System, method and device for detecting abnormal call chain and electronic equipment

Abstract

The invention provides a system, method and device for detecting an abnormal call chain and electronic equipment, and the system comprises a node analysis tree construction module, a logic relation graph construction module and an abnormal call automatic detection and dynamic verification module. The node analysis tree construction module is used for performing static analysis on source codes of the to-be-detected program through a node analysis model and integrating logic elements obtained through static analysis according to logic meanings to obtain a node analysis tree; the logic relation graph construction module is used for converting logic information contained in logic elements of a node analysis tree in the to-be-detected program into a logic relation to obtain a logic relation graph; and the abnormal call automatic detection and dynamic verification module is used for detecting and dynamically verifying the abnormal call chain in the to-be-detected program through the logic relation graph stored in the database. Through the method, the effect of accurately detecting the abnormal call chain can be achieved.

Description

Technical Field

[0001] The present application relates to the field of call chain anomaly detection, and in particular, to a system, method, device and electronic device for detecting abnormal call chains. Background Art

[0002] Currently, Python (a computer programming language) is executed by first compiling the source code into bytecode, and then the interpreter interprets the bytecode into machine code. In this process, if user input is not properly handled, malicious users may be able to execute unauthorized commands by injecting code. Python's deserialization vulnerability is also a common security risk, and attackers can exploit these vulnerabilities to execute malicious code.

[0003] In order to help developers identify and fix security vulnerabilities, the Python community has developed a variety of static analysis tools, among which Bandit (a security vulnerability detection tool) is a security vulnerability detection tool specifically for Python code. Bandit can scan Python code and identify common security issues, such as hard-coded passwords, SQL (Structured Query Language) injections, unsafe function calls, etc. But it also has some limitations. It may not be able to detect all types of security vulnerabilities, especially those complex vulnerabilities that require contextual understanding; at the same time, Bandit may also generate false positives, that is, mistakenly marking secure code as risky code.

[0004] In addition, the common problem of traditional point-based static analysis tools is that they can only detect the location of dangerous functions, but cannot completely detect the entire call chain. In other words, they cannot find the call entry of dangerous functions, nor can they determine whether the parameters passed into dangerous functions are user-controllable. These tasks still need to be done manually, which makes vulnerability detection inefficient.

[0005] Therefore, how to accurately detect abnormal call chains is a technical problem that needs to be solved. Summary of the invention

[0006] The purpose of the embodiments of the present application is to provide a method for detecting abnormal call chains. The technical solution of the embodiments of the present application can achieve the effect of accurately detecting abnormal call chains.

[0007] In the first aspect, an embodiment of the present application provides a system for detecting abnormal call chains, including a node analysis tree construction module, a logic relationship graph construction module and an abnormal call automatic detection and dynamic verification module; the node analysis tree construction module is used to perform static analysis on the source code of the program to be detected through a node analysis model, and integrate the logical elements obtained from the static analysis according to the logical meaning to obtain a node analysis tree; the logical relationship graph construction module is used to convert the logical information contained in the logical elements of the node analysis tree in the program to be detected into logical relationships to obtain a logical relationship graph; the abnormal call automatic detection and dynamic verification module is used to detect and dynamically verify the abnormal call chain in the program to be detected through the logical relationship graph stored in the database.

[0008] Optionally, the node analysis tree construction module is specifically used to:

[0009] Static analysis of source code and determination of logic meanings by a preset node analysis model, and initialization of various attribute values ​​of node analysis objects of the program to be detected, wherein the program to be detected includes a plurality of node analysis objects;

[0010] Traverse the abstract syntax tree, extract and fill each attribute value, and obtain multiple attribute values;

[0011] The abstract syntax tree is traversed, node analysis objects corresponding to multiple attribute values ​​are constructed into a node analysis tree, and the node analysis tree is stored in a file system in a preset format.

[0012] Optionally, the logic relationship diagram construction module is specifically used for:

[0013] Establish subordinate relationships between nodes at different levels of the node analysis tree, and set inclusion relationships between upper-level nodes and lower-level nodes;

[0014] Establish a sequential relationship between different nodes at the same level of the node analysis tree, and set a precedence relationship between the pre-order node and the post-order node;

[0015] Establishing a calling relationship between a calling node and a called node in a node analysis tree, and setting a pointing relationship between the caller and the called node;

[0016] The logical elements are regarded as points in the graph structure, and the logical relations are regarded as edges in the graph structure to form a logical relationship graph, wherein the logical relations include sequential relations, calling relations and subordinate relations.

