Business logic vulnerability detection method and device

Abstract

The invention provides a business logic vulnerability detection method and device, and the method comprises the steps: carrying out the static analysis of a code file of a program, and generating a code file structure; obtaining data stream information in the code file according to the code file structure; according to a preset taint library, a code file structure and data flow information, analyzing the runtime behavior of the program to identify logic vulnerabilities of a plurality of code snippets in the program; according to the method, automatic scanning of the logic vulnerabilities can be realized, the false alarm rate of the logic vulnerabilities of each code snippet can be counted, and logic vulnerability scanning of the code snippets is stopped under the condition that the false alarm rate of the code snippets reaches the preset threshold value, so that the false alarm rate of the business logic vulnerability automatic detection system is lower, and the detection efficiency is improved. And the attack can be identified more accurately.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a business logic vulnerability detection method and device. Background Art

[0002] With the rapid development of information technology, software systems are becoming increasingly complex, and the iteration of application versions is accelerating. In this context of rapid development, the development level of developers varies, and the security issues of the business may not be considered carefully during the design and development process, resulting in common business logic vulnerabilities, such as horizontal and vertical unauthorized access.

[0003] At present, there are two main methods for detecting business logic vulnerabilities: one is to detect whether there are business logic vulnerabilities in the source code during the source code detection stage through tools such as static code analysis (SAST); the other is to discover existing business logic vulnerabilities through penetration testing and other means before the system goes online or during operation and maintenance, and make corresponding rectifications.

[0004] However, existing SAST tools have obvious limitations in the automated detection of business logic vulnerabilities. They often have difficulty in achieving efficient and accurate automated detection, and business logic vulnerabilities have always been a hot topic for Web applications. Due to the particularity of logic vulnerabilities, security personnel often need to collect and organize the implementation logic of various interfaces when analyzing business logic systems. This is not only a large workload, but the detection results may also have false positives and negatives, and it takes a long time to detect. Only some business logic vulnerabilities can be found, and the discovery of vulnerabilities is not comprehensive and systematic enough. Summary of the invention

[0005] The present invention provides a business logic vulnerability detection method and device, which are used to solve the defects in the prior art that the analysis of logic vulnerabilities relies on manual collection of the implementation logic of various interfaces, which is time-consuming and the discovery of logic vulnerabilities is not comprehensive enough.

[0006] The present invention provides a business logic vulnerability detection method, comprising: Perform static analysis on the program's code files and generate the code file structure; According to the code file structure, obtaining data flow information in the code file; Analyze the runtime behavior of the program according to a preset taint library, code file structure, and data flow information to identify logical vulnerabilities of multiple code fragments in the program; The false alarm rate of the logic vulnerability of each code segment is counted, and when the false alarm rate of the code segment reaches a preset threshold, the logic vulnerability scanning of the code segment is stopped.

[0007] According to a business logic vulnerability detection method provided by the present invention, a static analysis is performed on the code file of the program to generate a code file structure, which specifically includes: performing semantic and grammatical analysis on the code file of the program to generate an abstract syntax tree and a control flow graph of the program.

[0008] According to a business logic vulnerability detection method provided by the present invention, data flow information in the code file is obtained according to the code file structure, including: determining the variables in the code file, and obtaining the transmission direction and purification status of the variables according to the code file structure and the variables.

[0009] According to a business logic vulnerability detection method provided by the present invention, the taint library includes multiple taints, each taint represents a potential risk function; According to the preset taint library, code file structure and data flow information, the runtime behavior of the program is analyzed to identify the logic vulnerabilities of multiple code fragments in the program, including: For each code snippet in the program: based on the code file structure and data flow information, the taint is propagated from the source of the program to other parts of the program; if any variable in the program is marked as a taint, and the value of the variable is used in the parameter of a function, the function is determined to be a risky function, and the call of the function constitutes a logical vulnerability.

