Network security unknown vulnerability mining guiding path generation method

Abstract

The invention provides a method for generating a guiding path for unknown vulnerability mining of network security. The method comprises basic steps and a specific implementation method. The basic steps comprise complexity calculation of basic blocks, complexity calculation of code snippets, complexity calculation of code paths, consideration of influences of vulnerability risks and vulnerability probability factors and priority ranking of the code paths; by applying the technical scheme, the execution difficulty of the path triggering vulnerability can be evaluated, and the paths which are easy to trigger the vulnerability are preferentially sorted.

Description

Technical Field

[0001] The present invention relates to the technical field of network security vulnerability mining, and in particular to a method for generating a guiding path for mining unknown network security vulnerabilities. Background Art

[0002] Since there may be multiple reachable paths to the basic block where the network security vulnerability point is located, and the difficulty of triggering the vulnerability on each code path is different, if all code paths are randomly selected and vulnerability mining is performed, it may take a long time to mine the vulnerability. Since the time period required for vulnerability mining is often very long, the later the vulnerability is discovered, the greater the loss to commercial software. At the same time, for binary programs, the causes of vulnerabilities on multiple reachable paths to the same vulnerability point are similar. After the vulnerability at the vulnerability point is fixed, the vulnerabilities of other paths will also be eliminated at the same time. Therefore, it is necessary to prioritize the code paths of suspected vulnerabilities, give priority to mining paths that are easy to trigger vulnerabilities, are more harmful, and have a higher probability of vulnerability, so as to discover vulnerabilities faster. Summary of the invention

[0003] In view of this, the purpose of the present invention is to provide a method for generating guidance paths for mining unknown network vulnerabilities, evaluate the execution difficulty of paths triggering vulnerabilities, and prioritize those paths that are easy to trigger vulnerabilities.

[0004] To achieve the above-mentioned purpose, the present invention adopts the following technical scheme: a method for generating a guidance path for mining unknown network vulnerabilities, including basic steps and specific implementation methods;

[0005] The basic steps include basic block complexity calculation, code fragment complexity calculation, code path complexity calculation, consideration of vulnerability risk and vulnerability probability factors, and priority sorting of code paths;

[0006] Specific implementation methods include:

[0007] Step 1: Reverse compile the binary program to be exploited into a readable form and divide it into basic blocks and fragments. A fragment contains one or more basic blocks.

[0008] Step 2: Calculate the complexity of the basic block by the number of instructions and instruction types;

[0009] Step 3: Calculate the complexity of the fragment by weighted summing according to the complexity of each basic block contained in the fragment and the number of basic blocks according to the level;

[0010] Step 4: Calculate the complexity of the path by the complexity of the fragments that the path passes through and the complexity of the basic blocks;

[0011] Step 5: predict suspected vulnerability points based on the path complexity calculated in step 4, and calculate the priority of the path where the suspected vulnerability points are located based on the complexity of the path where the suspected vulnerability points are located and the vulnerability existence factors, wherein the vulnerability existence factors include the frequency of occurrence of the corresponding codes of the vulnerabilities of different vulnerability types and the corresponding code complexity;

[0012] Step 6: Sort the priorities of all paths where suspected vulnerability points are located, and prioritize high-probability vulnerabilities.

[0013] In a preferred embodiment, the basic block complexity is calculated as follows: the complexity of each basic block is measured by the number of instructions and the type of instructions. The more instructions and the more memory read and write instructions a basic block contains, the higher the complexity of the basic block. The complexity of each basic block is calculated by these two indicators. The code fragment complexity is calculated as follows: a complexity calculation method for each type of code fragment is designed. For a loop type code fragment, the number of loops, the number of basic blocks in the loop body, and the weighted accumulation of the complexity of the basic blocks are the main measurement indicators for measuring the loop type code fragment. For a conditional branch type code fragment, the number of branches and the complexity of each branch basic block are the main measurement indicators for measuring the loop type code fragment. The weighted accumulation of complexity is an important measure of its complexity; the complexity of the code path is calculated as follows: the complexity of the entire code path is calculated mainly through the complexity of the code fragments and the complexity of the basic blocks that the code path passes through; for the if-type code fragments on the code path, a greater weight should be given; considering the impact of vulnerability risk and vulnerability probability factors, specifically: the corresponding prediction probability, the greater the probability of vulnerability existence, the higher the priority of the vulnerability point; the priority sorting of the code path is specifically as follows: all code paths suspected of vulnerability points are prioritized, and the higher the priority code path, the earlier it should be mined; the path obtained after priority sorting is the guiding strategy for subsequent vulnerability mining.