[0017] Optionally, the abnormal call automatic detection and dynamic verification module is specifically used for:

[0018] Search the database for all nodes that contain target function calls and record the parameter passing process of all nodes;

[0019] Combined with the logical relationship diagram, and recursive search according to the parameter passing process, all abnormal call chains are obtained;

[0020] Compare and integrate all exception call chains with dynamic execution results to check whether all exception call chains lead to security defects.

[0021] In the second aspect, an embodiment of the present application provides a method for detecting abnormal call chains, including: performing static analysis on the source code of a program to be detected through a node analysis model, and integrating the logical elements obtained from the static analysis according to logical meanings to obtain a node analysis tree; converting the logical information contained in the logical elements of the node analysis tree in the program to be detected into logical relationships to obtain a logical relationship diagram; detecting and dynamically verifying abnormal call chains in the program to be detected through the logical relationship diagram stored in a database.

[0022] In the above embodiments, the present application detects abnormal call chains by combining dynamic and static semi-automatic methods. Compared with the traditional point-based static analysis method, the present application can detect and dynamically verify abnormal call chains in the program to be detected through the stored logic relationship diagram, and can not only locate dangerous functions in the source code, but also find abnormal call chains of dangerous functions and dynamically verify abnormal call chains. The effect of accurately detecting abnormal call chains can be achieved.

[0023] In some embodiments, the source code of the program to be tested is statically analyzed through a node analysis model, and the logical elements obtained by the static analysis are integrated according to the logical meaning to obtain a node analysis tree, including: statically analyzing the source code and judging the logical meaning through a preset node analysis model, and initializing each attribute value of the node analysis object of the program to be tested, wherein the program to be tested includes multiple node analysis objects; traversing the abstract syntax tree, extracting and filling each attribute value, and obtaining multiple attribute values; traversing the abstract syntax tree, constructing the node analysis objects corresponding to the multiple attribute values ​​into a node analysis tree, and storing the node analysis tree in a preset format in a file system.

[0024] In the above embodiment of the present application, a node analysis tree can be accurately constructed by initializing various attribute values ​​of the node analysis object of the program to be detected and multiple attribute values ​​of the abstract syntax tree.

[0025] In some embodiments, the logical information contained in the logical elements of the node analysis tree in the program to be detected is converted into logical relationships to obtain a logical relationship graph, including: establishing a subordinate relationship between nodes of different levels of the node analysis tree, and setting an inclusion relationship between the upper node and the lower node; establishing a sequence relationship between different nodes at the same level of the node analysis tree, and setting a precedence relationship between the pre-order node and the post-order node; establishing a calling relationship between the calling node and the called node of the node analysis tree, and setting a pointing relationship between the caller and the callee; using the logical elements as points in the graph structure and the logical relationships as edges in the graph structure to form a logical relationship graph, wherein the logical relationships include sequence relationships, calling relationships and subordinate relationships.

[0026] In the above-mentioned embodiment of the present application, after constructing multiple logical relationships between nodes of the node analysis tree, different relationships can be used as edges to accurately form a logical relationship graph.

[0027] In some embodiments, the abnormal call chain in the program to be detected is detected and dynamically verified through the logical relationship diagram stored in the database, including: searching the database for all nodes containing the target function call, and recording the parameter passing process of all nodes; combining the logical relationship diagram, and performing recursive search according to the parameter passing process to obtain all abnormal call chains; comparing and integrating all abnormal call chains with the dynamic execution results to check whether all abnormal call chains cause security defects.

[0028] In the above-mentioned embodiments of the present application, the entire call chain can be accurately detected and verified in combination with the storage logic relationship diagram.

[0029] In a third aspect, an embodiment of the present application provides a device for detecting an abnormal call chain, including:

[0030] An analysis module is used to perform static analysis on the source code of the program to be detected through a node analysis model, and integrate the logical elements obtained by the static analysis according to the logical meaning to obtain a node analysis tree;

[0031] A conversion module, used for converting the logic information contained in the logic elements of the node analysis tree in the program to be detected into a logical relationship to obtain a logical relationship diagram;

[0032] The detection module is used to detect and dynamically verify the abnormal call chain in the program to be detected through the logical relationship diagram stored in the database.

[0033] Optionally, the detection module is specifically used for:

[0034] Static analysis of source code and determination of logic meanings by a preset node analysis model, and initialization of various attribute values ​​of node analysis objects of the program to be detected, wherein the program to be detected includes a plurality of node analysis objects;

[0035] Traverse the abstract syntax tree, extract and fill each attribute value, and obtain multiple attribute values;

[0036] The abstract syntax tree is traversed, node analysis objects corresponding to multiple attribute values ​​are constructed into a node analysis tree, and the node analysis tree is stored in a file system in a preset format.