[0010] According to a business logic vulnerability detection method provided by the present invention, after analyzing the runtime behavior of the program according to a preset taint library, code file structure and data flow information, the method further includes: When a specific data flow or code pattern is identified, the code file of the program is analyzed to determine the program structure and logic; Based on the structure and logic of the program, analyze the program's unauthorized control process and identify potential unauthorized vulnerability points; Analyze the program logic of the potential unauthorized vulnerability point according to a preset unauthorized logic model, and determine the operation that leads to the unauthorized behavior according to the logic analysis result; wherein the unauthorized logic model is used to determine the program operation that leads to the unauthorized behavior; Based on the logic analysis results and a preset unauthorized logic attack model, the steps and targets of the unauthorized attack are determined, wherein the unauthorized logic attack model is used to describe how an attacker exploits an unauthorized vulnerability to attack.

[0011] According to a business logic vulnerability detection method provided by the present invention, the statistical false alarm rate of the logic vulnerability of each code fragment specifically includes: inputting the logic vulnerability of each code fragment into a pre-trained vulnerability judgment model to determine whether the logic vulnerability of each code fragment is a false alarm.

[0012] The present invention also provides a business logic vulnerability detection device, comprising: Static analysis module, used to perform static analysis on the program's code files and generate code file structures; A data flow analysis module, used for obtaining data flow information in the code file according to the code file structure; A taint analysis module, used to analyze the runtime behavior of the program according to a preset taint library, code file structure, and data flow information, so as to identify logical vulnerabilities of multiple code fragments in the program; The false alarm analysis module is used to count the false alarm rate of the logic vulnerability of each code segment, and stop scanning the logic vulnerability of the code segment when the false alarm rate of the code segment reaches a preset threshold.

[0013] The present invention also provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the business logic vulnerability detection method described in any one of the above methods is implemented.

[0014] The present invention also provides a non-transitory computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the business logic vulnerability detection method as described in any one of the above is implemented.

[0015] The present invention also provides a computer program product, including a computer program, wherein when the computer program is executed by a processor, the business logic vulnerability detection method described in any one of the above is implemented.

[0016] The business logic vulnerability detection method and device provided by the present invention generate a code file structure by statically analyzing the code file of the program; obtain data flow information in the code file according to the code file structure; analyze the runtime behavior of the program according to a preset taint library, code file structure and data flow information to identify logical vulnerabilities of multiple code fragments in the program, thereby not only realizing automatic scanning of logical vulnerabilities, but also being able to count the false alarm rate of logical vulnerabilities of each code fragment, and stopping logical vulnerability scanning of the code fragment when the false alarm rate of the code fragment reaches a preset threshold, so that the false alarm rate of the business logic vulnerability automatic detection system is lower and attacks can be identified more accurately. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] In order to more clearly illustrate the technical solutions in the present invention or the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0018] Figure 1 This is one of the flow charts of the business logic vulnerability detection method provided by the present invention.

[0019] Figure 2 This is the second flow chart of the business logic vulnerability detection method provided by the present invention.

[0020] Figure 3 It is a structural schematic diagram of the vulnerability automatic detection platform provided by the present invention.

[0021] Figure 4 This is the third flow chart of the business logic vulnerability detection method provided by the present invention.

[0022] Figure 5 It is a structural schematic diagram of the business logic vulnerability detection device provided by the present invention.

[0023] Figure 6 It is a structural schematic diagram of the electronic device provided by the present invention. DETAILED DESCRIPTION

[0024] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution of the present invention will be clearly and completely described below in conjunction with the drawings of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0025] In order to solve the problem that the analysis of logic vulnerabilities in the prior art relies on manually collecting the implementation logic of various excuses, which is time-consuming and the discovery of logic vulnerabilities is not comprehensive enough, and to realize automatic scanning of logic vulnerabilities and more accurately identify attacks, the method of the embodiment of the present invention sets up a business logic vulnerability detection platform, and sets up a static analysis layer, a data flow analysis layer, a taint analysis layer, and a false alarm analysis layer in the detection platform. Among them: Static analysis layer: responsible for analyzing the semantic and grammatical levels of code files, generating basic analysis structures such as abstract syntax trees and control flow graphs, and using SAST tools to analyze the security of application source code or binary files during the coding phase.

[0026] Data flow analysis layer: collects the variable transfer flow and variable purification status in the code as the basis for taint propagation analysis.

[0027] Taint analysis layer: configure the taint library, perform logical vulnerability determination based on the data flow information obtained by data flow analysis, and mainly analyze the dangerous parameters passed into the dangerous function.

