "when detecting (stated condition or event)" or "in response to detecting (stated condition or event)", depending on the context.

[0070] It should be noted that in this article, step codes such as S10 and S20 are used for the purpose of expressing the corresponding content more clearly and concisely, and do not constitute a substantial limitation on the sequence. When implementing the step, those skilled in the art may execute S20 first and then S10, etc., but these should all be within the scope of protection of this application.

[0071] It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0072] In the subsequent description, the suffixes such as "module", "component" or "unit" used to represent elements are only used to facilitate the description of the present application, and have no specific meanings. Therefore, "module", "component" or "unit" can be used in a mixed manner.

[0073] refer to Figure 1 As shown, the present application provides a static detection accuracy improvement method based on false alarm feedback, including:

[0074] Obtain false positive information based on the defect description in the static detection results;

[0075] In an embodiment of the present application, when improving the accuracy of static detection based on false positive feedback, it is necessary to eliminate the factors that produce false positives when statically detecting the code. Therefore, in the scheme of the present application, the code of the project to be tested is first scanned by a static code analysis tool to obtain the static detection result of the project to be tested, and the false positive information is determined and collected by analyzing and verifying the detection result. In an embodiment of the present application, when scanning the code of the project to be tested, a customized static code analysis tool can also be used, a general static code analysis tool can also be used, and other types of static code analysis tools can also be used, which will not be repeated here and are all within the scope of protection of the present application.

[0076] capturing a path blocking binary group based on the false alarm information;

[0077] In an embodiment of the present application, a path blocking pair (PBP) is captured from the acquired false alarm information, and the path blocking pair represents a vulnerability path containing a specific path pattern that generates a false alarm. Among them, the formation of the path relationship should be established through value flow analysis, specifically to construct several basic program models such as control flow graphs, function call graphs, and pointer analysis graphs, which are used to describe the relationship between the execution order of statements in the function, calls between functions, and program pointer pointing. The value flow graph model used to express the control flow and data flow dependency between variables is constructed through the above basic program model, and the value flow graph is positioned according to the specific vulnerability model to determine the vulnerability path. Specifically, for the use after release vulnerability (UAF), first, by traversing all value flow graph nodes, all memory release nodes are selected, marked as the starting source (Source) node, and the source (Source) node is traversed to obtain all vulnerability paths. In an embodiment of the present application, the specific path traversal starts from the source node, performs a depth-first search backward along the edges on the value flow graph, and judges the visited nodes one by one to determine whether the memory pointed to by the free node release pointer contains the memory pointed to by the node's used variable. If it does, the node is marked as a termination sink node, and the node sequence from the source node to the sink node is recorded as a vulnerable path.

[0078] In the embodiment of the present application, the path blocking tuple has the following form:<Rule, Path(k)> , where Rule is the matching rule. Specifically, Rule=<include, all, head-tail> , for the matching rule Rule, it has the following meanings:

[0079] Include matching include: The current path subsequence contains the vulnerability path node sequence;

[0080] Complete match all: The current path contains a sequence of vulnerability path nodes arranged in a strict order;

[0081] Head-tail matching: The current path contains the node sequence of the first node and the last node of the vulnerability path node;

[0082] Among them, Path(k) is represented as a vulnerability path node sequence, which can be a complete sequence from the tracing start point to the tracing end point, or a partial sequence from the tracing start point to the tracing end point. Specifically, for a path node sequence of length k, it has the following representation:

[0083] Path(k) = (node ​​1, node 2,..., node k)

[0084] In the embodiment of the present application, the path blocking binary is captured from the false positive information by scanning the test report of the project to be tested with a static code analysis tool, determining the matching rules of each false positive item, selecting the corresponding vulnerability path node sequence in the defect path tracking, and generating a path blocking binary file with the determined matching rules and the corresponding vulnerability path node sequence. In the embodiment of the present application, in the specific process of capturing the path blocking binary, a tool can be used to provide a graphical input interface, and the corresponding vulnerability path node sequence is determined by receiving the selection input by the user; it is also possible to automatically extract the corresponding vulnerability path node sequence in the defect path tracking by writing a script program, and finally generate a path blocking binary file with the matching rules and the corresponding vulnerability path node sequence.

