Application vulnerability detection method, device, and medium based on taint analysis

Abstract

The present invention provides a method, device, and medium for detecting application vulnerabilities based on taint analysis. The method comprises: performing lexical and syntactic analysis on the original code of the application to obtain equivalent intermediate representation data; traversing an abstract syntax tree to extract data dependencies and method call dependencies to form a propagation path tree corresponding to the application; collecting the application's vulnerabilities, marking the vulnerabilities as entry points for tainted data, and setting propagation rules; inputting the tainted data into the entry points so that the tainted data propagates along various propagation paths in the propagation path tree according to the propagation rules, and obtaining output results at the respective exit points of each propagation path; determining whether the output results obtained at the exit points match the vulnerability detection rules; and if so, determining that the propagation path corresponding to the output results has a vulnerability. The present invention can improve the efficiency and accuracy of application vulnerability detection.

Description

Technical Field

[0001] The present invention relates to the field of application security technology, and in particular to a method, device and medium for detecting application vulnerability based on taint analysis. Background Art

[0002] With the continuous development of the internet industry, applications on enterprise cloud platforms are becoming increasingly specialized, complex, and large-scale. As enterprises increasingly rely on cloud services in the digital age, cloud application security has become a critical concern. The convenience of cloud services provides enterprises with powerful storage, computing, and application capabilities. However, this comes with an increasing risk of cyberattacks. Against this backdrop, timely identifying vulnerabilities in cloud applications and ensuring the effectiveness of cloud security measures are imperative and essential for maintaining business security on enterprise cloud platforms.

[0003] Application vulnerabilities generally refer to hidden vulnerabilities or weaknesses within an application that, while harmless in themselves, can lead to serious security issues if exploited. These vulnerabilities or weaknesses may stem from logical errors introduced consciously or unconsciously during software development, or they may be closely related to the specific system environment. Furthermore, patching or correcting old vulnerabilities can introduce new ones, making vulnerability issues persistent. Application vulnerabilities can exist in the design and implementation of hardware, software, and protocols, as well as in the security policies employed by the system. Their existence directly allows unauthorized or unauthorized users to gain or escalate access rights, thereby providing attackers with opportunities to compromise network systems.

[0004] Currently, there are two main methods for detecting and analyzing vulnerabilities in cloud platform applications:

[0005] Static code analysis, which looks for software vulnerabilities by examining source code or binary files, is a manual code inspection method that uses walkthrough audits to identify vulnerabilities in the code.

[0006] Dynamic testing and analysis detects vulnerabilities by running the application. During dynamic testing, testers observe the application's running state by simulating attacks, capturing and analyzing the application's behavior to discover vulnerabilities.

[0007] Conventional cloud platform application vulnerability detection and analysis methods usually require direct traversal or dynamic operation of code content, which is time-consuming and may lead to certain missed detections. Summary of the Invention

[0008] In response to at least one of the above technical problems, embodiments of the present invention provide a method, device, and medium for detecting application vulnerability based on taint analysis.

[0009] According to a first aspect, an embodiment of the present invention provides an application vulnerability detection method based on taint analysis, including:

[0010] Performing lexical and grammatical analysis on the original code of the application to obtain equivalent intermediate representation data; wherein the hierarchical intermediate representation data includes an abstract syntax tree formed by key elements in the original code;

[0011] Traversing the abstract syntax tree to extract data dependencies and method call dependencies, and forming a propagation path tree corresponding to the application program with the data dependencies and the method call dependencies;

[0012] Collecting the vulnerabilities of the application, marking the vulnerabilities as entry points for contaminated data, and setting propagation rules for the contaminated data during the propagation process from the entry points to the exit points;

[0013] Inputting the contaminated data into the inlet, so that the contaminated data propagates along each propagation path in the propagation path tree according to the propagation rule, and obtaining an output result at each exit of each propagation path;

[0014] Determining whether an output result obtained at the exit matches a vulnerability detection rule;

[0015] If so, it is determined that there is a vulnerability in the propagation path corresponding to the output result.