[0028] False alarm analysis layer: Based on machine learning and call chain tracking, the false alarm rate of logical vulnerabilities in each code snippet is counted to reduce false alarms.

[0029] Combine the following Figure 1-Figure 4 A business logic vulnerability detection method according to an embodiment of the present invention is described.

[0030] The present invention provides a method for detecting business logic vulnerabilities. Figure 1 ,include: 101. Perform static analysis on the program's code files and generate the code file structure.

[0031] Among them, the static analysis layer in the business logic vulnerability detection platform of this embodiment is responsible for "understanding" the code files and completing the analysis at the semantic and grammatical levels, such as generating abstract syntax trees, generating control flow graphs of programs and other basic analysis structures.

[0032] A typical implementation method of the static analysis layer is to integrate the SAST tool in the existing technology to analyze the syntax, structure, process, interface, etc. of the source code or binary file of the application during the coding stage to discover security vulnerabilities in the program code.

[0033] Therefore, the main function of the static analysis layer is to analyze the code using compilation principles. The setting method is roughly the same as that of the compiler, that is, the code is decomposed and classified and rearranged according to its semantics.

[0034] 102. Obtain data flow information in the code file according to the code file structure.

[0035] This step is performed through the data flow analysis layer in the business logic vulnerability detection platform. The data flow analysis layer is mainly responsible for determining the variables in the code file, and collecting the transfer flow of the variables in the code and the purification of the variables according to the code file structure and variables.

[0036] Data flow analysis is the basis of taint propagation analysis. The more comprehensive and accurate the information it collects, the more accurate the subsequent taint propagation analysis will be. Therefore, based on the above static analysis layer's decomposition, classification and rearrangement of the code, the data flow analysis layer is mainly limited to the analysis of variables and some special function calls (such as system calls), while other function processes and parameter calls are generally not analyzed. The main core analysis process is similar to the principle of antivirus software, which is to determine whether there is a risk in the data flow of the variable.

[0037] 103. Analyze the runtime behavior of the program according to a preset taint library, code file structure, and data flow information to identify logical vulnerabilities of multiple code snippets in the program.

[0038] The taint analysis layer needs to configure a preset taint library, so as to compare and make vulnerability judgments according to a series of data flow information obtained during the data flow analysis process. The judgment is mainly based on the analysis of the dangerous parameters passed into the dangerous function, combined with some program information of the dangerous parameters during data flow analysis.

[0039] Therefore, the code file structure is obtained by decomposing and classifying the code through the static analysis layer, and the data flow information is obtained by analyzing the variables through the data flow analysis layer. On this basis, the taint analysis layer can smoothly analyze the function call to identify the logical vulnerabilities of multiple code fragments in the program.

[0040] The main core analysis of the taint analysis layer is to determine whether there is overflow, abnormal jump, etc. in the function call process.

[0041] 104. Count the false alarm rate of the logic vulnerabilities of each code segment, and when the false alarm rate of the code segment reaches a preset threshold, stop scanning the logic vulnerabilities of the code segment.

[0042] Step 104 is performed by the false alarm analysis layer of the business logic vulnerability detection platform. The false alarm analysis layer is mainly responsible for the false alarm optimization of deep compilation scanning results based on machine learning and call chain tracking, and does not repeat the scan after multiple false alarms are processed.

[0043] Generally, the false alarm analysis layer uses a more common machine learning model as a vulnerability judgment model to complete the pattern recognition function, and completes dynamic training of the vulnerability judgment model based on manual tuning during use.

[0044] Specifically, in a specific implementation scheme, the training process of the vulnerability judgment model includes: Data collection: First, you need to collect data for training and validating the model. This data may include historical scan results, known vulnerability cases, false positive cases, and relevant code context information.

[0045] Feature extraction: Extract features from the collected data. These features should be able to reflect the security properties of the code, such as code structure, data flow pattern, API usage, permission check, etc.

[0046] Model selection: Choose an appropriate machine learning algorithm, such as decision tree, support vector machine (SVM), neural network, or deep learning model, based on the nature of the problem and the characteristics of the data.

