An Intra-aware Software Threat Detection Method Based on Sensitive Call Graph

Abstract

The present invention discloses an internal perception software threat detection method based on sensitive call graph, which relates to the field of network security and computer software security technology, simulates the "perception-strategy-effect" mechanism of the human nervous system, and realizes real-time detection and response to software security threats. The detection method includes constructing a priori knowledge base including a starting method library, a sensitive method library, and a propagation method library to identify key operation points of the application and generate a sensitive call graph to reveal potential risk paths; deploying bionic receptors at key logic points, constructing an internal perception network, and monitoring the application status in real time; the perception module converts multi-dimensional status information into a perception vector for analysis by the strategy module, and generates a defense strategy in combination with the threat state machine model; the system quickly executes defense operations through the effect module, effectively responds to complex security threats, improves system security, and is suitable for applications with high security requirements.

Description

Technical Field

[0001] The present invention relates to the field of network security and computer software security technology, and in particular to an internal perception software threat detection method based on a sensitive call graph. Background Art

[0002] As the main means of defending against network security threats, traditional security protection systems often adopt a "shell-type" strategy based on border defense or a "patch-type" management that relies on post-remediation. Its core mechanism mainly relies on feature detection technology to implement passive defense measures, such as firewalls and anti-virus software. However, the inherent staticity, singleness and reaction lag of these measures make them incapable of dealing with unknown or dynamically evolving security threats. Especially when prior knowledge is insufficient to support the cognition of complex attack patterns, traditional methods are limited in dealing with zero-day attacks and emerging attack variants due to the size of the predefined knowledge base and the scope of labels, making it difficult to achieve effective coverage of security threats. Summary of the invention

[0003] In order to solve the above technical problems, the present invention provides an internal perception software threat detection method based on sensitive call graph, comprising the following steps:

[0004] S1. Constructing a priori knowledge base: The priori knowledge base includes a starting method library, a sensitive method library, and a propagation method library; the starting method library is used to identify starting methods that may introduce external data, which is not verified or cleaned and may contain potential security threats; the sensitive method library is used to include methods that may trigger dangerous operations after receiving tainted data; the propagation method library is used to identify application methods that can transmit or spread tainted data;

[0005] S2. Generate sensitive call graph: Identify sensitive methods in the application through the taint analysis algorithm and generate a sensitive call graph for representing sensitive methods and their call relationships in the application;

[0006] S3. Build an internal perception network: Based on the sensitive call graph and prior knowledge base, deploy bionic sensors and bionic effectors at the key logic points of the application to form an internal perception network, monitor the running status of the application in real time, and convert the collected multi-dimensional status information into perception vectors;

[0007] S4. Build a threat state machine model: Convert the sensitive call graph into a threat state machine model, use the state transition rules of the finite state machine to evaluate the security situation of the application in real time, and determine the nature of the security threat;

[0008] S5. Execute defense measures: formulate corresponding defense strategies based on the prior knowledge base and the current perception vector, and respond to detected security threats in real time according to the defense strategies.

[0009] The technical solution further defined in the present invention is:

[0010] Further, in step S1, the starting method in the starting method library is composed of two tuples Indicates that Indicates the signature of the starting method, which is the unique identifier of the method and is used to match the starting method in the application. Indicates the type of tainted data generated by the initiation method;

[0011] The sensitive methods in the sensitive method library are represented by two tuples: Indicates that Represents the sensitive method signature, i represents the sensitive parameter serial number, and the sensitive method library contains the following categories of sensitive methods: arbitrary command execution class, arbitrary code execution class, arbitrary file operation class, network request class, database operation class, and information leakage class;

[0012] Propagation method library using quad represents the taint propagation method, where Represents the signature of the taint propagation method, from represents the source variable, to represents the target variable, Indicates the type of tainted object after taint propagation; taint propagation methods include three modes: object to result, parameter to object, and parameter to result.

[0013] As described above, in the method for detecting internally perceived software threats based on a sensitive call graph, in step S2, the sensitive call graph is defined as:

[0014]

[0015] Among them, node V represents the method in the application; edge E represents the calling relationship between methods. If method A calls method B, there is an edge from A to B in the sensitive call graph; the root node R represents the starting point in the sensitive call graph; the leaf node L represents the end point in the sensitive call graph; the call chain C represents the path from the root node to any node, representing a series of method calls during the execution of the application.

[0016] As described above, in the method for detecting internal software threats based on sensitive call graph, in step S2, a sensitive call graph is generated based on pointer analysis, and the specific method is as follows: first, variables related to pointer analysis and sensitive call graph are initialized, and variables related to sensitive call graph include work queue WL, method call graph CG, pointer flow graph PFG and taint flow graph TFG; then, statements are traversed from the entry method of application P and pointer analysis is performed;

[0017] During the pointer analysis process, for variable assignment and field acquisition statements, the taint flow graph is updated according to whether the corresponding variable or its pointer is a tainted object to realize taint propagation; for method calls in the statement, if the method is the starting method in the prior knowledge base, the corresponding tainted object is constructed and added to the taint flow graph; if the method is a propagation method in the propagation method library, the taint object is propagated and the taint flow graph is updated according to the prior knowledge and pointer analysis rules; if the method is a sensitive method in the sensitive method library, its sensitive parameters and its pointer are judged whether they point to the tainted object. If they point to the tainted object, the method call chain is traced back and the sensitive call graph is updated.

