A network security unknown vulnerability mining guidance path generation method

Abstract

The application provides a network security unknown vulnerability mining guidance path generation method, which comprises basic steps and specific implementation methods; the basic steps comprise complexity calculation of a basic block, complexity calculation of a code segment, complexity calculation of a code path, consideration of influences of a vulnerability risk and a vulnerability probability factor, and priority sorting of the code path; application of the technical solution can evaluate execution difficulty of a path triggering a vulnerability, and paths triggering vulnerabilities easily are preferentially sorted.

Description

Technical Field

[0001] This invention relates to the field of network security vulnerability mining technology, and in particular to a method for generating a guidance path for mining unknown network security vulnerabilities. Background Technology

[0002] Because there may be multiple reachable paths to the basic block containing a cybersecurity vulnerability, and each code path has a different degree of difficulty in triggering the vulnerability, randomly selecting all code paths for vulnerability discovery could take a very long time. Since vulnerability discovery is often time-consuming, the later a vulnerability is discovered, the greater the loss to commercial software. Furthermore, for binary programs, multiple reachable paths to the same vulnerability point often have similar causes; fixing the vulnerability at the vulnerability point will simultaneously eliminate vulnerabilities in other paths. Therefore, it is necessary to prioritize potentially vulnerable code paths, prioritizing paths that are more likely to trigger vulnerabilities, pose a greater threat, and have a higher probability of existence, thus discovering vulnerabilities more quickly. Summary of the Invention

[0003] In view of this, the purpose of this invention is to provide a method for generating guidance paths for discovering unknown network security vulnerabilities, assessing the execution difficulty of paths that trigger vulnerabilities, and prioritizing those paths that are easy to trigger vulnerabilities.

[0004] To achieve the above objectives, the present invention adopts the following technical solution: a method for generating guidance paths for mining unknown network security vulnerabilities, including basic steps and specific implementation methods;

[0005] The basic steps include calculating the complexity of basic blocks, calculating the complexity of code segments, calculating the complexity of code paths, considering the impact of vulnerability risks and vulnerability probability factors, and prioritizing code paths.

[0006] Specific implementation methods include:

[0007] Step 1: Reverse compile the binary program to be exploited into a readable form, and divide it into basic blocks and fragments. A fragment contains one or more basic blocks.

[0008] Step 2: Calculate the complexity of the basic block using the number of instructions and the instruction type;

[0009] Step 3: Calculate the complexity of the fragment by using a weighted summation based on the complexity of each basic block contained in the fragment and the number of basic blocks.

[0010] Step 4: Calculate the complexity of the path by considering the complexity of the segments it passes through and the complexity of the basic blocks.

[0011] Step 5: Predict suspected vulnerability points based on the path complexity calculated in Step 4. Calculate the priority of the path containing the suspected vulnerability point based on the complexity of the path containing the vulnerability and the vulnerability existence factors. The vulnerability existence factors include the frequency of occurrence of the corresponding code for different vulnerability types and the corresponding code complexity.

[0012] Step 6: Sort the paths containing all suspected vulnerability points by priority, prioritizing high-probability vulnerabilities.

[0013] In a preferred embodiment, the complexity calculation of a basic block is specifically as follows: the complexity of each basic block is measured by its number of instructions and instruction types; the more instructions it contains and the more memory read / write instructions it contains, the higher its complexity. The complexity of each basic block is calculated using these two metrics. The complexity calculation of a code segment is specifically as follows: a complexity calculation method is designed for each code segment type. For loop-type code segments, the number of loop iterations, the number of basic blocks within the loop body, and the weighted sum of the basic block complexities are the main metrics for evaluating loop-type code segments. For conditional branch-type code segments, the number of branches and the complexity of each branch's basic block are used as the main metrics for evaluating the complexity of loop-type code segments. The weighted sum of complexity is an important metric for measuring its complexity. The complexity calculation of a code path is specifically as follows: the complexity of the entire code path is calculated primarily by the complexity of the code segments and basic blocks traversed by the path. If-type code segments within the code path should be given greater weight. Considering the impact of vulnerability risk and probability factors, the corresponding predicted probabilities are used; vulnerability points with higher probability of existence have higher priority. The priority ranking of code paths involves prioritizing all suspected vulnerability paths, with higher-priority paths being explored earlier. The paths derived from this priority ranking serve as the guiding strategy for subsequent vulnerability discovery.