[0047] Train the model: Use labeled data (i.e. known true vulnerabilities and false positives) to train the model. The model learns features and patterns that distinguish between the two.

[0048] Validation and testing: Evaluate the performance of the model through cross-validation and independent test sets to ensure that the model has high accuracy and low false positive rate.

[0049] Dynamic training: In actual applications, the model can be dynamically updated and adjusted based on user feedback and emerging data to adapt to new vulnerability patterns and reduce false positives.

[0050] False positive tuning: Models may include specific tuning mechanisms for identifying and reducing false positives. For example, thresholds may be set to decide when a potential vulnerability is flagged as a false positive.

[0051] Contextual analysis: The model may analyze the code in conjunction with contextual information, such as the code’s business logic, user roles, and permissions, to improve recognition accuracy.

[0052] Ensemble learning: In some cases, ensemble learning methods can be used to combine the prediction results of multiple models to improve the overall recognition ability.

[0053] Continuous monitoring: The model continuously monitors new code and changes in real-world deployments, analyzing in real time or periodically to identify new vulnerabilities and false positives.

[0054] During the application phase, the logical vulnerability of each code snippet is input into the pre-trained vulnerability judgment model to determine whether the logical vulnerability of each code snippet is a false alarm.

[0055] In a specific implementation, in an actual business logic vulnerability detection system, the process of using a trained vulnerability judgment model to identify real vulnerabilities and false positives may include: Data preparation: Before applying the model, the code data to be analyzed needs to be prepared, which may include source code, compiled code, or specific code snippets.

[0056] Feature extraction: Apply the same feature extraction process as in the training phase to the new code data to obtain a feature vector for model input.

[0057] Model loading: Load the trained vulnerability judgment model and prepare for prediction.

[0058] Predictive execution: The extracted feature vectors are input into the model, and the model makes predictions based on the learned patterns and rules to determine whether each code snippet is a vulnerability or a false positive.

[0059] Result analysis: Analyze the model’s predictions to identify code snippets that are flagged as vulnerabilities and possible false positives.

[0060] Threshold determination: Based on the set threshold or confidence level, the model's prediction results are screened to determine which prediction results require further manual review.

[0061] Risk Assessment: Perform risk assessment on potential vulnerabilities identified by the model to determine the severity of the vulnerabilities and the priority of remediation.

[0062] Feedback loop: The model’s predicted results and manual review feedback are used as new data for further training and optimization of the model.

[0063] Report generation: Generates a detailed analysis report, including model-identified vulnerabilities, false positives, and related analysis and recommendations.

[0064] Integration and Automation: Integrate model applications into the automated CI / CD (continuous integration / continuous deployment) process to achieve real-time security detection during code submission, building, testing, and deployment.

[0065] Human review: For code snippets that the model cannot determine or flag as high risk, human review by security experts may be required.

[0066] Continuous monitoring: Models are continuously run in production, monitoring for new code changes and potential security issues.

[0067] Performance monitoring: Monitor the performance of the model in actual applications, including indicators such as accuracy, recall, and false alarm rate, to ensure the continued effectiveness of the model.

[0068] Model update: Based on performance monitoring results and new data, the model is updated regularly to adapt to new code patterns and attack techniques.

[0069] Through these steps, the trained vulnerability judgment model can play a role in actual business logic vulnerability detection, helping to improve the automation level and accuracy of detection while reducing the workload of manual review.

[0070] The business logic vulnerability detection method provided by the embodiment of the present invention generates a code file structure by statically analyzing the code file of the program; obtains data flow information in the code file according to the code file structure; analyzes the runtime behavior of the program according to a preset taint library, code file structure and data flow information to identify logical vulnerabilities of multiple code fragments in the program, thereby not only realizing automatic scanning of logical vulnerabilities, but also being able to count the false alarm rate of logical vulnerabilities of each code fragment, and stopping logical vulnerability scanning of the code fragment when the false alarm rate of the code fragment reaches a preset threshold, thereby making the false alarm rate of the business logic vulnerability automatic detection system lower and being able to identify attacks more accurately.

[0071] Furthermore, the taint library includes multiple taints, each of which represents a potential risk function. For each code snippet in the program, see Figure 2 , step 103 comprises: 201. Based on the code file structure and data flow information, propagate the taint from the source of the program to other parts of the program.