[0085] The detection logic of the static detection engine is updated based on the path blocking tuple.

[0086] In an embodiment of the present application, after capturing the path blocking binary from the false alarm information, the generated path blocking binary file is further sent to the detection engine, and the detection engine parses the path blocking binary file to obtain the matching rules Rule of all path blocking binary and the vulnerability path node sequence Path (k). The detection engine further updates the detection logic based on the path blocking binary. In the process of updating the detection logic, the false alarm path is shielded according to different matching rules, thereby improving the accuracy of static detection.

[0087] refer to Figure 2 As shown, the steps of obtaining false alarm information based on the defect description in the static detection result include:

[0088] Analyzing and verifying the defect description in the static detection result;

[0089] Defect descriptions that are verified through analysis are identified as false positives.

[0090] In an embodiment of the present application, by analyzing the static detection results, for example, analyzing the code defect description and defect tracking in the static detection results, determining the possible causes of false alarms, and then verifying the possible causes of false alarms, thereby determining false alarm information. For example, by analyzing the defect description and defect tracking of the code, finding out the possible causes of the defects, and then modifying the corresponding code and verifying it, when the modified verification passes, it is determined that the corresponding defect cause is determined to be false alarm information.

[0091] refer to Figure 3 As shown, the step of obtaining a path blocking binary group based on the false alarm information includes:

[0092] Determine a corresponding matching rule based on the false positive information;

[0093] Acquire a corresponding vulnerability path node sequence based on the false positive information;

[0094] The matching rule and the corresponding vulnerability path node sequence are used to generate a path blocking tuple, and / or a path blocking tuple file is generated.

[0095] In an exemplary embodiment, when determining the corresponding matching rule based on the above analysis to determine the false alarm information and obtaining the corresponding path sequence, the user can select the corresponding defect tracking as the corresponding path sequence through the front desk, and select the corresponding matching rule as the matching rule of the false alarm path blocking binary group through the front desk, for example, the obtained path blocking binary group<Rule, Path(k)> As shown below:

[0096] Rule = include

[0097] Path(k) = String salt ->messageDigest.digest() ->response.addCookie()

[0098] Further based on the above content, a path blocking binary file is generated.

[0099] refer to Figure 4 As shown, the step of updating the detection logic of the static detection engine based on the path blocking tuple includes:

[0100] Parsing the path blocking binary to obtain a matching rule of the path blocking binary and a vulnerability path node sequence;

[0101] Establishing a working node stack and a set of vulnerable paths, and adding the path source node to the working node stack;

[0102] When the working node stack is not empty, popping the top node of the stack;

[0103] Compare the pop-up node with the node corresponding to the offset in the vulnerability path node sequence;

[0104] The vulnerability path set is updated according to the matching rules and comparison results.

[0105] In an embodiment of the present application, after receiving the transmitted path blocking binary file, the detection engine parses the received path blocking binary file, obtains the matching rules and vulnerability path node sequence contained therein, establishes a working node stack and a vulnerability path set, and adds the path element (source) node to the working node stack. When the working node stack is not empty, the top node of the stack is popped up, and the popped node is compared with the node with the corresponding offset in the vulnerability path node sequence, and the vulnerability path set is further updated according to the comparison result and the obtained matching rules.