[0014] In a preferred embodiment, step 2 specifically includes:

[0015]

[0016] In the formula: Cb represents the complexity of the basic block; ni represents the number of instructions of the corresponding instruction type; This indicates the weight value of the instruction of this instruction type; y represents the influence coefficient, which is usually between 0.01 and 0.1. This represents the distance from the top to the bottom of the stack during each stack operation within the basic block; num represents the total number of instructions in the basic block; during each stack operation, the stack top pointer sp and the stack bottom pointer bp, with the distance between sp and bp representing the size of the stack memory used; the instruction types include data transfer instructions, arithmetic operation instructions, bitwise operation instructions, program flow control instructions, string operation instructions, and processor control instructions; the instruction weight values... The time complexity of the instruction is O(n) to obtain the weight of the instruction. The weight of the instruction depends on its specific function. The time complexity is calculated based on the specific function implemented, and thus the weight of the instruction is obtained.

[0017] In a preferred embodiment, the complexity calculation formula in step 3 is:

[0018]

[0019] In the formula: θi represents the weight of the basic blocks at different levels in the corresponding segment; This represents the complexity of the first basic block in different levels; This indicates the complexity of the second basic block in different levels; the level of the basic block is determined by the conditions reached in this segment.

[0020] In a preferred embodiment, the formula for calculating the path complexity in step 4 is:

[0021] cr=V(G)(cf1+cf2+…)(3)

[0022] V(G)=e-n+2(4)

[0023] Where V(G) is the cyclomatic complexity of a path; cfi is the complexity of all segments involved in the path; e is the number of edges in a path; and n is the number of nodes in the control flow graph.

[0024] In a preferred embodiment, step 5 specifically involves: the frequency of occurrence of the corresponding code refers to the frequency of occurrence of the code corresponding to this type of vulnerability, and the risk level of the vulnerability is determined by the frequency of occurrence of the code corresponding to different vulnerability types and the complexity of the corresponding code.

[0025] The formula for calculating the priority of the path where the suspected vulnerability is located is as follows:

[0026]

[0027] In the formula: Pv represents the probability of a vulnerability occurring; Pc represents the relationship with code complexity; cri represents the complexity of a path, α + β = 1; vulnerability types include stack vulnerabilities, integer overflow vulnerabilities, format string vulnerabilities, heap vulnerabilities, and logic vulnerabilities, where: stack vulnerabilities correspond to Pv = 0.9, Pc = 0.3; integer overflow vulnerabilities correspond to Pv = 0.6, Pc = 0.3; format string vulnerabilities correspond to Pv = 0.6, Pc = 0.6; heap vulnerabilities correspond to Pv = 0.3, Pc = 0.6; and logic vulnerabilities correspond to Pv = 0.3, Pc = 0.9; currently, the determination of the values ​​of α and β depends on experimental results. For example, for a certain type of application program, select several programs with known vulnerabilities, substitute the formula, and see what values ​​of α and β best approximate the actual situation. Then, for this type of program, select this set of α and β values.

[0028] Compared with existing technologies, this invention has the following advantages: This invention utilizes the frequency and complexity of the corresponding code for different vulnerability types to determine the risk level of a vulnerability, and prioritizes all paths containing suspected vulnerability points, giving priority to high-probability vulnerabilities. Simultaneously, it analyzes the potential damage caused by vulnerabilities, prioritizing paths that have a greater impact on system security. Furthermore, it assesses the difficulty of triggering vulnerabilities through specific paths, prioritizing paths that are easily triggered. Attached Figure Description

[0029] Figure 1 This is a flowchart illustrating a preferred embodiment of the present invention. Detailed Implementation

[0030] The present invention will be further described below with reference to the accompanying drawings and embodiments.

[0031] It should be noted that the following detailed descriptions are illustrative and intended to provide further explanation of this application. Unless otherwise specified, all technical and scientific terms used in this invention have the same meaning as commonly understood by one of ordinary skill in the art to which this application pertains.