[0072] 202. If any variable in the program is marked as a tainted variable, and the value of the variable is used in a function parameter, the function is determined to be a risky function, and the call of the function constitutes a logic vulnerability.

[0073] For example, in this embodiment, it is found that the variables username and password are assigned to user input in the user login function, and the variable uploadedFile is assigned to the uploaded file content in the file upload processing function.

[0074] In the taint analysis layer, when username and password are assigned as form inputs, they are marked as tainted.

[0075] Taints propagate to other parts of the program as the data flows. For example, if username is used in a database query without proper sanitization and validation, it will propagate the taint to the database query function. If the executeQuery function uses a tainted username as a query parameter, then executeQuery is identified as a risky function. If the executeQuery function is called with an unsanitized username, this may constitute a SQL injection vulnerability.

[0076] Through the taint analysis technology of steps 201-202, the system can more accurately identify real security vulnerabilities and significantly reduce false positives compared to traditional static analysis methods.

[0077] Furthermore, the system of the embodiment of the present invention also includes other analysis layers. Other analysis layers are independent of other components and are specifically used to detect and build analysis models for unauthorized vulnerabilities. They can also be considered as subclasses of the taint analysis layer, that is, there are three modes: The first is that other analysis layers are set up independently, and the system calls them in the order of static analysis layer → data flow analysis layer → taint analysis layer → false alarm analysis layer → other analysis layers.

[0078] The second is to set other analysis layers as subclasses of the taint analysis layer. The system calls them in the order of static analysis layer → data flow analysis layer → taint analysis layer → false alarm analysis layer. When the taint analysis layer is called, other analysis layers are called according to preset judgment conditions.

[0079] Third, no other analysis layers are set up, and the system calls them in the order of static analysis layer → data flow analysis layer → taint analysis layer → false alarm analysis layer.

[0080] Let’s take one of these methods as an example. Figure 3 As shown, Figure 3 The schematic diagram of the automatic vulnerability detection platform of this embodiment is shown. Among them, the other analysis layers include 4 layers: unauthorized code analysis layer, unauthorized control flow analysis layer, unauthorized logic modeling layer and unauthorized logic attack model layer.

[0081] See also Figure 4 After analyzing the runtime behavior of the program according to the preset taint library, code file structure and data flow information, the method further includes: 401. When a specific data flow or code pattern is identified, an unauthorized analysis is performed on the code file of the program to determine the program structure and logic.

[0082] Step 401 is implemented through the unauthorized code analysis layer.

[0083] It should be noted that the unauthorized code analysis is similar to the static analysis of the code in the static analysis layer in the first step in some aspects. Both are part of static analysis, and both analyze the code without running the program, checking the source code or binary files. However, the two are different in that the main purpose of the static analysis layer is to discover potential security vulnerabilities in the code through syntax and structure analysis, such as injection vulnerabilities, unsafe API usage, etc.; while the unauthorized code analysis layer focuses on identifying specific types of code problems that may lead to unauthorized behavior, such as improper access control, privilege escalation, etc.

[0084] 402. Based on the structure and logic of the program, analyze the program for unauthorized control flow and identify potential unauthorized vulnerability points.

[0085] Step 402 is implemented through the unauthorized control process analysis layer.

[0086] Based on the above static structure and logic analysis, the control flow (dynamic operation process) of the code operation is analyzed through virtualization technology, including function calls and conditional statements. By analyzing the control flow, the scanner can identify potential unauthorized vulnerability points, such as unauthorized function calls or conditional judgment errors. The unauthorized control flow analysis layer is essentially an analysis from the perspective of dynamic operation.

[0087] 403. Analyze the program logic of the potential unauthorized vulnerability point according to a preset unauthorized logic model, and determine the operation that leads to the unauthorized behavior according to the logic analysis result; wherein the unauthorized logic model is used to determine the program operation that leads to the unauthorized behavior.

[0088] Step 403 is implemented through the unauthorized logic modeling layer, which is essentially an analysis from the user operation perspective. By implementing the implementation logic of the unauthorized logic modeling layer analysis program, the scanning program can determine which operations may lead to unauthorized behavior and further verify whether these operations have security risks.

