A vulnerability reachable path detection method and device combining SCA with SAST

Abstract

The present application provides a vulnerability reachable path detection method and device combining SCA with SAST, the method comprising: obtaining a project to be detected; extracting an entry function based on the project to be detected; when the project to be detected is a source code project or a product project, generating a function call graph based on the call graph generation logic corresponding to the source code project or the call graph generation logic corresponding to the product project; identifying the vulnerability function in the dependent component of the project to be detected based on the preset software bill of materials information through a software component analysis tool; starting from the vulnerability function, performing a depth-first search traversal in the function call graph to detect whether the entry function is traversed; if so, determining the path from the entry function to the vulnerability function as the vulnerability reachable path. The method and device can automatically detect the vulnerability reachable path, thereby determining whether the security vulnerability will be triggered, and then avoiding the invalid troubleshooting of the SCA tool during use, so that the reliability of the SCA tool can be improved.

Description

Technical Field

[0001] The present application relates to the technical field of static vulnerability detection, and more specifically, to a method and device for detecting vulnerability reachable paths by combining SCA with SAST. Background Art

[0002] Software Composition Analysis (SCA) tools can identify open source and third-party components used in software by analyzing binary files, source code, or other related resources, and provide detailed information about these components, such as version numbers and known vulnerabilities.

[0003] However, the existing SCA-based vulnerability accessibility methods do not effectively distinguish between source code projects and product projects, which are two completely different types of projects when testing the projects to be tested. Among them, source code projects mainly focus on the analysis during the code writing process, while product projects are finished products that have been compiled and packaged, and they often undergo code obfuscation, resource integration and other processes. In the case of differences between the above two types of projects, the existing methods fail to specifically analyze the differences between the two, which makes it impossible to accurately adapt to the characteristics of different projects during the detection process, thus affecting the detection accuracy.

[0004] On the other hand, in the software operation mechanism, the entry function, as the starting point of program execution, determines the subsequent execution process and function call path. However, due to the lack of extraction of the entry function, the existing method can only know that there is a call to the vulnerable function in the code, but cannot determine whether the program will execute the method where the vulnerability is located during the actual operation. It can be seen that the security vulnerabilities discovered by the existing methods are only potential and theoretical vulnerabilities, and are not actually triggered in the execution path of the user source code. This will cause a large number of false alarms, resulting in large-scale investigations of such false alarms, resulting in low reliability of the existing SCA tool-based vulnerability accessibility methods.

[0005] Therefore, the existing SCA-based methods for implementing vulnerability reachability have low detection accuracy and high false positive rate. Summary of the invention

[0006] The purpose of this application is to provide a vulnerability reachable path detection method and device combining SCA with SAST, which can automatically detect the vulnerability reachable path, thereby determining whether a security vulnerability will be triggered, and further avoiding invalid troubleshooting during the use of the SCA tool, so as to improve the reliability of the SCA tool.

[0007] The first aspect of the present application provides a vulnerability reachable path detection method combining SCA with SAST, including:

[0008] Get the items to be tested;

[0009] Extracting an entry function based on the item to be detected;

[0010] When the project to be detected is a source code project or a product project, generating a function call graph based on a call graph generation logic corresponding to the source code project or a call graph generation logic corresponding to the product project;

[0011] Using a software component analysis tool based on preset software bill of materials information, identifying vulnerability functions in the dependent components of the project to be tested;

[0012] Taking the vulnerable function as the starting point, a depth-first search traversal is performed in the function call graph to detect whether the entry function is traversed;

[0013] If so, the path from the entry function to the vulnerable function is determined as a vulnerable reachable path.

[0014] In the above implementation process, the method can automatically identify and confirm whether the path from the entry function to the vulnerable function is reachable for the project to be tested, thereby providing application reliability assurance for the SCA (software component analysis) tool.

[0015] Furthermore, the method further comprises:

[0016] Based on a preset component package name association mapping library, the vulnerability reachable paths are classified at the component level to obtain a classification result.

[0017] Further, the extracting entry function based on the item to be detected includes:

[0018] When the project to be detected is a Java project, the main function is determined as the entry function;

[0019] When the project to be detected is a Java Web project, traverse the API routing format based on the preset framework to obtain a first abstract syntax tree; identify the entry function corresponding to the method definition with preset annotations in the abstract syntax tree; the entry function is used to accept external parameters.