[0016] In one embodiment, traversing the abstract syntax tree to extract data dependencies and method call dependencies includes:

[0017] S1. Put the Nth node in the abstract syntax tree at the end of a queue; wherein the initial value of N is 0, the 0th node is the root node of the abstract syntax tree; and N is an integer;

[0018] S2: Take out the first node in the queue that is not empty and use it as the current node, and call the processing function corresponding to the current node;

[0019] S3. Determine whether the Nth node is a leaf node of the abstract syntax tree;

[0020] S4. If yes, exit the traversal process, output the sequential calling relationship between the processing functions of each node as the method call dependency relationship, and output the dependency relationship between the output parameters and input parameters of the processing function as the data dependency relationship;

[0021] S5. Otherwise, take the child node of the Nth node as the N+1th node and return to S1.

[0022] In one embodiment, the output result corresponding to the pollution data output at the outlet includes a performance feature and a processing result corresponding to the pollution data; wherein the performance feature is characteristic information reflecting the propagation path.

[0023] In one embodiment, determining whether the output result obtained at the exit matches the vulnerability detection rule includes:

[0024] Matching the processing results in the output results with vulnerability detection rules of various attack modes of corresponding vulnerabilities;

[0025] If the processing result matches the vulnerability detection rule of at least one attack mode, then the propagation path corresponding to the performance feature in the output result has a vulnerability corresponding to the at least one attack mode.

[0026] In one embodiment, the method further comprises:

[0027] If the processing results obtained at each exit corresponding to each entry do not hit the vulnerability detection rule of any attack mode of the corresponding vulnerability point, then the application is a normal application.

[0028] In one embodiment, the method further comprises:

[0029] If there is a vulnerability in the propagation path corresponding to the output result, a vulnerability exploitation path diagram is generated, and vulnerability repair suggestions are generated;

[0030] An alarm message is generated according to the vulnerability exploitation path map and the vulnerability repair suggestion, and the alarm message is pushed to an operation and maintenance personnel so that the operation and maintenance personnel can repair the vulnerability according to the vulnerability exploitation path map and the vulnerability repair suggestion.

[0031] In one embodiment, performing lexical and grammatical analysis on the original code of the application to obtain equivalent intermediate representation data includes:

[0032] Scan the classes, functions, objects, variables, comments, grammatical keywords and regular expressions in the application, mark the grammar in the application and the code start segment and code end segment of the application, perform grammatical analysis on the application according to the grammatical rules of the text type of the application, express the grammatical features of the application through context-associated grammar, obtain key elements in the application, and form the equivalent intermediate representation data with the key elements.

[0033] According to a second aspect, an embodiment of the present invention provides an application vulnerability detection device based on taint analysis, comprising:

[0034] A first analysis module is configured to perform lexical and syntactic analysis on the original code of the application program to obtain equivalent intermediate representation data; wherein the hierarchical intermediate representation data includes an abstract syntax tree formed by key elements in the original code;

[0035] A traversal analysis module, configured to traverse the abstract syntax tree to extract data dependencies and method call dependencies, and form a propagation path tree corresponding to the application program from the data dependencies and the method call dependencies;

[0036] An entry marking module is used to collect the vulnerabilities of the application, mark the vulnerabilities as the entry of polluted data, and set propagation rules for the polluted data during the propagation process from the entry to the exit;

[0037] a data propagation module, configured to input the contaminated data into the inlet, so that the contaminated data propagates along each propagation path in the propagation path tree according to the propagation rule, and obtain an output result at each exit of each propagation path;

[0038] The result matching module is used to determine whether the output result obtained at the exit matches the vulnerability detection rule; if so, it is determined that a vulnerability exists in the propagation path corresponding to the output result.

[0039] According to a third aspect, an embodiment of the present invention provides a computer-readable storage medium having a computer program stored thereon, which, when executed in a computer, causes the computer to execute the method provided in the first aspect.

[0040] According to a fourth aspect, an embodiment of the present invention provides a computing device, comprising a memory and a processor, wherein the memory stores executable code, and when the processor executes the executable code, the method provided in the first aspect is implemented.