[0106] refer to Figure 5 As shown, when the matching rule is a rule containing a match, the step of updating the detection logic includes:

[0107] Initialize the offset of the blocking node to 1;

[0108] When the pop-up node and the node corresponding to the offset of the vulnerability path node sequence are the same node, the blocking node offset is increased by 1;

[0109] When the blocking node offset is greater than the maximum length of the vulnerability path node sequence, the current pop-up node path traversal is blocked, and the blocking node offset is reduced by 1;

[0110] When the pop-up node is the same as the terminal sink node in the vulnerability path node sequence, the nodes in the stack are arranged into a vulnerability path in order from the bottom of the stack to the top of the stack, and the vulnerability path is added to the vulnerability path set;

[0111] When the pop-up node is not the same as the terminating sink node in the vulnerability path node sequence, the subsequent nodes of the current pop-up node are sequentially added to the top of the working node stack, and the current pop-up node is compared with the node corresponding to the offset in the vulnerability path node sequence;

[0112] If they are the same node, the blocking node offset is reduced by 1.

[0113] refer to Figure 6 As shown, when the matching rule is a completely matching rule, the step of updating the detection logic includes:

[0114] Set the blocking node offset to 1;

[0115] When the pop-up node and the node corresponding to the offset of the vulnerability path node sequence are the same node, the blocking node offset is increased by 1;

[0116] When the pop-up node and the node corresponding to the offset of the vulnerability path node sequence are different nodes, the blocking node offset offset is initialized and the blocking node offset offset is set to 1;

[0117] When the blocking node offset is greater than the maximum length of the vulnerability path node sequence, the current path traversal is blocked and the blocking node offset is set to 1;

[0118] When the pop-up node is the same as the terminal sink node in the vulnerability path node sequence, the nodes in the stack are arranged as a vulnerability path in order from the bottom of the stack to the top of the stack, the vulnerability path is added to the vulnerability path set, and the blocking node offset is initialized;

[0119] When the pop-up node is not the same as the terminating sink node in the vulnerability path node sequence, the subsequent nodes of the current pop-up node are sequentially added to the top of the working node stack, and the current pop-up node is compared with the node corresponding to the offset in the vulnerability path node sequence;

[0120] If they are the same node, the blocking node offset is reduced by 1.

[0121] refer to Figure 7 As shown, when the matching rule is a head-to-tail matching rule, the step of updating the detection logic includes:

[0122] Mark the length of the vulnerable path node sequence as k, and initialize the blocking node offset;

[0123] When the pop-up node and the node corresponding to the offset of the vulnerability path node sequence are the same node, the value of the blocking node offset is determined;

[0124] When the blocking node offset is 1, the blocking node offset is set to k;

[0125] When the blocking node offset is k, the blocking node offset is increased by 1;

[0126] When the increased blocking node offset is greater than k, the current pop-up node path traversal is blocked and the blocking node offset is initialized;

[0127] When the pop-up node is the same as the terminating sink node in the vulnerability path node sequence, a vulnerability path is formed according to the nodes in the working node stack, and the vulnerability path is added to the vulnerability path set;

[0128] When the pop-up node is not identical to the terminating sink node in the vulnerability path node sequence, the subsequent nodes of the current pop-up node are sequentially added to the top of the working node stack, and the pop-up node is compared with the node corresponding to the offset of the current vulnerability path node sequence;

[0129] If they are the same node, the blocking node offset is initialized.

[0130] In an exemplary embodiment, after the detection logic of the detection engine is updated based on the above steps, the code of the new project to be tested is tested, and the test results are used to verify whether the same type of false positive information is eliminated, that is, by verifying the updated detection engine, it is determined whether the accuracy of static detection is effectively improved. When there is no false positive information of the same type, it is determined that the accuracy of static detection is effectively improved.