[0037] Optionally, the conversion module is specifically used for:

[0038] Establish subordinate relationships between nodes at different levels of the node analysis tree, and set inclusion relationships between upper-level nodes and lower-level nodes;

[0039] Establish a sequential relationship between different nodes at the same level of the node analysis tree, and set a precedence relationship between the pre-order node and the post-order node;

[0040] Establishing a calling relationship between a calling node and a called node in a node analysis tree, and setting a pointing relationship between the caller and the called node;

[0041] The logical elements are regarded as points in the graph structure, and the logical relations are regarded as edges in the graph structure to form a logical relationship graph, wherein the logical relations include sequential relations, calling relations and subordinate relations.

[0042] Optionally, the verification module is specifically used to:

[0043] Search the database for all nodes that contain target function calls and record the parameter passing process of all nodes;

[0044] Combined with the logical relationship diagram, and recursive search according to the parameter passing process, all abnormal call chains are obtained;

[0045] Compare and integrate all exception call chains with dynamic execution results to check whether all exception call chains lead to security defects.

[0046] In a fourth aspect, an embodiment of the present application provides an electronic device, comprising a processor and a memory, wherein the memory stores computer-readable instructions, and when the computer-readable instructions are executed by the processor, the steps in the method provided in the first aspect are executed.

[0047] In a fifth aspect, an embodiment of the present application provides a readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the steps in the method provided in the first aspect are executed.

[0048] Other features and advantages of the present application will be described in the following description, and partly become apparent from the description, or be understood by practicing the embodiments of the present application. The purpose and other advantages of the present application can be realized and obtained by the structures specifically pointed out in the written description, claims, and drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0049] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments of the present application will be briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0050] Figure 1 A schematic diagram of the structure of a system for detecting abnormal call chains provided in an embodiment of the present application;

[0051] Figure 2 A flowchart of a method for detecting abnormal call chains provided in an embodiment of the present application;

[0052] Figure 3 A schematic block diagram of a device for detecting abnormal call chains provided in an embodiment of the present application;

[0053] Figure 4 A schematic diagram of the structure of a device for detecting abnormal call chains provided in an embodiment of the present application. DETAILED DESCRIPTION

[0054] The technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the accompanying drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments. The components of the embodiments of the present application usually described and shown in the drawings here can be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of the present application provided in the drawings is not intended to limit the scope of the application claimed for protection, but merely represents the selected embodiments of the present application. Through the embodiments of the present application, all other embodiments obtained by those skilled in the art without making creative work belong to the scope of protection of the present application.

[0055] It should be noted that similar reference numerals and letters represent similar items in the following drawings, so once an item is defined in one drawing, it does not need to be further defined and explained in subsequent drawings. At the same time, in the description of this application, the terms "first", "second", etc. are only used to distinguish the description and cannot be understood as indicating or implying relative importance.

[0056] First, some terms involved in the embodiments of the present application are explained to facilitate understanding by those skilled in the art.

[0057] Bandit is a tool specifically used for Python source code security analysis. It uses the ast module in the Python standard library to parse Python source code into an abstract syntax tree, and uses the abstract syntax tree to find possible security issues.

[0058] Neo4j is an open source graph database that uses a graph model to store and query data. A graph database is a special type of database designed to process and store graph-structured data, where the graph consists of nodes and relationships. Neo4j is designed to handle the growing demand for data storage by using efficient graph data structures instead of traditional table designs.

[0059] Cypher is a declarative graph query language specifically designed for query and update operations on graph databases. It allows users to describe patterns in graphs through concise syntax without having to write complex query code. The design philosophy of Cypher is to allow users to focus more on business domain issues rather than how to write query code. This language is inspired by SQL, but is specifically designed for the characteristics of graph databases, making querying and updating graph data more efficient and intuitive.

[0060] A call chain refers to the calling relationship between different classes, functions or methods, and statements in the same program or software source code. A complete call chain should include the calling entry, the complete parameter passing process, and the final parameter processing function.

[0061] The present application is applied to the scenario of call chain anomaly detection. The specific scenario is to build a call chain anomaly detection system, through which the abnormal call chain is semi-automatically detected by combining dynamic and static methods.

[0062] Currently, Python (a computer programming language) first compiles the source code into bytecode when it is executed, and then the interpreter interprets the bytecode into machine code. In this process, if user input is not properly handled, malicious users may execute unauthorized commands by injecting code. Python's deserialization vulnerability is also a common security risk, and attackers can exploit these vulnerabilities to execute malicious code. In order to help developers identify and fix security vulnerabilities, the Python community has developed a variety of static analysis tools, among which Bandit (a security vulnerability detection tool) is a security vulnerability detection tool specifically for Python code. Bandit can scan Python code and identify common security issues such as hard-coded passwords, SQL (structured query language) injection, unsafe function calls, etc. But it also has some limitations. It may not detect all types of security vulnerabilities, especially those complex vulnerabilities that require contextual understanding; at the same time, Bandit may also generate false positives, that is, mistakenly marking secure code as risky code. In addition, the common problem of traditional point-based static analysis tools is that they can only detect the location of dangerous functions, but cannot completely detect the entire call chain. In other words, they cannot find the call entry of dangerous functions, nor can they determine whether the parameters passed into dangerous functions are user-controllable. These tasks still need to be done manually, which makes vulnerability detection inefficient.

