Security data penetration testing method

Abstract

The invention provides a security data penetration test method. The method comprises the steps of pre-establishing a multi-thread application program race condition vulnerability feature library, performing static analysis on source codes of a target application program, identifying potential race condition vulnerability points, and obtaining a preliminary vulnerability candidate set; for monitored suspected race condition events, abstracting event context information into constraint conditions, exploring an input combination of suspected static conditions by using a constraint solver, and determining a minimum input set of stable triggering race conditions; aiming at memory models and synchronous primitives of different programming languages, obtaining a race condition inverse mode, and extracting universal utilization primitives covering various race condition vulnerabilities; in the penetration test process, static analysis, dynamic monitoring and symbolic execution are applied to mine race condition vulnerabilities of a target application system, the availability of the vulnerabilities is verified, and evaluation of system security is assisted to be completed.

Description

Technical Field

[0001] The present invention relates to the field of information technology, and in particular to a security data penetration testing method. Background Art

[0002] Race conditions are a common and thorny problem in multithreaded applications. When multiple threads access shared resources concurrently, data inconsistency and abnormal program behavior may occur if there is no proper synchronization mechanism. When using race conditions to attack in penetration testing, the challenge is how to reliably trigger race conditions. Due to the uncertainty of thread scheduling, race conditions have a certain degree of randomness and unpredictability. Attackers need to develop precise techniques to operate on shared resources within a specific time window to increase the probability of race conditions. At the same time, the impact of different programming languages ​​and concurrency models on race conditions is also worth further study. For example, in languages ​​that use explicit locks, if the granularity of the lock is too large or the lock is used improperly, new race conditions may be introduced. In a concurrency model based on message passing, if the order of sending and receiving messages is not guaranteed, race conditions may also occur. Therefore, when conducting penetration testing, it is necessary to fully consider the technology stack used by the target application and conduct in-depth analysis of its concurrency mechanism to discover and exploit potential race condition vulnerabilities. Summary of the invention

[0003] The present invention provides a security data penetration testing method, which mainly includes:

[0004] Pre-establish a multi-threaded application race condition vulnerability feature library, perform static analysis on the target application source code, identify potential race condition vulnerability points, and obtain a preliminary set of vulnerability candidates;

[0005] Based on the vulnerability candidate set, a multi-threaded interaction scenario that can trigger race conditions is established and constructed. Through dynamic instrumentation, the access of multiple threads to shared resources is monitored in real time during the application runtime to capture suspected static condition events.

[0006] For suspected race condition events monitored, the event context information is abstracted into constraints, and the constraint solver is used to explore the input combination of suspected static conditions to determine the minimum input set that stably triggers the race condition.

[0007] Monitor whether a race condition is triggered. If a race condition is triggered, analyze the impact of the race condition on the data integrity and behavior correctness of the application, construct an attack payload that uses the race condition to execute arbitrary code or elevate permissions, and evaluate the harmfulness of the race condition vulnerability.

[0008] Targeting the memory models and synchronization primitives of different programming languages, we can obtain race condition anti-patterns and extract common exploit primitives that cover various race condition vulnerabilities.

[0009] During the penetration test, static analysis, dynamic monitoring, and symbolic execution are used to discover race condition vulnerabilities in the target application system and verify the exploitability of the vulnerabilities to assist in completing the assessment of system security.

[0010] Obtain typical race condition vulnerability cases of multi-threaded applications, summarize the causes, triggering conditions, exploitation methods and repair solutions of the vulnerabilities, improve the race condition vulnerability knowledge base, and integrate the summarized race condition vulnerability knowledge and exploitation primitives into automated vulnerability mining and penetration testing tools.

