Security detection system for software dependent package

Abstract

The invention discloses a security detection system for a software dependent package, and relates to the technical field of dependent package security detection. Comprising a data collection module, a data analysis module, a defect analysis module, a vulnerability detection module, a simulation detection module and a result evaluation module. According to the security detection system for the software dependency package, whether the application can run on the target operating system or not can be judged through the data analysis module under the condition that the application is not run, the incompatible dependency package is removed, and the defect of the dependency package is analyzed through the defect analysis module; the defects that an existing vulnerability mining or defect detection technology represented by fuzzy testing and static auditing has concealment in the detection triggering effect and a code mode does not have universality in the aspect of logic defect detection among different software implementations are effectively overcome.

Description

Technical Field

[0001] The present invention relates to the technical field of dependency package security detection, and in particular to a software dependency package security detection system. Background Art

[0002] Software dependency packages refer to external modules, libraries or other software components that a software project depends on during the software development process. These dependency packages usually include code libraries or tools used to implement specific functions, provide necessary functional support or solve specific problems. With the popularity and use of open source software, the number of dependency packages used in software projects continues to increase. These dependency packages are usually maintained by the community and may have security vulnerabilities or other security vulnerabilities. Therefore, it is necessary to conduct security reviews and inspections on these dependency packages to reduce the security risks of software projects.

[0003] The invention with publication number CN118094548A discloses a security detection system for software dependency packages. A fuzzy code generation module uses a fuzzy test algorithm to generate a number of random or semi-random fuzzy test codes. The fuzzy test module inputs the generated fuzzy test code into the dependency package to determine whether the dependency package has a security vulnerability. The path establishment module performs symbolic execution on the dependency package and establishes a program symbolic execution path for the dependency package. The symbolic execution path is analyzed to find security vulnerability triggering conditions that cause program crashes or abnormal behavior. According to the discovered security vulnerability triggering conditions, a symbolic test code with an input value is generated. The generated symbolic test code is input into the dependency package to verify whether the discovered security vulnerability exists.

[0004] As shown in the above invention, the existing software dependency package security detection system combines fuzz testing and symbolic execution algorithms to perform global detection of software dependency packages, thereby improving test coverage. However, this method can only detect vulnerabilities in dependency packages, but cannot detect the compatibility of dependency packages with target software, as well as defects in the dependency packages themselves. Summary of the invention

[0005] In view of the deficiencies in the prior art, the present invention provides a software dependency package security detection system to solve the existing problems.

[0006] To achieve the above objectives, the present invention is implemented through the following technical solutions: a software dependency package security detection system, the

[0007] Data collection module, used to collect software dependency packages and dependency package related information;

[0008] Data analysis module, used to analyze whether the software dependency package is compatible with the target system;

[0009] Defect analysis module, used to perform defect analysis of dependent packages based on the dependency graph and defect algorithm formed by dependent packages;

[0010] The vulnerability detection module detects vulnerabilities in software dependency packages based on the three processes of information collection, information aggregation, and vulnerability judgment;

[0011] The simulation detection module uses hook technology to mount the methods or functions of the application software. When the mounted method or function is called, the vulnerability detection module is triggered;

[0012] The result evaluation module is used to confirm whether there are security vulnerabilities in the dependent packages, and to organize the discovered security vulnerabilities into a report and submit it to the developer.

[0013] Preferably, the data analysis module obtains the version, format, size, and number of bits of the current dependency package in the first deep dependency model, and determines whether the version, format, size, and number of bits of the current dependency package in the target system meet the requirements. If the requirements are met, the compatibility check of the current dependency package is determined to have passed; otherwise, the compatibility check of the current dependency package is determined to have failed.

[0014] Preferably, the analysis steps of the defect analysis module include:

[0015] 1) Obtain the source code of the protocol software, specific API and conditional check program point C in the protocol software t , converting the source code into an intermediate representation, where t is the number of the condition checker point C;

[0016] 2) Based on the intermediate representation, the call graph, system dependency graph and inter-procedural dominance tree of the software to be analyzed are constructed respectively;

[0017] 3) Based on the specific API and system dependency graph, identify the program point V in the function call point of the call graph i , where i is the number of program point V;

[0018] 4) Analyze program point V based on system dependency graph i The control in the function depends on the program point V i The fixed value statement obtains the program point O j , where j is the number of program point O;

[0019] 5) Combine the inter-procedural dominance tree and the path constraint implied relationship to solve and check whether any program point V is passed when executing to each program point Oj i and all condition checkers point C t , and execute to each program point V i Have you passed all the condition checks at point C? t , thus obtaining the safety mechanism defect detection results.