[0063] To this end, the present application adopts a system for detecting abnormal call chains, including a node analysis tree construction module, a logic relationship diagram construction module and an abnormal call automatic detection and dynamic verification module; the node analysis tree construction module is used to statically analyze the source code of the program to be detected through a node analysis model, and integrate the logical elements obtained by the static analysis according to the logical meaning to obtain a node analysis tree; the logic relationship diagram construction module is used to convert the logical information contained in the logical elements of the node analysis tree in the program to be detected into a logical relationship to obtain a logical relationship diagram; the abnormal call automatic detection and dynamic verification module is used to detect and dynamically verify the abnormal call chain in the program to be detected through the logical relationship diagram stored in the database. Through this system, the effect of accurately detecting abnormal call chains can be achieved.

[0064] In the embodiment of the present application, the execution entity may be an abnormal call chain detection device in the abnormal call chain detection system. In actual applications, the abnormal call chain detection device may be an electronic device such as a terminal device and a server, which is not limited here.

[0065] Combine the following Figure 1 The system for detecting abnormal call chains in an embodiment of the present application is described in detail.

[0066] Please see Figure 1 , Figure 1 A schematic diagram of the structure of a system for detecting abnormal call chains provided in an embodiment of the present application is shown in FIG. Figure 1 The system for detecting abnormal call chains shown includes:

[0067] A node analysis tree construction module 110 , a logic relationship diagram construction module 120 and an abnormal call automatic detection and dynamic verification module 130 .

[0068] The node analysis tree construction module 110 is used to perform static analysis on the source code of the program to be tested through the node analysis model, and integrate the logical elements obtained from the static analysis according to the logical meaning to obtain a node analysis tree; the logic relationship graph construction module 120 is used to convert the logical information contained in the logic elements of the node analysis tree in the program to be tested into a logical relationship to obtain a logic relationship graph; the abnormal call automatic detection and dynamic verification module 130 is used to detect and dynamically verify the abnormal call chain in the program to be tested through the logic relationship graph stored in the database.

[0069] Among them, the call chain can be a call chain formed by a call instruction input by any user. Static analysis can be to scan the program code through lexical analysis, syntax analysis, control flow, data flow analysis and other technologies without actually executing the program, to verify whether the code meets the indicators such as standardization, security, reliability, maintainability, etc., and finally obtain a logical information. The logical information includes some words or phrases that can reflect the logical relationship, such as include and contain. Logical elements can represent some related logical information such as words, phrases, codes and symbols with logical information. Logical meaning represents the logical meaning represented by the logical element itself, and the importance of the logical element can be divided according to the logical meaning. Logical relations include sequential relations, call relations and subordinate relations. The database can be a graph database.

[0070] Optionally, the node analysis tree construction module 110 is specifically used for:

[0071] The source code is statically analyzed and the logical meaning is determined through a preset node analysis model, and each attribute value of the node analysis object of the program to be detected is initialized, wherein the program to be detected includes multiple node analysis objects; the abstract syntax tree is traversed, each attribute value is extracted and filled, and multiple attribute values ​​are obtained; the abstract syntax tree is traversed, the node analysis objects corresponding to the multiple attribute values ​​are constructed into a node analysis tree, and the node analysis tree is stored in a file system in a preset format.

[0072] Among them, the node analysis model can be a traditional tool for analyzing and understanding the importance and mutual relationship of nodes in complex systems. It is built through AST (abstract syntax tree). The model aggregates AST classes and sets multiple states or data attribute values ​​in the model to characterize the logical meaning and logical information in AST. The preset format can be json format, etc. The attribute values ​​include the type constant value of the node returned by this attribute, the name of the node returned by this attribute, and the value of the current node returned or set by this attribute, in the format of a string and other related attribute information. Traverse the abstract syntax tree, extract and fill in each attribute value, and obtain multiple attribute values. The attribute values ​​in the architecture can be automatically filled in by traversing the abstract syntax tree as the preset architecture to obtain multiple attribute values. The multiple attribute values ​​include all or part of the attribute values ​​in each attribute value.