[0011] The technical solution provided by the embodiment of the present invention may have the following beneficial effects:

[0012] The present invention discloses a security data penetration testing method. The method first establishes a race condition vulnerability feature library and identifies potential vulnerability points through static analysis. Then, a multi-threaded interaction scenario is designed, and the dynamic stub technology is used to monitor shared resource access and capture suspected race condition events. For the captured events, the context information is abstracted into constraint conditions by using symbolic execution technology, and the input combination that triggers the race condition is explored by using a constraint solver. The impact of the race condition on the application is further analyzed, and an attack payload is constructed to evaluate the vulnerability hazard. The present invention also studies the concurrency mode of different programming languages ​​and extracts general exploitation primitives. In the penetration test, the present invention comprehensively uses static analysis, dynamic monitoring and symbolic execution technologies to comprehensively mine race condition vulnerabilities. By analyzing typical cases, the present invention continuously improves the vulnerability knowledge base and integrates relevant knowledge and exploitation primitives into automated tools. The present invention realizes efficient detection, verification and utilization of race condition vulnerabilities in multi-threaded applications, providing strong support for improving system security. BRIEF DESCRIPTION OF THE DRAWINGS

[0013] Figure 1 The present invention is a flowchart of a security data penetration testing method.

[0014] Figure 2 A schematic diagram of a security data penetration testing method of the present invention.

[0015] Figure 3 It is another schematic diagram of a security data penetration testing method of the present invention. DETAILED DESCRIPTION

[0016] In order to further understand the content of the present invention, the present invention is described in detail in conjunction with the accompanying drawings and embodiments. The present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It is understood that the specific embodiments described herein are only used to explain the relevant inventions, rather than to limit the invention. It is also necessary to explain that, for ease of description, only the parts related to the invention are shown in the accompanying drawings.

[0017] like Figure 1-3 In this embodiment, a security data penetration testing method may specifically include:

[0018] Step S101, pre-establish a multi-threaded application race condition vulnerability feature library, perform static analysis on the source code of the target application, identify potential race condition vulnerability points, and obtain a preliminary vulnerability candidate set.

[0019] Extract key features according to a pre-established multi-threaded application race condition vulnerability feature library, the key features including vulnerability patterns, code structures and variable dependencies; receive the source code of the target application, perform static analysis on the source code using a matching method based on regular expressions and syntax analysis, identify potential race condition vulnerability points, and obtain a preliminary set of vulnerability candidates; perform deep semantic analysis on the preliminary set of vulnerability candidates, perform code structure analysis through an abstract syntax tree, simulate the program execution path, extract context information of each candidate vulnerability point, and generate a vulnerability feature vector; perform data preprocessing and feature selection on the vulnerability feature vector, map the feature vector to a high-dimensional feature space using a support vector machine algorithm, construct an optimal classification hyperplane, and obtain a preliminary list of race condition vulnerabilities.

