Java framework automatic vulnerability mining construction method based on static analysis

Abstract

The invention provides a static analysis-based Java framework automatic vulnerability mining construction method, which is used for improving the application security test efficiency of Java framework development and solving the problems of low vulnerability mining efficiency and accuracy while time and labor are wasted by manpower. According to the construction method, multiple static analysis technologies are combined to perform static analysis on codes, vulnerability points which possibly exist are mined, then an automatic verification technology and a Fuzz fuzzy test technology are performed to perform dynamic verification on accessibility and availability of the vulnerability points, and finally full-process automation of automatic mining and verification of Java framework vulnerabilities is realized.

Description

Technical Field

[0001] The invention belongs to the technical field of network security, and in particular relates to a Java framework automatic vulnerability discovery construction method based on static analysis. Background Art

[0002] Before preparing for the official launch of a website, conducting a comprehensive security audit is an indispensable step to ensure system robustness and user data security. Traditional source code audits rely on manual analysis by security professionals to identify potential security issues through empirical methods such as building vulnerability verification messages. However, this method is relatively inefficient, has limited coverage, and is costly.

[0003] In order to improve the efficiency and coverage of source code auditing, it is urgent to introduce an automated source code analysis system that fully utilizes advanced program analysis technology to traverse the code and actively detect possible security vulnerabilities in the source code. This system should also have the ability to generate verification cases to verify vulnerability exploitation, thereby reducing the false positive rate and achieving the goal of efficiently discovering various security vulnerabilities on the website.

[0004] This comprehensive auditing approach not only improves the overall security of the website code and reduces potential security risks, but also helps ensure the confidentiality and integrity of user data. By introducing an automated source code analysis system, we can not only detect potential threats faster, but also reduce the burden of manual auditing, ensuring that the website can provide more secure and reliable services after it is officially launched. Summary of the invention

[0005] The purpose of the present invention is to address the deficiencies of the prior art and provide a Java framework automated vulnerability discovery construction method based on static analysis.

[0006] The objective of the present invention is to achieve the following technical solution: a Java framework automated vulnerability discovery construction method based on static analysis, specifically comprising the following steps:

[0007] (1) Restore and analyze the original Java framework code;

[0008] The step (1) specifically includes the following sub-steps:

[0009] (1.1) Construct a sample set {C} containing M Java code samples to be analyzed: {C} = {c1, c2, …, c i ,…,c M}, where c i is the i-th Java code sample to be analyzed;

[0010] (1.2) For each Java code sample c to be analyzed in the sample set {C}i Perform decompilation analysis to obtain a sample set {C′} of analyzable Java code samples: {C′} = {c1′, c′2, …, c i ′,…,c′ M}; The decompilation analysis process is as follows: if sample c i If it is a compiled code, the decompilation technology is used to restore the sample c i , get the analyzable Java code sample c i ′; otherwise, sample c i This is the analyzable Java code sample c i ′;

[0011] (2) Performing automated batch analysis on the sample set {C′} of analyzable Java code samples to obtain a set of analysis results {A};

[0012] The step (2) specifically includes the following sub-steps:

[0013] (2.1) Construct a dataset {R} containing N static analysis rules: {R} = {r1, r2, …, r j ,…,r N}, where rj is the jth static analysis rule;

[0014] (2.2) Use the dataset {R} to automatically batch analyze the sample set {C′} of analyzable Java code samples, extract valid information, and obtain the analysis result set {A}: {A} = {a1, a2, …, a i ,…,a M}, where a i is the ith analyzable Java code sample c i ′The result after automated analysis of the dataset {R};

[0015] (3) Perform verification operations on the analysis result set {A};

[0016] The step (3) specifically includes the following sub-steps:

[0017] (3.1) Construct the PoC automated verification set {P} based on the analysis result set {A}: {P} = {p1, p2, ..., p k ,…,p K}, where p k Indicates automatic generation of L k The validation set of PoC validation samples, Any PoC verification sample Including vulnerability types Request header information Request method and request body information

[0018] (3.2) Use the PoC automated verification set {P} to analyze the analyzable Java code sample c i 'Perform automated vulnerability verification and obtain an automated verification result set {R};

[0019] (4) Perform secondary verification on the analysis result set {A} using the Fuzz testing technology to obtain the secondary verification result set {R′};

[0020] (5) The automated verification result set {R} is combined with the secondary verification result set {R′} to obtain the final automated verification result set {F}.

[0021] Furthermore, the decompilation technology includes d-cli, tomcat-jasper and Lombok annotation equivalent removal technology.

[0022] Furthermore, the automated batch analysis specifically includes BytecodeDL, Tabby, CodeQL or Datalog technology.

[0023] Furthermore, the static analysis rules are matching rules that fully cover various types of vulnerabilities based on taint tracking or information extraction rules for Java programs.