[0020] Preferably, the specific API includes: an API in an open source cryptographic algorithm library for verifying digital signatures or message authentication codes.

[0021] Preferably, the method for constructing a call graph includes: taking each function as a node and taking function call relationships as edges;

[0022] The method for constructing an inter-procedural dominator tree includes: taking each statement as a node and taking the dominator relationship as an edge.

[0023] Preferably, the program point V i The identification steps include:

[0024] S1: traverse all function call points in the call graph;

[0025] S2: When any function call point is located on the call path of a specific API, and the parameters of the function call point have a data dependency relationship with the field variables representing the message authentication code or digital signature in the message, the function call point is used as a program point V to verify the authenticity and integrity of the protocol message. i .

[0026] Preferably, the hook technology is a technology for modifying methods or functions in memory. The hook technology allows the program to intercept and process the execution logic of the method or function. When the specified method or function is called, the hook technology can capture the original code of the method or function before it is executed, thereby gaining control over the method or function, and then processing or modifying the method or function to add the required functions.

[0027] Preferably, the result evaluation module evaluates the severity of each discovered security vulnerability using the CVSS basic score, and compiles the evaluated security vulnerabilities into a report, the report including vulnerability description, vulnerability impact, vulnerability exploitation scenario, and vulnerability repair suggestions, submits the compiled security vulnerability report to the developer, updates the security vulnerability report, records the status and results of the vulnerability repair, and archives the repaired report.

[0028] Beneficial Effects

[0029] The present invention provides a software dependency package security detection system. Compared with the prior art, it has the following beneficial effects:

[0030] 1. The security detection system of the software dependency package can determine whether the application can run on the target operating system without running the application through the data analysis module, eliminate incompatible dependency packages, and analyze the defects of the dependency packages through the defect analysis module, effectively making up for the shortcomings of existing vulnerability mining or defect detection technologies represented by fuzz testing and static auditing in detecting logical defects where the detection trigger effect is hidden and the code mode is not universal among different software implementations.

[0031] 2. The security detection system of the software dependency package can detect vulnerabilities in the software dependency package through the vulnerability detection module, effectively improve the test coverage, and discover more potential security vulnerabilities. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] Figure 1 It is a schematic diagram of the system connection structure of the present invention;

[0033] Figure 2 It is a schematic diagram of the defect analysis method flow of the present invention. DETAILED DESCRIPTION

[0034] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0035] See Figure 1-2 , the present invention provides the following three technical solutions:

[0036] The first implementation method: A security detection system for software dependency packages includes a data collection module, a data analysis module, a defect analysis module, a vulnerability detection module, a simulation detection module and a result evaluation module.

[0037] Data collection module, used to collect software dependency packages and dependency package related information;

[0038] A data analysis module is used to analyze whether the software dependency package is compatible with the target system. The data analysis module obtains the version, format, size, and number of bits of the current dependency package in the first deep dependency model, and determines whether the version, format, size, and number of bits of the current dependency package in the target system meet the requirements. If the requirements are met, the compatibility check of the current dependency package is determined to have passed; otherwise, the compatibility check of the current dependency package is determined to have failed.

[0039] Defect analysis module, used to perform defect analysis of dependent packages based on the dependency graph and defect algorithm formed by dependent packages;

[0040] The vulnerability detection module detects vulnerabilities in software dependency packages based on the three processes of information collection, information aggregation, and vulnerability judgment;

[0041] The simulation detection module uses hook technology to mount the methods or functions of the application software. When the mounted method or function is called, the vulnerability detection module is triggered;

[0042] The result evaluation module is used to confirm whether there are security vulnerabilities in the dependent packages, and to organize the discovered security vulnerabilities into a report and submit it to the developer.

[0043] Hook technology is a technology that modifies methods or functions in memory. Hook technology allows the program to intercept and process the execution logic of methods or functions. When the specified method or function is called, hook technology can capture the original code of the method or function before it is executed, thereby gaining control over the method or function, and then processing or modifying the method or function to add the required functions.

[0044] The first deep dependency model specifically provides an XML file for each library package therein to record information such as the name, version, format, number of bits, size, external interface functions, etc. of the library package.