[0089] 404. Determine the steps and targets of the unauthorized attack based on the logic analysis result and a preset unauthorized logic attack model, wherein the unauthorized logic attack model is used to describe how an attacker exploits an unauthorized vulnerability to attack.

[0090] Step 404 is implemented through the unauthorized logical attack model layer, which mainly plays the role of analyzing and summarizing the results. By clarifying the steps and goals of unauthorized attacks, the security team can formulate more targeted defense measures, such as strengthening access control of key paths and encrypting sensitive data.

[0091] Take the source code of an e-commerce platform as an example, which has user account management, order processing and payment functions.

[0092] Step 401 implementation: The system identifies that in the user account management function, the user ID is passed through the URL parameter. The system marks this transmission method as a possible risk of unauthorized access.

[0093] Step 402 is implemented: Further analysis revealed that if the user ID parameter is modified, the corresponding user information will also be changed, and the change operation does not undergo strict identity verification.

[0094] Step 403 is implemented: the system uses the unauthorized logic model to analyze and find that an attacker may access or modify other users' information by modifying the user ID parameter in the URL.

[0095] Step 404 is implemented: Based on the logic analysis results and the preset unauthorized logic attack model, the steps and targets of the unauthorized attack are determined, including the steps of the attacker modifying URL parameters, bypassing identity authentication, and accessing or modifying other user information.

[0096] Risk assessment and remediation suggestions: The system generates a report that points out specific risk points of unauthorized access and provides remediation suggestions, such as validating URL parameters and adding permission checks for user operations.

[0097] Dynamic defense strategy: Based on the unauthorized attack model, the system can dynamically adjust the access control strategy, such as triggering additional security checks when suspicious parameter modifications are detected.

[0098] In general, the main function of other analysis layers is to conduct a deeper analysis of the unauthorized logic. The analysis object is the specific call process rather than the overall system operation process. Since the analysis object is the specific call process, it is relatively closer to the actual business logic. In some systems, the specific call process is a specific business scenario.

[0099] In this embodiment, the technical effects of the vulnerability detection method implemented based on the business logic vulnerability automatic detection platform are as follows: 1. Discover the code snippet of the unauthorized vulnerability

[0100] Currently, SAST-related tools only focus on mining TOP defects and are unable to detect logic defects at the business level. The method of the embodiment of the present invention realizes automatic detection of business logic vulnerabilities through the setting of a data flow analysis layer and a taint analysis layer, and can automatically detect unauthorized vulnerabilities at the source code level without manual work.

[0101] 2. Accurately identify attacks and reduce false alarm rates

[0102] Compared with manual analysis of source code vulnerabilities in daily work, the method of the embodiment of the present invention can reduce the false alarm rate of the automatic detection system of business logic vulnerabilities by setting a false alarm analysis layer, and can more accurately identify attacks, thereby reducing the workload of manual reading.

[0103] 3. More comprehensive discovery of unauthorized vulnerabilities in business systems

[0104] Compared with the incomplete problem of unauthorized access vulnerabilities detected through black box testing, the automated detection platform of this embodiment first uses a static analysis layer to perform deep compilation analysis on the source code (i.e., deep analysis of the code or machine code at the compilation stage), and then uses a data flow analysis layer to analyze the variable transfer process to achieve control flow analysis (i.e., analysis of running processes such as variable transfer and function calls), and uses a taint analysis layer to analyze the function parameter process, thereby achieving an unauthorized access attack model based on the implementation logic of different business scenarios, which can more comprehensively discover the location of vulnerabilities.

[0105] The business logic vulnerability detection device provided by the present invention is described below. The business logic vulnerability detection device described below and the business logic vulnerability detection method described above can be referenced to each other.

[0106] The present invention provides a business logic vulnerability detection device, see Figure 5 ,include: Static analysis module 501, used to perform static analysis on the code files of the program and generate a code file structure; A data flow analysis module 502, used to obtain data flow information in the code file according to the code file structure; The taint analysis module 503 is used to analyze the runtime behavior of the program according to a preset taint library, code file structure and data flow information to identify logical vulnerabilities of multiple code fragments in the program; The false alarm analysis module 504 is used to count the false alarm rate of the logic vulnerabilities of each code segment, and stop scanning the logic vulnerabilities of the code segment when the false alarm rate of the code segment reaches a preset threshold.