[0032] It should be noted that the terminology used herein is for the purpose of describing particular implementations only and is not intended to limit the exemplary implementations according to this application; as used herein, the singular form is intended to include the plural form as well, unless the context clearly indicates otherwise; furthermore, it should be understood that when the terms “comprising” and / or “including” are used in this specification, they indicate the presence of features, steps, operations, devices, components and / or combinations thereof.

[0033] A method for generating guidance paths for discovering unknown network security vulnerabilities, referenced Figure 1 The process includes the following steps:

[0034] 1. Basic Steps

[0035] ① Complexity calculation of basic blocks

[0036] The complexity of each basic block is measured by the number and type of instructions. The more instructions it contains, and the more memory read / write instructions it has, the higher its complexity. The complexity of each basic block is calculated using these two metrics.

[0037] ②Calculation of code snippet complexity

[0038] Design a method for calculating the complexity of each code snippet type. For example, for loop-type code snippets, the number of loop iterations, the number of basic blocks within the loop body, and the weighted sum of the complexity of the basic blocks are the main metrics for evaluating loop-type code snippets. For conditional branch-type code snippets, the number of branches and the weighted sum of the complexity of the basic blocks in each branch are important metrics for evaluating their complexity.

[0039] ③ Calculation of code path complexity

[0040] The complexity of the entire code path is primarily calculated by considering the complexity of the code segments and basic blocks traversed along the path. If-type code segments within the path should be given greater weight, as they may represent data integrity verification points along that path. The more data integrity verification points a path passes through, the more difficult it is to construct the corresponding input to reach the vulnerability, meaning the higher the path's complexity.

[0041] ④ The impact of vulnerability risk and vulnerability probability factors

[0042] Since different vulnerability types pose varying degrees of harm, vulnerability risk factors must be considered when prioritizing paths. Furthermore, because the process involves predicting potential vulnerabilities, there are corresponding probabilities; vulnerabilities with higher probabilities of existence have higher priority.

[0043] ⑤ Priority sorting of code paths

[0044] Based on the above factors, all code paths suspected of being vulnerable points are prioritized, with higher-priority paths being explored earlier. The paths determined by this priority ranking serve as the guiding strategy for subsequent vulnerability discovery.

[0045] 2. Specific Implementation Method

[0046] Step 1: Reverse compile the binary program to be exploited into a readable form, and divide it into basic blocks and fragments (a fragment contains one or more basic blocks);

[0047] Step 2: Calculate the complexity of the basic block using the number of instructions and the instruction type;

[0048]

[0049] In the formula:

[0050] Cb — the complexity of a basic block;

[0051] ni — the number of instructions corresponding to the instruction type;

[0052] —The weight value of the instruction of this instruction type;

[0053] y – Influence coefficient, typically ranging from 0.01 to 0.1;

[0054] —The distance from the top to the bottom of the stack during each stack operation involved in the basic block;

[0055] num — the total number of instructions in the basic block.

[0056] During each stack operation, the stack top pointer sp and the stack bottom pointer bp are used. The distance between sp and bp represents the size of the stack memory used. The distance between the stack top and the stack bottom is a common computer representation and will not be elaborated here.

[0057] The instruction types include data transfer instructions, arithmetic operation instructions, bitwise operation instructions, and program flow control instructions.

[0058] String manipulation instructions and processor control instructions.

[0059] The weight value of the instruction The time complexity of the reference instruction is O(n). The weight of the instruction depends on its specific characteristics.

[0060] The time complexity of an instruction is calculated based on its specific implementation, thus determining its weight. The method for calculating O(n) time complexity is generally accepted and will not be elaborated upon here. The correspondence between the instruction weight and its time complexity is shown in Table 1 below:

[0061] Table 1 shows the correspondence between instruction weights and instruction time complexity.

[0062] Serial Number Time complexity Instruction weight value 1 O(1) 1 2 O(n) a 3 <![CDATA[O(n 2 )]]> <![CDATA[a 2 ]]> 4 O(logn) Log(a) 5 O(nlogn) alog(a) 6 <![CDATA[O(n 3 )]]> <![CDATA[a 3 ]]> 7 <![CDATA[O(2 n )]]> <![CDATA[2 a ]]>

[0063] Note: The value of 'a' equals 1 + (number of instruction types) - 1. For example, if there are two instruction types with different time complexities in this basic block, then 'a' = 1 + 2 - 1 = 1.5. Numbers 1-7 correspond to 7 different time complexities, covering the possible time complexity scenarios in the code.