[0131] In an exemplary embodiment:

[0132] Use static detection tools to detect and scan a section of code in the following original test project:

[0133] private void doGet(String data, HttpServletRequest request,HttpServletResponse response) throws ServletException, IOException {

[0134] String salt = "ThisIsMySalt";

[0135] MessageDigest messageDigest = MessageDigest.getInstance("SHA-512");

[0136] messageDigest.reset(); byte[]hashedCredsAsBytes=messageDigest.digest((salt+data).getBytes("UTF-8");

[0137] data = IO.toHex(hashedCredsAsBytes);

[0138] response.addCookie(new Cookie("auth", data));

[0139] }

[0140] After the detection scan, the following test result report is given:

[0141] Defect description: In line (7), the [response.addCookie] method is called to add a cookie object containing sensitive information to the [HttpServletResponse] object [response]. The information stored in the cookie should not contain sensitive information. It is recommended to store sensitive information in the session. Defect description location: file CookieService.java, line (7);

[0142] Defect tracking 1: Line (2) statement [String salt = "ThisIsMySalt"] creates a string object; Defect tracking location: file CookieService.java, line (2);

[0143] Defect tracking 2: The [messageDigest.digest] method is called in line (5); Defect tracking location: file CookieService.java, line (5);

[0144] Defect tracking 3: Calling the [IO.toHex] method at line (6); Defect tracking location: file CookieService.java, line (6);

[0145] Defect tracking 4: Create a new [Cookie] object in line (7), with the variable [data] as a parameter; Defect tracking location: file CookieService.java, line (7);

[0146] Defect tracking 5: Calling the [response.addCookie] method at line (7); Defect tracking location: file CookieService.java, line (7);

[0147] After analyzing the above test result report, it is found that the variable data is hashed and encrypted by calling the messageDigest.digest method by defining a specific salt value before being added to the object response, thus protecting the sensitive data in the data. Therefore, it is a false positive. Select Defect Tracking 1, Defect Tracking 2 and Defect Tracking 5 in the foreground, select the include matching mode, and capture the following path blocking tuples<Rule, Path(k)> :in

[0148] Rule = include

[0149] Path(k) =Strings alt->messageDigest.digest()->response.addCookie();

[0150] By generating a path blocking binary file based on the captured content in the foreground, submitting the file to the detection engine, the detection logic in subsequent detection tasks is updated.

[0151] After updating the detection logic of the detection engine, further static detection is performed on the code in the new project:

[0152] PasswordAuthentication credentials = new PasswordAuthentication(user,password.toCharArray());

[0153] String salt = SaltGenerator.generateSalt(10);

[0154] MessageDigest messageDigest = MessageDigest.getInstance("SHA-512");

[0155] messageDigest.reset();

[0156] String credentialsToHash = credentials.getUserName() + ":" + (newString(credentials.getPassword()));

[0157] byte[]hashedCredsAsBytes=

[0158] messageDigest.digest((salt+credentialsToHash).getBytes("UTF-8");

[0159] data = IO.toHex(hashedCredsAsBytes);

[0160] response.addCookie(new Cookie("auth", data));

[0161] After value flow analysis, this code has a path sequence: String salt ->messageDigest.digest() ->data = IO.toHex(hashedCredsAsBytes) ->new Cookie("auth", data) ->response.addCookie()

[0162] In the new round of static detection, the path blocking tuple guided the path traversal and excluded the path sequence containing String salt ->messageDigest.digest() ->response.addCookie(), thus eliminating the false positives of the static analysis tool for the above code.

[0163] An embodiment of the present application also provides a computing device, including a memory and a processor. A control program is stored in the memory. When the control program is executed by the processor, the steps of the static detection accuracy improvement method based on false alarm feedback in any of the above embodiments are implemented.

[0164] An embodiment of the present application also provides a computer-readable storage medium, on which a control program is stored. When the control program is executed by a processor, the steps of the static detection accuracy improvement method based on false alarm feedback in any of the above embodiments are implemented.

[0165] In the embodiments of the smart terminal and storage medium provided in the present application, all technical features of any of the above-mentioned control method embodiments may be included, and the expanded and explained contents of the specification are basically the same as those of the embodiments of the above-mentioned methods, and will not be repeated here.

