Code detection method and device and electronic equipment

Abstract

The invention discloses a code detection method and device and electronic equipment, relates to the technical field of network security, and is used for improving the accuracy of code detection and reducing the false alarm rate of code detection. The method comprises the following steps: firstly, constructing a control flow graph (CFG) based on an abstract syntax tree (ATS) corresponding to a to-be-detected code; then, cutting an unreachable path in the CFG to obtain a target reachable path; finally, code detection is executed based on the target reachable path, a code detection result is obtained, and a code detection report is generated. By means of the method, the inaccessible path where codes in the CFG cannot be actually executed is cut, the actually executed reachable path is obtained, code detection is conducted on the actually executed reachable path, the detection efficiency is improved, unnecessary paths are prevented from being detected, and the false alarm rate is reduced.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a code detection method, device and electronic equipment. Background Art

[0002] With the rapid development of computer network technology, the number of existing applications has grown rapidly, resulting in a sharp increase in the amount of code, and the number of unsafe codes has also increased dramatically. Manual review of unsafe codes can no longer meet the needs.

[0003] In the related art, static code detection tools are usually used to detect unsafe codes. When analyzing the code, static code detection tools often try to predict the security of the code without actually executing the code. Since there are unreachable paths in the control flow graph (CFG) (for example, dead code, specific branches in the loop will not be executed under certain conditions), in the static code detection process, the unreachable paths may be mistakenly regarded as reachable paths, which causes the static code detection tool to perform unnecessary analysis on the code on these unreachable paths, thereby increasing the false alarm rate. With the increase in the complexity of the application, the number of paths in the CFG may grow exponentially. When facing a large number of paths, the static code detection tool cannot accurately distinguish which paths are actually reachable and which paths are unreachable. This uncertainty may also cause the static code detection tool to perform incorrect analysis on the code on the unreachable path, thereby generating false alarms. In addition, static code detection tools usually analyze the code data structure as a whole, which also increases the false alarm rate.

[0004] In view of this, how to reduce the false alarm rate in the process of static code detection is an urgent problem that needs to be solved. Summary of the invention

[0005] The embodiments of the present application provide a code detection method, device and electronic device to improve the accuracy of code detection and reduce the false alarm rate.

[0006] In a first aspect, the present application provides a code detection method, the method comprising:

[0007] Based on the abstract syntax tree ATS corresponding to the code to be detected, a control flow graph CFG is constructed;

[0008] Pruning the unreachable paths in the CFG to obtain the target reachable paths;

[0009] Code detection is performed based on the target reachable path, code detection results are obtained, and a code detection report is generated.

[0010] Through the above method, the unreachable paths in the control flow graph are trimmed, and when executing code detection, only the target reachable paths are detected, avoiding unnecessary detection of codes in unreachable paths in related technologies, thereby reducing the false alarm rate.

[0011] In an optional implementation, constructing a control flow graph CFG based on an abstract syntax tree ATS corresponding to the code to be detected includes:

[0012] Based on the code to be detected, construct an abstract syntax tree ATS;

[0013] Converting the abstract syntax tree into a target intermediate code;

[0014] Based on the target intermediate code, a control flow graph CFG is constructed.

[0015] Through the above method, by constructing a control flow graph, it is possible to divide the basic blocks and identify the unreachable paths therein.

[0016] In an optional implementation, pruning the unreachable paths in the CFG to obtain the target reachable paths includes:

[0017] Identify all basic blocks in the CFG;

[0018] Traversing all the basic blocks to determine the basic block containing the branch instruction;

[0019] According to the basic block containing the branch instruction, an unreachable path is determined, and the unreachable path in the CFG is pruned to obtain a target reachable path.

[0020] Through the above method, unreachable paths can be pruned, reducing the number of paths in the control flow graph. When executing code detection, only the code that actually needs to be executed in the reachable path needs to be detected, thereby improving detection efficiency.