[0064] Step 3: Calculate the complexity of the fragment by using a weighted summation based on the complexity of each basic block contained in the fragment and the number of basic blocks.

[0065] The formula for calculating the complexity of a fragment is:

[0066]

[0067] In the formula: θi — the weight of the basic block at different levels in the corresponding segment; —The complexity of the first basic block in different levels; —The complexity of the second basic block in different levels.

[0068] The hierarchy of a basic block is determined by the conditions reached within that segment. For example, all sequentially executed basic blocks are at the same hierarchy, while those containing conditional statements or loops are at the next lower hierarchy. The weights of different hierarchical levels decrease sequentially. Empirically, θ1 = 1, θi+1 = 0.1θi.

[0069] Step 4: Calculate the path complexity by combining the complexity of the segments traversed and the complexity of the basic blocks; the formula for calculating path complexity is:

[0070] cr=V(G)(cf1+cf2+…)(3)

[0071] V(G)=e-n+2(4)

[0072] Where V(G) is the cyclomatic complexity of a path; cfi is the complexity of all segments involved in the path; e is the number of edges in a path; and n is the number of nodes in the control flow graph.

[0073] By viewing the code in the form of a program flowchart, the number of edges and nodes can be counted intuitively. Alternatively, existing tools such as IDA can be used to obtain the number of edges and nodes.

[0074] Step 5: Predict suspected vulnerability points based on the path complexity calculated in Step 4. Calculate the priority of the path containing the suspected vulnerability point based on the complexity of the path and the vulnerability existence factors. The vulnerability existence factors include the frequency of occurrence of the corresponding code for different vulnerability types and the corresponding code complexity.

[0075] The frequency of occurrence of the corresponding code refers to the frequency with which the code corresponding to that type of vulnerability appears. For example, a stack vulnerability occurs in stack operation code. Because stack operation code appears frequently in the path, the corresponding code for the stack vulnerability appears frequently, thus the stack vulnerability itself appears more frequently. However, stack operation code is relatively simple, meaning its complexity is low and the probability of errors is small; therefore, the probability of a stack vulnerability occurring is low. The frequency of occurrence of the corresponding code and its complexity together determine the level of risk associated with the vulnerability for different vulnerability types.

[0076] The formula for calculating the priority of the path where the suspected vulnerability is located is as follows:

[0077]

[0078] In the formula:

[0079] Pv – Probability of vulnerability occurrence;

[0080] Pc — Corresponding to the relationship with code complexity;

[0081] cri — the complexity of a path, α+β=1.

[0082] The vulnerability types include stack vulnerabilities, integer overflow vulnerabilities, format string vulnerabilities, heap vulnerabilities, and logic vulnerabilities, wherein: the stack vulnerability corresponds to Pv=0.9, Pc=0.3; the integer overflow vulnerability corresponds to Pv=0.6, Pc=0.3; the format string vulnerability corresponds to Pv=0.6, Pc=0.6; the heap vulnerability corresponds to Pv=0.3, Pc=0.6; and the logic vulnerability corresponds to Pv=0.3, Pc=0.9.

[0083] Currently, the determination of the values ​​of α and β depends on experimental results. For example, for a certain type of application program, several programs with known vulnerabilities are selected, the formula is substituted, and the specific values ​​of α and β are seen to be closest to the actual situation. Then, for this type of program, this set of α and β values ​​is selected.

[0084] Step 6: Sort the paths containing all suspected vulnerability points by priority, prioritizing high-probability vulnerabilities.

