Living body library-based unknown vulnerability large-scale mining pipeline design and implementation method

Abstract

The invention relates to an unknown vulnerability large-scale mining pipeline design and implementation method based on a living body library, and belongs to the field of network security. The method comprises the steps of inspection, marking, auditing, sorting, mining, simplifying, utilizing and repairing. According to the method, firstly, various vulnerabilities including an operating system, a database, a protocol, application software and the like can be dug and repaired on a large scale; 2, the method is suitable for common computer professional college student technicians to complete; and thirdly, the assembly line is suitable for multi-person cooperation, the overall vulnerability mining and repairing efficiency is greatly improved, the requirement on personal professional skills is greatly reduced, and the assembly line can be effectively applied to the vulnerability attack resistance level of various types of software.

Description

Technical Field

[0001] The present invention belongs to the field of network security, and in particular relates to a design and implementation method of a large-scale mining pipeline for unknown vulnerabilities based on a living body library. Background Art

[0002] Unknown vulnerabilities are the commanding heights that network penetration and network defense are fighting for. Whoever reaches this commanding height will have control over penetration or defense. Unknown vulnerability mining technology refers to the technology of mining unknown vulnerabilities in target software and hardware, involving reverse analysis, fuzz testing, taint analysis, symbolic execution, virtualization, cloud computing and other technologies. It is difficult for one person to master, integrate and apply all these technologies.

[0003] Current vulnerability mining technology mainly relies on technical experts, and it is up to individuals to complete the entire process of mining a single vulnerability. This has practical problems such as low output and low efficiency, and is far from meeting the needs of advanced defense. Summary of the invention

[0004] 1. Technical issues to be resolved

[0005] The technical problem to be solved by the present invention is how to provide a design and implementation method for a large-scale unknown vulnerability mining pipeline based on a living body library to solve the practical problems of low output and low efficiency of current vulnerability mining technology.

[0006] (II) Technical solution

[0007] In order to solve the above technical problems, the present invention proposes a large-scale unknown vulnerability mining pipeline design and implementation method based on a living body library, which includes the following steps:

[0008] Step S1, submitting for inspection: the developer of the target system to be inspected submits the virtual machine of the target system to be inspected to the inspector to generate the original development image of the target system;

[0009] Step S2, marking: R&D personnel and testing personnel work together to analyze the attack surface of the original development image of the target system, and give the attack surface of each module from the three aspects of files received by each module of the target system, wireless signals, and wired network transmission data, and mark them out to generate an attack surface marked image and enter the next stage of the pipeline;

[0010] Step S3, audit: perform vulnerability discovery on the source code in the attack surface marked image through static code auditing, and generate an image containing static clues of suspected vulnerabilities;

[0011] Step S4, sorting: Dynamically verify the static clues of suspicious vulnerabilities by manually generating test cases or using test cases stored in the vulnerability library, and then the R&D personnel and the tester jointly determine the confirmability of the static clues of suspicious vulnerabilities, sort these suspicious vulnerability static clues according to the confirmability, and generate a vulnerability confirmability sorting image from high to low, to provide support for the subsequent priority repair of vulnerabilities that can be dynamically verified;

[0012] Step S5, mining: Based on step S2, dynamic vulnerability mining is performed to mine a large number of program anomalies, namely dynamic vulnerability clues, and a vulnerability dynamic clue image containing an initial abnormal input sample set is generated;

[0013] Step S6, simplification: Based on step S5, collect and analyze the input sample set that causes program abnormalities in the target system, perform deduplication, simplification, grading, and availability analysis on the set, and generate an image containing a simplified abnormal input sample set;

[0014] Step S7, Exploitation: According to the result of step S6, the exploitable vulnerabilities are manually analyzed in depth, and then the detection personnel and the R&D personnel jointly determine the degree of harm of the exploitable vulnerabilities and sort them from high to low, and generate an image containing the vulnerabilities and vulnerability exploitation verification tools;

[0015] Step S8, repair: repair the attack surface and the discovered vulnerabilities in step S2, step S3, and step S7, and finally generate an image containing the target system and code after the vulnerabilities are repaired.