[0041] The application vulnerability detection method, device, and medium based on taint analysis provided by the embodiments of the present invention perform lexical and syntactic analysis on the original code of an application to obtain equivalent intermediate representation data. The abstract syntax tree within the equivalent intermediate representation data is then traversed to extract data dependencies and method call dependencies. These dependencies are then combined to form a propagation path tree corresponding to the application. Next, the application's vulnerabilities are collected, marked as entry points for tainted data, and propagation rules are set for the tainted data from the entry points to the exit points. The tainted data is then input into the entry points. This propagates along each propagation path in the propagation path tree according to the propagation rules, and output results are obtained at the exit points of each propagation path. The method then determines whether the output results obtained at the exit points match the vulnerability detection rules. If so, the propagation path corresponding to the output results is determined to have a vulnerability. This embodiment of the present invention provides a vulnerability detection solution based on taint analysis technology that can detect various vulnerabilities in applications, thereby improving the application security management capabilities of cloud platforms. Compared to existing static analysis methods, the embodiments of the present invention can improve detection flexibility. Compared to existing dynamic testing methods, the embodiments of the present invention can improve detection efficiency. This shows that the embodiments of the present invention can improve the efficiency and accuracy of application vulnerability detection, ensuring the security of cloud platform applications, thereby enhancing the security of cloud platform network systems and reducing the incidence of confidential and private enterprise data leaks. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] Figure 1 Schematic diagram of a flow chart of an application vulnerability detection method based on taint analysis in one embodiment of the present invention;

[0043] Figure 2 This is a technical route system diagram of an application vulnerability detection method based on taint analysis in one embodiment of the present invention;

[0044] Figure 3 Schematic diagram of various functional parts involved in a method for detecting application vulnerability based on taint analysis in one embodiment of the present invention;

[0045] Figure 4 FIG. 4 is a structural block diagram of an application vulnerability detection device based on taint analysis in one embodiment of the present invention. DETAILED DESCRIPTION

[0046] In the first aspect, the embodiment of the present invention provides an application vulnerability detection method based on taint analysis, see Figure 1 、 Figure 2 and Figure 3The method includes the following steps S110 to S160:

[0047] S110, performing lexical and syntactic analysis on the original code of the application to obtain equivalent intermediate representation data; wherein the hierarchical intermediate representation data includes an abstract syntax tree formed by key elements in the original code;

[0048] Among them, the original code of the application has various types, for example, Go, Java, C / C++, Python, PHP and other source programs. This application may be a normal application or an application with certain vulnerabilities, that is, an application with vulnerabilities.

[0049] Here, S110 actually refers to converting the character stream of the original code into a word stream in a prescribed format.

[0050] In one embodiment, the lexical and syntactic analysis of the original code of the application in S110 to obtain equivalent intermediate representation data may include: scanning the classes, functions, objects, variables, comments, grammatical keywords and regular expressions in the application, marking the grammar in the application and the code start segment and code end segment of the application, performing grammatical analysis on the application according to the grammatical rules of the text type of the application, representing the grammatical features of the application through context-associated grammar, obtaining key elements in the application, and forming the key elements into the equivalent intermediate representation data.

[0051] It can be seen that various key elements in the application can be obtained through scanning, annotation, syntax analysis, syntax association and other methods, and then these key elements can be formed into equivalent intermediate representation data.

[0052] One form of the hierarchical intermediate representation data is an abstract syntax tree, which is a tree structure formed by various key elements obtained through lexical and grammatical analysis. The key elements exist in the form of nodes in the abstract syntax tree.

[0053] S120: Traverse the abstract syntax tree to extract data dependencies and method call dependencies, and form a propagation path tree corresponding to the application program with the data dependencies and the method call dependencies;

[0054] The data dependency relationship refers to the dependency relationship between the output parameters of a method and the input parameters of the method.

[0055] Method call dependencies refer to the dependencies between various processing functions. For example, when executing a processing function, it needs to use the parameters of another processing function, so there is a dependency relationship between the two processing functions.

[0056] It can be seen that the data dependencies and method call dependencies in the application can form various data propagation paths, which form a propagation path tree.