[0020] Furthermore, when the project to be detected is a source code project, the generating of a function call graph based on the call graph generating logic corresponding to the source code project includes:

[0021] Traversing the second abstract syntax tree corresponding to the Java source code in the project to be detected to obtain all method definitions;

[0022] Performing symbol resolution on method calls in all method definitions to obtain method call relationships;

[0023] Traversing all the method definitions, so as to determine the corresponding two method definitions as points and the method call relationship as an edge when the method call relationship is an internal call of all the method definitions; or determining the corresponding single method definition as a point, the method call relationship as an edge, and the API corresponding to the external call as a point when the method call relationship is an external call of all the method definitions;

[0024] After traversing all the method definitions, a function call graph is generated based on the points and the edges.

[0025] Furthermore, when the project to be detected is a product project, the generating logic of the call graph corresponding to the product project is based on the call graph to generate the function call graph, including:

[0026] Taking the entry function as a starting point, based on the Java bytecode in the project to be detected, a function call graph starting from the entry function is generated.

[0027] Furthermore, the method further comprises:

[0028] Obtain basic information about the software bill of materials and collect open source vulnerability information;

[0029] Based on the open source vulnerability information, determine the vulnerable function and the outermost API interface;

[0030] Vulnerability summary information is pre-generated based on the software bill of materials basic information, the open source vulnerability information, the vulnerability function and the outermost API interface.

[0031] A second aspect of the present application provides a vulnerability reachable path detection device combining SCA with SAST, and the vulnerability reachable path detection device combining SCA with SAST includes:

[0032] A first acquisition unit, used to acquire an item to be detected;

[0033] An extraction unit, used for extracting an entry function based on the item to be detected;

[0034] A generating unit, configured to generate a function call graph based on a call graph generating logic corresponding to the source code project or a call graph generating logic corresponding to the product project when the project to be detected is a source code project or a product project;

[0035] An identification unit, used to identify the vulnerability functions in the dependent components of the project to be detected based on preset software bill of materials information through a software component analysis tool;

[0036] A traversal unit, used to perform a depth-first search traversal in the function call graph starting from the vulnerable function, and detect whether the entry function is traversed;

[0037] The first determining unit is used to determine the path from the entry function to the vulnerability function as a vulnerable reachable path when traversing to the entry function.

[0038] Furthermore, the SCA combined with SAST vulnerability reachable path detection device also includes:

[0039] The classification unit is used to classify the vulnerability reachable paths at the component level based on a preset component package name association mapping library to obtain a classification result.

[0040] Furthermore, the extraction unit is specifically used to determine the main function as the entry function when the project to be detected is a Java project;

[0041] The extraction unit is specifically used to traverse the API routing format based on the preset framework to obtain a first abstract syntax tree when the project to be detected is a Java Web project; identify the entry function corresponding to the method definition with preset annotations in the abstract syntax tree; and the entry function is used to accept external parameters.

[0042] Furthermore, when the project to be detected is a source code project, the generating unit includes:

[0043] A traversal subunit is used to traverse the second abstract syntax tree corresponding to the Java source code in the project to be detected to obtain all method definitions;

[0044] A parsing subunit, used for performing symbol parsing on method calls in all method definitions to obtain method call relationships;

[0045] The traversal subunit is further used to traverse all the method definitions, so as to determine the corresponding two method definitions as points and the method call relationship as an edge when the method call relationship is an internal call of all the method definitions; or to determine the corresponding single method definition as a point, the method call relationship as an edge, and the API corresponding to the external call as a point when the method call relationship is an external call of all the method definitions;

[0046] A generating subunit is used to generate a function call graph based on the points and the edges after traversing all the method definitions.

[0047] Furthermore, when the project to be detected is a product project, the generating unit is specifically used to generate a function call graph starting from the entry function based on the Java bytecode in the project to be detected, taking the entry function as the starting point.

[0048] Furthermore, the SCA combined with SAST vulnerability reachable path detection device also includes:

[0049] The second acquisition unit is used to obtain basic information of the software bill of materials and collect open source vulnerability information;

[0050] A second determination unit is used to determine the vulnerable function and the outermost API interface based on the open source vulnerability information;

[0051] A pre-generation unit is used to pre-generate vulnerability summary information based on the basic information of the software material list, the open source vulnerability information, the vulnerability function and the outermost API interface.