[0045] In this embodiment, the format of the xml file of a library package is as follows:

[0046] <library>

[0047] <name> libxxx< / name> #Library name of the library package

[0048] <version> 1.0.0 <version>#Library package version

[0049] <parents>#All direct dependencies of the library package

[0050] <parent>#A direct dependency library of the library package

[0051] <name> libxxx< / name>

[0052] <version> 1.0.0< / version>

[0053] < / parent>

[0054] < / parents>

[0055] <!-- List all functions in this library -->

[0056] <functions>#All functions in the library package

[0057] <function>#A function in the library package

[0058] <name> fn_test[1.0.0]< / name> #Function version

[0059] <params> int, int, int< / params> #Function parameters

[0060] <return> int< / return> #Function return value

[0061] <sideeffect> ...< / sideeffect> #Side effects when the function is running

[0062] <testcase> path / to / testcase< / testcase> #The path of the test case for this function

[0063] < / function> ...

[0065] < / functions>

[0066] < / version> < / version> < / library>

[0067] The result evaluation module evaluates the severity of each discovered security vulnerability using the CVSS basic score, and compiles the evaluated security vulnerabilities into a report. The report includes vulnerability description, vulnerability impact, vulnerability exploitation scenario, and vulnerability repair suggestions. The compiled security vulnerability report is submitted to the developer, who updates the security vulnerability report, records the status and results of the vulnerability repair, and archives the repaired report.

[0068] This embodiment also provides a software dependency package capability detection system, including a computer device, which is programmed or configured to execute the software dependency package security detection system, or the storage medium of the computer device stores a computer program programmed or configured to execute the software dependency package security detection system.

[0069] In addition, this embodiment also provides a computer-readable storage medium, on which a computer program programmed or configured to execute a security detection system for a software dependency package is stored.

[0070] Second implementation method: The defect analysis step includes:

[0071] 1) Obtain the source code of the protocol software, specific API and conditional check program point C in the protocol software t , converting the source code into an intermediate representation, where t is the number of the condition checker point C;

[0072] 2) Based on the intermediate representation, the call graph, system dependency graph and inter-procedural dominance tree of the software to be analyzed are constructed respectively;

[0073] 3) Based on the specific API and system dependency graph, identify the program point V in the function call point of the call graph i , where i is the number of program point V;

[0074] 4) Analyze program point V based on system dependency graph i The control in the function depends on the program point V i The fixed value statement obtains the program point O j , where j is the number of program point O;

[0075] 5) Combine the inter-procedural dominance tree with the path constraint implied relationship to solve and check the execution to each program point O j Whether it passes through any program point V i and all condition checkers point C t , and execute to each program point V i Have you passed all the condition checks at point C? t , thus obtaining the safety mechanism defect detection results.

[0076] Specific APIs include: APIs in open source cryptographic algorithm libraries for verifying digital signatures or message authentication codes.

[0077] The method of constructing an inter-procedural dominator tree includes taking each statement as a node and taking the dominator relationship as an edge.

[0078] Program point V i The identification steps include:

[0079] S1: traverse all function call points in the call graph;

[0080] S2: When any function call point is located on the call path of a specific API, and the parameters of the function call point have a data dependency relationship with the field variables representing the message authentication code or digital signature in the message, the function call point is used as a program point V to verify the authenticity and integrity of the protocol message. i .

[0081] Program point O j The identification steps include:

[0082] A: Traverse program point V i The control in the function depends on the program point Vi The value statement of

[0083] B: If the source operand of the value statement is an error code constant indicating success or failure of verification, and the destination operand is a function return value or a variable with external influence, then add the destination operand to the Vars collection;

[0084] C: Traverse all usage points of each variable in the Vars collection;

[0085] D: When any use point is a conditional statement or assertion statement, the program point executed after the conditional statement or assertion statement is program point O. j .

[0086] The third implementation method is: compare the input parameter value of the vulnerability detection module with the user input data. If they are the same, the input parameter value is considered to be the user input data, and the context information of the application software is saved, and then the security vulnerabilities of the application software are detected; if the input parameter value of the vulnerability detection module is different from the user input data, compare the input parameter value of the vulnerability detection module with the next user input data, and repeat the operation.

[0087] When the vulnerability detection module detects security vulnerabilities in application software, the vulnerability detection module determines whether the method or function of the application software has vulnerability execution characteristics. If so, it is considered that the application software has vulnerabilities; if not, it returns to compare the input parameter value of the vulnerability detection module with the next user input data. In the above technical solution, when the vulnerability detection program is triggered, the method or function of the current application software is searched in the vulnerability execution characteristic method or function set. If the search is successful, it is considered that the current application software has vulnerabilities, otherwise it is considered that the current application software has no vulnerabilities, and then the input parameter value of the vulnerability detection module is compared with the next user input data, and the operation is repeated.