[0057] In one embodiment, traversing the abstract syntax tree in S120 to extract data dependencies and method call dependencies may include S1 to S5:

[0058] S1. Put the Nth node in the abstract syntax tree at the end of a queue; wherein the initial value of N is 0, the 0th node is the root node of the abstract syntax tree; and N is an integer;

[0059] S2: Take out the first node in the queue that is not empty and use it as the current node, and call the processing function corresponding to the current node;

[0060] S3. Determine whether the Nth node is a leaf node of the abstract syntax tree;

[0061] S4. If yes, exit the traversal process, output the sequential calling relationship between the processing functions of each node as the method call dependency relationship, and output the dependency relationship between the output parameters and input parameters of the processing function as the data dependency relationship;

[0062] S5. Otherwise, take the child node of the Nth node as the N+1th node and return to S1.

[0063] For example, the root node of the abstract syntax tree is placed in a queue, the root node is retrieved and used as the current node, and the processing function of the current node is called. The child node of the root node is then placed in a queue, the child node is retrieved and used as the current node, and the processing function of the current node is called. This results in a dependency relationship between the processing function of the root node and the processing functions of the child nodes. This process continues in this way until the current node is a leaf node at the top of the abstract syntax tree, and the entire process is exited. At this point, the dependency relationship between the processing functions of each node is obtained, namely the method call dependency relationship. At the same time, the dependency between the output parameters and input parameters of each processing function is used as a data dependency relationship.

[0064] As can be seen, the above S1 to S5 implement node relevance analysis by traversing the abstract syntax tree. The above process is a loop process until all nodes are traversed, thus gradually establishing the dependency relationship between the various processing functions called by the application.

[0065] S130: Collect the vulnerabilities of the application, mark the vulnerabilities as entry points for contaminated data, and set propagation rules for the contaminated data during the propagation process from the entry points to the exit points.

[0066] Vulnerabilities can be understood as locations within an application where vulnerabilities are prone to occur, such as buffer overflows, SQL injections, protocol vulnerabilities, privilege escalation vulnerabilities, configuration vulnerabilities, and logical vulnerabilities.

[0067] Among them, the vulnerable point is marked as the entrance of polluted data, and the vulnerable point can also be called the pollution source.

[0068] Among them, each entry has a corresponding exit, and the exit can also be marked to facilitate subsequent acquisition of the output result from the exit.

[0069] A series of propagation rules are developed to track the spread of contaminated data within the propagation path tree. These propagation rules define the target and method of taint source transmission, making it easier to track and record the process of tainted data propagating taint attributes. This also allows contaminated data to traverse various propagation paths after entering the input, and then carry performance characteristics in the output results, thus reflecting the characteristic information of the propagation path it has traversed.

[0070] Among them, various operations can be performed in the propagation path according to the called processing function, such as obtaining the running instruction information, analyzing and extracting the operands, and obtaining the data flow propagation mode, and then analyzing the specific propagation operation process.

[0071] S140, inputting the contaminated data into the inlet, so that the contaminated data propagates along each propagation path in the propagation path tree according to the propagation rule, and obtaining an output result at each exit of each propagation path;

[0072] That is, the contaminated data is input into each entrance, so that the contaminated data will be propagated along each possible propagation path in the propagation path tree, and then the result will be output at the corresponding exit.

[0073] S150: Determine whether the output result obtained at the exit matches the vulnerability detection rule;

[0074] S160: If yes, determine that there is a vulnerability in the propagation path corresponding to the output result.

[0075] That is, determine whether the output result at each exit matches the vulnerability detection rule. If it matches, it means that there is a vulnerability in the corresponding propagation path, especially the vulnerability of the entrance of the propagation path is stronger because the entrance itself is a vulnerable point.

[0076] In one embodiment, the output result corresponding to the pollution data output at the outlet includes a performance feature and a processing result corresponding to the pollution data; wherein the performance feature is characteristic information reflecting the propagation path.

[0077] It can be seen that the output results at the exit include the processing results and performance characteristics corresponding to the contaminated data. The performance characteristics can be used to determine which propagation path is taken, and whether there are vulnerabilities in the propagation path can be determined by whether the processing results match the vulnerability detection rules.

[0078] In one embodiment, determining whether the output result obtained at the exit matches the vulnerability detection rule in S150 may include:

[0079] S151, matching the processing results in the output results with vulnerability detection rules of various attack modes of corresponding vulnerabilities;

[0080] S152. If the processing result matches the vulnerability detection rule of at least one attack mode, then the propagation path corresponding to the performance characteristics in the output result has a vulnerability corresponding to the at least one attack mode.