[0020] Exemplarily, a multi-threaded application race condition vulnerability feature library is pre-established, known race condition vulnerability samples are collected, key features are extracted, a feature representation method is designed, and a matching algorithm based on regular expressions and syntax analysis is used to perform static analysis on the source code of the target application, identify potential race condition vulnerability points, and obtain a preliminary set of vulnerability candidates. According to the feature patterns defined in the pre-established vulnerability feature library, a deep semantic analysis is performed on the preliminarily screened vulnerability candidate set, an abstract syntax tree is used for code structure analysis, and the program execution path is simulated using symbolic execution technology to extract the context information, variable dependencies, and control flow graph of each candidate vulnerability point, and multi-threaded synchronization primitives are identified and analyzed at the same time to generate a detailed vulnerability feature vector. Data preprocessing and feature selection are performed on the generated vulnerability feature vector, and feature dimension reduction is performed using principal component analysis. Then, the feature vector is mapped to a high-dimensional feature space using a support vector machine algorithm, and an optimal classification hyperplane is constructed. Each potential vulnerability point is accurately classified and scored to obtain a preliminary list of race condition vulnerabilities. The preliminary vulnerability list is screened based on the risk score to determine high-risk vulnerabilities that require in-depth analysis. Code path analysis is performed on the selected high-risk race condition vulnerabilities. Taint analysis technology is used to track the propagation of shared variables. Data flow graphs and control flow graphs are constructed to track the transfer process of variables between multiple threads, locate key shared resource access points, and generate detailed vulnerability location reports. When pre-establishing a multi-threaded application race condition vulnerability feature library, 100 known race condition vulnerability samples are collected to extract key features such as shared variable access mode, thread synchronization operation, and resource release order. The feature representation method is designed using a vector space model, and each feature is represented by a binary value. A matching method based on regular expressions and syntax analysis is used to perform static analysis on the source code of the target application. The abstract syntax tree is traversed using depth-first search to identify potential race condition vulnerability points. A deep semantic analysis is performed on the initially screened vulnerability candidate set. The code structure is analyzed using an abstract syntax tree to construct a tree structure containing node types, variable scopes, and control dependencies. Symbolic execution technology is used to simulate the program execution path and generate path constraints. Context information for each candidate vulnerability point is extracted, including code snippets before and after 5 lines. Variable dependencies are analyzed and a data dependency graph is constructed. Generate a control flow graph and identify key branches and loop structures. Also identify and analyze the use of multi-threaded synchronization primitives, such as mutexes, semaphores, and conditional variables. Integrate this information to generate a 200-dimensional vulnerability feature vector. Perform data preprocessing on the generated vulnerability feature vector, including normalization and missing value processing. Use principal component analysis to reduce feature dimensionality, retain 95% of the variance information, and reduce the feature dimension to 50 dimensions. Then use the support vector machine algorithm and the radial basis kernel function to map the feature vector to a high-dimensional feature space, and construct the optimal classification hyperplane through iterative optimization.Accurately classify and score each potential vulnerability point, with a score range of 0-100, to obtain a preliminary list of race condition vulnerabilities. Screen the preliminary vulnerability list based on the risk score, set the threshold to 80 points, and identify high-risk vulnerabilities that require in-depth analysis. Perform code path analysis on the screened high-risk race condition vulnerabilities, use taint analysis technology to track the propagation of shared variables, build forward slices and backward slices, and mark taint sources and sinks. Build a data flow graph to represent the variable assignment and usage relationship. Generate a control flow graph to identify conditional branches and loop structures. Trace the transfer process of variables between multiple threads and identify communication points between threads. Locate key shared resource access points, including read, write and synchronization operations. Finally, generate a detailed vulnerability location report, including vulnerability type, severity, number of affected code lines and repair suggestions.