[0088] When the vulnerability detection module detects security vulnerabilities in the application software, the vulnerability detection program also determines whether the method or function of the application software has data propagation characteristics. If so, it is considered that its output data is also the data input by the user; if not, it returns to compare the input parameter value of the vulnerability detection program with the next user input data. In the above technical solution, when the vulnerability detection program is triggered, the method or function of the current application software is searched in the data propagation characteristic method or function set. If the search is successful, it is considered that the current application software has data propagation characteristics. Otherwise, it is considered that the current application software does not have data propagation characteristics. Then the input parameter value of the vulnerability detection program is compared with the next user input data, and the operation is repeated.

[0089] Meanwhile, the contents not described in detail in this specification belong to the prior art known to those skilled in the art, and the model parameters of each electrical appliance are not specifically limited, and conventional equipment can be used.

[0090] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device.

[0091] Although embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present invention, and that the scope of the present invention is defined by the appended claims and their equivalents.

Claims

1. A software dependency package security detection system, characterized in that: Said Data collection module, used to collect software dependency packages and dependency package related information; Data analysis module, used to analyze whether the software dependency package is compatible with the target system; Defect analysis module, used to perform defect analysis of dependent packages based on the dependency graph and defect algorithm formed by dependent packages; The vulnerability detection module detects vulnerabilities in software dependency packages based on the three processes of information collection, information aggregation, and vulnerability judgment; The simulation detection module uses hook technology to mount the methods or functions of the application software. When the mounted method or function is called, the vulnerability detection module is triggered; The result evaluation module is used to confirm whether there are security vulnerabilities in the dependent packages, and to organize the discovered security vulnerabilities into a report and submit it to the developer.

2. A software dependency package security detection system according to claim 1, characterized in that: The data analysis module obtains the version, format, size, and number of bits of the current dependency package in the first deep dependency model, and determines whether the version, format, size, and number of bits of the current dependency package in the target system meet the requirements. If so, the compatibility check of the current dependency package is determined to have passed; otherwise, the compatibility check of the current dependency package is determined to have failed.

3. A software dependency package security detection system according to claim 1, characterized in that: The analysis steps of the defect analysis module include: 1) Obtain the source code of the protocol software, specific API and conditional check program point C in the protocol software t , converting the source code into an intermediate representation, where t is the number of the condition checker point C; 2) Based on the intermediate representation, the call graph, system dependency graph and inter-procedural dominance tree of the software to be analyzed are constructed respectively; 3) Based on the specific API and system dependency graph, identify the program point V in the function call point of the call graph i , where i is the number of program point V; 4) Analyze program point V based on system dependency graph i The control in the function depends on the program point V i The fixed value statement obtains the program point O j , where j is the number of program point O; 5) Combine the inter-procedural dominance tree with the path constraint implied relationship to solve and check the execution to each program point O j Whether it passes through any program point V i and all condition checkers point C t , and execute to each program point V i Have you passed all the condition checks at point C? t , thus obtaining the safety mechanism defect detection results.

4. A software dependency package security detection system according to claim 3, characterized in that: The specific API includes: an API in an open source cryptographic algorithm library for verifying a digital signature or a message authentication code.

5. A software dependency package security detection system according to claim 3, characterized in that: The method for constructing a call graph includes: taking each function as a node and taking a function call relationship as an edge; The method for constructing an inter-procedural dominator tree includes: taking each statement as a node and taking the dominator relationship as an edge.

6. A software dependency package security detection system according to claim 3, characterized in that: The program point V i The identification steps include: S1: traverse all function call points in the call graph; S2: When any function call point is located on the call path of a specific API, and the parameters of the function call point have a data dependency relationship with the field variables representing the message authentication code or digital signature in the message, the function call point is used as a program point V to verify the authenticity and integrity of the protocol message. i .

7. A software dependency package security detection system according to claim 1, characterized in that: The hook technology is a technology for modifying methods or functions in memory. The hook technology allows the program to intercept and process the execution logic of the method or function. When the specified method or function is called, the hook technology can capture the original code of the method or function before it is executed, thereby gaining control over the method or function, and then processing or modifying the method or function to add the required functions.

8. A software dependency package security detection system according to claim 1, characterized in that: The result evaluation module evaluates the severity of each discovered security vulnerability using the CVSS basic score, and compiles the evaluated security vulnerabilities into a report, which includes vulnerability description, vulnerability impact, vulnerability exploitation scenario, and vulnerability repair suggestions. The compiled security vulnerability report is submitted to the developer, the security vulnerability report is updated, the vulnerability repair situation and results are recorded, and the repaired report is archived.

Images