[0073] Optionally, the logic relationship diagram construction module 120 is specifically used for:

[0074] A subordinate relationship is established between nodes at different levels of the node analysis tree, and an inclusion relationship is set between the upper node and the lower node; a sequence relationship is established between different nodes at the same level of the node analysis tree, and a precedence relationship is set between the pre-order node and the post-order node; a calling relationship is established between the calling node and the called node of the node analysis tree, and a pointing relationship is set between the caller and the callee; logical elements are taken as points in the graph structure, and logical relationships are taken as edges in the graph structure to form a logical relationship graph, wherein the logical relationship includes a sequence relationship, a calling relationship, and a subordinate relationship.

[0075] Among them, the inclusion relationship, for example, the upper node includes the lower node. The order relationship includes the pre-order node before the pre-order node. The call relationship includes the caller calling the callee.

[0076] Optionally, the abnormal call automatic detection and dynamic verification module 130 is specifically used for:

[0077] Search the database for all nodes that contain target function calls and record the parameter passing process of all nodes; combine with the logical relationship diagram and perform recursive search according to the parameter passing process to obtain all exception call chains; compare and integrate all exception call chains with dynamic execution results to check whether all exception call chains cause security defects.

[0078] also, Figure 1 The specific methods and steps performed by the system shown can be found in Figure 2 The method shown will not be described in detail here.

[0079] In the above Figure 1In the process shown, the present application uses a system for detecting abnormal call chains, including a node analysis tree construction module 110, a logic relationship diagram construction module 120, and an abnormal call automatic detection and dynamic verification module 130; the node analysis tree construction module 110 is used to statically analyze the source code of the program to be detected through a node analysis model, and integrate the logical elements obtained by the static analysis according to the logical meaning to obtain a node analysis tree; the logic relationship diagram construction module 120 is used to convert the logical information contained in the logical elements of the node analysis tree in the program to be detected into a logical relationship to obtain a logical relationship diagram; the abnormal call automatic detection and dynamic verification module 130 is used to detect and dynamically verify the abnormal call chain in the program to be detected through the logical relationship diagram stored in the database. Through this system, the effect of accurately detecting abnormal call chains can be achieved.

[0080] above Figure 1 A system for detecting abnormal call chains that can execute Figure 2 The method shown below is combined with Figure 2 The method for detecting abnormal call chains in an embodiment of the present application is described in detail.

[0081] Please see Figure 2 , Figure 2 A flowchart of a method for detecting abnormal call chains provided in an embodiment of the present application is shown in FIG. Figure 2 The method shown for detecting abnormal call chains includes:

[0082] Step 210: statically analyze the source code of the program to be detected using the node analysis model, and integrate the logical elements obtained from the static analysis according to the logical meaning to obtain a node analysis tree.

[0083] In some embodiments of the present application, the source code of the program to be tested is statically analyzed through a node analysis model, and the logical elements obtained by the static analysis are integrated according to the logical meaning to obtain a node analysis tree, including: statically analyzing the source code and judging the logical meaning through a preset node analysis model, and initializing each attribute value of the node analysis object of the program to be tested, wherein the program to be tested includes multiple node analysis objects; traversing the abstract syntax tree, extracting and filling each attribute value, and obtaining multiple attribute values; traversing the abstract syntax tree, constructing the node analysis objects corresponding to the multiple attribute values ​​into a node analysis tree, and storing the node analysis tree in a preset format in the file system.

[0084] In the above process, the present application can accurately construct a node analysis tree by initializing various attribute values ​​of the node analysis object of the program to be detected and multiple attribute values ​​of the abstract syntax tree.

[0085] Step 220: Convert the logic information contained in the logic elements of the node analysis tree in the program to be detected into a logic relationship to obtain a logic relationship diagram.

[0086] In some embodiments of the present application, the logical information contained in the logical elements of the node analysis tree in the program to be detected is converted into logical relationships to obtain a logical relationship graph, including: establishing a subordinate relationship between nodes of different levels of the node analysis tree, and setting an inclusion relationship between the upper node and the lower node; establishing a sequence relationship between different nodes at the same level of the node analysis tree, and setting a precedence relationship between the pre-order node and the post-order node; establishing a calling relationship between the calling node and the called node of the node analysis tree, and setting a pointing relationship between the caller and the callee; using the logical elements as points in the graph structure and the logical relationships as edges in the graph structure to form a logical relationship graph, wherein the logical relationships include sequence relationships, calling relationships and subordinate relationships.

[0087] In the above process, the present application can accurately form a logical relationship graph by constructing multiple logical relationships between nodes in the node analysis tree and using different relationships as edges.

[0088] Step 230: Detect and dynamically verify the abnormal call chain in the program to be detected through the logical relationship diagram stored in the database.