[0021] Step S102, based on the vulnerability candidate set, establish and construct a multi-threaded interaction scenario that can trigger a race condition, monitor the access of multiple threads to shared resources in real time during the application program running through dynamic instrumentation, and capture suspected static condition events.

[0022] Generate test cases according to multi-threaded interaction scenarios, the test cases include thread creation, resource allocation and concurrent operation information; perform code injection on the target application, the code injection inserts monitoring probes at shared resource access points, thread synchronization operation calls and key control flow nodes; obtain the execution status and resource access information of multiple threads through monitoring probes, the resource access information includes thread identification, operation type, access address and timestamp; perform data filtering, deduplication and classification on the resource access information to obtain a standardized event sequence; use temporal logic rules to analyze the thread interaction pattern in the event sequence, the analysis includes: modeling thread behavior using a finite state machine; judging whether there is concurrent access that violates synchronization constraints; if there is concurrent access that violates synchronization constraints, determine the type of race condition, the location of occurrence and related thread information.

[0023] Exemplarily, according to the shared resource access mode in the vulnerability candidate set, a multi-threaded interaction scenario is designed and constructed, and test cases are generated through thread creation, resource allocation and concurrent operations. In the test cases, multiple threads are simulated to read and write operations on shared variables, critical area access and resource lock contention, including complex interaction situations such as concurrent reading and writing, read and write interleaving and lock contention. Dynamic plugging technology is used to inject code into the target application. According to the pre-set plugging point selection criteria, monitoring probes are inserted at shared resource access points, thread synchronization operation calls and key control flow nodes to achieve tracking of thread creation, resource allocation, variable reading and writing and synchronization primitive usage. The LLVM framework is used for code injection to ensure the flexibility and scalability of the plugging process. When the application is running, the execution status and resource access of multiple threads are captured in real time through the inserted monitoring probes, the thread identification, operation type, access address and timestamp are recorded, the resource access sequence and timing relationship diagram between threads are constructed, and the interaction relationship and resource access sequence between threads are represented by a directed graph data structure. The captured event data is preprocessed, including data filtering, deduplication and classification, to construct a standardized event sequence. For the processed resource access sequence, the interaction pattern between threads is analyzed using temporal logic rules, and the thread behavior is modeled using finite state machines to detect concurrent access that violates synchronization constraints. Combined with the preset race condition pattern library, it is determined whether there is a suspected race condition event. The specific judgment criteria include time overlap of resource access, conflicting write operations of different threads on the same resource, etc. Finally, a detailed event report is generated, including the type of race condition, the location of occurrence, and related thread information. According to the shared resource access pattern in the vulnerability candidate set, a multi-threaded interaction scenario is designed, and 10 concurrent threads are created, including 5 read threads and 5 write threads, which operate on 3 shared variables respectively. 100 test cases are generated, each of which contains 50 random read and write operations and 10 resource lock contentions. The LLVM framework is used for dynamic instrumentation, and 200 monitoring probes are inserted into the target application, covering all shared variable access points and synchronization operation calls. The probe trigger threshold is set to 1 millisecond, and the thread ID, operation type (read / write), memory address, and timestamp are recorded. A red-black tree data structure is used to store the collected event data, and 10,000 events can be processed per second. A directed graph is constructed to represent the interaction between threads, with nodes representing threads, edges representing resource access, and weights representing access time intervals. A depth-first search algorithm is used to traverse the graph and identify loops as potential deadlock situations. A sliding window algorithm is used in the event preprocessing phase, with a window size set to 100ms to merge repeated events. A finite state machine is used to model thread behavior, and five states are defined, including idle, waiting, acquiring locks, accessing resources, and releasing locks. State transitions are controlled by 20 rules, including lock acquisition timeouts, resource access conflicts, etc.The race condition judgment standard is set as the time interval between two threads writing to the same memory address is less than 5ms, or the read and write operations overlap by more than 2ms. The final event report contains the race condition type, such as data competition, atomicity violation, occurrence location (source code line number), thread ID and variable address involved, and recommended repair plan.

[0024] Step S103, for the monitored suspected race condition events, abstract the event context information into constraint conditions, use the constraint solver to explore the input combination of suspected static conditions, and determine the minimum input set that stably triggers the race condition.

[0025] Obtain the program path and variable information related to the monitored suspected race condition event, perform variable symbolization processing based on the program path and variable information, and obtain the initial path condition including the variable value range and operation sequence; perform breadth-first traversal on the initial path condition to determine all executable paths, and if an execution path is determined, convert the branch conditions, variable assignments and thread operations on the execution path into logical expressions; use a constraint solver to solve the logical expression to obtain a specific input value combination that satisfies the constraint condition; perform simulation execution based on the specific input value combination, and determine a high-potential input combination with a triggering probability greater than a preset threshold by calculating the probability of each input combination triggering the race condition; verify and streamline the high-potential input combination, and screen out a minimum input subset that can stably trigger the race condition from the high-potential input combination by repeatedly executing the target program and adjusting the thread scheduling strategy.