[0014] In a preferred embodiment, the step 2 specifically includes:

[0015]

[0016] Where: Cb represents the complexity of the basic block; ni represents the number of instructions of the corresponding instruction type; Indicates the weight value of the instruction of this instruction type; y indicates the influence coefficient, which is usually between 0.01 and 0.1; Indicates the distance from the top of the stack to the bottom of the stack for each stack operation involved in the basic block; num indicates the total number of instructions in the basic block; for each stack operation, the distance between the top pointer sp and the bottom pointer bp indicates the size of the stack memory used; the instruction types include data transfer instructions, arithmetic operation instructions, bit operation instructions, program flow control instructions, string operation instructions, and processor control instructions; the weight value of the instruction The time complexity of the reference instruction is O(n); the weight of the instruction depends on its specific function, and the time complexity is calculated by the specific implemented function to obtain the weight of the instruction.

[0017] In a preferred embodiment, the complexity calculation formula in step 3 is:

[0018]

[0019] Where: θi represents the weights of basic blocks at different levels in the corresponding fragment; Indicates the complexity of the first basic block in different levels; Indicates the complexity of the second basic block in different levels; the level of the basic block is determined by the conditions reached in this fragment.

[0020] In a preferred embodiment, the calculation formula of the complexity of the path in step 4 is:

[0021] cr=V(G)(cf1+cf2+…)(3)

[0022] V(G)=e-n+2(4)

[0023] Where V(G) is the cyclomatic complexity of a path; cfi is the complexity of all fragments involved in the path; e is the number of edges in a path, and n is the number of nodes in the control flow graph.

[0024] In a preferred embodiment, the step 5 is specifically as follows: the corresponding code occurrence frequency refers to the occurrence frequency of the corresponding code of the vulnerability of this type, and the risk of the vulnerability is determined by the occurrence frequency of the corresponding code of the vulnerability of different vulnerability types and the complexity of the corresponding code;

[0025] The calculation formula for the priority of the path where the suspected vulnerability is located is:

[0026]

[0027] In the formula: Pv represents the probability of vulnerability occurrence; Pc represents the corresponding relationship with code complexity; cri represents the complexity of a path, α+β=1; the vulnerability types include stack vulnerabilities, integer overflow vulnerabilities, formatted string vulnerabilities, heap vulnerabilities and logical vulnerabilities, among which: the stack vulnerability corresponds to Pv=0.9, Pc=0.3; the integer overflow vulnerability corresponds to Pv=0.6, Pc=0.3; the formatted string vulnerability corresponds to Pv=0.6, Pc=0.6; the heap vulnerability corresponds to Pv=0.3, Pc=0.6; the logical vulnerability corresponds to Pv=0.3, Pc=0.9; currently, the determination of the two values ​​of α and β depends on experimental results. For example, for a certain type of application program, select several programs with known vulnerabilities, substitute the formula into it, and see what the specific values ​​of α and β are closest to the actual situation, and then select this set of α and β values ​​for this type of program.

[0028] Compared with the prior art, the present invention has the following beneficial effects: the present invention uses the frequency of occurrence of the corresponding codes of different vulnerability types and the complexity of the corresponding codes to jointly determine the risk of the vulnerability, and sorts the priority of the paths where all suspected vulnerability points are located, giving priority to high-probability vulnerabilities. At the same time, the degree of damage that the vulnerability may cause is analyzed, and those paths that have a greater impact on system security are mined first. The execution difficulty of the path triggering the vulnerability is evaluated, and those paths that are easy to trigger the vulnerability are prioritized. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] Figure 1 It is a flow chart of a preferred embodiment of the present invention. DETAILED DESCRIPTION

[0030] The present invention will be further described below in conjunction with the accompanying drawings and embodiments.

[0031] It should be noted that the following detailed descriptions are illustrative and are intended to provide further explanation of the present application. Unless otherwise specified, all technical and scientific terms used in the present invention have the same meanings as those commonly understood by those skilled in the art to which the present application belongs.

[0032] It should be noted that the terms used herein are only for describing specific embodiments and are not intended to limit the exemplary embodiments according to the present application; as used herein, unless the context clearly indicates otherwise, the singular form is also intended to include the plural form. In addition, it should be understood that when the terms "comprise" and / or "include" are used in this specification, they indicate the presence of features, steps, operations, devices, components and / or their combinations.