[0081] That is to say, the processing results in the output results of the export can be matched with the vulnerability detection rules of various attack modes corresponding to the vulnerability points of the import. As long as the vulnerability detection rule of at least one attack mode is hit, it is considered that a vulnerability exists.

[0082] Among them, a vulnerable point may have different vulnerabilities and therefore different attack modes. Therefore, corresponding vulnerability detection rules are set for each attack mode.

[0083] Among them, the attack modes may include buffer overflow mode, weak password mode, SQL injection mode, instruction injection mode, file upload vulnerability mode, file traversal vulnerability mode, privilege escalation vulnerability mode, integrity check vulnerability mode, logical vulnerability mode, etc.

[0084] In one embodiment, the method provided by the embodiment of the present invention may further include:

[0085] If the processing results obtained at each exit corresponding to each entry do not hit the vulnerability detection rule of any attack mode of the corresponding vulnerability point, then the application is a normal application.

[0086] It can be seen that only when the processing results in the output results of all exits corresponding to all entrances do not match the vulnerability detection rules of any attack mode, the entire application is considered normal and has no vulnerabilities.

[0087] In one embodiment, the method provided by the embodiment of the present invention may further include:

[0088] If there is a vulnerability in the propagation path corresponding to the output result, a vulnerability exploitation path diagram is generated, and vulnerability repair suggestions are generated;

[0089] An alarm message is generated according to the vulnerability exploitation path map and the vulnerability repair suggestion, and the alarm message is pushed to an operation and maintenance personnel so that the operation and maintenance personnel can repair the vulnerability according to the vulnerability exploitation path map and the vulnerability repair suggestion.

[0090] It can be seen that according to the matching results of the processing results at each exit and the vulnerability detection rules, the propagation paths of the vulnerability are known, and then a vulnerability exploitation path map is generated for each propagation path of the vulnerability. According to the pre-configured prior knowledge, corresponding vulnerability repair suggestions are given, and then an alarm information is generated based on the vulnerability exploitation path map and the vulnerability repair suggestions, and then the alarm information is pushed to the operation and maintenance personnel. In this way, the operation and maintenance personnel will refer to the vulnerability repair suggestions and the vulnerability exploitation path map to carry out the vulnerability repair work. Based on the method provided by the embodiment of the present invention, once a vulnerability is discovered, it is repaired immediately. Delaying the repair of the vulnerability may cause hackers to exploit the vulnerability to attack, causing irreparable losses.

[0091] Taint analysis examines whether data or operations introduced by a tainted source in an application can propagate directly to the tainted sink without undergoing harmless processing. If not, the information flow is secure; otherwise, the application may have security issues such as private data leakage or dangerous data manipulation.

[0092] In vulnerability analysis, taint analysis technology is used to mark vulnerable points where vulnerabilities may exist as entry points, and then contaminated data is input from the entry points. By tracking the information flow of contaminated data, it can be determined whether they will affect certain key program operations, and then program vulnerabilities can be discovered.

[0093] Taint analysis typically includes the following parts:

[0094] (1) Identify the point where the contaminated data is generated in the program, i.e., the entry point, and mark the entry point.

[0095] (2) Taint propagation analysis, which uses specific rules to track and analyze the propagation process of contaminated data in the application.

[0096] (3) Vulnerability detection, that is, matching the processing results output at the exit with the vulnerability detection rules to find out whether there is a vulnerability.

[0097] It can be seen that the present invention can track the flow of contaminated data input by the application and analyze the evolution of contaminated data in the application execution sequence based on the taint analysis technology, and then discover the vulnerability loopholes of the application's lack of effective and secure processing of input data. Taking the vulnerability analysis of the source code of an object-oriented program as an example, the original code is converted into equivalent intermediate representation data through lexical analysis, syntax analysis and other technologies to preserve all element information in the original code and the structural information of the code. Forward data flow analysis is performed through the equivalent intermediate representation data to extract data dependencies and method call dependencies. Vulnerabilities are collected, and the vulnerable points are marked as entry points. Contaminated data is input from the entry points. The generated data dependencies and method call dependencies are used to perform reverse taint dependency analysis on each vulnerable point to obtain the processing results. The processing results are matched with the vulnerability detection rules to determine whether there are vulnerabilities.