[0016] (III) Beneficial effects

[0017] The present invention proposes a design and implementation method for a large-scale unknown vulnerability mining pipeline based on a living body library. The beneficial effects of the present invention are: a low-threshold, high-yield unknown vulnerability mining and analysis pipeline development method for defense is proposed, which is firstly capable of large-scale mining and repairing various types of vulnerabilities including operating systems, databases, protocols, application software, etc.; secondly, it is suitable for ordinary computer major college students and technicians to complete; thirdly, it is suitable for multi-person collaboration, the overall vulnerability mining and repair efficiency is greatly improved, and the requirements for personal professional skills are greatly reduced. The pipeline can be effectively applied to the level of anti-vulnerability attack of various software. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] Figure 1 It is a flow chart of the present invention. DETAILED DESCRIPTION

[0019] In order to make the purpose, content and advantages of the present invention more clear, the specific implementation methods of the present invention are further described in detail below in conjunction with the drawings and examples.

[0020] The present invention proposes a method for developing a defense-oriented, low-threshold, high-yield unknown vulnerability mining and analysis pipeline. First, it is capable of large-scale mining and repairing various types of vulnerabilities including operating systems, databases, protocols, application software, etc.; second, it is suitable for college students and technicians majoring in ordinary computer science to complete; third, it is suitable for multi-person collaboration, and the overall vulnerability mining and repair efficiency is greatly improved, and the requirements for personal professional skills are greatly reduced. The pipeline can be effectively applied to the level of anti-vulnerability attack of various software.

[0021] This invention is based on the early research of the basic vulnerability living library by our own team. Based on virtualization and cloud computing technology, it contains all the dynamic information of a single vulnerability, can be repeatedly deduced and debugged, and can slice and analyze any single instruction of the vulnerability library. It further builds a vulnerability mining cloud platform. System developers upload the original development image of the target system to the cloud platform, and the detection personnel and R&D personnel conduct in-depth detection of the target system through static code auditing and dynamic vulnerability mining.

[0022] Step S1, submitting for inspection: the developer of the target system to be inspected submits the virtual machine of the target system to be inspected to the inspector, and the virtual machine contains the source code, compilation environment and compiled binary code of the target system, etc., to generate the original development image of the target system;

[0023] According to the network conditions and characteristics of the target system, the virtual machine of the target system to be tested is uploaded to the vulnerability mining cloud platform through offline or remote online methods to generate the original development image of the target system.

[0024] For example, for targets with high confidentiality requirements and many development images, they can be sent directly to the data center where the vulnerability mining cloud platform is located and uploaded directly.

[0025] Step S2, marking: R&D personnel and testing personnel work together to analyze the attack surface of the original development image of the target system, and give the attack surface of each module from three aspects: files received by each module of the target system, wireless signals, and wired network transmission data. Mark them and generate an attack surface marked image to enter the next stage of the pipeline.

[0026] When there is sufficient manpower, R&D personnel and testing personnel will work together to greatly improve the marking efficiency and ensure accurate and complete marking;

[0027] If manpower is limited, some R&D personnel or testers can mark as many attack surfaces as possible. For example, if there are no R&D personnel involved, the testers can find and mark the attack surfaces of the target system by analyzing traffic, checking open ports, checking processed file types, etc.

[0028] Step S3, Audit: Use static code auditing to discover vulnerabilities in the source code of the attack surface marked image, and generate an image containing static clues of suspected vulnerabilities.

[0029] For example, through static review tools such as Fortify, Peking University Kuber, Coverity, etc., static clues of suspicious vulnerabilities can be found, such as the use of dangerous functions that have not undergone security checks, SQL injection vulnerabilities that have not been filtered, and old versions of public libraries with known vulnerabilities.

[0030] Step S4, sorting: Dynamically verify the static clues of suspicious vulnerabilities by manually generating test cases or by using test cases stored in the vulnerability library. Then, the R&D personnel and the testers jointly determine the confirmability of the static clues of suspicious vulnerabilities, sort these suspicious vulnerability static clues according to the confirmability, and generate a vulnerability confirmability sorting image from high to low, to provide support for the subsequent priority repair of vulnerabilities that can be dynamically verified.

[0031] Step S5, mining: Based on step S2, dynamic vulnerability mining is performed, such as fuzz testing, to mine a large number of program anomalies, namely dynamic vulnerability clues, and generate a vulnerability dynamic clue image containing an initial abnormal input sample set.

[0032] For example, in fuzz testing, input samples are randomly generated, unexpected data that are used to input into the target system to discover security vulnerabilities and errors in the target system's applications.

[0033] Step S6, simplification: Based on step S5, collect and analyze the input sample set that causes program abnormalities in the target system, deduplicate, simplify, classify, and perform availability analysis on them, and generate an image containing a simplified abnormal input sample set.

