A static analysis-based automatic vulnerability discovery construction method for Java framework

Abstract

The application provides a Java framework automatic vulnerability discovery construction method based on static analysis, which is used for improving the application security test efficiency of Java framework development, and solves the problems of time-consuming and laborious manual work, low vulnerability discovery efficiency and low accuracy rate. The construction method uses various static analysis technologies to jointly perform static analysis on the code, discovers possible vulnerability points, then performs dynamic verification reachability and exploitability of the vulnerability points through automatic verification technology and Fuzz fuzz testing technology, and finally realizes the full-process automation of automatic mining and verification of Java framework vulnerabilities.

Description

Technical Field

[0001] The present invention belongs to the technical field of network security, and in particular relates to a static analysis-based Java framework automatic vulnerability discovery construction method. Background Art

[0002] Before preparing for a website's official launch, conducting a comprehensive security audit is an essential step to ensure system robustness and user data security. Traditional source code audits rely on manual analysis by security professionals, using empirical methods such as constructing vulnerability verification messages to identify potential security issues. However, this approach is relatively inefficient, has limited coverage, and is costly.

[0003] To improve the efficiency and coverage of source code audits, there is an urgent need to introduce an automated source code analysis system that leverages advanced program analysis techniques to traverse the code and proactively detect potential security vulnerabilities. This system should also be able to generate verification cases for vulnerability exploitation, thereby reducing false positives and achieving the goal of efficiently discovering various security vulnerabilities on websites.

[0004] This comprehensive auditing approach not only improves the overall security of the website's code and mitigates potential security risks, but also helps ensure the confidentiality and integrity of user data. By introducing an automated source code analysis system, we can not only detect potential threats more quickly but also reduce the burden of manual auditing, ensuring that the website can provide a more secure and reliable service after its official launch. Summary of the Invention

[0005] The purpose of the present invention is to address the deficiencies of the existing technology and provide a Java framework automatic vulnerability discovery construction method based on static analysis.

[0006] The object of the present invention is to achieve the following technical solution: a Java framework automated vulnerability discovery construction method based on static analysis, specifically comprising the following steps:

[0007] (1) Restore and analyze the original Java framework code;

[0008] The step (1) specifically includes the following sub-steps:

[0009] (1.1) Construct a sample set {C} containing M Java code samples to be analyzed: {C} = {c1, c2, ..., c i ,…,c M}, where c i is the i-th Java code sample to be analyzed;

[0010] (1.2) For each Java code sample c to be analyzed in the sample set {C}i Perform decompilation analysis to obtain a sample set {C′} of analyzable Java code samples: {C′}={c1′,c′2,…,c i ′,…,c′ M}; The decompilation analysis process is as follows: if sample c i If it is a compiled code, use decompilation technology to restore the sample c i , get the analyzable Java code sample c i ′; otherwise, sample c i This is the analyzable Java code sample c i ';

[0011] (2) Performing automated batch analysis on the sample set {C′} of analyzable Java code samples to obtain the analysis result set {A};

[0012] The step (2) specifically includes the following sub-steps:

[0013] (2.1) Construct a dataset {R} containing N static analysis rules: {R} = {r1, r2, ..., r j ,…,r N}, where rj is the jth static analysis rule;

[0014] (2.2) Use the dataset {R} to automatically batch analyze the sample set {C′} of analyzable Java code samples, extract valid information, and obtain the analysis result set {A}: {A}={a1,a2,…,a i ,…,a M}, where a i For the i-th analyzable Java code sample c i 'The results after automated analysis of the dataset {R};

[0015] (3) Perform verification operations on the analysis result set {A};

[0016] The step (3) specifically includes the following sub-steps:

[0017] (3.1) Construct the PoC automated verification set {P} based on the analysis result set {A}: {P} = {p1, p2, ..., p k ,…,p K}, where p k Indicates automatic generation of L k The validation set of PoC validation samples, Any PoC verification sample Including vulnerability types Request header information Request method and request body information

[0018] (3.2) Use the PoC automated verification set {P} to analyze the Java code sample c i 'Perform automated vulnerability verification and obtain the automated verification result set {R};

[0019] (4) Perform secondary verification on the analysis result set {A} using the Fuzz testing technology to obtain the secondary verification result set {R′};

[0020] (5) The automated verification result set {R} is merged with the secondary verification result set {R′} to obtain the final automated verification result set {F}.

[0021] Furthermore, the decompilation technology includes d-cli, tomcat-jasper and Lombok annotation equivalent removal technology.

[0022] Furthermore, the automated batch analysis specifically includes BytecodeDL, Tabby, CodeQL or Datalog technology.

[0023] Furthermore, the static analysis rules are matching rules that fully cover multiple types of vulnerabilities based on taint tracking or information extraction rules for Java programs.

[0024] Furthermore, the multiple types of vulnerabilities include SQL injection, XSS attack, path traversal attack, remote code / command execution, XXE, JNDI attack or Fastjson attack vulnerability.