[0018] As described above, in the method for detecting internal software threats based on sensitive call graphs, in step S2, the pointer analysis rule is specifically as follows: the definition statement is , when the type is a tainted source call, the rule is ; When the type is a taint propagation call from object to result, the rule is ; When the type is a parameter-to-object taint propagation call, the rule is ; When the type is a taint propagation call from parameter to result, the rule is ; When the type is a sensitive method call, the rule is ;

[0019] Among them, pt(r) represents the set pointed to by the caller pointer; Represents the set of pointers to corresponding parameters; r represents the result of the taint source; x represents the object or instance acted upon by method k; Indicates the i-th parameter passed to the sensitive method k; Sources indicates that this method k is a taint source and will generate tainted data; arg represents a parameter variable in the function, or a collection of multiple parameter values, which is used to describe the transfer relationship from parameter to object or result when taint propagates; The result of the pointer analysis of the tainted object indicates that at line l of the program execution, the pointer marked u points to a tainted object; Indicates the taint analysis result of mark u on code line j, which means that at the jth line of program execution, the object pointed to by mark u is tainted; similarly Indicates that at line j of code, mark The pointer analysis status of x; pt(x) represents the pointer analysis result of x, and the object pointed to is marked as tainted; Propagations represents the rules for taint propagation, that is, when object x is tainted, the return value r of method k will also be tainted; base represents the object itself that calls the method; result represents the return value marked as tainted; Sinks represents sensitive method call points, involving possible security risks; TaintFlows represents recording the flow direction of taints and tracking the propagation path of tainted objects.

[0020] As described above, in the method for detecting intraocular software threats based on a sensitive call graph, in step S3, constructing an intraocular network specifically includes the following sub-steps:

[0021] S3.1, traverse the nodes in the sensitive call graph and deploy the corresponding bionic receptors in the application;

[0022] S3.2, based on the sensitive method library in the prior knowledge base, deploy bionic sensors at sensitive method nodes not involved in the sensitive call graph to capture all sensitive operations;

[0023] S3.3. Deploy bionic effectors at all sensitive methods in the application.

[0024] As described above, in the method for detecting internally perceived software threats based on a sensitive call graph, in step S4, the threat state machine is defined as:

[0025]

[0026] Among them, S represents the state, corresponding to the node in the application sensitive call graph; event E represents the activity that triggers the state transition; transition Indicates the transition between states, triggered by events; initial state Indicates the starting point of the state machine, indicating the initial security state of the application; the terminal state A status indicating that a potential threat has been successfully identified or disrupted;

[0027] According to the definition of threat state machine, the sensitive call graph of the application is converted into the application threat state machine model, and the application states are divided into the starting state SOURCE, propagation state PROPAGATION, propagation termination state TERMINATE, dangerous state SINK and safe state SAFE. The termination state includes threat state SINK and safe state SAFE. The activities of triggering state transition of the application threat state machine include tainted data generation generate, tainted data propagate, and tainted data arrival and execution of sensitive operation sink_call. The threat state machine constructed based on the application sensitive call graph is finally expressed as:

[0028]

[0029] Where S represents a finite state set, S={SOURCE,PROPAGATION,TERMINATE,SINK,SAFE}; E represents an event set, E={generate,propagate,…,sink_call}; T represents a state transition function, ; represents the initial state, ; Indicates the termination state. .

[0030] As described above, an internal perception software threat detection method based on a sensitive call graph, in step S4, combined with the idea of ​​state transition from the current state to the next state of the finite state machine, describes the changes in the security situation during the execution of the application: when the event is the generation of tainted data, it is transferred from the current starting state to the new propagation state; when the event is the propagation of tainted data, it is transferred from the current propagation state to the new propagation state; when the event is the arrival of tainted data at a sensitive operation, it is transferred from the current propagation state to the new threat state; when the event is tainted data that has been cleaned or verified to be harmless, it is transferred from the current propagation state to the new security state; when the event is the execution of a sensitive operation, it is transferred from the current propagation termination state to the new threat state; when the event is the end of the request execution, it is transferred from the current propagation termination state to the new security state.

[0031] As described above, in the method for detecting internally perceived software threats based on a sensitive call graph, step S5 specifically includes the following sub-steps:

[0032] S5.1. When a user request is received during the running of the application, the threat state machine model TSM is initialized according to the sensitive call graph of the application;

[0033] S5.2, updating the state of the threat state machine based on the event information event perceived in real time by the bionic receptors in the internal perception network;

[0034] S5.3. The security status of the application is determined by detecting the status of the application threat state machine. If it is a safe status, it means that the request did not trigger sensitive operations or the tainted parameters have been cleaned, so there is no security threat and the application is in a safe status. If it is a threat status, since the parameters of the sensitive operations are tainted parameters passed in by the user and have not been cleaned by the security function, it means that the application is in a potentially dangerous state. At this time, the perception information of the bionic receptor is detected to determine whether the relevant parameters or behaviors are abnormal behaviors. For abnormal behaviors, the corresponding bionic effectors are activated based on the effect strategy library to implement countermeasures against the corresponding threats.

[0035] As described above, an internal perception software threat detection method based on a sensitive call graph, in step S5.2, starting from the starting state of the application, when the bionic sensor detects that tainted data is generated or externally input, the state machine will transfer from the starting state to the propagation state; in the propagation state, the tainted data is transmitted between multiple modules or functions; during the propagation process, the system continuously monitors the state of these data, if it is detected that the tainted data has been cleaned or verified and confirmed that it no longer poses a threat, the state machine will transfer from the propagation state to the safe state, if in the propagation state, the tainted data enters an unprocessed sensitive operation, the state machine will transfer to the threat state, in which case the system takes further defensive measures to prevent or mitigate potential attacks; if the propagation process ends without entering the threat state, the system enters the propagation termination state, indicating that the data propagation has ended and the threat has been processed.