[0098] It is understandable that in response to the urgent need for cloud platform application vulnerability security detection, the embodiments of the present invention can effectively solve vulnerability problems such as cloud configuration errors, insecure APIs, lack of reliable authentication and authorization management, and distributed denial of service attacks by performing real-time detection and security analysis of enterprise cloud platform application vulnerabilities, thereby improving the cloud platform application security management capabilities.

[0099] As can be seen, the embodiments of the present invention provide a cloud platform application vulnerability detection method based on taint analysis, which can improve the efficiency and accuracy of application vulnerability detection, ensure the security of cloud platform applications, and further enhance the security of cloud platform network systems, reducing the incidence of confidential and private enterprise data leakage incidents. The embodiments of the present invention are particularly suitable for application scenarios in large cloud platform enterprises, such as cloud platform enterprise software application security monitoring systems and cloud platform enterprise application security protection systems.

[0100] In a second aspect, an embodiment of the present invention provides an application vulnerability detection device based on taint analysis, see Figure 2 , the apparatus 100 comprises:

[0101] The first analysis module 110 is configured to perform lexical and syntactic analysis on the original code of the application program to obtain equivalent intermediate representation data; wherein the hierarchical intermediate representation data includes an abstract syntax tree formed by key elements in the original code;

[0102] A traversal analysis module 120 is configured to traverse the abstract syntax tree to extract data dependencies and method call dependencies, and form a propagation path tree corresponding to the application program from the data dependencies and the method call dependencies;

[0103] An entry marking module 130 is used to collect the vulnerabilities of the application, mark the vulnerabilities as the entry points of the polluted data, and set propagation rules for the polluted data during the propagation process from the entry points to the exit points;

[0104] A data propagation module 140 is configured to input the contaminated data into the inlet, so that the contaminated data is propagated along each propagation path in the propagation path tree according to the propagation rule, and output results are obtained at the respective exits of each propagation path;

[0105] The result matching module 150 is used to determine whether the output result obtained at the exit matches the vulnerability detection rule; if so, it is determined that a vulnerability exists in the propagation path corresponding to the output result.

[0106] In one embodiment, the traversal analysis module is specifically used to: S1, put the Nth node in the abstract syntax tree into the tail of the queue; wherein, the initial value of N is 0, the 0th node is the root node of the abstract syntax tree; N is an integer; S2; take out the first node in the queue that is not empty and use it as the current node, and call the processing function corresponding to the current node; S3, determine whether the Nth node is a leaf node of the abstract syntax tree; S4, if so, exit the traversal process, output the sequential calling relationship between the processing functions of each node as the method call dependency, and output the dependency relationship between the output parameters and input parameters of the processing function as the data dependency; S5, otherwise, use the child node of the Nth node as the N+1th node and return to S1.

[0107] In one embodiment, the output result corresponding to the pollution data output at the outlet includes a performance feature and a processing result corresponding to the pollution data; wherein the performance feature is characteristic information reflecting the propagation path.

[0108] In one embodiment, the result matching module is specifically used to: match the processing results in the output results with the vulnerability detection rules of various attack modes where the corresponding vulnerabilities exist; if the processing results hit the vulnerability detection rules of at least one attack mode, then the propagation path corresponding to the performance characteristics in the output result has a vulnerability corresponding to the at least one attack mode.

[0109] In one embodiment, the apparatus further comprises:

[0110] The first determination module is configured to determine that the application is a normal application if the processing results obtained at the exits corresponding to the entry points do not hit the vulnerability detection rules of any attack mode of the corresponding vulnerability point.

[0111] In one embodiment, the apparatus further comprises:

[0112] The first push module is used to generate a vulnerability exploitation path map and vulnerability repair suggestions if there is a vulnerability in the propagation path corresponding to the output result; generate alarm information based on the vulnerability exploitation path map and the vulnerability repair suggestions, and push the alarm information to the operation and maintenance personnel, so that the operation and maintenance personnel can repair the vulnerability according to the vulnerability exploitation path map and the vulnerability repair suggestions.