[0026] Exemplarily, for the suspected race condition events monitored, the program path and variable information related to the event are extracted, and the variables are symbolized, specifically including replacing integer variables with symbolic expressions, converting pointer variables into symbolic addresses in the memory model, and constructing the symbolic execution path of the event to obtain the initial path conditions including the variable value range and operation order. According to the initial path conditions, the symbolic execution technology is used to perform breadth-first traversal of the program, explore all possible execution paths, convert the branch conditions, variable assignments and thread operations on each path into logical expressions, and form a complete set of path constraints. At the same time, path pruning strategies such as loop expansion restrictions and state merging are used to deal with the state space explosion problem caused by multi-threading. The generated path constraints are optimized, similar constraints are merged, redundant conditions are eliminated, and constraint expressions are simplified. The optimized path constraint set is solved using the Z3 constraint solver, the maximum solution time is set to 60 seconds, the maximum number of solutions is set to 1000, specific input value combinations that meet the constraints are generated, and a candidate input set for the race condition is constructed. Perform a preliminary evaluation on the generated candidate input set, use fast simulation execution technology to calculate the probability of each input combination triggering the race condition, and screen out high-potential input combinations with a trigger probability greater than 0.5. Verify and streamline the screened high-potential input combinations, and screen out the minimum input subset that can stably trigger the race condition by repeatedly executing the target program and adjusting the thread scheduling strategy, such as using priority inversion and time slice round-robin scheduling. The "minimum input subset" is defined as the subset with the smallest input size under the premise of ensuring that the trigger probability is not less than 0.8, and determine the triggering conditions and necessary inputs of the race condition. For the suspected race condition events monitored, extract the relevant program path and variable information, replace 10 integer variables with symbolic expressions such as x1, x2,..., x10, and convert 5 pointer variables into symbolic addresses in the memory model such as m1, m2,..., m5, build a symbolic execution path, and obtain the initial path conditions. Adopting the breadth-first search strategy and setting the maximum search depth to 100, we explored the execution path and converted 20 branch conditions, 30 variable assignments, and 15 thread operations into logical expressions to form a set of path constraints. We used loop unrolling limited to 3 times and set the state merge threshold to 0.9 to deal with state space explosion. We optimized the constraints, merged 8 similar constraints, eliminated 12 redundant conditions, and simplified the constraint expressions. We used the Z3 solver with a maximum solution time of 60 seconds and a maximum number of solutions of 1000 to generate 800 input value combinations that satisfied the constraints. We quickly simulated and executed each input combination 100 times, calculated the trigger probability, and screened out 350 high-potential inputs with a trigger probability greater than 0.5. We repeatedly executed the target program, tested each input 500 times, used priority inversion, inverted every 10ms, and time slice rotation, with a time slice of 5ms scheduling strategy, and screened out 50 inputs that could stably trigger the race condition.The minimum input subset is defined as one with a trigger probability no less than 0.8 and a minimum input size. Finally, an input subset containing 3 integers and 2 pointers is determined with a trigger probability of 0.85.

[0027] Record and classify the captured suspected race condition events separately, extract key contextual information, abstract the variables, conditions, and synchronization operations involved in the events into symbolic expressions, and generate constraints and constraint systems; use the constraint solver to solve the constraint system to obtain the input combinations that meet the constraints, divide the input combinations into equivalence classes, and evaluate the stability and reproducibility of different input combinations triggering race conditions by testing different input combinations, and select the target input set as the basis for subsequent vulnerability exploitation and verification.

[0028] According to the captured suspected race condition events, the program execution path, variable status and thread interaction information when the event occurs are extracted, the relevant variables are replaced with symbolic expressions, the conditional statements are converted into logical constraints, the synchronization operations are identified and converted into timing constraints, and the symbolic execution path is constructed; the constructed symbolic execution path is analyzed to generate path constraints, and a constraint system is formed by combining the thread interaction constraints and resource access constraints; the constraint system is solved, the maximum solution time and the maximum number of solutions are set, and the input value combination that meets the constraint conditions is obtained; the obtained input combination is clustered using the K-means algorithm, the number of clusters is set to the square root of the number of input combinations, the equivalence classes are divided, and the center point of each equivalence class is selected as the representative input; the selected representative input is tested and executed, the race condition triggering situation of each execution is recorded, the triggering probability and reproducibility index are calculated, and the input combination of stable triggering is screened out according to the preset threshold as the target input set.