[0024] Furthermore, the multiple types of vulnerabilities include SQL injection, XSS attack, path traversal attack, remote code / command execution, XXE, JNDI attack or Fastjson attack vulnerability.

[0025] Furthermore, the information extracted by the information extraction rule of the Java program includes routing information, routing request method, parameter request method, parameter type and request header information.

[0026] Furthermore, the automated batch analysis includes the construction of a syntax tree database, automatic execution of static rule matching, and encryption and decryption extraction of static analysis results.

[0027] Furthermore, the validation set p k The construction method is to automatically generate L by arranging and combining Payload according to the parameter request extracted from the analysis result set {A} k PoC verification samples.

[0028] Furthermore, the automated vulnerability verification is specifically as follows:

[0029] The PoC stored in Yaml format is automatically converted into an Http request message, sent to the Java running program for verification, and the final verification result is automatically generated based on the returned result.

[0030] Furthermore, the secondary verification using Fuzz testing technology is specifically as follows:

[0031] Determine the Fuzz insertion location based on the static analysis results, construct Crash through fuzz testing, and generate and verify PoC based on the Crash content.

[0032] The beneficial effects of the present invention are: through the code recovery technology, the compiled code can still be analyzed, and at the same time, a variety of advanced static analysis technologies are used to audit and analyze the code, so as to increase the discovery rate of vulnerabilities and key information. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] Figure 1 This is a flowchart of a static analysis-based Java framework automated vulnerability discovery construction method. DETAILED DESCRIPTION

[0034] In order to make the purpose, technical scheme and advantages of the present invention more clear, the present invention is further described in detail in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention, rather than all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0035] Example 1

[0036] like Figure 1 As shown, the present invention provides a Java framework automatic vulnerability discovery construction method based on static analysis, which specifically includes the following steps:

[0037] (1) Restore and analyze the original Java framework code.

[0038] The step (1) specifically includes the following sub-steps:

[0039] (1.1) Construct a sample set {C} containing M Java code samples to be analyzed: {C} = {c1, c2, …, c i ,…,c M}, where c i is the i-th Java code sample to be analyzed.

[0040] (1.2) For each Java code sample c to be analyzed in the sample set {C} iPerform decompilation analysis to obtain a sample set {C′} of analyzable Java code samples: {C′} = {c1′, c′2, …, c i ′,…,c′ M}; The decompilation analysis process is as follows: if sample c i If it is a compiled code, the decompilation technology is used to restore the sample c i , get the analyzable Java code sample c i ', the decompilation technology includes d-cli, tomcat-jasper and Lombok annotation equivalent removal technology; otherwise, sample c i This is the analyzable Java code sample c i ′.

[0041] (2) Perform automated batch analysis on the sample set {C′} of analyzable Java code samples using technologies such as BytecodeDL, Tabby, CodeQL, Datalog, etc. to obtain a set of analysis results {A}.

[0042] The step (2) specifically includes the following sub-steps:

[0043] (2.1) Construct a dataset {R} containing N static analysis rules: {R} = {r1, r2, …, r j ,…,r N}, where rj is the jth static analysis rule. Any static analysis rule r j It contains matching rules that fully cover various types of vulnerabilities based on taint tracking and information extraction rules for Java programs, etc. Supported vulnerability types include SQL injection, XSS attack, path traversal attack, remote code / command execution, XXE and other mainstream attacks, and can build an anti-connection platform to accurately identify JNDI attack, Fastjson attack and other attacks.

[0044] The information extracted by the information extraction rule of the Java program includes routing information, routing request method, parameter request method, parameter type, request header and the like.

[0045] (2.2) Use the dataset {R} to automatically batch analyze the sample set {C′} of analyzable Java code samples, construct a syntax tree database, automatically execute static rule matching, encrypt and decrypt static analysis results, extract valid information, and obtain the analysis result set {A}: {A} = {a1, a2, …, a i ,…,a M}, where a i For the ith Java code sample c i′The result after automatic analysis of the static analysis rule matching set.

[0046] (3) Perform verification operations on the analysis result set {A}.

[0047] The step (3) specifically includes the following sub-steps:

[0048] (3.1) Construct the PoC automated verification set {P} based on the analysis result set {A}: {P} = {p1, p2, ..., p k ,…,p K}, where p k Indicates automatic generation of L k The verification set of the PoC verification samples is as follows: according to the parameter request method extracted from the analysis result set {A}, the Payload is automatically generated by permutation and combination. k PoC verification samples: Any PoC verification sample Including vulnerability types Request header information Request method and request body information

[0049] (3.2) Use the PoC automated verification set {P} to analyze the analyzable Java code sample c i 'Perform automated vulnerability verification: Use the PoC automated verification set P to automatically convert the Java code sample into an Http request message, send it to the Java running program for verification, and automatically generate an automated verification result set {R} based on the returned results.