[0113] In one embodiment, the first analysis module is specifically used to: scan the classes, functions, objects, variables, comments, grammatical keywords and regular expressions in the application, mark the grammar in the application and the code start segment and code end segment of the application, perform grammatical analysis on the application according to the grammatical rules of the text type of the application, represent the grammatical characteristics of the application through context-associated grammar, obtain key elements in the application, and form the key elements into the equivalent intermediate representation data.

[0114] It is understandable that the explanation of the relevant contents, specific implementation methods, beneficial effects, examples, etc. in the system provided by the embodiment of the present invention can be found in the corresponding parts of the method provided in the first aspect, and will not be repeated here.

[0115] In a third aspect, an embodiment of the present invention provides a computer-readable medium having computer instructions stored thereon. When the computer instructions are executed by a processor, the processor executes the method provided in the first aspect.

[0116] Specifically, a system or device equipped with a storage medium can be provided, on which software program codes that implement the functions of any of the above-mentioned embodiments are stored, and a computer (or CPU or MPU) of the system or device can be enabled to read and execute the program codes stored in the storage medium.

[0117] In this case, the program code itself read from the storage medium can realize the function of any one of the above-mentioned embodiments, and thus the program code and the storage medium storing the program code constitute part of the present invention.

[0118] Examples of storage media for providing program code include floppy disks, hard disks, magneto-optical disks, optical disks (such as CD-ROM, CD-R, CD-RW, DVD-ROM, DVD-RAM, DVD-RW, DVD+RW), magnetic tapes, non-volatile memory cards, and ROMs. Alternatively, the program code can be downloaded from a server computer via a communication network.

[0119] In addition, it should be clear that the functions of any of the above embodiments can be achieved not only by executing the program code read by the computer, but also by enabling the operating system operating on the computer to complete part or all of the actual operations based on the instructions of the program code.

[0120] In addition, it can be understood that the program code read from the storage medium is written into a memory provided in an expansion board inserted into the computer or into a memory provided in an expansion module connected to the computer, and then based on the instructions of the program code, a CPU installed on the expansion board or expansion module is enabled to perform part or all of the actual operations, thereby realizing the functions of any of the above embodiments.

[0121] It is understandable that the explanation, specific implementation methods, beneficial effects, examples, etc. of the relevant contents in the computer-readable medium provided in the embodiment of the present invention can be found in the corresponding parts of the method provided in the first aspect, and will not be repeated here.

[0122] In a fourth aspect, an embodiment of this specification provides a computing device, comprising a memory and a processor, wherein the memory stores executable code, and when the processor executes the executable code, it implements the method in any one of the embodiments in the specification.

[0123] It is understandable that the explanation, specific implementation, beneficial effects, examples, etc. of the relevant contents in the computing device provided by the embodiment of the present invention can be found in the corresponding parts of the method provided in the first aspect, and will not be repeated here.

[0124] The various embodiments in this specification are described in a progressive manner. Similar parts between the various embodiments can be referred to in conjunction with each other. Each embodiment focuses on the differences from other embodiments. In particular, the device embodiments are generally similar to the method embodiments, so the description is relatively simple. For relevant parts, refer to the description of the method embodiments.

[0125] Those skilled in the art will appreciate that in one or more of the above examples, the functions described in the present invention may be implemented using hardware, software, widgets, or any combination thereof. When implemented using software, these functions may be stored in a computer-readable medium or transmitted as one or more instructions or codes on a computer-readable medium.

[0126] The specific implementation methods described above further illustrate the objectives, technical solutions and beneficial effects of the present invention in detail. It should be understood that the above description is only a specific implementation method of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent replacements, improvements, etc. made on the basis of the technical solution of the present invention should be included in the scope of protection of the present invention.

Claims

1. A method for detecting application vulnerability based on taint analysis, characterized in that: include: Performing lexical and syntactic analysis on the original code of the application to obtain equivalent intermediate representation data; wherein the equivalent intermediate representation data includes an abstract syntax tree formed by key elements in the original code; Traversing the abstract syntax tree to extract data dependencies and method call dependencies, and forming a propagation path tree corresponding to the application program with the data dependencies and the method call dependencies; Collecting the vulnerabilities of the application, marking the vulnerabilities as entry points for contaminated data, and setting propagation rules for the contaminated data during the propagation process from the entry points to the exit points; Inputting the contaminated data into the inlet, so that the contaminated data propagates along each propagation path in the propagation path tree according to the propagation rule, and obtaining an output result at each exit of each propagation path; Determining whether an output result obtained at the exit matches a vulnerability detection rule; If so, it is determined that there is a vulnerability in the propagation path corresponding to the output result.