[0021] In an optional implementation, after pruning the unreachable paths in the CFG to obtain the target reachable paths, the method further includes:

[0022] Performing a taint analysis operation on the CFG, the taint analysis operation comprising: intra-basic block analysis and inter-basic block analysis;

[0023] The basic block analysis includes:

[0024] Based on the target intermediate code corresponding to the basic block, the variable state in the basic block is analyzed to obtain the exit state corresponding to the basic block, wherein the exit state includes the variable state, whether it is polluted, and the jump address;

[0025] The analysis between the basic blocks includes:

[0026] Based on the target intermediate code corresponding to the basic block, obtaining the branching and merging conditions of the tainted variable;

[0027] Based on the branching and merging conditions of the tainted variable, it is determined whether the basic block is executed.

[0028] Through the above method, taint analysis within a basic block and taint analysis between basic blocks are performed, which can present the entire process from the introduction of taint to the generation of defects.

[0029] In an optional implementation, analyzing the variable status in the basic block includes:

[0030] Determine whether there are complex type variables;

[0031] If so, the multi-level status information corresponding to the complex type variable is recorded.

[0032] Through the above method, multi-level state information of complex type variables is recorded, and the elements inside the complex type variables are analyzed and recorded, avoiding analyzing the complex type variables as a whole and not considering the entire complex type variable as a source, effectively reducing the false alarm rate.

[0033] In an optional implementation, after the taint propagation path in the CFG is trimmed to obtain the target reachable path, the method further includes:

[0034] Get the target hash algorithm from the target file;

[0035] Determine whether the target hash algorithm belongs to the preset hash algorithm set;

[0036] If not, the target hash algorithm is replaced with any preset hash algorithm in the preset hash algorithm set.

[0037] Through the above method, target files such as resource files and configuration files can be detected, avoiding the security risks caused by using unsafe hash algorithms.

[0038] In a second aspect, the present application provides a code detection device, the device comprising:

[0039] A construction module is used to construct a control flow graph CFG based on the abstract syntax tree ATS corresponding to the code to be detected;

[0040] The processing module is used to prune the unreachable paths in CFG to obtain the target reachable paths;

[0041] The detection module is used to perform code detection based on the target reachable path, obtain code detection results, and generate a code detection report.

[0042] In an optional implementation, when constructing a control flow graph CFG based on the abstract syntax tree ATS corresponding to the code to be detected, the processing module is specifically used to:

[0043] Based on the code to be tested, build an abstract syntax tree ATS;

[0044] Convert the abstract syntax tree into target intermediate code;

[0045] Based on the target intermediate code, a control flow graph CFG is constructed.

[0046] In an optional implementation, when pruning the unreachable paths in the CFG to obtain the target reachable paths, the processing module is specifically used to:

[0047] Identify all basic blocks in the CFG;

[0048] Traverse all basic blocks and determine the basic blocks containing branch instructions;

[0049] According to the basic blocks containing branch instructions, the unreachable paths are determined, and the unreachable paths in the CFG are pruned to obtain the target reachable paths.

[0050] In an optional implementation, after pruning the unreachable paths in the CFG to obtain a reachable target, the processing module is further configured to:

[0051] Perform taint analysis operations on CFG, including: analysis within basic blocks and analysis between basic blocks;

[0052] Basic block analysis, including:

[0053] Based on the target intermediate code corresponding to the basic block, the variable status in the basic block is analyzed to obtain the exit status corresponding to the basic block, which includes the variable status, whether it is polluted, and the jump address;

[0054] Analysis between basic blocks, including:

[0055] Based on the target intermediate code corresponding to the basic block, the branching and merging of the tainted variables are obtained;

[0056] Based on the branching and merging of the tainted variables, determine whether the basic block is executed.

[0057] In an optional implementation, when analyzing the variable status in the basic block, the processing module is specifically used to:

[0058] Determine whether there are complex type variables;

[0059] If so, record the multi-level status information corresponding to the complex type variable.