[0166] The embodiment of the present application further provides a computer program product, which includes a computer program code. When the computer program code runs on a computer, the computer executes the methods in the above various possible implementation modes.

[0167] An embodiment of the present application also provides a chip, including a memory and a processor, the memory is used to store a computer program, and the processor is used to call and run the computer program from the memory, so that a device equipped with the chip executes the methods in various possible implementation modes as described above.

[0168] It is understood that the above scenarios are only examples and do not constitute a limitation on the application scenarios of the technical solutions provided in the embodiments of the present application. The technical solutions of the present application can also be applied to other scenarios. For example, it is known to those skilled in the art that with the evolution of the system architecture and the emergence of new business scenarios, the technical solutions provided in the embodiments of the present application are also applicable to similar technical problems.

[0169] The serial numbers of the above-mentioned embodiments of the present application are for description only and do not represent the advantages or disadvantages of the embodiments.

[0170] The steps in the method of the embodiment of the present application can be adjusted in order, combined and deleted according to actual needs.

[0171] The units in the device of the embodiment of the present application can be merged, divided and deleted according to actual needs.

[0172] In the present application, the same or similar terminology concepts, technical solutions and / or application scenario descriptions are generally described in detail only the first time they appear. When they appear again later, they are generally not repeated for the sake of brevity. When understanding the technical solutions and other contents of the present application, for the same or similar terminology concepts, technical solutions and / or application scenario descriptions that are not described in detail later, reference can be made to the previous related detailed descriptions.

[0173] In the present application, the description of each embodiment has its own emphasis. For parts that are not described or recorded in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0174] The various technical features of the technical solution of the present application can be arbitrarily combined. In order to make the description concise, not all possible combinations of the various technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of the present application.

[0175] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present application, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) as above, and includes a number of instructions for a terminal device (which can be a mobile phone, a computer, a server, a controlled terminal, or a network device, etc.) to execute the method of each embodiment of the present application.

[0176] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When loading and executing computer program instructions on a computer, the process or function according to the embodiment of the present application is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices. Computer instructions can be stored in a storage medium, or transmitted from one storage medium to another storage medium. For example, computer instructions can be transmitted from a website site, computer, server or data center to another website site, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line) or wireless (e.g., infrared, wireless, microwave, etc.) mode. The storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more available media integration. Available media can be magnetic media, (e.g., floppy disk, storage disk, tape), optical media (e.g., DVD), or semiconductor media (e.g., solid-state storage disk Solid State Disk (SSD)), etc.

[0177] The above are only preferred embodiments of the present application, and are not intended to limit the patent scope of the present application. Any equivalent structure or equivalent process transformation made using the contents of the present application specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present application.

Claims

1. A static detection accuracy improvement method based on false alarm feedback, characterized in that: The static detection accuracy improvement method comprises: Perform analysis and verification based on the defect description in the static inspection results; Determine the defect description verified by analysis as a false positive; Determine a corresponding matching rule and obtain a corresponding vulnerability path node sequence based on the false alarm information, wherein the matching rule includes at least one of the following: inclusion matching, wherein the inclusion matching is that a subsequence in the current path node sequence contains a vulnerability path node sequence that generates a false alarm; full matching, wherein the full matching is that the current path node sequence contains a sequence of vulnerability path node sequences that generate false alarms; head-to-tail matching, wherein the head-to-tail matching is that the current path node sequence contains the first node and the last node of the vulnerability path node sequence that generates a false alarm; The matching rule and the vulnerability path node sequence are combined into a path blocking tuple, and a path blocking tuple file is generated; the path blocking tuple file is sent to a static detection engine for parsing to obtain the matching rule and the vulnerability path node sequence of the path blocking tuple; Establishing a working node stack and a set of vulnerable paths, and adding the path source node to the working node stack; When the working node stack is not empty, popping the node on the top of the stack; Compare the popped-up node with the node corresponding to the offset of the vulnerability path node sequence; The vulnerability path set is updated according to the matching rules and comparison results.