[0034] Step S7, Exploitation: According to the result of step S6, the exploitable vulnerabilities are manually analyzed in depth, and then the detection personnel and the R&D personnel jointly determine the degree of harm of the exploitable vulnerabilities and sort them from high to low, and generate an image containing the vulnerabilities and vulnerability exploitation verification tools;

[0035] Step S8, repair: repair the attack surface and the discovered vulnerabilities in step S2, step S3, and step S7. The repair method includes manual repair and automatic repair. Finally, an image containing the target system and code after the vulnerability repair is generated. Among them, the vulnerabilities that can be dynamically verified are repaired first.

[0036] Embodiment 1:

[0037] A design and implementation method for a large-scale unknown vulnerability mining pipeline based on a living body library. The development method of a low-threshold, high-yield unknown vulnerability mining and analysis pipeline for defense includes the following steps:

[0038] Step A: Submit for inspection. Upload the original development image. The developer of the target system to be inspected sends the target virtual machine to the inspector. The virtual machine contains the target source code, compilation environment, and compiled binary code. Depending on the network conditions, it is uploaded to the vulnerability mining cloud platform through offline or remote online methods to generate the original development image. For example, for targets with high confidentiality requirements and many development images, they can be sent to the data center where the vulnerability mining cloud platform is located and uploaded directly.

[0039] Step B: Marking. R&D personnel and testers analyze the attack surface together, and from the three types of files, wireless signals, and wired network transmission data received by each module, they give the attack surface of each module, mark it, generate an attack surface marking image, and enter the next stage of the pipeline. When there is sufficient manpower, R&D personnel and testers work together to greatly improve the marking efficiency and ensure accurate and complete marking; if there is wired manpower, some R&D personnel or testers mark as many attack surfaces as possible. For example, if there is no R&D personnel involved, the testers will find and mark the external interface of the target system by analyzing traffic, checking open ports, and checking the types of processed files.

[0040] Step C: Audit. Use static code auditing to discover vulnerabilities and generate images containing static clues of suspected vulnerabilities. For example, through static review tools such as Fortify, Peking University Kubler, and Coverity, static clues of suspected vulnerabilities can be found, such as the use of dangerous functions that have not been security checked, SQL injection vulnerabilities that have not been filtered, and old versions of public libraries with known vulnerabilities.

[0041] Step D: Sorting. Verify static vulnerability clues by manually generating test cases or using test cases stored in the vulnerability library, and sort these static clues according to their confirmability, to provide support for the subsequent priority repair of vulnerabilities that can be dynamically verified, and generate a vulnerability confirmability sorting image.

[0042] Step E: Mining. Based on step 2, dynamic vulnerability mining is performed, such as fuzz testing, to mine a large number of anomalies (i.e., dynamic vulnerability clues), and a vulnerability dynamic clue image containing an initial abnormal input sample set is generated.

[0043] Step F: Simplification. Collect and analyze the input sample set that causes program anomalies, perform deduplication, simplification, grading, and exploitability analysis on them, and generate an image containing a simplified abnormal input sample set.

[0044] Step G: Exploit. Exploit the vulnerability and generate an exploit verification tool and an image containing the exploit verification tool.

[0045] Step H: Repair. Repair the discovered vulnerabilities, including manual repair and automatic repair, and generate an image containing the target code after the vulnerability is repaired.

[0046] The beneficial effects of the present invention are as follows: a method for developing a defense-oriented, low-threshold, high-yield unknown vulnerability mining and analysis pipeline is proposed, which is firstly capable of large-scale mining and repairing various types of vulnerabilities including operating systems, databases, protocols, application software, etc.; secondly, it is suitable for ordinary computer major college students and technicians to complete; thirdly, it is suitable for multi-person collaboration, and the overall vulnerability mining and repair efficiency is greatly improved, and the requirements for personal professional skills are greatly reduced. The pipeline can be effectively applied to the level of anti-vulnerability attack of various software.