[0033] A method for generating guidance paths for mining unknown vulnerabilities in network security, reference Figure 1 , including the following processes:

[0034] 1. Basic steps

[0035] ① Complexity calculation of basic blocks

[0036] The complexity of each basic block is measured by the number of instructions and instruction types. The more instructions it contains and the more memory read and write instructions it contains, the higher the complexity of the basic block. Through these two indicators, the complexity of each basic block is calculated.

[0037] ② Code snippet complexity calculation

[0038] Design a complexity calculation method for each type of code snippet. For example, for loop-type code snippets, the number of loops, the number of basic blocks in the loop body, and the weighted accumulation of basic block complexity are the main indicators for measuring loop-type code snippets. For conditional branch-type code snippets, the number of branches and the weighted accumulation of the complexity of each branch basic block are important indicators for measuring their complexity.

[0039] ③ Calculation of the complexity of the code path

[0040] The complexity of the entire code path is calculated mainly through the complexity of the code snippets and the complexity of the basic blocks that the code path passes through. For the if-type code snippets on the code path, a greater weight should be given, because they may be data integrity verification points on the path. The more data integrity verification points a path passes through, the more difficult it is to construct the corresponding input to reach the vulnerability point, that is, the higher the complexity of this path.

[0041] ④ Impact of vulnerability risk and vulnerability probability factors

[0042] Since different vulnerability types have different degrees of harm, vulnerability risk factors need to be considered when prioritizing paths. At the same time, since the method predicts suspected vulnerability points, there will be corresponding prediction probabilities. The higher the probability of vulnerability, the higher the priority.

[0043] ⑤ Prioritization of code paths

[0044] Based on the above factors, all code paths of suspected vulnerabilities are prioritized. The higher the priority, the earlier the code path should be mined. The path obtained after priority sorting is the guiding strategy for subsequent vulnerability mining.

[0045] 2. Specific implementation method

[0046] Step 1: Reverse compile the binary program to be exploited into a readable form and divide it into basic blocks and fragments (a fragment contains one or more basic blocks);

[0047] Step 2: Calculate the complexity of the basic block by the number of instructions and instruction types;

[0048]

[0049] Where:

[0050] Cb – complexity of basic blocks;

[0051] ni – the number of instructions corresponding to the instruction type;

[0052] ——The weight value of the instruction of this instruction type;

[0053] y——Influence coefficient, usually between 0.01 and 0.1;

[0054] ——The distance from the top of the stack to the bottom of the stack for each stack operation involved in the basic block;

[0055] num – the total number of instructions in the basic block.

[0056] Each time the stack is operated, the stack top pointer sp, the stack bottom pointer bp, and the distance between sp and bp indicate the size of the stack memory used. The distance from the stack top to the stack bottom is a common computer representation and will not be elaborated here.

[0057] The instruction types include data transfer instructions, arithmetic operation instructions, bit operation instructions, program flow control instructions,

[0058] String operation instructions, processor control instructions.

[0059] The weight value of the instruction The time complexity of the reference instruction is O(n). The weight of the instruction depends on its specific

[0060] Function, the time complexity is calculated by the specific implemented function, so as to obtain the weight of the instruction. The method of calculating the time complexity O(n) is well-known and will not be repeated here. The corresponding relationship between the weight value of the instruction and the time complexity of the instruction is shown in Table 1 below:

[0061] Table 1 Correspondence between instruction weight value and instruction time complexity

[0062] Serial number Time complexity Instruction weight value 1 O(1) 1 2 O(n) a 3 <![CDATA[O(n 2 )]]> <![CDATA[a 2 ]]> 4 O(logn) Log(a) 5 O(nlogn) alog(a) 6 <![CDATA[O(n 3 )]]> <![CDATA[a 3 ]]> 7 <![CDATA[O(2 n )]]> <![CDATA[2 a ]]>

[0063] Note: the value of a is equal to 1+(number of instruction types)-1. For example, if there are two instruction types with different time complexities in the basic block, then a=1+2-1=1.5. Numbers 1-7 correspond to 7 types of time complexity, covering the possible time complexity situations in the code.

[0064] Step 3: Calculate the complexity of the fragment by weighted summing according to the complexity of each basic block contained in the fragment and the number of basic blocks according to the level;

[0065] The complexity of a fragment is calculated as:

[0066]

[0067] Where: θi — weights of basic blocks at different levels in the corresponding fragment; — the complexity of the first basic block in different levels; ——The complexity of the second basic block in different levels.