2. The method according to claim 1, characterized in that The traversing the abstract syntax tree to extract data dependencies and method call dependencies includes: S1. Put the Nth node in the abstract syntax tree at the end of the queue; wherein the initial value of N is 0, the 0th node is the root node of the abstract syntax tree; and N is an integer; S2: Take out the first node in the queue that is not empty and use it as the current node, and call the processing function corresponding to the current node; S3. Determine whether the Nth node is a leaf node of the abstract syntax tree; S4. If yes, exit the traversal process, output the sequential calling relationship between the processing functions of each node as the method call dependency relationship, and output the dependency relationship between the output parameters and input parameters of the processing function as the data dependency relationship; S5. Otherwise, take the child node of the Nth node as the N+1th node and return to S1.

3. The method according to claim 1, characterized in that The output result corresponding to the pollution data output at the outlet includes performance characteristics and processing results corresponding to the pollution data; wherein the performance characteristics are characteristic information reflecting the propagation path.

4. The method according to claim 3, characterized in that The determining whether the output result obtained at the exit matches the vulnerability detection rule includes: Matching the processing results in the output results with vulnerability detection rules of various attack modes of corresponding vulnerabilities; If the processing result matches the vulnerability detection rule of at least one attack mode, then the propagation path corresponding to the performance feature in the output result has a vulnerability corresponding to the at least one attack mode.

5. The method according to claim 4, characterized in that Also includes: If the processing results obtained at each exit corresponding to each entry do not hit the vulnerability detection rule of any attack mode of the corresponding vulnerability point, then the application is a normal application.

6. The method according to claim 1, characterized in that Also includes: If there is a vulnerability in the propagation path corresponding to the output result, a vulnerability exploitation path diagram is generated, and vulnerability repair suggestions are generated; An alarm message is generated according to the vulnerability exploitation path map and the vulnerability repair suggestion, and the alarm message is pushed to an operation and maintenance personnel so that the operation and maintenance personnel can repair the vulnerability according to the vulnerability exploitation path map and the vulnerability repair suggestion.

7. The method according to claim 1, characterized in that The lexical and grammatical analysis of the original code of the application program to obtain equivalent intermediate representation data includes: Scan the classes, functions, objects, variables, comments, grammatical keywords and regular expressions in the application, mark the grammar in the application and the code start segment and code end segment of the application, perform grammatical analysis on the application according to the grammatical rules of the text type of the application, express the grammatical features of the application through context-associated grammar, obtain key elements in the application, and form the equivalent intermediate representation data with the key elements.

8. An application vulnerability detection device based on taint analysis, characterized in that: include: A first analysis module is configured to perform lexical and syntactic analysis on the original code of the application program to obtain equivalent intermediate representation data; wherein the equivalent intermediate representation data includes an abstract syntax tree formed by key elements in the original code; A traversal analysis module, configured to traverse the abstract syntax tree to extract data dependencies and method call dependencies, and form a propagation path tree corresponding to the application program from the data dependencies and the method call dependencies; An entry marking module is used to collect the vulnerabilities of the application, mark the vulnerabilities as the entry of polluted data, and set propagation rules for the polluted data during the propagation process from the entry to the exit; a data propagation module, configured to input the contaminated data into the inlet, so that the contaminated data propagates along each propagation path in the propagation path tree according to the propagation rule, and obtain an output result at each exit of each propagation path; The result matching module is used to determine whether the output result obtained at the exit matches the vulnerability detection rule; if so, it is determined that a vulnerability exists in the propagation path corresponding to the output result.

9. A computer-readable storage medium, characterized in that A computer program is stored thereon, and when the computer program is executed in a computer, the computer is caused to execute the method according to any one of claims 1 to 7.

10. A computing device, characterized in that The method comprises a memory and a processor, wherein the memory stores executable code, and when the processor executes the executable code, the method according to any one of claims 1 to 7 is implemented.

Images