[0025] Furthermore, the information extracted by the information extraction rule of the Java program includes routing information, routing request method, parameter request method, parameter type and request header information.

[0026] Furthermore, the automated batch analysis includes the construction of a syntax tree database, automatic execution of static rule matching, and encryption and decryption extraction of static analysis results.

[0027] Furthermore, the validation set p k The construction method is to automatically generate L by permuting and combining Payload according to the parameter request extracted from the analysis result set {A} k PoC verification samples.

[0028] Furthermore, the automated vulnerability verification is specifically as follows:

[0029] The PoC stored in YAML format is automatically converted into an Http request message, sent to the Java running program for verification, and the final verification result is automatically generated based on the returned result.

[0030] Furthermore, the secondary verification using Fuzz testing technology is specifically as follows:

[0031] Determine the Fuzz insertion location based on the static analysis results, construct Crash through fuzz testing, and generate and verify PoC based on the Crash content.

[0032] The beneficial effects of the present invention are: through code recovery technology, the compiled code can still be analyzed, and at the same time, a variety of advanced static analysis technologies are used to audit and analyze the code, so as to increase the discovery rate of vulnerabilities and key information. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] Figure 1 This is a flowchart of a static analysis-based Java framework automated vulnerability discovery construction method. DETAILED DESCRIPTION

[0034] In order to make the purpose, technical solutions and advantages of the present invention more clearly understood, the present invention is further described in detail with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to illustrate the present invention, rather than to represent all embodiments. All other embodiments obtained by persons of ordinary skill in the art based on the embodiments of the present invention without creative work are within the scope of protection of the present invention.

[0035] Example 1

[0036] like Figure 1 As shown, the present invention provides a Java framework automatic vulnerability discovery construction method based on static analysis, which specifically includes the following steps:

[0037] (1) Restore and analyze the original Java framework code.

[0038] The step (1) specifically includes the following sub-steps:

[0039] (1.1) Construct a sample set {C} containing M Java code samples to be analyzed: {C} = {c1, c2, ..., c i ,…,c M}, where c i is the i-th Java code sample to be analyzed.

[0040] (1.2) For each Java code sample c to be analyzed in the sample set {C} iPerform decompilation analysis to obtain a sample set {C′} of analyzable Java code samples: {C′}={c1′,c′2,…,c i ′,…,c′ M}; The decompilation analysis process is as follows: if sample c i If it is a compiled code, use decompilation technology to restore the sample c i , get the analyzable Java code sample c i ', the decompilation technology includes d-cli, tomcat-jasper and Lombok annotation equivalent removal technology; otherwise, sample c i This is the analyzable Java code sample c i ′.

[0041] (2) The sample set {C′} of analyzable Java code samples is automatically batch analyzed using technologies such as BytecodeDL, Tabby, CodeQL, Datalog, etc., to obtain the analysis result set {A}.

[0042] The step (2) specifically includes the following sub-steps:

[0043] (2.1) Construct a dataset {R} containing N static analysis rules: {R} = {r1, r2, ..., r j ,…,r N}, where rj is the jth static analysis rule. Any static analysis rule r j It includes comprehensive matching rules for various vulnerability types based on taint tracking, as well as information extraction rules for Java programs. Supported vulnerability types include SQL injection, XSS attacks, path traversal attacks, remote code / command execution, XXE, and other mainstream attacks. It also provides an anti-connection platform for accurate identification of JNDI attacks, Fastjson attacks, and more.

[0044] The information extracted by the information extraction rule of the Java program includes routing information, routing request method, parameter request method, parameter type, request header and the like.

[0045] (2.2) Using the dataset {R}, we automatically batch analyze the sample set {C′} of analyzable Java code samples, construct a syntax tree database, automatically execute static rule matching, encrypt and decrypt static analysis results, extract valid information, and obtain the analysis result set {A}: {A} = {a1, a2, …, a i ,…,a M}, where a i For the i-th Java code sample c i′The result after automated analysis of the static analysis rule matching set.

[0046] (3) Perform verification operations on the analysis result set {A}.

[0047] The step (3) specifically includes the following sub-steps:

[0048] (3.1) Construct the PoC automated verification set {P} based on the analysis result set {A}: {P} = {p1, p2, ..., p k ,…,p K}, where p k Indicates automatic generation of L k The verification set of the PoC verification samples is as follows: according to the parameter request extracted from the analysis result set {A}, the Payload is automatically generated by permutation and combination. k PoC verification samples: Any PoC verification sample Including vulnerability types Request header information Request method and request body information

[0049] (3.2) Use the PoC automated verification set {P} to analyze the Java code sample c i 'Perform automated vulnerability verification: Use the PoC automated verification set P to automatically convert the Java code sample into an Http request message, send it to the Java running program for verification, and automatically generate the automated verification result set {R} based on the returned results.