[0107] Optionally, the static analysis module 501 is specifically used to: perform semantic and grammatical analysis on the code files of the program, and generate an abstract syntax tree and a control flow graph of the program.

[0108] Optionally, the data flow analysis module 502 is specifically used to: determine the variables in the code file, and obtain the transfer flow and purification status of the variables according to the code file structure and the variables.

[0109] Optionally, the stain library includes a plurality of stains, each stain representing a potential risk function; The taint analysis module 503 is specifically used for: for each code snippet in the program: based on the code file structure and data flow information, propagating the taint from the source of the program to other parts of the program; if any variable in the program is marked as a taint, and the value of the variable is used in the parameter of the function, then the function is determined to be a risky function, and the call of the function constitutes a logical vulnerability.

[0110] Optionally, the device further comprises: An unauthorized code analysis module is used to analyze the runtime behavior of the program according to a preset taint library, code file structure and data flow information, and then, when a specific data flow or code pattern is identified, perform an unauthorized analysis on the code file of the program to determine the program structure and logic; An unauthorized control flow analysis module is used to analyze the unauthorized control flow of a program based on the structure and logic of the program to identify potential unauthorized vulnerability points; An unauthorized logic modeling module is used to analyze the program logic of the potential unauthorized vulnerability point according to a preset unauthorized logic model, and determine the operation that leads to the unauthorized behavior according to the logic analysis result; wherein the unauthorized logic model is used to determine the program operation that leads to the unauthorized behavior; The unauthorized logic attack identification module is used to determine the steps and targets of the unauthorized attack based on the logic analysis results and the preset unauthorized logic attack model, wherein the unauthorized logic attack model is used to describe how the attacker exploits the unauthorized vulnerability to attack.

[0111] Optionally, the false alarm analysis module 504 is specifically used to: input the logic vulnerability of each code snippet into a pre-trained vulnerability judgment model to determine whether the logic vulnerability of each code snippet is a false alarm.

[0112] The business logic vulnerability detection device provided by the embodiment of the present invention generates a code file structure by statically analyzing the code file of the program; obtains data flow information in the code file according to the code file structure; analyzes the runtime behavior of the program according to the preset taint library, code file structure and data flow information to identify logical vulnerabilities of multiple code fragments in the program, thereby not only realizing automatic scanning of logical vulnerabilities, but also being able to count the false alarm rate of logical vulnerabilities of each code fragment, and stopping logical vulnerability scanning of the code fragment when the false alarm rate of the code fragment reaches a preset threshold, thereby making the false alarm rate of the business logic vulnerability automatic detection system lower and being able to identify attacks more accurately.

[0113] Figure 6 An example of a physical structure diagram of an electronic device is shown in FIG. Figure 6 As shown, the electronic device may include: a processor 610, a communication interface 620, a memory 630 and a communication bus 640, wherein the processor 610, the communication interface 620 and the memory 630 communicate with each other through the communication bus 640. The processor 610 may call the logic instructions in the memory 630 to execute the business logic vulnerability detection method, including: statically analyzing the code file of the program to generate a code file structure; obtaining data flow information in the code file according to the code file structure; analyzing the runtime behavior of the program according to the preset taint library, the code file structure and the data flow information to identify the logic vulnerabilities of multiple code fragments in the program; counting the false alarm rate of the logic vulnerability of each code fragment, and stopping the logic vulnerability scanning of the code fragment when the false alarm rate of the code fragment reaches a preset threshold.

[0114] In addition, the logic instructions in the above-mentioned memory 630 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when it is sold or used as an independent product. Based on such an understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc. Various media that can store program codes.

[0115] On the other hand, the present invention also provides a computer program product, which includes a computer program, which can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can execute the business logic vulnerability detection methods provided by the above methods, including: statically analyzing the code file of the program to generate a code file structure; obtaining data flow information in the code file according to the code file structure; analyzing the runtime behavior of the program according to a preset taint library, code file structure and data flow information to identify logical vulnerabilities in multiple code fragments in the program; counting the false alarm rate of the logical vulnerabilities of each code fragment, and stopping the logical vulnerability scanning of the code fragment when the false alarm rate of the code fragment reaches a preset threshold.