[0050] (4) The analysis result set {A} is re-verified using the Fuzz fuzz testing technology. The specific steps of re-verification using the Fuzz fuzz testing technology are as follows: the Fuzz insertion location is determined based on the static analysis results, the Crash is constructed using the fuzz test, and the PoC is generated and verified based on the Crash content to obtain the re-verification result set {R′}.

[0051] (5) The automated verification result set {R} is combined with the secondary verification result set {R′} to obtain the final automated verification result set {F}.

[0052] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A Java framework automated vulnerability discovery construction method based on static analysis, characterized in that: The specific steps include: (1) Restore and analyze the original Java framework code; The step (1) specifically includes the following sub-steps: (1.1) Construct a sample set {C} containing M Java code samples to be analyzed: {C} = {c1, c2, …, c i ,…,c M }, where c i is the i-th Java code sample to be analyzed; (1.2) For each Java code sample c to be analyzed in the sample set {C} i Perform decompilation analysis to obtain a sample set {C′} of analyzable Java code samples: {C′} = {c1′, c′2, …, c i ′,…,c′ M }; The decompilation analysis process is as follows: if sample c i If it is a compiled code, the decompilation technology is used to restore the sample c i , get the analyzable Java code sample c i ′; otherwise, sample c i That is, the analyzable Java code sample c i ′; (2) Performing automated batch analysis on the sample set {C′} of analyzable Java code samples to obtain a set of analysis results {A}; The step (2) specifically includes the following sub-steps: (2.1) Construct a dataset {R} containing N static analysis rules: {R} = {r1, r2, …, r j ,…,r N }, where rj is the jth static analysis rule; (2.2) Use the dataset {R} to automatically batch analyze the sample set {C′} of analyzable Java code samples, extract valid information, and obtain the analysis result set {A}: {A} = {a1, a2, …, a i ,…,a M }, where a i is the ith analyzable Java code sample c i ′The result after automated analysis of the dataset {R}; (3) Perform verification operations on the analysis result set {A}; The step (3) specifically includes the following sub-steps: (3.1) Construct the PoC automated verification set {P} based on the analysis result set {A}: {P} = {p1, p2, ..., p k ,…,p K }, where p k Indicates automatic generation of L k The validation set of PoC validation samples, Any PoC verification sample Including vulnerability types Request header information Request method and request body information (3.2) Use the PoC automated verification set {P} to analyze the analyzable Java code sample c i 'Perform automated vulnerability verification and obtain an automated verification result set {R}; (4) Perform secondary verification on the analysis result set {A} using the Fuzz testing technology to obtain the secondary verification result set {R′}; (5) The automated verification result set {R} is combined with the secondary verification result set {R′} to obtain the final automated verification result set {F}.

2. According to the static analysis-based Java framework automated vulnerability discovery construction method of claim 1, it is characterized in that: The decompilation technology includes d-cli, tomcat-jasper and Lombok annotation equivalent removal technology.

3. According to the static analysis-based Java framework automated vulnerability discovery construction method of claim 1, it is characterized in that: The automated batch analysis specifically includes BytecodeDL, Tabby, CodeQL or Datalog technology.

4. According to the static analysis-based Java framework automated vulnerability discovery construction method of claim 1, it is characterized in that: The static analysis rules are matching rules that fully cover various types of vulnerabilities based on taint tracking or information extraction rules for Java programs.

5. According to the static analysis-based Java framework automated vulnerability discovery construction method of claim 4, it is characterized in that: The various types of vulnerabilities include SQL injection, XSS attack, path traversal attack, remote code / command execution, XXE, JNDI attack or Fastjson attack vulnerability.

6. The method for constructing a Java framework automatic vulnerability discovery based on static analysis according to claim 4 is characterized in that: The information extracted by the information extraction rule of the Java program includes routing information, routing request method, parameter request method, parameter type and request header information.

7. The method for constructing a Java framework automatic vulnerability discovery based on static analysis according to claim 1, characterized in that: The automated batch analysis includes the construction of a syntax tree database, automatic execution of static rule matching, and encryption and decryption extraction of static analysis results.

8. The method for constructing a Java framework automatic vulnerability discovery based on static analysis according to claim 1, characterized in that: The validation set p k The construction method is to automatically generate L by arranging and combining Payload according to the parameter request extracted from the analysis result set {A} k PoC verification samples.

9. The method for constructing a Java framework automatic vulnerability discovery based on static analysis according to claim 1, characterized in that: The automated vulnerability verification is specifically as follows: The PoC stored in Yaml format is automatically converted into an Http request message, sent to the Java running program for verification, and the final verification result is automatically generated based on the returned result.

10. The method for constructing a Java framework automatic vulnerability discovery based on static analysis according to claim 1, characterized in that: The secondary verification using Fuzz testing technology is specifically as follows: Determine the Fuzz insertion location based on the static analysis results, construct Crash through fuzz testing, and generate and verify PoC based on the Crash content.

Images