[0060] In an optional implementation, after the taint propagation path in the CFG is trimmed to obtain the target reachable path, the detection module is further used to:

[0061] Get the target hash algorithm from the target file;

[0062] Determine whether the target hash algorithm belongs to the preset hash algorithm set;

[0063] If not, the target hash algorithm is replaced with any preset hash algorithm in the preset hash algorithm set.

[0064] In a third aspect, the present application provides an electronic device comprising a processor and a memory, wherein the memory stores program code, and when the program code is executed by the processor, the processor executes the steps of the code detection method described in the first aspect above.

[0065] In a fourth aspect, the present application provides a computer-readable storage medium, which includes a program code. When the program code is run on an electronic device, the program code is used to enable the electronic device to execute the steps of the code detection method described in the first aspect above.

[0066] In a fifth aspect, the present application provides a computer program product, which, when called by a computer, enables the computer to execute the steps of the code detection method as described in the first aspect.

[0067] In addition, other features and advantages of the present application will be described in the subsequent description, and partly become apparent from the description, or be understood by practicing the present application. The purpose and other advantages of the present application can be realized and obtained by the structures particularly pointed out in the written description, claims, and drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0068] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for describing the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative labor. In the drawings:

[0069] Figure 1 A schematic diagram of an application scenario provided for an embodiment of the present application;

[0070] Figure 2A schematic diagram of an implementation flow of a code detection method provided in an embodiment of the present application;

[0071] Figure 3 A schematic diagram of an unreachable path provided in an embodiment of the present application;

[0072] Figure 4 A schematic diagram of the structure of a code detection method and device provided in an embodiment of the present application;

[0073] Figure 5 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0074] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the technical solution of the present application, rather than all of the embodiments. Based on the embodiments recorded in the application documents, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the technical solution of the present application.

[0075] It should be noted that in the description of this application, "multiple" is understood as "at least two". "And / or" describes the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B can represent three situations: A exists alone, A and B exist at the same time, and B exists alone. A and B are connected, which can represent two situations: A and B are directly connected and A and B are connected through C. In addition, in the description of this application, words such as "first" and "second" are only used for the purpose of distinguishing descriptions, and cannot be understood as indicating or implying relative importance, nor can they be understood as indicating or implying order.

[0076] In addition, the collection, dissemination, and use of data in the technical solution of this application comply with the requirements of relevant national laws and regulations.

[0077] The following is a brief introduction to the design concept of the embodiment of the present application:

[0078] In the related art, static code detection tools are usually used to detect unsafe codes. When analyzing codes, static code detection tools often try to predict the security of codes without actually executing them. Since there are unreachable paths in CFG (e.g., dead code, specific branches in loops will not be executed under certain circumstances), in the static code detection process, unreachable paths may be mistakenly regarded as reachable paths, which causes the static code detection tool to perform unnecessary analysis on the codes on these unreachable paths, thereby increasing the false alarm rate. With the increase of application complexity, the number of paths in CFG may grow exponentially. When facing a large number of paths, static code detection tools cannot accurately distinguish which paths are actually reachable and which paths are unreachable. This uncertainty may also cause the static code detection tool to perform incorrect analysis on the codes on the unreachable paths, thereby generating false alarms. In addition, static code detection tools usually analyze the code data structure as a whole, which also increases the false alarm rate.

[0079] In view of this, the present application provides a code detection method, which includes: first, constructing a control flow graph CFG based on the abstract syntax tree ATS corresponding to the code to be detected; then, pruning the unreachable paths in the CFG to obtain the target reachable path; finally, performing code detection based on the target reachable path, obtaining the code detection result, and generating a code detection report. Through the above method, the impossible paths are filtered out, the number of paths in the CFG is reduced, and when performing code detection, only the code path actually executed needs to be detected, which can effectively reduce the false alarm rate.

[0080] The following describes a code detection method provided by an exemplary embodiment of the present application with reference to the accompanying drawings.

[0081] See also Figure 1 , which is a schematic diagram of possible application scenarios in the embodiment of the present application. The application scenario diagram includes a server and terminal devices (including terminal device 121, terminal device 122...terminal device 12n).