[0068] The level of the basic block is determined by the conditions reached in this fragment. For example, all basic blocks executed sequentially are at the same level, and those inside conditional judgments and loops are at the next level. The weights of different levels decrease in turn. According to experience, θ1=1, θi+1=0.1θi.

[0069] Step 4: Calculate the complexity of the path by the complexity of the fragments that the path passes through and the complexity of the basic blocks; the calculation formula for the complexity of the path is:

[0070] cr=V(G)(cf1+cf2+…)(3)

[0071] V(G)=e-n+2(4)

[0072] Where V(G) is the cyclomatic complexity of a path; cfi is the complexity of all fragments involved in the path; e is the number of edges in a path, and n is the number of nodes in the control flow graph.

[0073] By looking at the code in the form of a program flow chart, you can intuitively count the number of edges and nodes, or you can use existing tools such as IDA to obtain the number of edges and nodes.

[0074] Step 5: Predict suspected vulnerability points based on the path complexity calculated in step 4, and calculate the priority of the path where the suspected vulnerability points are located based on the complexity of the path where the suspected vulnerability points are located and the vulnerability existence factors. The vulnerability existence factors include the frequency of occurrence of the corresponding code of the vulnerability of different vulnerability types and the corresponding code complexity.

[0075] The frequency of occurrence of the corresponding code refers to the frequency of occurrence of the corresponding code of this type of vulnerability. For example, stack vulnerabilities appear in stack operation codes. Since stack operation codes appear frequently in the path, i.e., the frequency of occurrence of the corresponding code of stack vulnerabilities is high, the frequency of occurrence of stack vulnerabilities is also relatively high. However, stack operation codes are relatively simple codes, i.e., the complexity of the corresponding codes is low, and the probability of errors is small, so the probability of stack vulnerabilities is low. The risk of the existence of vulnerabilities is determined by the frequency of occurrence of the corresponding codes of vulnerabilities of different vulnerability types and the complexity of the corresponding codes.

[0076] The calculation formula for the priority of the path where the suspected vulnerability is located is:

[0077]

[0078] Where:

[0079] Pv——Probability of vulnerability occurrence;

[0080] Pc——corresponding relationship with code complexity;

[0081] cri——the complexity of a path, α+β=1.

[0082] Vulnerability types include stack vulnerabilities, integer overflow vulnerabilities, formatted string vulnerabilities, heap vulnerabilities and logical vulnerabilities, among which: the stack vulnerability corresponds to Pv=0.9, Pc=0.3; the integer overflow vulnerability corresponds to Pv=0.6, Pc=0.3; the formatted string vulnerability corresponds to Pv=0.6, Pc=0.6; the heap vulnerability corresponds to Pv=0.3, Pc=0.6; the logical vulnerability corresponds to Pv=0.3, Pc=0.9.

[0083] Currently, the determination of the two values ​​of α and β depends on experimental results. For example, for a certain type of application program, select several programs with known vulnerabilities, substitute the formula into it, and see what specific values ​​of α and β are closest to the actual situation. Then, corresponding to this type of program, this set of α and β values ​​is selected.

[0084] Step 6: Sort the priorities of all paths where suspected vulnerability points are located, and prioritize high-probability vulnerabilities.

Claims

1. A method for generating a guidance path for mining unknown network security vulnerabilities, characterized in that Includes basic steps and specific implementation methods; The basic steps include basic block complexity calculation, code fragment complexity calculation, code path complexity calculation, consideration of vulnerability risk and vulnerability probability factors, and priority sorting of code paths; The specific implementation methods include: Step 1: Reverse compile the binary program to be exploited into a readable form and divide it into basic blocks and fragments. A fragment contains one or more basic blocks. Step 2: Calculate the complexity of the basic block by the number of instructions and instruction types; Step 3: Calculate the complexity of the fragment by weighted summing according to the complexity of each basic block contained in the fragment and the number of basic blocks according to the level; Step 4: Calculate the complexity of the path by the complexity of the fragments that the path passes through and the complexity of the basic blocks; Step 5: predict suspected vulnerability points based on the path complexity calculated in step 4, and calculate the priority of the path where the suspected vulnerability points are located based on the complexity of the path where the suspected vulnerability points are located and the vulnerability existence factors, wherein the vulnerability existence factors include the frequency of occurrence of the corresponding codes of the vulnerabilities of different vulnerability types and the corresponding code complexity; Step 6: Sort the priorities of all paths where suspected vulnerability points are located, and prioritize high-probability vulnerabilities.