[0036] The beneficial effects of the present invention are:

[0037] (1) In the present invention, by constructing an internal perception network based on a sensitive call graph, accurate identification and real-time monitoring of key operation points of the application are achieved. Compared with the traditional static analysis method, this mechanism can dynamically capture potential threats, greatly improving the accuracy and real-time performance of threat detection. In addition, the present invention adopts a bionic sensor and a threat state machine model, which can not only quickly identify and respond to known security threats, but also effectively respond to unknown threats through an adaptive learning mechanism. This dual defense mechanism significantly enhances the overall defense capability of the system.

[0038] (2) In the present invention, an optimal balance is achieved between performance and security. The monitoring points are accurately located through the sensitive call graph, which reduces the consumption of system resources, thereby reducing the performance overhead of the system, such as CPU load and service response time. While maintaining efficient threat detection, the operating efficiency of the system is ensured. In addition, the internal perception network and policy module have a high degree of adaptability and can dynamically adjust the defense strategy according to the emerging threat patterns, giving the system greater flexibility and robustness, enabling it to cope with a variety of attack methods.

[0039] (3) The present invention is particularly suitable for scenarios with high security requirements. In these scenarios, the system faces complex and ever-changing security threats. The dynamic defense mechanism provided by the present invention can effectively defend against these threats and ensure the continuous and stable operation of the system. Through this innovative internal perception network and threat detection mechanism, the present invention significantly improves the threat detection capability, response speed and system performance of the software system, and provides strong security protection for application scenarios with high security requirements, thereby meeting the growing data security needs and network complexity requirements. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] Figure 1It is a schematic diagram of the overall framework of the method of the present invention;

[0041] Figure 2 It is a schematic diagram of the overall process of the method of the present invention;

[0042] Figure 3 Schematic diagram of the working process of the method of the embodiment of the present invention;

[0043] Figure 4 is a schematic diagram of a stain propagation mode in an embodiment of the present invention;

[0044] Figure 5 Schematic diagram of the state transition of the threat state machine in an embodiment of the present invention. DETAILED DESCRIPTION

[0045] This embodiment provides a method for detecting software threats based on an internal perception of a sensitive call graph. Figure 1 As shown, the method includes a perception module, a strategy module and an effect module, which can be further divided into the following Figure 2 The five steps shown are the construction of a priori knowledge base, the generation of sensitive call graph, the construction of internal perception network, the introduction of threat state machine model, and threat detection and response.

[0046] Among them, the perception module is responsible for the construction of the prior knowledge base, the generation of the sensitive call graph and the construction of the internal perception network. It generates a sensitive call graph by identifying the key operation points in the application to capture potential security risks, and deploys bionic sensors to reduce redundancy and improve perception efficiency; the strategy module combines the threat state machine model with the perception vector and the prior knowledge base provided by the perception module to comprehensively evaluate the security situation of the application and formulate corresponding defense strategies; finally, in the threat detection and response steps, the effect module quickly executes the defense operations formulated by the policy module, responds to the detected security threats in real time, and ensures the overall security of the system; through the collaborative work of these three modules, efficient threat detection and response to the software system can be achieved.

[0047] First, the key elements of the internal perception software threat detection method based on sensitive call graph, namely the workflow, are described:

[0048] : Information perception; during the execution of the application, the deployed bionic sensor will perceive the application status information R(t) in real time:

[0049]

[0050] in, is the i-th bionic sensor.

[0051] :Information preprocessing; After the perception processor receives the real-time perception information R(t) perceived by the bionic sensor, it Convert it into a more intuitive and concise perception vector , in order to facilitate subsequent transmission and processing operations, this process can be described as:

[0052]

[0053] in, represents the perception vector.

[0054] : Situational awareness; the bionic sensor of the strategy module will sense the vector Perform a security assessment on the application security situation at time t and generate the corresponding application security status S(t):

[0055]

[0056] Among them, application security status , which is composed of an m-dimensional state vector s.

[0057] : Control right judgment; for abnormal application security status The defense mechanism will make a decision based on whether the state belongs to a known security threat and select the corresponding security defense center to deal with it. This process can be described as:

[0058]

[0059] in, For control, Directly based on the effect strategy library processing, The type of threat must be determined before the effects can be dealt with; A known type of security threat.

[0060] : Strategy selection; when the application is attacked by a known type of security threat, that is, , the processor sends the corresponding effect vector based on the effect strategy library To activate the bionic effector to counter the threat:

[0061]

[0062] Among them, Policy is the effect policy set in the effect policy library.

[0063] : Policy execution; when an application is threatened, the effect processor in the effect module will execute the effect vector sent by the policy module. To activate the corresponding bionic effector to complete the effect action A(t) and realize the defense against security threats, the process can be described as:

[0064]

[0065] in, is the effector behavior that the i-th bionic effector needs to perform.

[0066] Based on the above basic definition, Figure 3 The figure shows the workflow of the method of this embodiment. During the execution of the application, the perception processing is performed by The state information R collected by the bionic sensor is integrated and encoded into a perception vector , the policy module will be based on Conduct situational awareness and assess the security status S of the application; for known characteristic threats covered by prior knowledge , Generate effect vector based on policy library Policy Activate the corresponding bionic effector to complete effect action A and achieve threat countermeasure.

[0067] like Figure 2 As shown, the present embodiment provides an internal perception software threat detection method based on a sensitive call graph, comprising the following steps:

[0068] S1. Construct a priori knowledge base: The prior knowledge base includes a starting method library, a sensitive method library, and a propagation method library. It focuses on the essential characteristics of known threats and can help the defense center accurately locate key security points and capture known forms of attack threats. The starting method library is used to identify starting methods that may introduce external data. The external data has not been verified or cleaned and may contain potential security threats. The sensitive method library is used to include methods that may trigger dangerous operations after receiving tainted data. The propagation method library is used to identify application methods that can transmit or spread tainted data.