[0082] Exemplarily, the terminal device can access the network and communicate with the server via cellular mobile communication technology, wherein the cellular mobile communication technology, for example, includes the fifth generation mobile communication (5th Generation Mobile Networks, 5G) technology.

[0083] Optionally, the target terminal may access the network and communicate with the server 102 via short-range wireless communication, wherein the short-range wireless communication method, for example, includes Wireless Fidelity (Wi-Fi) technology.

[0084] The terminal device 120 includes but is not limited to mobile phones, tablet computers, laptops, desktop computers, e-readers, intelligent voice interaction devices, vehicle-mounted terminals and other devices; various software can be installed on the terminal device, such as applications and applets, etc., which are not specifically limited in this application.

[0085] Server 102 can be an independent physical server, or a server cluster or distributed system composed of multiple physical servers. It can also be a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, content delivery networks (CDN), as well as big data and artificial intelligence platforms.

[0086] For further information, see Figure 2 As shown, it is a schematic diagram of an implementation process of a code detection method provided in an embodiment of the present application. The specific implementation process of the method is as follows:

[0087] S1: Construct a control flow graph CFG based on the abstract syntax tree ATS corresponding to the code to be detected.

[0088] In an embodiment of the present application, before performing a code detection operation on the code to be detected, a control flow graph CFG needs to be constructed first.

[0089] Specifically, CFG is an abstract representation of a process or program. It is an abstract data structure used in compilers that represents all the paths traversed during the execution of a program or code.

[0090] In an optional implementation, first, an abstract syntax tree ATS is constructed based on the code to be detected. Specifically, the code to be detected can be converted into a structured text language, so that the obtained structured text language can be subjected to syntax analysis and lexical analysis to generate the ATS.

[0091] Further, the abstract syntax tree is converted into a target intermediate code. The intermediate code is a low-code form between the source code and the target code. In the embodiment of the present application, the target intermediate code can be a three-address code (TAC), a static single assignment (SSA), etc. The specific form of the target intermediate code is not specifically limited in the embodiment of the present application.

[0092] Furthermore, after obtaining the target intermediate code, a control flow graph CFG can be constructed based on the target intermediate code. Constructing CFG is to model the control flow of each basic block in the code. CFG is a directed graph, each node corresponds to a basic block, and the edges between nodes are the control flow paths between basic blocks.

[0093] S2: Prune the unreachable paths in CFG to obtain the target reachable paths;

[0094] In the embodiment of the present application, CFG is composed of multiple basic blocks (BB), and the directed edge between every two BBs in CFG is a code execution path.

[0095] Therefore, when pruning unreachable paths in CFG, all BBs in CFG need to be identified.

[0096] Specifically, there is a single-in and single-out branch and no jumps in the BB. The header of each basic block is usually a target instruction (the target of a jump or conditional branch) or an entry program (the first instruction of the program or the beginning of a control flow structure). When dividing each BB, the starting position of the basic block is determined by identifying the header in the code. Whenever a jump instruction is encountered, such as goto, turn, break, continue, etc., or the jump part of a branch condition, if it causes the control flow to jump outside the current basic block, the current basic block ends here. By dividing the starting position and ending position of the code in a basic block, all basic blocks can be determined.

[0097] Further, all basic blocks are traversed to determine the basic blocks containing branch instructions.

[0098] In a basic block, branch instructions are used to change the execution flow of the program, so that the program can selectively execute different code segments based on certain conditions. In a basic block, branch instructions are usually the last instruction to decide whether the program continues to execute the next basic block or jumps to other locations.

[0099] In CFG, basic blocks are represented by nodes, and branch instructions connect different basic blocks through directed edges to represent the jump relationship of the program execution path. Figure 3As shown, for example, CFG includes BB1, BB2, BB3, BB4 and BB5, BB1 is connected to BB2 through a directed edge, BB2 is connected to BB3 and BB4 through directed edges, and BB3 and BB4 are connected to BB5 through directed edges. Among them, BB2 includes branch instructions of the switch, if and other types, and then BB2 is determined to be a branch jump node, so that the BBs before and after the branch jump node can be calculated respectively, so as to determine the next actual jump BB, for example, the next BB that BB2 actually jumps to is BB3, and then the path between BB2 and BB4 can be cut, so that the target reachable path finally obtained is BB2 to BB3, and BB2 to BB4 is an unreachable path.