[0052] The third aspect of the present application provides an electronic device, including a memory and a processor, the memory is used to store a computer program, and the processor runs the computer program to enable the electronic device to execute the SCA combined with SAST vulnerability reachable path detection method described in any one of the first aspect of the present application.

[0053] The fourth aspect of the present application provides a computer-readable storage medium storing computer program instructions. When the computer program instructions are read and executed by a processor, the vulnerability reachable path detection method of SCA combined with SAST described in any one of the first aspect of the present application is executed.

[0054] The beneficial effects of the present application are as follows: the method and device can determine which vulnerabilities really need to be repaired by investing resources by judging the accessibility of the vulnerabilities, thereby reducing the misjudgment of unreachable vulnerabilities, and further improving the accuracy of the assessment of the security risks actually faced by the software;

[0055] At the same time, the method and device can adjust the repair priority of those vulnerabilities that are determined to be unreachable, thereby avoiding wasting manpower, material resources and time on these vulnerabilities and causing the real risks to be ignored;

[0056] In addition, the method and device can also support the detection of source code projects and product projects, thereby improving the flexibility of application. BRIEF DESCRIPTION OF THE DRAWINGS

[0057] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments of the present application will be briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0058] Figure 1 A flowchart of a vulnerability reachable path detection method combining SCA with SAST provided in an embodiment of the present application;

[0059] Figure 2 A flowchart of another SCA combined with SAST vulnerability reachable path detection method provided in an embodiment of the present application;

[0060] Figure 3 An example diagram of a vulnerability function for a log4j vulnerability provided in an embodiment of the present application;

[0061] Figure 4 An example diagram of two common entry functions provided in an embodiment of the present application;

[0062] Figure 5 An example diagram of a function call provided in an embodiment of the present application;

[0063] Figure 6 An example diagram of a vulnerability accessible path provided in an embodiment of the present application;

[0064] Figure 7 An example diagram of a component package name association mapping library provided in an embodiment of the present application;

[0065] Figure 8 A schematic diagram of the structure of a vulnerability reachable path detection device combining SCA and SAST provided in an embodiment of the present application;

[0066] Fig. 9 A schematic diagram of the structure of another SCA combined with SAST vulnerability reachable path detection device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0067] The technical solutions in the embodiments of the present application will be described below in conjunction with the drawings in the embodiments of the present application.

[0068] It should be noted that similar reference numerals and letters represent similar items in the following drawings, so once an item is defined in one drawing, it does not need to be further defined and explained in subsequent drawings. At the same time, in the description of this application, the terms "first", "second", etc. are only used to distinguish the description and cannot be understood as indicating or implying relative importance.

[0069] Example 1

[0070] Please see Figure 1 , Figure 1 A flowchart of a vulnerability reachable path detection method combining SCA with SAST is provided in this embodiment. The vulnerability reachable path detection method combining SCA with SAST includes:

[0071] S101, obtaining items to be tested.

[0072] S102: Extracting an entry function based on the item to be detected.

[0073] As an optional implementation, extracting an entry function based on the item to be detected includes:

[0074] When the project to be detected is a Java project, the main function is determined as the entry function;

[0075] When the project to be detected is a Java Web project, traverse the API routing format based on the preset framework to obtain the first abstract syntax tree; identify the entry function corresponding to the method definition with the preset annotation in the abstract syntax tree; the entry function is used to accept external parameters.

[0076] S103: When the project to be detected is a source code project or a product project, a function call graph is generated based on a call graph generation logic corresponding to the source code project or a call graph generation logic corresponding to the product project.

[0077] In this embodiment, the method can generate a function call graph corresponding to the project to be detected based on the SAST tool.

[0078] In this embodiment, the SAST tool can perform a comprehensive scan and analysis of the source code, and detect security vulnerabilities hidden in the code by converting the source code into intermediate representations such as AST and IR, and relying on analysis techniques such as control flow analysis and data flow analysis. Among them, the inter-procedural taint analysis technology can identify all possible paths from the program entry to the function outbreak point, so that potential risks such as web injection classes can be discovered in the early stages of development.

[0079] As an optional implementation, when the project to be detected is a product project, a function call graph is generated based on a call graph generation logic corresponding to the product project, including:

[0080] Taking the entry function as the starting point, based on the Java bytecode in the project to be detected, a function call graph starting from the entry function is generated.

[0081] In this embodiment, the method takes the entry function as the starting point, and generates a function call graph starting from these entry points based on the entry function. The nodes in the function call graph are the fully qualified signatures of the method definitions, and the edges are the call relationships between the method definitions.