[0050] (4) The analysis result set {A} is secondary verified using the Fuzz fuzz testing technology. The secondary verification using the Fuzz fuzz testing technology is as follows: the Fuzz insertion position is determined according to the static analysis results, the Crash is constructed by fuzz testing, and the PoC is generated and verified according to the Crash content to obtain the secondary verification result set {R′}.

[0051] (5) The automated verification result set {R} is merged with the secondary verification result set {R′} to obtain the final automated verification result set {F}.

[0052] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A Java framework automated vulnerability discovery construction method based on static analysis, characterized in that: The specific steps include: (1) Restore and analyze the original Java framework code; The step (1) specifically includes the following sub-steps: (1.1) Construct a sample set {C} containing M Java code samples to be analyzed: {C} = {c1, c2, ..., c i ,…,c M }, where c i is the i-th Java code sample to be analyzed; (1.2) For each Java code sample c to be analyzed in the sample set {C} i Perform decompilation analysis to obtain a sample set {C′} of analyzable Java code samples: {C′}={c1′,c′2,…,c i ′,…,c′ M }; The decompilation analysis process is as follows: if sample c i If it is a compiled code, use decompilation technology to restore the sample c i , get the analyzable Java code sample c i ′; otherwise, sample c i This is the analyzable Java code sample c i '; (2) Performing automated batch analysis on the sample set {C′} of analyzable Java code samples to obtain the analysis result set {A}; The step (2) specifically includes the following sub-steps: (2.1) Construct a dataset {R} containing N static analysis rules: {R} = {r1, r2, ..., r j ,…,r N }, where rj is the jth static analysis rule; (2.2) Use the dataset {R} to automatically batch analyze the sample set {C′} of analyzable Java code samples, extract valid information, and obtain the analysis result set {A}: {A}={a1,a2,…,a i ,…,a M }, where a i For the i-th analyzable Java code sample c i 'The results after automated analysis of the dataset {R}; (3) Perform verification operations on the analysis result set {A}; The step (3) specifically includes the following sub-steps: (3.1) Construct the PoC automated verification set {P} based on the analysis result set {A}: {P} = {p1, p2, ..., p k ,…,p K }, where p k Indicates automatic generation of L k The validation set of PoC validation samples, Any PoC verification sample Including vulnerability types Request header information Request method and request body information (3.2) Use the PoC automated verification set {P} to analyze the Java code sample c i 'Perform automated vulnerability verification and obtain the automated verification result set {R}; (4) Perform secondary verification on the analysis result set {A} using the Fuzz testing technology to obtain the secondary verification result set {R′}; (5) The automated verification result set {R} is merged with the secondary verification result set {R′} to obtain the final automated verification result set {F}.

2. The method for constructing a Java framework automated vulnerability discovery system based on static analysis according to claim 1, characterized in that: The decompilation technology includes d-cli, tomcat-jasper and Lombok annotation equivalent removal technology.

3. The method for constructing a Java framework automated vulnerability discovery based on static analysis according to claim 1, characterized in that: The automated batch analysis specifically includes BytecodeDL, Tabby, CodeQL or Datalog technology.

4. The method for constructing a Java framework automated vulnerability discovery based on static analysis according to claim 1, characterized in that: The static analysis rules are matching rules that fully cover various types of vulnerabilities based on taint tracking or information extraction rules for Java programs.

5. The method for constructing a Java framework automated vulnerability discovery based on static analysis according to claim 4, characterized in that: The various types of vulnerabilities include SQL injection, XSS attacks, path traversal attacks, remote code / command execution, XXE, JNDI attacks or Fastjson attacks.

6. The method for constructing a Java framework automated vulnerability discovery based on static analysis according to claim 4, characterized in that: The information extracted by the information extraction rule of the Java program includes routing information, routing request method, parameter request method, parameter type and request header information.

7. The method for constructing a Java framework automated vulnerability discovery based on static analysis according to claim 1, characterized in that: The automated batch analysis includes the construction of a syntax tree database, automatic execution of static rule matching, and encryption and decryption extraction of static analysis results.

8. The method for constructing a Java framework automated vulnerability discovery system based on static analysis according to claim 1, characterized in that: The validation set p k The construction method is to automatically generate L by permuting and combining Payload according to the parameter request extracted from the analysis result set {A} k PoC verification samples.

9. The method for constructing a Java framework automated vulnerability discovery system based on static analysis according to claim 1, characterized in that: The automated vulnerability verification is specifically as follows: The PoC stored in YAML format is automatically converted into an Http request message, sent to the Java running program for verification, and the final verification result is automatically generated based on the returned result.

10. The method for constructing a Java framework automatic vulnerability discovery based on static analysis according to claim 1, characterized in that: The secondary verification using Fuzz testing technology is specifically as follows: Determine the Fuzz insertion location based on the static analysis results, construct Crash through fuzz testing, and generate and verify PoC based on the Crash content.

Images