[0100] Through the above method, by capturing the branch jump nodes between BBs, calculating the BBs before and after the branch jump nodes, and determining the actually executable BBs, the impossible paths are cut, thereby reducing the number of CFG paths.

[0101] In an optional implementation, after the unreachable paths in the CFG are pruned to obtain the target reachable paths, it is also necessary to perform taint analysis within the basic block and taint analysis between basic blocks.

[0102] Specifically, when performing taint analysis within a basic block, the impact of the target intermediate code within the basic block on the variable state can be analyzed based on the target intermediate code corresponding to the basic block to obtain the exit state corresponding to the basic block. Specifically, the exit state includes the variable state, whether it is contaminated, and the jump address.

[0103] Furthermore, when performing taint analysis between basic blocks, the branching and merging of tainted variables can be analyzed based on the target intermediate code corresponding to the basic block. The branch structure at the code level will be displayed as the branch jump of the basic block, which needs to be based on the jump condition fragment. The basic block contains information such as jump address and branch record, which can be used to determine whether the basic block is executed.

[0104] When analyzing statements in BB, the code will continuously update a set of variable information. This set contains all variables that need further analysis. During the analysis process, each variable object not only records whether it is polluted and the constant value, but also records the corresponding multi-level status information.

[0105] When analyzing the variable status in a basic block, it is also necessary to determine whether there are complex type variables, such as array objects, map objects, list objects, struct objects, etc.

[0106] If there are complex type variables, analyze the state changes of the complex type variables and record the multi-level state information corresponding to the complex type variables. For example, the array object maintains the state sequence of each element in the list, the map object records the variable state corresponding to each key-value, the list object maintains the state sequence of each element in the list, and the struct object records the state of each field.

[0107] For another example, in a list object, there are elements 1, 2, and 3. When performing taint analysis, the state change analysis will be performed on each element in the list object. For example, if the analysis result of element 1 is safe, the analysis result of element 2 is unsafe, and the analysis result of element 3 is safe, then the multi-level state information corresponding to the list object is recorded, that is, the state change corresponding to each element.

[0108] Through the above method, it is avoided to analyze the complex type variable as a whole as an object, thereby reducing the situation where the entire complex type variable is misjudged as a source, effectively reducing the false alarm rate.

[0109] S3: Perform code detection based on the target reachable path, obtain code detection results, and generate a code detection report.

[0110] In the embodiment of the present application, a security rule base is pre-set, and when executing code detection, code detection can be performed on the basic blocks on the target reachable path based on the preset security rule base. When executing code detection, static code analysis technology is used to match the code in each basic block on the target reachable path with the security rules in the preset security rule base, and the data flow, control flow, semantics and other information in the basic block are matched with the security rule base, and potential security vulnerabilities in the code are determined therefrom.

[0111] Furthermore, after obtaining the code detection result, a code detection report can also be generated. In the embodiment of the present application, the code detection report includes Common Weakness Enumeration (CWE) ID, which defines the classification of software or hardware vulnerabilities. According to the CWE ID, the code weakness or vulnerability type can be accurately determined, which is convenient for developers to understand the problems that the code may cause and facilitate code repair.

[0112] In the embodiment of the present application, the detection report mainly includes the following fields: type, abbrev, category, shortMessage, LongMessage, classname, sourceLine, start, end, sourcefile, and sourcepath.

[0113] Among them, type is the name of the alarm; abbrev is the abbreviation of the alarm category; category is the alarm category; shortMessage is a simple description of the bug; LongMessage is a detailed description of the bug; classname is the class where the bug is located; sourceLine is the line number where the bug is located; start is the starting line number of the bug; end is the ending line number of the bug; sourcefile is the name of the file where the bug appears; sourcepath is the file path where the bug appears.