[0089] In some embodiments of the present application, the abnormal call chain in the program to be detected is detected and dynamically verified through the logical relationship diagram stored in the database, including: searching for all nodes containing the target function call in the database, and recording the parameter passing process of all nodes; combining the logical relationship diagram, and performing recursive search according to the parameter passing process to obtain all abnormal call chains; comparing and integrating all abnormal call chains with the dynamic execution results to check whether all abnormal call chains cause security defects.

[0090] In the above process, the present application can accurately detect and verify the entire call chain in combination with the stored logical relationship diagram.

[0091] In the above Figure 2In the process shown, the present application uses a method for detecting abnormal call chains, including: statically analyzing the source code of the program to be detected through a node analysis model, and integrating the logical elements obtained by the static analysis according to the logical meaning to obtain a node analysis tree; converting the logical information contained in the logical elements of the node analysis tree in the program to be detected into a logical relationship to obtain a logical relationship diagram; detecting and dynamically verifying the abnormal call chain in the program to be detected through the logical relationship diagram stored in the database. Through the semi-automatic detection of abnormal call chains by combining dynamic and static, compared with the traditional point-based static analysis method, the present application can detect and dynamically verify the abnormal call chain in the program to be detected through the stored node analysis tree and logical relationship diagram, which can not only locate the dangerous functions in the source code, but also search for the abnormal call chain of the dangerous function, and dynamically verify the abnormal call chain. The effect of accurately detecting abnormal call chains can be achieved.

[0092] Previous article Figure 2 Describes the method of detecting abnormal call chains. Figure 3-Figure 4 Describes a device for detecting abnormal call chains.

[0093] Please refer to Figure 3 , is a schematic block diagram of a device 300 for detecting abnormal call chains provided in an embodiment of the present application. The device 300 may be a module, program segment or code on an electronic device. The device 300 is similar to the above Figure 1 The method embodiment corresponds to and can be executed Figure 1 The various steps involved in the method embodiment and the specific functions of the device 300 can be found in the description below. To avoid repetition, the detailed description is appropriately omitted here.

[0094] Optionally, the device 300 includes:

[0095] An analysis module 310 is used to perform static analysis on the source code of the program to be detected through a node analysis model, and integrate the logical elements obtained by the static analysis according to the logical meaning to obtain a node analysis tree;

[0096] The conversion module 320 is used to convert the logic information contained in the logic elements of the node analysis tree in the program to be detected into a logic relationship to obtain a logic relationship diagram;

[0097] The detection module 330 is used to detect and dynamically verify the abnormal call chain in the program to be detected through the logical relationship diagram stored in the database.

[0098] Optionally, the detection module 310 is specifically used for:

[0099] The source code is statically analyzed and the logical meaning is determined through a preset node analysis model, and each attribute value of the node analysis object of the program to be detected is initialized, wherein the program to be detected includes multiple node analysis objects; the abstract syntax tree is traversed, each attribute value is extracted and filled, and multiple attribute values ​​are obtained; the abstract syntax tree is traversed, the node analysis objects corresponding to the multiple attribute values ​​are constructed into a node analysis tree, and the node analysis tree is stored in a file system in a preset format.

[0100] Optionally, the conversion module 320 is specifically used for:

[0101] A subordinate relationship is established between nodes at different levels of the node analysis tree, and an inclusion relationship is set between the upper node and the lower node; a sequence relationship is established between different nodes at the same level of the node analysis tree, and a precedence relationship is set between the pre-order node and the post-order node; a calling relationship is established between the calling node and the called node of the node analysis tree, and a pointing relationship is set between the caller and the callee; logical elements are taken as points in the graph structure, and logical relationships are taken as edges in the graph structure to form a logical relationship graph, wherein the logical relationship includes a sequence relationship, a calling relationship, and a subordinate relationship.

[0102] Optionally, the verification module 330 is specifically used for:

[0103] Search the database for all nodes that contain target function calls and record the parameter passing process of all nodes; combine with the logical relationship diagram and perform recursive search according to the parameter passing process to obtain all exception call chains; compare and integrate all exception call chains with dynamic execution results to check whether all exception call chains cause security defects.

[0104] In a fourth aspect, an embodiment of the present application provides an electronic device, comprising a processor and a memory, wherein the memory stores computer-readable instructions, and when the computer-readable instructions are executed by the processor, the steps in the method provided in the first aspect are executed.

[0105] Please refer to Figure 4 4 is a schematic block diagram of a device for detecting abnormal call chains provided in an embodiment of the present application. The device may include a memory 410 and a processor 420. Optionally, the device may also include: a communication interface 430 and a communication bus 440. The device is similar to the above Figure 2 The method embodiment corresponds to and can be executed Figure 2 The various steps involved in the method embodiment and the specific functions of the device can be found in the description below.