[0082] In this embodiment, the vulnerability function (ie, vulnerability outbreak function) is a node in the function call graph.

[0083] In this embodiment, when facing a product project, the method adopts the RTA algorithm to obtain a higher precision function call compared to the CHA algorithm.

[0084] By implementing this implementation method, the method can give full play to the advantages of SAST tools in fine-grained code analysis and obtain better function call graphs, which is conducive to more reliable reachability analysis and judgment of vulnerabilities in components discovered by SCA tools, and then screen out reachable vulnerabilities and unreachable vulnerabilities, so that R&D personnel can focus on fixing vulnerabilities with real risks and improve R&D efficiency.

[0085] S104: Using a software component analysis tool based on preset software bill of materials information, identify vulnerability functions in dependent components of the project to be tested.

[0086] S105. Starting from the vulnerable function, perform a depth-first search traversal in the function call graph to detect whether the entry function is traversed. If so, execute step S106; if not, end this process.

[0087] S106: Determine the path from the entry function to the vulnerable function as the vulnerable reachable path.

[0088] In this embodiment, the execution subject of the method may be a computing device such as a computer or a server, and no limitation is made in this embodiment.

[0089] In this embodiment, the execution subject of the method may also be a smart device such as a smart phone, a tablet computer, etc., which is not limited in this embodiment.

[0090] It can be seen that the vulnerability reachable path detection method combining SCA with SAST described in this embodiment can automatically detect the vulnerability reachable path, thereby determining whether a security vulnerability will be triggered, and further avoiding invalid troubleshooting during the use of the SCA tool, thereby improving the reliability of the SCA tool.

[0091] Example 2

[0092] Please see Figure 2 , Figure 2A flowchart of a vulnerability reachable path detection method combining SCA with SAST is provided in this embodiment. The vulnerability reachable path detection method combining SCA with SAST includes:

[0093] S201. Obtain basic information of the software bill of materials and collect open source vulnerability information.

[0094] In this embodiment, the method obtains SBOM information (ie, basic information of the software bill of materials) of the open source component through an SCA (software composition analysis) tool.

[0095] In this embodiment, the method uses vulnerability information published on platforms such as open source project code repositories and CVE vulnerability libraries, combined with repair codes, etc.

[0096] S202. Based on the open source vulnerability information, determine the vulnerable function and the outermost API interface.

[0097] In this embodiment, in order to implement the reachability analysis of the vulnerability, the method needs to determine the vulnerability detailed information of the outbreak point corresponding to the vulnerability (ie, the vulnerability function) and the outermost API function (ie, the outermost API interface) corresponding to the vulnerability.

[0098] S203, pre-generate vulnerability summary information based on the basic information of the software bill of materials, open source vulnerability information, vulnerability functions and the outermost API interface.

[0099] In this embodiment, the method can store the open source vulnerability information (including the vulnerability function and the outermost API interface) into the basic information of the software bill of materials according to the agreed format.

[0100] In this embodiment, the open source vulnerability information includes information such as package name, class name, method name, parameter type, return value type, etc., which are used to generate a complete fully qualified signature of the function.

[0101] In this embodiment, the vulnerability function will be used in product detection, and the outermost API interface will be used in source code detection.

[0102] Please see Figure 3 , Figure 3 A vulnerability function example diagram for log4j vulnerabilities is shown, wherein the vulnerability outbreak function and the outermost API function are reflected in the sample code.

[0103] S204: Obtain items to be detected.

[0104] S205: Extract entry functions based on the items to be detected.

[0105] As an optional implementation, an entry function is extracted based on the item to be detected, including:

[0106] When the project to be detected is a Java project, the main function is determined as the entry function;

[0107] When the project to be detected is a Java Web project, traverse the API routing format based on the preset framework to obtain the first abstract syntax tree; identify the entry function corresponding to the method definition with the preset annotation in the abstract syntax tree; the entry function is used to accept external parameters.

[0108] In this embodiment, for a Java project, the main method is the most basic entry function.

[0109] In this embodiment, for Java Web projects, since they are generally built based on open source frameworks such as Spring and Dubbo (i.e., preset frameworks), it is possible to obtain the API entry that can accept external parameters by traversing the abstract syntax tree (AST) corresponding to the code and identifying method definitions with specific annotations based on the API routing format agreed upon by these frameworks.