[0114] Through the above method, when executing code detection, it is only necessary to perform code detection on the BB on the target reachable path, avoiding false alarms caused by code detection on the BB on the unreachable path, and the generated code detection report can intuitively reflect the problems existing in the code, making subsequent code repair more efficient and quick.

[0115] In an optional implementation, when performing specific code detection, it is also necessary to obtain the target hash algorithm from the target file, and in the embodiment of the present application, a hash algorithm set is preset, and each hash algorithm belonging to the preset hash algorithm set is considered to be a secure hash algorithm.

[0116] Therefore, when the target hash algorithm is obtained from the target file, for example, the target hash algorithm is obtained from the resource file or the configuration file. Then, the target hash algorithm can be matched with each hash algorithm in the preset hash algorithm set to determine whether the target hash algorithm belongs to the preset hash algorithm set. If the target hash algorithm does not belong to the preset hash algorithm set, the target hash algorithm is considered to be an unsafe hash algorithm and there is a security risk. At this time, any preset hash algorithm in the preset hash algorithm set can be used to replace the target hash algorithm.

[0117] Further, based on the same technical concept, the embodiment of the present application provides a code detection method device, which is used to implement the above method flow of the embodiment of the present application. Figure 4 As shown, the device includes: a construction module 401, a processing module 402, and a detection module 403, wherein:

[0118] A construction module 401 is used to construct a control flow graph CFG based on an abstract syntax tree ATS corresponding to the code to be detected;

[0119] Processing module 402, used to prune unreachable paths in CFG to obtain target reachable paths;

[0120] The detection module 403 is used to perform code detection based on the target reachable path, obtain code detection results, and generate a code detection report.

[0121] In an optional implementation, when constructing a control flow graph CFG based on the abstract syntax tree ATS corresponding to the code to be detected, the processing module 402 is specifically used to:

[0122] Based on the code to be tested, build an abstract syntax tree ATS;

[0123] Convert the abstract syntax tree into target intermediate code;

[0124] Based on the target intermediate code, a control flow graph CFG is constructed.

[0125] In an optional implementation, when pruning the unreachable paths in the CFG to obtain the target reachable paths, the processing module is specifically used to:

[0126] Identify all basic blocks in the CFG;

[0127] Traverse all basic blocks and determine the basic blocks containing branch instructions;

[0128] According to the basic blocks containing branch instructions, the unreachable paths are determined, and the unreachable paths in the CFG are pruned to obtain the target reachable paths.

[0129] In an optional implementation, after pruning the unreachable paths in the CFG to obtain a reachable target, the processing module 402 is further configured to:

[0130] Perform taint analysis operations on CFG, including: analysis within basic blocks and analysis between basic blocks;

[0131] Basic block analysis, including:

[0132] Based on the target intermediate code corresponding to the basic block, the variable status in the basic block is analyzed to obtain the exit status corresponding to the basic block, which includes the variable status, whether it is polluted, and the jump address;

[0133] Analysis between basic blocks, including:

[0134] Based on the target intermediate code corresponding to the basic block, the branching and merging of the tainted variables are obtained;

[0135] Based on the branching and merging of the tainted variables, determine whether the basic block is executed.

[0136] In an optional implementation, when analyzing the variable status in the basic block, the processing module 402 is specifically used to:

[0137] Determine whether there are complex type variables;

[0138] If so, record the multi-level status information corresponding to the complex type variable.

[0139] In an optional implementation, after the taint propagation path in the CFG is trimmed to obtain the target reachable path, the detection module 403 is further used to:

[0140] Get the target hash algorithm from the target file;

[0141] Determine whether the target hash algorithm belongs to the preset hash algorithm set;

[0142] If not, the target hash algorithm is replaced with any preset hash algorithm in the preset hash algorithm set.