[0069] The starting methods in the starting method library are composed of two tuples Indicates that Indicates the signature of the starting method, which is the unique identifier of the method and is used to match the starting method in the application. Indicates the type of tainted data generated by the starting method; as shown in Table 1 below, two starting methods getParameter and getQueryString that introduce user request parameters are shown. Through the method signatures and tainted parameter types in the table, the user request parameters in the application interaction process can be accurately located and subsequent security risk assessments can be performed.

[0070] Table 1 Example of starting method

[0071]

[0072] The sensitive methods in the sensitive method library are represented by two tuples: Indicates that Represents the sensitive method signature, i represents the sensitive parameter sequence number, as shown in Table 2 below. After the first parameter of the command execution method Runtime.exec is contaminated, the attacker can control the sensitive method to execute any malicious command, posing a serious security threat to the application. The sensitive method library contains the following categories of sensitive methods: arbitrary command execution class, arbitrary code execution class, arbitrary file operation class, network request class, database operation class, and information leakage class.

[0073] Table 2: Examples of sensitive methods

[0074]

[0075] like Figure 4 As shown in the figure, common taint propagation modes include object to result, parameter to object, and parameter to result: 1. Object to result propagation mode: If the source object base is polluted, the return value result of the method call will also be polluted; 2. Parameter to object propagation mode: If a parameter of the taint propagation method If it is contaminated, the object base of the calling method will be contaminated; 3. Parameter to result propagation mode: It means that if a parameter of the taint propagation method If it is polluted, the return value result of the method call will also be polluted.

[0076] The propagation method library uses the quad represents the taint propagation method, where Represents the signature of the taint propagation method, from represents the source variable, to represents the target variable, Indicates the type of the tainted object after taint propagation; as shown in Table 3 below, if the first parameter of the taint propagation method StringBuilder.append is a tainted object, the object base that calls the method will be contaminated, and the new tainted object type is java.lang.StringBuilder.

[0077] Table 3 Propagation method examples

[0078]

[0079] S2. Generate sensitive call graph: This embodiment constructs a sensitive call graph by taint analysis. The sensitive method call graph can be defined as ,in:

[0080] Node V: represents methods in the application, especially those involving sensitive operations. These methods may be ordinary business logic methods or methods that process sensitive data.

[0081] Edge E: represents the calling relationship between methods. If method A calls method B, there is an edge pointing from A to B in the sensitive call graph. The edge can have attributes, such as call type (direct call or indirect call), parameter passing method, etc.

[0082] Root node R: represents the starting point in the sensitive call graph, usually the entry method of the application or the taint source, and has no incoming edges but only outgoing edges.

[0083] Leaf node L: represents the end point in the sensitive call graph, usually a sensitive method in the application; in taint analysis, sensitive methods usually refer to those methods that process or transmit sensitive data (such as user input, passwords, personal information, etc.) or perform dangerous operations (such as command execution, network requests, database operations, etc.).

[0084] Call chain C: represents the path from the root node to any node, representing a series of method calls during the execution of the application. In the sensitive call graph, special attention is paid to the sensitive call chain involving sensitive methods, which represents the call path of sensitive methods in the application and is a potential path for attackers to exploit.

[0085] In order to generate a more accurate sensitive method call graph, the method of this embodiment introduces a sensitive call graph generation method based on pointer analysis, which uses the accurate data flow tracking capability of pointer analysis to realize the propagation and tracking of taints and improve the accuracy of taint analysis. The essence of pointer analysis is to track how abstract objects flow in the application. Then, by marking the taint source as a special taint object, the propagation of taint can be realized with the help of the data flow analysis process of pointer analysis. Finally, by analyzing whether the pointer of the taint convergence point points to a taint object, taint detection can be realized and a sensitive method call chain can be generated. As shown in Table 4 below, the formal description and definition of the relevant symbols of pointer analysis are introduced.

[0086] Table 4 Pointer analysis related symbol table

[0087]

[0088] Based on the principle of taint analysis, the pointer analysis rules for taint-related methods shown in Table 5 below are defined in this embodiment. In the conventional pointer analysis process, the processing of taint-related method calls is added:

[0089] 1. When the called method is the starting method in the starting method library, a special tainted object t is generated and added to the pointer set pt(r) of the caller pointer to create a tainted source;

[0090] 2. When the called method is a propagation method in the propagation method library, the tainted object will be added to the pointing set of the corresponding pointer according to the propagation rules of the corresponding method in the prior knowledge base, thereby realizing taint propagation;

[0091] 3. When the called method is a sensitive method in the sensitive method library, if the corresponding parameter pointer points to a collection If the tainted object t is included, it means that the call chain is a sensitive method call chain.

[0092] Table 5 Pointer analysis rules for taint propagation methods

[0093]

[0094] Among them, pt(r) represents the set pointed to by the caller pointer; Represents the set of pointers to corresponding parameters; r represents the result of the taint source; x represents the object or instance acted upon by method k; Indicates the i-th parameter passed to the sensitive method k; Sources indicates that this method k is a taint source and will generate tainted data; arg represents a parameter variable in the function, or a collection of multiple parameter values, which is used to describe the transfer relationship from parameter to object or result when taint propagates; The result of the pointer analysis of the tainted object indicates that at line l of the program execution, the pointer marked u points to a tainted object; Indicates the taint analysis result of tag u on a specific code line j, which means that at the jth line of program execution, the object pointed to by tag u is tainted; similarly Indicates that at line j of code, mark The pointer analysis status of x; pt(x) represents the pointer analysis result of x, and the object pointed to is marked as tainted; Propagations represents the rules for taint propagation, that is, when object x is tainted, the return value r of method k will also be tainted; base represents the object itself that calls the method; result represents the return value marked as tainted; Sinks represents sensitive method call points, involving possible security risks; TaintFlows represents recording the flow direction of taints and tracking the propagation path of tainted objects.