[0106] Specifically, the memory 410 is used to store computer-readable instructions.

[0107] Processor 420 is used to process the readable instructions stored in the memory and can execute Figure 2 The steps in the method.

[0108] The communication interface 430 is used for signaling or data communication with other node devices, for example, for communication with a server or a terminal, or for communication with other device nodes, but the embodiments of the present application are not limited thereto.

[0109] The communication bus 440 is used to realize direct connection and communication among the above components.

[0110] The communication interface 430 of the device in the embodiment of the present application is used to communicate signals or data with other node devices. The memory 410 can be a high-speed RAM memory or a non-volatile memory, such as at least one disk memory. The memory 410 can also be at least one storage device located away from the aforementioned processor. The memory 410 stores computer-readable instructions. When the computer-readable instructions are executed by the processor 420, the electronic device executes the aforementioned Figure 2 The method process shown. The processor 420 can be used on the device 300 and is used to perform the functions in the present application. Exemplarily, the above-mentioned processor 420 can be a general-purpose processor, a digital signal processor (Digital Signal Processor, DSP), an application-specific integrated circuit (Application Specific Integrated Circuit, ASIC), a field programmable gate array (Field Programmable Gate Array, FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, and the embodiments of the present application are not limited thereto.

[0111] The embodiment of the present application also provides a readable storage medium, when the computer program is executed by a processor, Figure 2 The method process in the method embodiment shown is executed by the electronic device.

[0112] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working process of the device described above can refer to the corresponding process in the aforementioned method, and will not be described in detail here.

[0113] In summary, the embodiment of the present application provides a system, method, device and electronic device for detecting abnormal call chains, the system includes a node analysis tree construction module, a logic relationship diagram construction module and an abnormal call automatic detection and dynamic verification module; the node analysis tree construction module is used to statically analyze the source code of the program to be detected through a node analysis model, and integrate the logical elements obtained by the static analysis according to the logical meaning to obtain a node analysis tree; the logic relationship diagram construction module is used to convert the logical information contained in the logical elements of the node analysis tree in the program to be detected into a logical relationship to obtain a logical relationship diagram; the abnormal call automatic detection and dynamic verification module is used to detect and dynamically verify the abnormal call chain in the program to be detected through the logical relationship diagram stored in the database. Through this system, the effect of accurately detecting abnormal call chains can be achieved.

[0114] In several embodiments provided in the present application, it should be understood that the disclosed devices and methods can also be implemented in other ways. The device embodiments described above are merely schematic. For example, the flowcharts and block diagrams in the accompanying drawings show the possible architecture, functions and operations of the devices, methods and computer program products according to multiple embodiments of the present application. In this regard, each box in the flowchart or block diagram can represent a module, a program segment or a part of a code, and the module, a program segment or a part of a code contains one or more executable instructions for implementing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two consecutive boxes can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flowchart, and the combination of boxes in the block diagram and / or flowchart can be implemented with a dedicated hardware-based system that performs a specified function or action, or can be implemented with a combination of dedicated hardware and computer instructions.

[0115] In addition, the functional modules in the various embodiments of the present application may be integrated together to form an independent part, or each module may exist separately, or two or more modules may be integrated to form an independent part.

[0116] If the functions are implemented in the form of software function modules and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application can be essentially or partly embodied in the form of a software product that contributes to the prior art. The computer software product is stored in a storage medium, including several instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0117] The above description is only an embodiment of the present application and is not intended to limit the scope of protection of the present application. For those skilled in the art, the present application may have various changes and variations. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application should be included in the scope of protection of the present application. It should be noted that similar reference numerals and letters represent similar items in the following drawings, so once an item is defined in one drawing, it does not need to be further defined and explained in the subsequent drawings.

[0118] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

[0119] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

Claims

1. A system for detecting abnormal call chains, characterized in that: include: Node analysis tree construction module, logic relationship diagram construction module and abnormal call automatic detection and dynamic verification module; The node analysis tree construction module is used to perform static analysis on the source code of the program to be detected through the node analysis model, and integrate the logical elements obtained by the static analysis according to the logical meaning to obtain the node analysis tree; The logic relationship diagram construction module is used to convert the logic information contained in the logic elements of the node analysis tree in the program to be detected into a logic relationship to obtain a logic relationship diagram; The abnormal call automatic detection and dynamic verification module is used to detect and dynamically verify the abnormal call chain in the program to be detected through the logical relationship diagram stored in the database.