[0110] Please see Figure 4 , Figure 4 Example diagrams of two common entry functions are shown.

[0111] S206: When the project to be detected is a source code project, traverse the second abstract syntax tree corresponding to the Java source code in the project to be detected to obtain all method definitions.

[0112] In this embodiment, the method can use an open source Java syntax analyzer to perform lexical and syntactic analysis on the Java source code to generate an abstract syntax tree (i.e., a second abstract syntax tree), and at the same time implement type analysis and symbol resolution based on semantic analysis.

[0113] S207: Perform symbol resolution on method calls in all method definitions to obtain method call relationships.

[0114] In this embodiment, the method obtains all method definitions when traversing the abstract syntax tree (AST) corresponding to the source code, and then performs symbol resolution on all method calls in the method definitions. This process can find the method definition corresponding to the current method call.

[0115] S208. Traverse all method definitions to determine the corresponding two method definitions as points and the method call relationship as an edge when the method call relationship is an internal call of all method definitions; or when the method call relationship is an external call of all method definitions, determine the corresponding single method definition as a point, determine the method call relationship as an edge, and determine the API corresponding to the external call as a point.

[0116] In this embodiment, when both method definitions are from self-developed code (i.e., internal calls), the method can establish a pointing relationship (i.e., a calling relationship) between the two current methods, and determine the calling relationship as an edge in the function call graph, and determine the two method definitions as two nodes in the function call graph. The method definition is represented by the fully qualified signature of the method.

[0117] In this embodiment, when the method definition calls the JRE core class library or a third-party dependency package, the method establishes a call relationship between the method definition and the called content, and marks the call relationship method with a fromLib tag, wherein the called content marked with fromLib has a potential corresponding relationship with the outermost API of the component.

[0118] In this embodiment, when facing a source code project, the method can use CHA class inheritance analysis to point to the method definition in the corresponding subclass, thereby avoiding the problem of "the method definition obtained by method call parsing is the method in the parent class" due to the characteristics of Java language inheritance and polymorphism.

[0119] S209. After traversing all method definitions, a function call graph is generated based on the points and edges.

[0120] In this embodiment, after traversing all method definitions in the AST, the method can obtain a global function call graph, wherein the nodes in the function call graph represent method definitions in the self-developed code or method calls marked with fromLib, and the edges represent call relationships.

[0121] As an optional implementation, when the project to be detected is a product project, generating a function call graph based on the project to be detected includes:

[0122] Taking the entry function as the starting point, based on the Java bytecode in the project to be detected, a function call graph starting from the entry function is generated.

[0123] In this embodiment, SAST has different function call graph generation logic for source code projects and product projects. Among them, since source code detection only targets self-developed code, it can generate a function call graph for the entire program, while product detection should generate a function call graph starting from the entry of the self-developed code because it has third-party dependent code. Figure 5 , Figure 5 A function call example diagram is shown. Figure 5 The purpose of is to show the function call relationship, and the diagram does not need to delve into the specific function content.

[0124] S210: Using a software component analysis tool based on preset software bill of materials information, identify vulnerability functions in dependent components of the project to be tested.

[0125] In this embodiment, the method can identify the components that the project directly and indirectly depends on based on files such as pom through the SCA tool, and identify components with vulnerable function information by matching component information with the SBOM information knowledge base.

[0126] S211. Starting from the vulnerable function, perform a depth-first search traversal in the function call graph to detect whether the entry function is traversed. If so, execute step S212; if not, end this process.

[0127] In this embodiment, the method can detect source code and bytecode, starting from the outermost API function and the outbreak point vulnerability function, and perform a depth-first search traversal from back to front in the corresponding function call graph. If the entry function can be matched, the vulnerability is reachable, otherwise it is unreachable.

[0128] S212: Determine the path from the entry function to the vulnerable function as the vulnerable reachable path.

[0129] In this embodiment, the method can output the path from the entry function to the vulnerability function as a vulnerability reachable path, wherein the vulnerability reachable path can be multiple.

[0130] S213: Based on a preset component package name association mapping library, classify the vulnerability reachable paths at the component level to obtain a classification result.

[0131] In this embodiment, the method can use the component package name association mapping library to classify the function information in the vulnerability reachable path according to the component, so that when the reachable path is displayed, it can be clearly known in which component the current function is located. Figure 6 , Figure 6 An example graph of a vulnerability reachable path is shown.