[0095] As shown in Algorithm 1 below, the workflow of the sensitive call graph generation method based on pointer analysis is described. First, the variables related to pointer analysis and sensitive call graph are initialized. The variables related to the sensitive call graph include the work queue WL, the method call graph CG, the pointer flow graph PFG, and the taint flow graph TFG. Then, statements are traversed starting from the entry method of the application P and pointer analysis is performed.

[0096] Algorithm 1 Sensitive call graph generation method based on pointer analysis:

[0097] Input: Application entry method m entry , pointer analysis algorithm A , Prior Knowledge Base PK

[0098] Output: Sensitive call graph SCG

[0099] 1: Initialize work list WL as empty

[0100] 2: Initialize call graph CG as empty

[0101] 3:Initialize pointer flow graph PFG as empty

[0102] 4:Initialize taint flow graph TFG as empty 5:

[0104] 6: Add m entry to WL

[0105] 7: while WL is not empty do

[0106] 8: Remove m from WL

[0107] 9: Use A to perform pointer analysis on m ,update WL and PFG

[0108] 10: for each assignment statement s : y = x or s: y = x.f in m do

[0109] 11: if x is tainted then

[0110] 12: Add (y, O t ) to TFG

[0111] 13: end if

[0112] 14: end for

[0113] 15: for each call statement s:y = x.k ( a 1 ,…,a n ) in m do

[0114] 16: Add s to CG

[0115] 17: if x.k ∈ PK.sources then

[0116] 18: Add (y, O t ) to TFG

[0117] 19: else if x.k ∈ PK.sinks and sensitive argument a i is tainted then

[0118] 20: Traceback from a i to find sensitive call chain SCC based on CG

[0119] 21: Add SCC to SCG

[0120] 22: else if x.k ∈ PK.propagators then

[0121] 23: if x or a i is tainted then

[0122] 24: update TFG based on Propagation rule of x.k

[0123] 25: end if

[0124] 26: end if

[0125] 27: end for

[0126] 28: end while

[0127] 29: return SCG

[0128] During the pointer analysis process, for variable assignment and field acquisition statements, the system will update the taint flow graph according to whether the corresponding variable or its pointer is a tainted object to achieve taint propagation; for method calls in the statement, if the method is the starting method in the prior knowledge base, the corresponding tainted object is constructed and added to the taint flow graph; if the method is a propagation method, the tainted object is propagated and the taint flow graph is updated according to the prior knowledge and the pointer analysis rules in Table 5; if the method is a sensitive method, its sensitive parameters and its pointer are judged whether they point to the tainted object. If they point to the tainted object, the method call chain is traced back and the sensitive call graph is updated.

[0129] S3. Constructing an internal perception network: Algorithm 2 shown below describes the process of deploying bionic sensors and effectors in an application based on the sensitive method call graph and the prior knowledge base, and then constructing an internal perception network in the application. First, traverse the nodes in the sensitive method call graph and deploy corresponding bionic sensors in the application. Second, based on the sensitive method library in the prior knowledge base, deploy bionic sensors at sensitive method nodes that are not involved in the sensitive method call graph, so as to capture all sensitive operations and prevent the impact of insufficient coverage of the sensitive call graph on the threat detection capability of the low-level defense center. Finally, deploy bionic effectors at all sensitive methods in the application so that the defense center can quickly block the attack link.

[0130] Algorithm 2: Internal perception network construction algorithm based on sensitive call graph:

[0131] Input: Target Application Application , Sensitive Call Graph CallGraph , sensitive method library sinks

[0132] Output: sensor set Sensors , Effector Collection Effectors

[0133] 1: Initialize Sensors as an empty set for tracking deployed sensors

[0134] 2: Initialize Effectors as an empty map for tracking deployedeffectors

[0135] 3: for each node n in CallGraph.nodes do

[0136] 4: sensor = new Sensor ( n )

[0137] 5: Deploy sensor in Application

[0138] 6: Add sensor to Sensors

[0139] 7: end for

[0140] 8: for each method sink in Sinks do

[0141] 9: sensor = new Sensor ( sink )

[0142] 10: if sensor not in Sensors

[0143] 11: Deploy sensor in Application

[0144] 12: Add sensor to Sensors

[0145] 13: end if

[0146] 14: effector = new Effectot (n )

[0147] 15: Deploy effector in Application

[0148] 16: Add effector to Effectors

[0149] 17: end for

[0150] 18: return Sensors , Effectors

[0151] S4. Constructing a threat state machine model: This embodiment defines an application threat state machine model based on the finite state machine concept. , used to represent and manage security threat states and their transitions in applications. The relevant symbols are defined as follows:

[0152] State S: the security threat situation of the application at a specific moment, corresponding to the node in the sensitive call graph of the application;

[0153] Event E: Activities that trigger state transitions, such as function calls, data access, etc.

[0154] Convert T: , indicating the transition between states, triggered by events;

[0155] Initial state : , the starting point of the state machine, indicating the initial security state of the application;

[0156] Termination Status : , indicating a state where a potential threat has been successfully identified or disrupted.

[0157] According to the definition of the threat state machine above, the sensitive call graph of the application is converted into an application threat state machine model, and the application states are divided into the starting state SOURCE, the propagation state PROPAGATION, the propagation termination state TERMINATE, the dangerous state SINK and the safe state SAFE. The termination state includes the threat state SINK and the safe state SAFE. The activities that trigger state transitions of the application threat state machine include tainted data generation generate, tainted data propagate, and tainted data arrival and execution of sensitive operations sink_call.