2. According to claim 1, a method for generating a guidance path for mining unknown network security vulnerabilities is characterized in that: The complexity calculation of basic blocks is as follows: the complexity of each basic block is measured by the number of instructions and the type of instructions. The more instructions it contains and the more memory read and write instructions it contains, the higher the complexity of the basic block. The complexity of each basic block is calculated through these two indicators. The complexity calculation of code snippets is as follows: a complexity calculation method for each type of code snippet is designed. For loop-type code snippets, the weighted sum of the number of loops, the number of basic blocks in the loop body, and the complexity of the basic blocks is the main measurement indicator for measuring loop-type code snippets. For conditional branch-type code snippets, the weighted sum of the number of branches and the complexity of each branch basic block is the main measurement indicator for measuring loop-type code snippets. and are important indicators of its complexity; the complexity calculation of the code path is specifically as follows: the complexity of the entire code path is calculated mainly through the complexity of the code fragments and the complexity of the basic blocks passed by the code path; for the if-type code fragments on the code path, a greater weight should be given; considering the influence of vulnerability risk and vulnerability probability factors, specifically: the corresponding prediction probability, the greater the probability of vulnerability, the higher the priority of the vulnerability point; the priority sorting of the code path is specifically as follows: prioritize the code paths of all suspected vulnerability points, and the higher the priority of the code path, the earlier it should be mined; the path obtained after priority sorting is the guiding strategy for subsequent vulnerability mining.

3. According to claim 1, a method for generating a guidance path for mining unknown network security vulnerabilities is characterized in that: The step 2 specifically includes: Where: Cb represents the complexity of the basic block; ni represents the number of instructions of the corresponding instruction type; Indicates the weight value of the instruction of this instruction type; y indicates the influence coefficient, which is usually between 0.01 and 0.1; Indicates the distance from the top of the stack to the bottom of the stack for each stack operation involved in the basic block; num indicates the total number of instructions in the basic block; for each stack operation, the distance between the top pointer sp and the bottom pointer bp indicates the size of the stack memory used; the instruction types include data transfer instructions, arithmetic operation instructions, bit operation instructions, program flow control instructions, string operation instructions, and processor control instructions; the weight value of the instruction The time complexity of the reference instruction is O(n); the weight of the instruction depends on its specific function, and the time complexity is calculated by the specific implemented function to obtain the weight of the instruction.

4. According to claim 1, a method for generating a guidance path for mining unknown network security vulnerabilities is characterized in that: The complexity calculation formula in step 3 is: Where: θi represents the weights of basic blocks at different levels in the corresponding fragment; Indicates the complexity of the first basic block in different levels; Indicates the complexity of the second basic block in different levels; the level of the basic block is determined by the conditions reached in this fragment.

5. According to claim 1, a method for generating a guidance path for mining unknown network security vulnerabilities is characterized in that: The calculation formula of the complexity of the path in step 4 is: cr=V(G)(cf1+cf2+…)(3) V(G)=e-n+2(4) Where V(G) is the cyclomatic complexity of a path; cfi is the complexity of all fragments involved in the path; e is the number of edges in a path, and n is the number of nodes in the control flow graph.

6. According to claim 1, a method for generating a guidance path for mining unknown network security vulnerabilities is characterized in that: The step 5 is specifically as follows: the corresponding code occurrence frequency refers to the occurrence frequency of the corresponding code of the vulnerability of this type, and the risk of the vulnerability is determined by the occurrence frequency of the corresponding code of the vulnerability of different vulnerability types and the complexity of the corresponding code; The calculation formula for the priority of the path where the suspected vulnerability is located is: In the formula: Pv represents the probability of vulnerability occurrence; Pc represents the corresponding relationship with code complexity; cri represents the complexity of a path, α+β=1; the vulnerability types include stack vulnerabilities, integer overflow vulnerabilities, formatted string vulnerabilities, heap vulnerabilities and logical vulnerabilities, among which: the stack vulnerability corresponds to Pv=0.9, Pc=0.3; the integer overflow vulnerability corresponds to Pv=0.6, Pc=0.3; the formatted string vulnerability corresponds to Pv=0.6, Pc=0.6; the heap vulnerability corresponds to Pv=0.3, Pc=0.6; the logical vulnerability corresponds to Pv=0.3, Pc=0.9; currently, the determination of the two values ​​of α and β depends on experimental results. For example, for a certain type of application program, select several programs with known vulnerabilities, substitute the formula into it, and see what the specific values ​​of α and β are closest to the actual situation, and then select this set of α and β values ​​for this type of program.

Images