[0132] In this embodiment, the method can pre-establish a component package name association mapping library between components and package names. Since component information such as groupId, artifactId, version, etc. in package managers such as Maven do not have a strict naming format, it is necessary to pre-establish a component package name mapping library. Figure 7 An example diagram of a component package name association mapping library is shown, wherein the method can quickly map the component where the search content is located according to the package name information in the function signature based on the mapping library, thereby facilitating more effective determination of the location of the function in the reachability path.

[0133] In this embodiment, the execution subject of the method may be a computing device such as a computer or a server, and no limitation is made in this embodiment.

[0134] In this embodiment, the execution subject of the method may also be a smart device such as a smart phone, a tablet computer, etc., which is not limited in this embodiment.

[0135] It can be seen that the vulnerability reachable path detection method of SCA combined with SAST described in this embodiment can extract both the vulnerability outbreak point function and the outermost API function that reaches the vulnerability for the same public component vulnerability, and simultaneously take into account the function-level vulnerability reachability analysis of source code and product projects. Then, it is also possible to quickly locate the component where the function is located through the function signature by building a mapping library that associates components with package names. Finally, it is also possible to accurately build a function call graph for source code and product projects and automatically extract reachable entry functions, thereby covering all possible reachable paths.

[0136] Example 3

[0137] Please see Figure 3 , Figure 3 This is a schematic diagram of the structure of a vulnerability reachable path detection device combining SCA and SAST provided in this embodiment. Figure 3 As shown, the vulnerability reachable path detection device of SCA combined with SAST includes:

[0138] A first acquisition unit 310 is used to acquire an item to be detected;

[0139] An extraction unit 320, used for extracting an entry function based on the item to be detected;

[0140] A generating unit 330 is used to generate a function call graph based on a call graph generation logic corresponding to the source code project or a call graph generation logic corresponding to the product project when the project to be detected is a source code project or a product project;

[0141] The identification unit 340 is used to identify the vulnerability functions in the dependent components of the project to be detected based on the preset software bill of materials information through the software component analysis tool;

[0142] A traversal unit 350 is used to perform a depth-first search traversal in the function call graph starting from the vulnerability function to detect whether the entry function is traversed;

[0143] The first determining unit 360 is used to determine the path from the entry function to the vulnerability function as a vulnerability reachable path when traversing to the entry function.

[0144] In this embodiment, the explanation of the vulnerability reachable path detection device combining SCA with SAST can refer to the description in Embodiment 1 or Embodiment 2, which will not be elaborated in this embodiment.

[0145] It can be seen that the vulnerability reachable path detection device combining SCA with SAST described in this embodiment can automatically detect the vulnerability reachable path, thereby determining whether a security vulnerability will be triggered, and further avoiding invalid troubleshooting during the use of the SCA tool, thereby improving the reliability of the SCA tool.

[0146] Example 4

[0147] Please see Figure 4 , Figure 4 This is a schematic diagram of the structure of a vulnerability reachable path detection device combining SCA and SAST provided in this embodiment. Figure 4 As shown, the vulnerability reachable path detection device of SCA combined with SAST includes:

[0148] A first acquisition unit 310 is used to acquire an item to be detected;

[0149] An extraction unit 320, used for extracting an entry function based on the item to be detected;

[0150] A generating unit 330, configured to generate a function call graph based on the item to be detected;

[0151] The identification unit 340 is used to identify the vulnerability functions in the dependent components of the project to be detected based on the preset software bill of materials information through the software component analysis tool;

[0152] A traversal unit 350 is used to perform a depth-first search traversal in the function call graph starting from the vulnerability function to detect whether the entry function is traversed;

[0153] The first determining unit 360 is used to determine the path from the entry function to the vulnerability function as a vulnerability reachable path when traversing to the entry function.

[0154] As an optional implementation, the vulnerability reachable path detection device combining SCA with SAST also includes:

[0155] The classification unit 370 is used to classify the vulnerability reachable paths at the component level based on a preset component package name association mapping library to obtain a classification result.

[0156] As an optional implementation, the extraction unit 320 is specifically configured to determine the main function as the entry function when the project to be detected is a Java project;

[0157] The extraction unit 320 is specifically used to traverse the API routing format based on the preset framework to obtain the first abstract syntax tree when the project to be detected is a Java Web project; identify the entry function corresponding to the method definition with preset annotations in the abstract syntax tree; the entry function is used to accept external parameters.