[0158] The threat state machine built based on the application sensitive call graph is finally expressed as: ,in:

[0159] Finite state set S: S = {SOURCE, PROPAGATION, TERMINATE, SINK, SAFE};

[0160] Event set E: E={generate,propagate,…,sink_call};

[0161] State transition function T: ;

[0162] Initial state : ;

[0163] Termination Status : .

[0164] Based on the above definition, combined with the idea of ​​state transition from the current state to the next state of the finite state machine, the state transition table of the threat state machine built based on the application sensitive call graph can be used to describe the changes in the security situation during the execution of the application. The state transition table is shown in Table 6 below.

[0165] Table 6 Application threat state machine state transition table

[0166]

[0167] S5. Execute defensive measures: Based on the method for constructing an internal perception network of an integrated application based on a sensitive call graph and a threat state machine model, this embodiment proposes a threat detection method based on an internal perception network. This method is security situation-oriented and based on the idea of ​​a finite state machine. It constructs a threat state machine model of an application through a sensitive call graph. During the execution of the application, it couples the perception capability of the application's internal perception network, analyzes and evaluates the application's security status based on the status of the threat state machine, and thereby realizes the application's threat detection capability.

[0168] Algorithm 3 shown below describes the workflow of the threat detection method based on the internal perception network. First, when a user request is received during the application running process, the threat state machine model TSM is initialized according to the application sensitive call graph.

[0169] Algorithm 3 Threat detection algorithm based on internal perception network:

[0170] Input: Target Application App , Sensitive Call Graph CallGraph , receptors Sensors , Effector Effectors

[0171] Output: Application security status State

[0172] 1:Initialize the Threat State Machine TSM 2:

[0174] 3:while App is Running do

[0175] 4: if App.state = GetRequest do

[0176] 5: TSM = newThreatStateMachine ( CallGraph )

[0177] 6: TSM.state = SOURCE

[0178] 7: while TSM.state not in { SAFE, SINK } do

[0179] 8: event = sensors.getEvent ()

[0180] 9: TSM.updateState ( event )

[0181] 10: end while

[0182] 11: if TSM.state == SAFE do

[0183] 12: State = SAFE

[0184] 13: else if TSM.tate == SINK do

[0185] 14: threat = sensors.detectAnormaly ()

[0186] 15: if threat is known threat do

[0187] 16: State = UNSAFE

[0188] 17: Activate the effectors to perform the correspondingeffector behavior

[0189] 18: else if threat is unknown threat do

[0190] 19: State = UNSAFE

[0191] 20: Upload information about the unknown threat

[0192] 21: end if

[0193] 22: end while

[0194] Secondly, the state of the threat state machine is updated based on the event information event perceived in real time by the bionic receptors in the internal perception network. This process is as follows Figure 5 As shown, starting from the starting state of the application, when the bionic sensor detects the generation of tainted data or external input, the state machine will transfer from the starting state to the propagation state; in the propagation state, the tainted data may be propagated along the call chain of the program, and this process may be multiple cycles, indicating that the data is passed between multiple modules or functions; during the propagation process, the system continuously monitors the status of these data. If it is detected that the tainted data has been cleaned or verified and confirmed that it no longer poses a threat, the state machine will transfer from the propagation state to the security state. If in the propagation state, the tainted data enters an unprocessed sensitive operation, such as accessing sensitive information or performing unauthorized operations, the state machine will transfer to the threat state. In this case, the system will take further defensive measures to prevent or mitigate potential attacks; if the propagation process ends without entering the threat state, the system enters the propagation termination state, indicating that the data propagation is over and the threat has been processed.

[0195] Finally, the security status of the application is determined by detecting the status of the application threat state machine. If it is a safe state, it means that the request did not trigger sensitive operations or the tainted parameters have been cleaned, so there is no security threat and the application is in a safe state; if it is a threat state, since the parameters of the sensitive operation are tainted parameters passed in by the user and have not been cleaned by the security function, it means that the application is in a potentially dangerous state. At this time, the perception information of the bionic receptor is detected to determine whether the relevant parameters or behaviors are abnormal behaviors; for abnormal behaviors, the corresponding bionic effectors are activated based on the effect strategy library to implement countermeasures against the corresponding threats.

[0196] In order to verify the feasibility and effectiveness of the method for intra-aware application threat detection based on sensitive call graph proposed in this embodiment, the invention conducts experiments based on the application security testing environment OWASP Benchmark provided by the Open Worldwide Application Security Project (OWASP). Four types of common application security vulnerabilities in the OWASP Benchmark are selected, and a total of 1,370 security test cases are used for the experiment, as shown in Table 7 below, which describes the specific experimental case information.

[0197] Table 7 Low-level defense center experimental environment information table

[0198]

[0199] Based on the OWASP Benchmark experimental environment, this paper focuses on testing the effectiveness of the internal perception network construction method and the threat detection performance of the threat detection method based on the internal perception network.

[0200] (1) Performance overhead test: To verify the effectiveness of the method, a system performance overhead comparison experiment was conducted in the OWASP Benchmark experimental environment between an internal perception network built based on a sensitive call graph and a full perception network covering all method nodes.

[0201] The experiment selected transactions per second (TPS), service response time (RT) and CPU load as indicators for system performance overhead testing; as shown in Table 8 below, the results of this experiment are described. Compared with the full-perception network, the number of transactions per second of applications perceived by the internal perception network increased by 146.8%, the service response time decreased by 53.2%, and the CPU load decreased from 28.95% to 6.43%. It can be seen that the internal perception network construction method based on the sensitive call graph effectively reduces the additional system performance overhead brought by the perception process.