2. The static detection accuracy improvement method based on false alarm feedback according to claim 1 is characterized in that: When the matching rule is a rule containing a match, the step of updating the vulnerability path set includes: Initialize the blocking node offset to 1; When the pop-up node is the same as the node corresponding to the offset of the vulnerability path node sequence, the blocking node offset is increased by 1; When the blocking node offset is greater than the length of the vulnerability path node sequence, the current pop-up node path traversal is blocked, and the blocking node offset is reduced by 1; When the pop-up node is the same as the terminal sink node in the vulnerability path node sequence, the nodes in the stack are arranged into a vulnerability path in order from the bottom of the stack to the top of the stack, and the vulnerability path is added to the vulnerability path set; When the pop-up node is not the same as the terminating sink node in the vulnerability path node sequence, the subsequent nodes of the current pop-up node are sequentially added to the top of the working node stack, and the current pop-up node is compared with the node corresponding to the offset in the vulnerability path node sequence; If they are the same node, the blocking node offset is reduced by 1.

3. The static detection accuracy improvement method based on false alarm feedback according to claim 1 is characterized in that: When the matching rule is a completely matching rule, the step of updating the vulnerability path set includes: Set the blocking node offset to 1; When the pop-up node is the same as the node corresponding to the offset of the vulnerability path node sequence, the blocking node offset is increased by 1; When the pop-up node and the node corresponding to the offset of the vulnerability path node sequence are different nodes, the blocking node offset offset is initialized and the blocking node offset offset is set to 1; When the blocking node offset is greater than the length of the vulnerability path node sequence, the current path traversal is blocked and the blocking node offset is set to 1; When the pop-up node is the same as the terminal destination node in the vulnerability path node sequence, the nodes in the stack are arranged into a vulnerability path in order from the bottom of the stack to the top of the stack, the vulnerability path is added to the vulnerability path set, and the blocking node offset is initialized; When the pop-up node is not the same as the terminating sink node in the vulnerability path node sequence, the subsequent nodes of the current pop-up node are sequentially added to the top of the working node stack, and the current pop-up node is compared with the node corresponding to the offset in the vulnerability path node sequence; If they are the same node, the blocking node offset is reduced by 1.

4. The static detection accuracy improvement method based on false alarm feedback according to claim 1 is characterized in that: When the matching rule is a head-to-tail matching rule, the step of updating the vulnerability path set includes: Mark the length of the vulnerable path node sequence as k, and initialize the blocking node offset; When the pop-up node is the same as the node corresponding to the offset of the vulnerability path node sequence, the value of the blocking node offset is determined; When the blocking node offset is 1, the blocking node offset is set to k; When the blocking node offset is k, the blocking node offset is increased by 1; When the increased blocking node offset is greater than k, the current pop-up node path traversal is blocked and the blocking node offset is initialized; When the pop-up node is the same as the terminating sink node in the vulnerability path node sequence, a vulnerability path is formed according to the nodes in the working node stack, and the vulnerability path is added to the vulnerability path set; When the pop-up node is not the same as the terminating sink node in the vulnerability path node sequence, the subsequent nodes of the current pop-up node are sequentially added to the top of the working node stack, and the pop-up node is compared with the node corresponding to the offset of the current vulnerability path node sequence; If they are the same node, the blocking node offset is initialized.

5. The static detection accuracy improvement method based on false alarm feedback according to any one of claims 1 to 4, characterized in that: The static detection accuracy improvement method further includes: The detection engine based on the updated detection logic verifies the static detection results of the new items to be tested; If there is no identical false alarm information in the static detection result, it is determined that the verification is passed.

6. A computing device, characterized in that include: A memory, a processor, and a computer program stored in the memory and running on the processor, wherein when the processor executes the computer program, the steps of the static detection accuracy improvement method based on false alarm feedback described in any one of claims 1 to 5 are implemented.

Images