[0143] Based on the same technical concept, the embodiment of the present application also provides an electronic device, which can implement the code detection method process provided in the above embodiment of the present application. In one embodiment, the electronic device can be a server, or a terminal device or other electronic device. Figure 5 As shown, the electronic device may include:

[0144] At least one processor 501, and a memory 502 connected to the at least one processor 501. The specific connection medium between the processor 501 and the memory 502 is not limited in the embodiment of the present application. Figure 5 In the example, the processor 501 and the memory 502 are connected via a bus 500. The bus 500 is Figure 5 The connections between other components are shown in bold lines, and are not intended to be limiting. The bus 500 can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 5 Only one thick line is used in the figure, but it does not mean that there is only one bus or one type of bus. Alternatively, the processor 501 can also be called a controller, and there is no limitation on the name.

[0145] In the embodiment of the present application, the memory 502 stores instructions that can be executed by at least one processor 501. The at least one processor 501 can execute a code detection method discussed above by executing the instructions stored in the memory 502. The processor 501 can implement Figure 5 The functions of each module in the device shown.

[0146] Among them, the processor 501 is the control center of the device, and can use various interfaces and lines to connect the various parts of the entire control device. By running or executing instructions stored in the memory 502 and calling data stored in the memory 502, the various functions of the device and processing data, the device can be monitored as a whole.

[0147] In one possible design, the processor 501 may include one or more processing units, and the processor 501 may integrate an application processor and a modem processor, wherein the application processor mainly processes an operating system, a user interface, and application programs, and the modem processor mainly processes wireless communications. It is understandable that the modem processor may not be integrated into the processor 501. In some embodiments, the processor 501 and the memory 502 may be implemented on the same chip, and in some embodiments, they may also be implemented separately on separate chips.

[0148] Processor 501 can be a general-purpose processor, such as a CPU, a digital signal processor, an application-specific integrated circuit, a field programmable gate array or other programmable logic device, a discrete gate or transistor logic device, a discrete hardware component, and can implement or execute the methods, steps and logic block diagrams disclosed in the embodiments of the present application. A general-purpose processor can be a microprocessor or any conventional processor, etc. The steps of a code detection method disclosed in the embodiments of the present application can be directly embodied as a hardware processor execution, or a combination of hardware and software modules in the processor.

[0149] The memory 502 is a non-volatile computer-readable storage medium that can be used to store non-volatile software programs, non-volatile computer executable programs and modules. The memory 502 may include at least one type of storage medium, such as a flash memory, a hard disk, a multimedia card, a card-type memory, a random access memory (Random Access Memory, RAM), a static random access memory (Static Random Access Memory, SRAM), a programmable read-only memory (Programmable Read Only Memory, PROM), a read-only memory (Read Only Memory, ROM), an electrically erasable programmable read-only memory (Electrically Erasable Programmable Read-Only Memory, EEPROM), a magnetic memory, a disk, an optical disk, etc. The memory 502 is any other medium that can be used to carry or store a desired program code in the form of an instruction or data structure and can be accessed by a computer, but is not limited thereto. The memory 502 in the embodiment of the present application can also be a circuit or any other device that can realize a storage function, for storing program instructions and / or data.

[0150] By programming the processor 501, the code corresponding to the frequency offset estimation method described in the above embodiment can be fixed into the chip, so that the chip can execute the code when running. Figure 2The steps of a code detection method in the embodiment shown are as follows: How to design and program the processor 501 is a technique known to those skilled in the art and will not be described in detail here.

[0151] Based on the same inventive concept, an embodiment of the present application further provides a storage medium, which stores computer instructions. When the computer instructions are executed on a computer, the computer executes a code detection method discussed above.

[0152] In some possible implementations, the present application also provides various aspects of a code detection method that can also be implemented in the form of a program product, which includes program code. When the program product is run on an apparatus, the program code is used to enable the control device to execute the steps of a code detection method according to various exemplary implementations of the present application described above in this specification.