[0202] Table 8 Performance overhead comparison test results

[0203]

[0204] (2) Dynamic threat detection capability test: In order to verify the threat detection performance of the threat detection method based on the internal perception network, the method of this embodiment constructs an internal perception network in the test case based on the sensitive call graph, and uses the simulated attack script provided by OWASPBenchmark to perform simulated attacks to test the performance of the threat detection method.

[0205] As shown in Table 9 below, the results of the dynamic threat detection experiment are described. The results show that the threat detection method based on the internal perception network can detect more than 95% of threat attack behaviors, which is significantly improved compared to the static vulnerability detection results. This is because during the construction of the internal perception network, in addition to deploying bionic sensors at the nodes of the sensitive call graph, bionic sensors are also deployed at all sensitive methods in the application according to the sensitive method library. Therefore, more abnormal threat behaviors that are not covered by the sensitive call graph can be captured, thereby ensuring the threat detection capability of the method of this embodiment.

[0206] Table 9 Dynamic threat detection experiment results

[0207]

[0208] In the table, TP represents the number of vulnerabilities detected by the system; TPR represents the proportion of all vulnerability instances that are correctly identified by the system.

[0209] This embodiment proposes solutions to the two major problems of internal perception network construction and threat detection. First, a sensitive call graph generation method based on pointer analysis is used to obtain key logical points in the application, and an internal perception network construction method based on the sensitive call graph is proposed to achieve fine-grained perception capabilities of the application; secondly, the sensitive call graph is combined with the finite state machine to design a threat state machine model of the application, and on this basis, a threat detection method based on the internal perception network is proposed to achieve threat detection of the application, thereby effectively responding to complex security threats and improving system security. It is suitable for applications with high security requirements.

[0210] In addition to the above embodiments, the present invention may also have other implementation modes. Any technical solution formed by equivalent replacement or equivalent transformation falls within the protection scope required by the present invention.

Claims

1. A method for detecting software threats based on an intra-aware sensitive call graph, characterized in that: The following steps are involved: S1. Constructing a priori knowledge base: The priori knowledge base includes a starting method library, a sensitive method library, and a propagation method library; the starting method library is used to identify the starting method of introducing external data, which is not verified or cleaned and contains potential security threats; the sensitive method library is used to include methods that trigger dangerous operations after receiving tainted data; The propagation method library is used to identify application methods that can transmit or spread tainted data; S2. Generate sensitive call graph: Identify sensitive methods in the application through the taint analysis algorithm and generate a sensitive call graph for representing sensitive methods and their call relationships in the application; S3. Build an internal perception network: Based on the sensitive call graph and prior knowledge base, deploy bionic sensors and bionic effectors at the key logic points of the application to form an internal perception network, monitor the running status of the application in real time, and convert the collected multi-dimensional status information into perception vectors; S4. Build a threat state machine model: Convert the sensitive call graph into a threat state machine model, use the state transition rules of the finite state machine to evaluate the security situation of the application in real time, and determine the nature of the security threat; S5. Execute defense measures: formulate corresponding defense strategies based on the prior knowledge base and the current perception vector, and respond to detected security threats in real time according to the defense strategies.

2. The method for detecting software threats based on an intra-aware sensitive call graph according to claim 1, characterized in that: In step S1, the starting method in the starting method library consists of a binary group Indicates that Indicates the signature of the starting method, which is the unique identifier of the method and is used to match the starting method in the application. Indicates the type of tainted data generated by the initiation method; The sensitive methods in the sensitive method library are represented by two tuples: Indicates that Represents the sensitive method signature, i represents the sensitive parameter serial number, and the sensitive method library contains the following categories of sensitive methods: arbitrary command execution class, arbitrary code execution class, arbitrary file operation class, network request class, database operation class, and information leakage class; Propagation method library using quad represents the taint propagation method, where Represents the signature of the taint propagation method, from represents the source variable, to represents the target variable, Indicates the type of tainted object after taint propagation; taint propagation methods include three modes: object to result, parameter to object, and parameter to result.

3. The method for detecting software threats based on an intra-aware sensitive call graph according to claim 1, characterized in that: In step S2, the sensitive call graph is defined as: Among them, node V represents the method in the application; edge E represents the calling relationship between methods. If method A calls method B, there is an edge from A to B in the sensitive call graph; the root node R represents the starting point in the sensitive call graph; the leaf node L represents the end point in the sensitive call graph; the call chain C represents the path from the root node to any node, representing a series of method calls during the execution of the application.

4. The method for detecting software threats based on an intra-aware sensitive call graph according to claim 3, characterized in that: In the step S2, a sensitive call graph is generated based on pointer analysis, and the specific method is as follows: first, variables related to pointer analysis and sensitive call graph are initialized, and the variables related to the sensitive call graph include work queue WL, method call graph CG, pointer flow graph PFG and taint flow graph TFG; Then, starting from the entry method of application P, statements are traversed and pointer analysis is performed; During the pointer analysis process, for variable assignment and field acquisition statements, the taint flow graph is updated according to whether the corresponding variable or its pointer is a tainted object to achieve taint propagation; for method calls in statements, if the method is the starting method in the prior knowledge base, the corresponding tainted object is constructed and added to the taint flow graph; If the method is a propagation method in the propagation method library, the tainted object is propagated and the taint flow graph is updated according to the prior knowledge and pointer analysis rules; If the method is a sensitive method in the sensitive method library, determine whether its sensitive parameters and its pointer point to a tainted object. If they point to a tainted object, backtrack the method call chain and update the sensitive call graph.