[0158] As an optional implementation, when the project to be detected is a source code project, the generating unit 330 includes:

[0159] A traversal subunit 331 is used to traverse the second abstract syntax tree corresponding to the Java source code in the project to be detected to obtain all method definitions;

[0160] The parsing subunit 332 is used to perform symbol parsing on the method calls in all method definitions to obtain method call relations;

[0161] The traversal subunit 331 is further used to traverse all method definitions, so as to determine the corresponding two method definitions as points and the method call relationship as an edge when the method call relationship is an internal call of all method definitions; or to determine the corresponding single method definition as a point, the method call relationship as an edge, and the API corresponding to the external call as a point when the method call relationship is an external call of all method definitions;

[0162] The generating subunit 333 is used to generate a function call graph based on the points and edges after traversing all method definitions.

[0163] As an optional implementation, when the project to be detected is a product project, the generation unit 330 is specifically used to generate a function call graph starting from the entry function based on the Java bytecode in the project to be detected, taking the entry function as the starting point.

[0164] As an optional implementation, the vulnerability reachable path detection device combining SCA with SAST also includes:

[0165] The second acquisition unit 380 is used to acquire basic information of the software bill of materials and collect open source vulnerability information;

[0166] A second determining unit 390 is used to determine the vulnerable function and the outermost API interface based on the open source vulnerability information;

[0167] The pre-generation unit 400 is used to pre-generate vulnerability summary information based on the basic information of the software bill of materials, open source vulnerability information, vulnerability functions and the outermost API interface.

[0168] In this embodiment, the explanation of the vulnerability reachable path detection device combining SCA with SAST can refer to the description in Embodiment 1 or Embodiment 2, which will not be elaborated in this embodiment.

[0169] It can be seen that the vulnerability reachable path detection device combining SCA and SAST described in this embodiment can extract both the vulnerability outbreak point function and the outermost API function that reaches the vulnerability for the same public component vulnerability, and simultaneously take into account the function-level vulnerability reachability analysis of the source code and product projects. Then, it is also possible to quickly locate the component where the function is located through the function signature by building a mapping library that associates components with package names. Finally, it is also possible to accurately build a function call graph for source code and product projects and automatically extract reachable entry functions, thereby covering all possible reachable paths.

[0170] An embodiment of the present application provides an electronic device, including a memory and a processor, wherein the memory is used to store a computer program, and the processor runs the computer program to enable the electronic device to execute the vulnerability reachable path detection method combining SCA with SAST in embodiment 1 or embodiment 2 of the present application.

[0171] An embodiment of the present application provides a computer-readable storage medium storing computer program instructions. When the computer program instructions are read and executed by a processor, the vulnerability reachable path detection method combining SCA with SAST in embodiment 1 or embodiment 2 of the present application is executed.

[0172] In several embodiments provided in the present application, it should be understood that the disclosed devices and methods can also be implemented in other ways. The device embodiments described above are merely schematic. For example, the flowcharts and block diagrams in the accompanying drawings show the possible architecture, functions and operations of the devices, methods and computer program products according to multiple embodiments of the present application. In this regard, each box in the flowchart or block diagram can represent a module, a program segment or a part of a code, and the module, a program segment or a part of a code contains one or more executable instructions for implementing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two consecutive boxes can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flowchart, and the combination of boxes in the block diagram and / or flowchart can be implemented with a dedicated hardware-based system that performs a specified function or action, or can be implemented with a combination of dedicated hardware and computer instructions.

[0173] In addition, the functional modules in the various embodiments of the present application may be integrated together to form an independent part, or each module may exist separately, or two or more modules may be integrated to form an independent part.

[0174] If the function is implemented in the form of a software function module and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application can be essentially or partly embodied in the form of a software product that contributes to the prior art. The computer software product is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, server, or network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, and other media that can store program codes.

[0175] The above description is only an embodiment of the present application and is not intended to limit the scope of protection of the present application. For those skilled in the art, the present application may have various changes and variations. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application should be included in the scope of protection of the present application. It should be noted that similar reference numerals and letters represent similar items in the following drawings, so once an item is defined in one drawing, it does not need to be further defined and explained in the subsequent drawings.