Claims

1. A method for generating a guidance path for discovering unknown network security vulnerabilities, characterized in that... Includes basic steps and specific implementation methods; The basic steps include calculating the complexity of basic blocks, calculating the complexity of code segments, calculating the complexity of code paths, considering the impact of vulnerability risks and vulnerability probability factors, and prioritizing code paths. Specific implementation methods include: Step 1: Reverse compile the binary program to be exploited into a readable form, and divide it into basic blocks and fragments. A fragment contains one or more basic blocks. Step 2: Calculate the complexity of the basic block using the number of instructions and the instruction type; Step 3: Calculate the complexity of the fragment by using a weighted summation based on the complexity of each basic block contained in the fragment and the number of basic blocks. Step 4: Calculate the complexity of the path by considering the complexity of the segments it passes through and the complexity of the basic blocks. Step 5: Predict suspected vulnerability points based on the path complexity calculated in Step 4. Calculate the priority of the path containing the suspected vulnerability point based on the complexity of the path containing the vulnerability and the vulnerability existence factors. The vulnerability existence factors include the frequency of occurrence of the corresponding code for different vulnerability types and the corresponding code complexity. Step 6: Sort the paths containing all suspected vulnerability points by priority, prioritizing high-probability vulnerabilities; The complexity calculation of basic blocks is as follows: the complexity of each basic block is measured by its number of instructions and instruction types. The more instructions it contains, and the more memory read / write instructions it has, the higher its complexity. The complexity of each basic block is calculated using these two metrics. The complexity calculation of code segments is as follows: a complexity calculation method is designed for each type of code segment. For loop-type code segments, the weighted sum of the loop iterations, the number of basic blocks within the loop body, and the complexity of each basic block is used as the metric. For conditional branch-type code segments, the complexity is calculated by weighting the number of branches and the complexity of each branch's basic block. The summation is an important metric for its complexity. The complexity of a code path is calculated by combining the complexity of the code segments and basic blocks along the path. If-type code segments within the path are given greater weight. The impact of vulnerability risk and probability is considered by predicting the corresponding probabilities; vulnerabilities with higher probabilities are given higher priority. The priority ranking of code paths involves prioritizing all suspected vulnerability paths, with higher-priority paths being explored earlier. The paths derived from this priority ranking serve as the guiding strategy for subsequent vulnerability discovery. Step 2 specifically includes: In the formula: Cb represents the complexity of the basic block; n i Indicates the number of instructions of the corresponding instruction type; This indicates the weight value of the instruction of this instruction type; y represents the influence coefficient, which is usually between 0.01 and 0.

1. This represents the distance from the top to the bottom of the stack during each stack operation within the basic block; num represents the total number of instructions in the basic block; during each stack operation, the stack top pointer sp and the stack bottom pointer bp, with the distance between sp and bp representing the size of the stack memory used; the instruction types include data transfer instructions, arithmetic operation instructions, bitwise operation instructions, program flow control instructions, string operation instructions, and processor control instructions; the instruction weight values... The time complexity of the reference instruction is O(n); the time complexity is calculated based on the specific implementation function, thus obtaining the instruction weight. The complexity calculation formula in step 3 is as follows: In the formula: θi represents the weight of the basic blocks at different levels in the corresponding segment; This represents the complexity of the first basic block in different levels; This indicates the complexity of the second basic block at different levels; the level of the basic block is determined by the conditions reached in this segment. The formula for calculating the path complexity in step 4 is as follows: cr=V(G)(cf1+cf2+…)(3) V(G)=e-n+2(4) Where V(G) is the cyclomatic complexity of a path; cfi is the complexity of all segments involved in the path; e is the number of edges in a path; and n is the number of nodes in the control flow graph. Step 5 specifically involves: the frequency of occurrence of the corresponding code refers to the frequency of occurrence of the code corresponding to this type of vulnerability. The risk level of the vulnerability is determined by the frequency of occurrence of the code corresponding to different vulnerability types and the complexity of the corresponding code. The formula for calculating the priority of the path where the suspected vulnerability is located is as follows: In the formula: P v P represents the probability of a vulnerability occurring. c This indicates the relationship between the code complexity and the complexity of the path; cri represents the complexity of a path, α+β=1; vulnerability types include stack vulnerabilities, integer overflow vulnerabilities, format string vulnerabilities, heap vulnerabilities, and logic vulnerabilities, where: the stack vulnerability corresponds to P v =0.9, P c =0.3; the integer overflow vulnerability corresponds to P v =0.6, P c =0.3; the format string vulnerability corresponds to P v＝ 0.6, P c＝ 0.6; the heap vulnerability corresponds to P v＝ 0.3, P c＝ 0.6; the logical vulnerability corresponds to P v =0.3, P c =0.9; the values ​​of α and β depend on the experimental results.

Images