5. The method for detecting software threats based on an intra-aware sensitive call graph according to claim 4, characterized in that: In step S2, the pointer analysis rule is specifically: the definition statement is , when the type is a tainted source call, the rule is ; When the type is object-to-result taint propagation call, the rules are ; When the type is a parameter-to-object taint propagation call, the rule is ; When the type is a parameter-to-result taint propagation call, the rules are ; When the type is a sensitive method call, the rules are ; Among them, pt(r) represents the set pointed to by the caller pointer; Represents the set of pointers to corresponding parameters; r represents the result of the taint source; x represents the object or instance acted upon by method k; Indicates the i-th parameter passed to the sensitive method k; Sources indicates that this method k is a taint source and will generate tainted data; arg represents a parameter variable in the function, or a collection of multiple parameter values, which is used to describe the transfer relationship from parameter to object or result when taint propagates; The result of the pointer analysis of the tainted object indicates that at line l of the program execution, the pointer marked u points to a tainted object; Indicates the taint analysis result of mark u on code line j, which means that at the jth line of program execution, the object pointed to by mark u is tainted; similarly Indicates that at line j of code, mark The pointer analysis status of x; pt(x) represents the pointer analysis result of x, and the object pointed to is marked as tainted; Propagations represents the rules for taint propagation, that is, when object x is tainted, the return value r of method k will also be tainted; base represents the object itself that calls the method; result represents the return value marked as tainted; Sinks represents sensitive method call points, which involve security risks; TaintFlows represents recording the flow direction of taints and tracking the propagation path of tainted objects.

6. The method for detecting software threats based on an intra-aware sensitive call graph according to claim 1, characterized in that: In step S3, constructing the internal perception network specifically includes the following sub-steps: S3.1, traverse the nodes in the sensitive call graph and deploy the corresponding bionic receptors in the application; S3.2, based on the sensitive method library in the prior knowledge base, deploy bionic sensors at sensitive method nodes not involved in the sensitive call graph to capture all sensitive operations; S3.

3. Deploy bionic effectors at all sensitive methods in the application.

7. The method for detecting software threats based on an intra-aware sensitive call graph according to claim 1, characterized in that: In step S4, the threat state machine is defined as: Among them, S represents the state, corresponding to the node in the application sensitive call graph; event E represents the activity that triggers the state transition; transition Indicates the transition between states, triggered by events; initial state Indicates the starting point of the state machine, indicating the initial security state of the application; the terminal state A status indicating that a potential threat has been successfully identified or disrupted; According to the definition of threat state machine, the sensitive call graph of the application is converted into the application threat state machine model, and the application states are divided into the starting state SOURCE, propagation state PROPAGATION, propagation termination state TERMINATE, dangerous state SINK and safe state SAFE. The termination state includes threat state SINK and safe state SAFE. The activities of triggering state transition of the application threat state machine include tainted data generation generate, tainted data propagate, and tainted data arrival and execution of sensitive operation sink_call. The threat state machine constructed based on the application sensitive call graph is finally expressed as: Where S represents a finite state set, S={SOURCE,PROPAGATION,TERMINATE,SINK,SAFE}; E represents an event set, E={generate,propagate,…,sink_call}; T represents a state transition function, ; represents the initial state, ; Indicates the termination state. .

8. The method for detecting software threats based on an internal perception based on a sensitive call graph according to claim 7, characterized in that: In the step S4, combined with the idea of ​​state transition from the current state to the next state of the finite state machine, the changes in the security situation during the execution of the application are described: when the event is the generation of tainted data, it is transferred from the current starting state to the new propagation state; when the event is the propagation of tainted data, it is transferred from the current propagation state to the new propagation state; when the event is the arrival of tainted data at a sensitive operation, it is transferred from the current propagation state to a new threat state; when the event is tainted data that has been cleaned or verified to be harmless, it is transferred from the current propagation state to a new security state; when the event is the execution of a sensitive operation, it is transferred from the current propagation termination state to a new threat state; when the event is the end of the request execution, it is transferred from the current propagation termination state to a new security state.

9. The method for detecting software threats based on an intra-awareness sensitive call graph according to claim 1, characterized in that: The step S5 specifically includes the following sub-steps: S5.

1. When a user request is received during the running of the application, the threat state machine model TSM is initialized according to the sensitive call graph of the application; S5.2, updating the state of the threat state machine based on the event information event perceived in real time by the bionic receptors in the internal perception network; S5.

3. The security status of the application is determined by detecting the status of the application threat state machine. If it is a safe status, it means that the request did not trigger sensitive operations or the tainted parameters have been cleaned, so there is no security threat and the application is in a safe status. If it is a threat status, since the parameters of the sensitive operations are tainted parameters passed in by the user and have not been cleaned by the security function, it means that the application is in a potentially dangerous state. At this time, the perception information of the bionic receptor is detected to determine whether the relevant parameters or behaviors are abnormal behaviors. For abnormal behaviors, the corresponding bionic effectors are activated based on the effect strategy library to implement countermeasures against the corresponding threats.

10. The method for detecting software threats based on an intra-awareness sensitive call graph according to claim 9, characterized in that: In step S5.2, starting from the initial state of the application, when the bionic sensor detects the generation of tainted data or external input, the state machine will transfer from the initial state to the propagation state; in the propagation state, the tainted data is transmitted between multiple modules or functions; During the propagation process, the system continuously monitors the status of the data. If it is detected that the tainted data has been cleaned or verified and confirmed that it no longer poses a threat, the state machine will move from the propagation state to the safe state. If in the propagation state, the tainted data enters an unprocessed sensitive operation, the state machine will move to the threat state. In this case, the system will take further defensive measures to prevent or mitigate potential attacks. If the propagation process ends without entering the threat state, the system enters the propagation termination state, indicating that the data propagation has ended and the threat has been processed.

Images