[0176] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

[0177] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

Claims

1. A vulnerability reachable path detection method combining SCA with SAST, characterized in that: include: Get the items to be tested; Extracting an entry function based on the item to be detected; When the project to be detected is a source code project or a product project, generating a function call graph based on a call graph generation logic corresponding to the source code project or a call graph generation logic corresponding to the product project; Using a software component analysis tool based on preset software bill of materials information, identifying vulnerability functions in the dependent components of the project to be detected; the vulnerability functions include the outermost API function and the outbreak point vulnerability function; Taking the vulnerable function as the starting point, a depth-first search traversal is performed in the function call graph to detect whether the entry function is traversed; If so, the path from the entry function to the vulnerable function is determined as a vulnerable reachable path.

2. The vulnerability reachable path detection method combining SCA with SAST according to claim 1 is characterized in that: The method further comprises: Based on a preset component package name association mapping library, the vulnerability reachable paths are classified at the component level to obtain a classification result.

3. The vulnerability reachable path detection method combining SCA with SAST according to claim 1 is characterized in that: The step of extracting an entry function based on the item to be detected includes: When the project to be detected is a Java project, the main function is determined as the entry function; When the project to be detected is a Java Web project, traverse the API routing format based on the preset framework to obtain a first abstract syntax tree; identify the entry function corresponding to the method definition with preset annotations in the abstract syntax tree; the entry function is used to accept external parameters.

4. The vulnerability reachable path detection method combining SCA with SAST according to claim 1 is characterized in that: When the project to be detected is a source code project, the generating a function call graph based on the call graph generating logic corresponding to the source code project includes: Traversing the second abstract syntax tree corresponding to the Java source code in the project to be detected to obtain all method definitions; Performing symbol resolution on method calls in all method definitions to obtain method call relationships; Traversing all the method definitions, so as to determine the corresponding two method definitions as points and the method call relationship as an edge when the method call relationship is an internal call of all the method definitions; or determining the corresponding single method definition as a point, the method call relationship as an edge, and the API corresponding to the external call as a point when the method call relationship is an external call of all the method definitions; After traversing all the method definitions, a function call graph is generated based on the points and the edges.

5. The vulnerability reachable path detection method combining SCA with SAST according to claim 1 is characterized in that: When the project to be detected is a product project, the generating of a function call graph based on the call graph generating logic corresponding to the product project includes: Taking the entry function as a starting point, based on the Java bytecode in the project to be detected, a function call graph starting from the entry function is generated.

6. The vulnerability reachable path detection method combining SCA with SAST according to claim 1 is characterized in that: The method further comprises: Obtain basic information about the software bill of materials and collect open source vulnerability information; Based on the open source vulnerability information, determine the vulnerable function and the outermost API interface; Vulnerability summary information is pre-generated based on the software bill of materials basic information, the open source vulnerability information, the vulnerability function and the outermost API interface.

7. A vulnerability reachable path detection device combining SCA with SAST, characterized in that: The SCA combined with SAST vulnerability reachable path detection device includes: A first acquisition unit, used to acquire an item to be detected; An extraction unit, used for extracting an entry function based on the item to be detected; A generating unit, configured to generate a function call graph based on a call graph generating logic corresponding to the source code project or a call graph generating logic corresponding to the product project when the project to be detected is a source code project or a product project; An identification unit, used to identify the vulnerability functions in the dependent components of the project to be detected based on the preset software bill of materials information through a software component analysis tool; the vulnerability functions include the outermost API function and the outbreak point vulnerability function; A traversal unit, used to perform a depth-first search traversal in the function call graph starting from the vulnerable function, and detect whether the entry function is traversed; The first determining unit is used to determine the path from the entry function to the vulnerability function as a vulnerable reachable path when traversing to the entry function.

8. The SCA combined with SAST vulnerability reachable path detection device according to claim 7 is characterized in that: The SCA combined with SAST vulnerability reachable path detection device also includes: The classification unit is used to classify the vulnerability reachable paths at the component level based on a preset component package name association mapping library to obtain a classification result.

9. An electronic device, characterized in that: The electronic device includes a memory and a processor, the memory is used to store a computer program, and the processor runs the computer program to enable the electronic device to execute the vulnerability reachable path detection method combining SCA with SAST as described in any one of claims 1 to 6.

10. A readable storage medium, characterized in that: The readable storage medium stores computer program instructions, and when the computer program instructions are read and executed by a processor, the vulnerability reachable path detection method combining SCA with SAST as described in any one of claims 1 to 6 is executed.

Images