[0153] It should be noted that, although several units or subunits of the device are mentioned in the above detailed description, this division is merely exemplary and not mandatory. In fact, according to the embodiments of the present application, the features and functions of two or more units described above can be embodied in one unit. Conversely, the features and functions of one unit described above can be further divided into multiple units to be embodied.

[0154] In addition, although the operations of the method of the present application are described in a specific order in the drawings, this does not require or imply that the operations must be performed in this specific order, or that all the operations shown must be performed to achieve the desired results. Additionally or alternatively, some steps may be omitted, multiple steps may be combined into one step, and / or one step may be decomposed into multiple steps.

[0155] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0156] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a server, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the process in the flowchart. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0157] Program code for performing the operations of the present application may be written using any combination of one or more programming languages, including object-oriented programming languages ​​such as Java, C++, etc., and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user computing device, partially on the user device, as a stand-alone software package, partially on the user computing device and partially on a remote computing device, or entirely on a remote computing device or server.

[0158] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0159] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A code detection method, characterized in that: The method comprises: Based on the abstract syntax tree ATS corresponding to the code to be detected, a control flow graph CFG is constructed; Pruning the unreachable paths in the CFG to obtain the target reachable paths; Code detection is performed based on the target reachable path, code detection results are obtained, and a code detection report is generated.

2. The method according to claim 1, characterized in that The construction of a control flow graph CFG based on the abstract syntax tree ATS corresponding to the code to be detected includes: Based on the code to be detected, construct an abstract syntax tree ATS; Converting the abstract syntax tree into a target intermediate code; Based on the target intermediate code, a control flow graph CFG is constructed.

3. The method according to claim 1, characterized in that The pruning of the unreachable paths in the CFG to obtain the target reachable paths includes: Identify all basic blocks in the CFG; Traversing all the basic blocks to determine the basic block containing the branch instruction; According to the basic block containing the branch instruction, an unreachable path is determined, and the unreachable path in the CFG is pruned to obtain a target reachable path.

4. The method according to claim 1, characterized in that After the unreachable paths in the CFG are trimmed to obtain the target reachable paths, the method further includes: Performing a taint analysis operation on the CFG, the taint analysis operation comprising: intra-basic block analysis and inter-basic block analysis; The basic block analysis includes: Based on the target intermediate code corresponding to the basic block, the variable state in the basic block is analyzed to obtain the exit state corresponding to the basic block, wherein the exit state includes the variable state, whether it is polluted, and the jump address; The analysis between the basic blocks includes: Based on the target intermediate code corresponding to the basic block, obtaining the branching and merging conditions of the tainted variable; Based on the branching and merging conditions of the tainted variable, it is determined whether the basic block is executed.

5. The method according to claim 4, characterized in that The analyzing the variable status in the basic block includes: Determine whether there are complex type variables; If so, the multi-level status information corresponding to the complex type variable is recorded.

6. The method according to claim 1, characterized in that After the taint propagation path in the CFG is trimmed to obtain the target reachable path, the method further includes: Get the target hash algorithm from the target file; Determine whether the target hash algorithm belongs to a preset hash algorithm set; If not, the target hash algorithm is replaced with any one of the preset hash algorithms in the preset hash algorithm set.

7. A code detection device, characterized in that: The device comprises: A construction module is used to construct a control flow graph CFG based on the abstract syntax tree ATS corresponding to the code to be detected; The processing module is used to prune the unreachable paths in the CFG to obtain the target reachable paths; The detection module is used to perform code detection based on the target reachable path, obtain code detection results, and generate a code detection report.

8. The device according to claim 7, characterized in that When constructing a control flow graph CFG based on the abstract syntax tree ATS corresponding to the code to be detected, the processing module is specifically used to: Based on the code to be detected, construct an abstract syntax tree ATS; Converting the abstract syntax tree into a target intermediate code; Based on the target intermediate code, a control flow graph CFG is constructed.

9. An electronic device comprising a memory, a processor and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the method according to any one of claims 1 to 6 is implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the method according to any one of claims 1 to 6 is implemented.

Images