2. The system according to claim 1, characterized in that The node analysis tree construction module is specifically used for: Static analysis of the source code and determination of the logical meaning by using the preset node analysis model, and initialization of various attribute values ​​of the node analysis object of the program to be detected, wherein the program to be detected includes a plurality of node analysis objects; Traversing the abstract syntax tree, extracting and filling each attribute value, and obtaining multiple attribute values; The abstract syntax tree is traversed, node analysis objects corresponding to the multiple attribute values ​​are constructed into the node analysis tree, and the node analysis tree is stored in a file system in a preset format.

3. The system according to claim 1 or 2, characterized in that: The logic relationship diagram construction module is specifically used for: Establishing subordinate relationships between nodes at different levels of the node analysis tree, and setting inclusion relationships between upper-level nodes and lower-level nodes; Establishing a sequence relationship between different nodes at the same level of the node analysis tree, and setting a precedence relationship between the pre-sequence node and the post-sequence node; Establishing a calling relationship between a calling node and a called node in the node analysis tree, and setting a pointing relationship between the caller and the called node; The logical elements are used as points in a graph structure, and the logical relationships are used as edges in the graph structure to form the logical relationship graph, wherein the logical relationships include sequential relationships, calling relationships, and subordinate relationships.

4. The system according to claim 1 or 2, characterized in that: The abnormal call automatic detection and dynamic verification module is specifically used for: Searching the database for all nodes that contain target function calls, and recording the parameter transfer process of all nodes; Combining the node analysis tree and the logic relationship diagram, and performing recursive search according to the parameter transfer process, to obtain all abnormal call chains; The entire exception call chain is compared and integrated with the dynamic execution result to check whether the entire exception call chain causes a security defect.

5. A method for detecting abnormal call chains, characterized in that: include: Static analysis is performed on the source code of the program to be tested through the node analysis model, and the logical elements obtained by the static analysis are integrated according to the logical meaning to obtain a node analysis tree; Converting the logic information contained in the logic elements of the node analysis tree in the program to be detected into a logic relationship to obtain a logic relationship diagram; The abnormal call chain in the program to be detected is detected and dynamically verified through the logical relationship diagram stored in the database.

6. The method according to claim 5, characterized in that The node analysis model is used to perform static analysis on the source code of the program to be detected, and the logical elements obtained by the static analysis are integrated according to the logical meaning to obtain a node analysis tree, including: Static analysis of the source code and determination of the logical meaning by using the preset node analysis model, and initialization of various attribute values ​​of the node analysis object of the program to be detected, wherein the program to be detected includes a plurality of node analysis objects; Traversing the abstract syntax tree, extracting and filling each attribute value, and obtaining multiple attribute values; The abstract syntax tree is traversed, node analysis objects corresponding to the multiple attribute values ​​are constructed into the node analysis tree, and the node analysis tree is stored in a file system in a preset format.

7. The method according to claim 5 or 6, characterized in that: The step of converting the logic information contained in the logic elements of the node analysis tree in the program to be detected into a logic relationship to obtain a logic relationship diagram includes: Establishing subordinate relationships between nodes at different levels of the node analysis tree, and setting inclusion relationships between upper-level nodes and lower-level nodes; Establishing a sequence relationship between different nodes at the same level of the node analysis tree, and setting a precedence relationship between the pre-sequence node and the post-sequence node; Establishing a calling relationship between a calling node and a called node in the node analysis tree, and setting a pointing relationship between the caller and the called node; The logical elements are used as points in a graph structure, and the logical relationships are used as edges in the graph structure to form the logical relationship graph, wherein the logical relationships include sequential relationships, calling relationships, and subordinate relationships.

8. The method according to claim 5 or 6, characterized in that: The detecting and dynamically verifying the abnormal call chain in the program to be detected by the logical relationship diagram stored in the database includes: Searching the database for all nodes that contain target function calls, and recording the parameter transfer process of all nodes; Combining the node analysis tree and the logic relationship diagram, and performing recursive search according to the parameter transfer process, to obtain all abnormal call chains; The entire exception call chain is compared and integrated with the dynamic execution result to check whether the entire exception call chain causes a security defect.

9. A device for detecting abnormal call chains, characterized in that: include: An analysis module is used to perform static analysis on the source code of the program to be detected through a node analysis model, and integrate the logical elements obtained by the static analysis according to the logical meaning to obtain a node analysis tree; A conversion module, used for converting the logic information contained in the logic elements of the node analysis tree in the program to be detected into a logical relationship to obtain a logical relationship diagram; The detection module is used to detect and dynamically verify the abnormal call chain in the program to be detected through the logical relationship diagram stored in the database.

10. An electronic device, characterized in that: include: A memory and a processor, wherein the memory stores computer-readable instructions, and when the computer-readable instructions are executed by the processor, the steps in the method according to any one of claims 5 to 8 are executed.

Images