[0116] On the other hand, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, the business logic vulnerability detection method provided by the above methods is implemented, including: statically analyzing the code file of the program to generate a code file structure; obtaining data flow information in the code file according to the code file structure; analyzing the runtime behavior of the program according to a preset taint library, code file structure and data flow information to identify logical vulnerabilities of multiple code fragments in the program; counting the false alarm rate of the logical vulnerabilities of each code fragment, and stopping the logical vulnerability scanning of the code fragment when the false alarm rate of the code fragment reaches a preset threshold.

[0117] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative labor.

[0118] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0119] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A business logic vulnerability detection method, characterized in that: include: Perform static analysis on the program's code files and generate the code file structure; According to the code file structure, obtaining data flow information in the code file; Analyze the runtime behavior of the program according to a preset taint library, code file structure, and data flow information to identify logical vulnerabilities of multiple code fragments in the program; The false alarm rate of the logic vulnerability of each code segment is counted, and when the false alarm rate of the code segment reaches a preset threshold, the logic vulnerability scanning of the code segment is stopped.

2. The business logic vulnerability detection method according to claim 1, characterized in that: Perform static analysis on the program's code files to generate the code file structure, including: Perform semantic and syntactic analysis on the program's code files to generate an abstract syntax tree and the program's control flow graph.

3. The business logic vulnerability detection method according to claim 1, characterized in that: According to the code file structure, data flow information in the code file is obtained, including: Determine the variables in the code file, and obtain the transfer flow and purification status of the variables according to the code file structure and the variables.

4. The business logic vulnerability detection method according to claim 1, characterized in that: The stain library includes a plurality of stains, each stain representing a potential risk function; According to the preset taint library, code file structure and data flow information, the runtime behavior of the program is analyzed to identify the logic vulnerabilities of multiple code fragments in the program, including: For each code snippet in the program: Based on the code file structure and data flow information, propagate the taint from the source of the program to other parts of the program; If any variable in the program is marked as tainted, and the value of the variable is used in a function parameter, the function is determined to be a risky function, and the call of the function constitutes a logic vulnerability.

5. The business logic vulnerability detection method according to claim 1, characterized in that: After analyzing the runtime behavior of the program according to the preset taint library, code file structure and data flow information, the method further includes: When a specific data flow or code pattern is identified, the code file of the program is analyzed to determine the program structure and logic; Based on the structure and logic of the program, analyze the program's unauthorized control process and identify potential unauthorized vulnerability points; Analyze the program logic of the potential unauthorized vulnerability point according to a preset unauthorized logic model, and determine the operation that leads to the unauthorized behavior according to the logic analysis result; wherein the unauthorized logic model is used to determine the program operation that leads to the unauthorized behavior; Based on the logic analysis results and a preset unauthorized logic attack model, the steps and targets of the unauthorized attack are determined, wherein the unauthorized logic attack model is used to describe how an attacker exploits an unauthorized vulnerability to attack.

6. The business logic vulnerability detection method according to claim 1, characterized in that: The statistical false positive rate of logic vulnerabilities of each code snippet specifically includes: The logical vulnerability of each code snippet is input into the pre-trained vulnerability judgment model to determine whether the logical vulnerability of each code snippet is a false positive.

7. A business logic vulnerability detection device, characterized in that: include: Static analysis module, used to perform static analysis on the program's code files and generate code file structures; A data flow analysis module, used for obtaining data flow information in the code file according to the code file structure; A taint analysis module, used to analyze the runtime behavior of the program according to a preset taint library, code file structure, and data flow information, so as to identify logical vulnerabilities of multiple code fragments in the program; The false alarm analysis module is used to count the false alarm rate of the logic vulnerability of each code segment, and stop scanning the logic vulnerability of the code segment when the false alarm rate of the code segment reaches a preset threshold.

8. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the program, the business logic vulnerability detection method as described in any one of claims 1 to 6 is implemented.

9. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the business logic vulnerability detection method as described in any one of claims 1 to 6 is implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the business logic vulnerability detection method as described in any one of claims 1 to 6 is implemented.

Images