[0047] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the technical principles of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A large-scale unknown vulnerability mining pipeline design and implementation method based on a living body library, characterized in that: The method comprises the following steps: Step S1, submitting for inspection: the developer of the target system to be inspected submits the virtual machine of the target system to be inspected to the inspector to generate the original development image of the target system; Step S2, marking: R&D personnel and testing personnel work together to analyze the attack surface of the original development image of the target system, and give the attack surface of each module from the three aspects of files received by each module of the target system, wireless signals, and wired network transmission data, and mark them out to generate an attack surface marked image and enter the next stage of the pipeline; Step S3, audit: perform vulnerability discovery on the source code in the attack surface marked image through static code auditing, and generate an image containing static clues of suspected vulnerabilities; Step S4, sorting: Dynamically verify the static clues of suspicious vulnerabilities by manually generating test cases or using test cases stored in the vulnerability library, and then the R&D personnel and the tester jointly determine the confirmability of the static clues of suspicious vulnerabilities, sort these suspicious vulnerability static clues according to the confirmability, and generate a vulnerability confirmability sorting image from high to low, to provide support for the subsequent priority repair of vulnerabilities that can be dynamically verified; Step S5, mining: Based on step S2, dynamic vulnerability mining is performed to mine a large number of program anomalies, namely dynamic vulnerability clues, and a vulnerability dynamic clue image containing an initial abnormal input sample set is generated; Step S6, simplification: Based on step S5, collect and analyze the input sample set that causes program abnormalities in the target system, perform deduplication, simplification, grading, and availability analysis on the set, and generate an image containing a simplified abnormal input sample set; Step S7, Exploitation: According to the result of step S6, the exploitable vulnerabilities are manually analyzed in depth, and then the detection personnel and the R&D personnel jointly determine the degree of harm of the exploitable vulnerabilities and sort them from high to low, and generate an image containing the vulnerabilities and vulnerability exploitation verification tools; Step S8, repair: repair the attack surface and the discovered vulnerabilities in step S2, step S3, and step S7, and finally generate an image containing the target system and code after the vulnerabilities are repaired.

2. The design and implementation method of the large-scale mining pipeline for unknown vulnerabilities based on the living body library as claimed in claim 1 is characterized in that: In step S1, the virtual machine includes the target system source code, the compilation environment and the compiled binary code.

3. The design and implementation method of the large-scale mining pipeline for unknown vulnerabilities based on the living body library as claimed in claim 1 is characterized in that: In step S1, according to the network conditions and the characteristics of the target system, the virtual machine of the target system to be detected is uploaded to the vulnerability mining cloud platform through a close offline or remote online method to generate the original development image of the target system.

4. The design and implementation method of the large-scale mining pipeline for unknown vulnerabilities based on the living body library as claimed in claim 3 is characterized in that: In step S1, for targets with high confidentiality requirements and many development images, they are specifically sent to the data center where the vulnerability mining cloud platform is located and uploaded directly.

5. The design and implementation method of the large-scale mining pipeline for unknown vulnerabilities based on the living body library as claimed in claim 1 is characterized in that: In step S2, when there is sufficient manpower, R&D personnel and detection personnel work together to improve marking efficiency; if manpower is limited, some R&D personnel or detection personnel mark as many attack surfaces as possible; if there is no R&D personnel involved, the detection personnel analyze the traffic, check the open ports, and check the processing file types to find and mark the attack surfaces of the target system.

6. The design and implementation method of the large-scale mining pipeline for unknown vulnerabilities based on the living body library as claimed in claim 1 is characterized in that: In step S3, static clues of suspicious vulnerabilities are found through static review tools, and the static review tools include: Fortify, Peking University Kuber and Coverity.

7. The design and implementation method of the large-scale mining pipeline for unknown vulnerabilities based on the living body library as claimed in claim 1 is characterized in that: In step S4, the vulnerability library contains all dynamic information of a single vulnerability, and can be repeatedly deduced and debugged, and any single instruction can be sliced ​​and analyzed.

8. The design and implementation method of the large-scale mining pipeline for unknown vulnerabilities based on the living body library as claimed in claim 1 is characterized in that: In step S5, a fuzzy testing method is used to perform dynamic vulnerability mining, wherein the input sample in the fuzzy test is randomly generated, unexpected data, which is used to input into the target system to discover security vulnerabilities and errors in the target system application.

9. The design and implementation method of the large-scale mining pipeline for unknown vulnerabilities based on the living body library as claimed in claim 1 is characterized in that: In step S8, the repair method includes two methods: manual repair and automatic repair.

10. The design and implementation method of a large-scale unknown vulnerability mining pipeline based on a living body library as claimed in claim 1, characterized in that: In step S8, vulnerabilities that can be dynamically verified are repaired first.

Images