[0029] Exemplarily, according to the captured suspected race condition events, extract the program execution path, variable states, and thread interaction information when the event occurs. Replace the relevant variables with symbolic expressions, convert the conditional statements into logical constraints using predicate logic expressions, identify synchronization operations and convert them into timing constraints, and construct a complete symbolic execution path. Use the KLEE symbolic execution tool to analyze the constructed symbolic execution path, generate path constraint conditions, combine the interaction constraints and resource access constraints between threads to form a complete constraint system, optimize the complexity of the constraint system through constraint simplification and merging, use the constraint graph analysis method to evaluate the complexity of the constraint system, and calculate the number of constraint nodes and edge density. Use the Z3 solver to solve the optimized constraint system, set the maximum solving time to 300 seconds and the maximum number of solutions to 10,000, generate specific input value combinations that satisfy the constraint conditions, perform clustering analysis on the generated input combinations using the K-means algorithm, set the number of clusters to the square root of the number of input combinations, and divide the equivalent classes. For the divided equivalent classes, select the center point of each class as the representative input for 100 test executions, record the race condition triggering situation for each execution, use the Monte Carlo method to calculate the triggering probability and reproducibility index. The triggering probability is defined as the number of successful triggers divided by the total number of executions, and the reproducibility index is defined as the maximum number of consecutive successful triggers divided by the total number of executions. Filter out the input combinations that stably trigger according to the preset threshold (triggering probability greater than 0.8 and reproducibility index greater than 0.6) set by statistical analysis of historical data as the target input set. For the 50 captured suspected race condition events, extract the program execution path of each event, which on average contains 20 basic blocks, record 100 variable states and 30 thread interactions. Replace 50 integer variables with symbolic expressions x1 to x50, and 20 pointer variables with symbolic addresses p1 to p20. Convert 80 conditional statements into logical constraints using predicate logic, such as converting "if(x>0)" to "x>0". Identify 40 synchronization operations and convert them into timing constraints, such as "thread1_lock<thread2_lock". Use the KLEE tool to analyze the symbolic execution path, generate 500 path constraints, combine 60 thread interaction constraints and 80 resource access constraints to form a system consisting of 640 constraints. By merging 30 similar constraints and eliminating 50 redundant constraints, the optimized constraint system contains 560 constraints. Using constraint graph analysis, 560 nodes are calculated, and the edge density is 0.15. Using the Z3 solver, set the maximum solving time to 300 seconds and the maximum number of solutions to 10,000, generate 8,000 input combinations that satisfy the constraints. Use the K-means algorithm, set the number of clusters to 90 (approximately equal to the square root of 8,000), cluster the 8,000 inputs, and divide 90 equivalent classes. Select the 90 class center points and perform 100 test executions for each, recording the triggering situation.The Monte Carlo method is used to calculate the trigger probability and reproducibility. For example, if an input triggers 80 times, the probability is 0.8, the maximum continuous triggering is 30 times, and the reproducibility is 0.3. According to historical data, the thresholds are set to 0.8 and 0.6, and finally 25 stable triggering input combinations are selected as the target input set.

[0030] Step S104, monitor whether a race condition is triggered. If a race condition is triggered, analyze the impact of the race condition on the data integrity and behavior correctness of the application, construct an attack payload that uses the race condition to execute arbitrary code or elevate permissions, and evaluate the harmfulness of the race condition vulnerability.

[0031] The key execution point information of the application is obtained, and a monitoring probe is inserted at the key execution point, wherein the monitoring probe is used to capture the thread execution status, shared variable access sequence and synchronization operation information in real time; based on the information captured by the monitoring probe, the resource access sequence and timing relationship between threads are compared to determine whether a race condition is triggered; if the race condition is triggered, a snapshot comparison is performed on the data status before and after the program execution to obtain the tampered data items and track the propagation path of the tampered data; based on the obtained propagation path, the attack vector is analyzed to select the most matching attack method from it; for the selected attack method, a corresponding input sequence and thread scheduling scheme are constructed to introduce the tampered data into the control flow decision point or memory operation of the program, wherein the control flow decision point or memory operation is used to implement control flow hijacking or buffer overflow.

[0032] Exemplarily, dynamic binary instrumentation technology is used to insert monitoring probes at key execution points of the application program to capture thread execution status, shared variable access sequence and synchronization operation information in real time. The resource access sequence and timing relationship between threads are compared through the vector clock algorithm to determine whether a race condition is triggered. If a race condition is triggered, a snapshot comparison is performed on the data status before and after the program is executed to identify the tampered data items. The propagation path of the tampered data is tracked through the taint analysis method, the degree of impact on key business logic is evaluated, and the affected memory areas and control flow branches are marked. Based on the taint analysis results, possible attack vectors are analyzed, including memory corruption, type confusion, and use-after-free, and the most suitable attack method is selected. According to the selected attack vector, a specific input sequence and thread scheduling scheme are constructed to try to introduce the tampered data into the control flow decision point or memory operation of the program to achieve control flow hijacking or buffer overflow, including ROP chain construction, shellcode injection, and stack overflow. Using the constructed attack payload, the operation that triggers the race condition is repeatedly executed 100 times in the target environment, and the success rate and impact range are recorded. The CVSS scoring system is used to assess the vulnerability's hazard level based on the stability and destructiveness of the attack effect, and attempts are made to obtain higher-level system permissions through privilege escalation operations. For multi-threaded applications, the Pin dynamic binary instrumentation tool is used to insert monitoring probes at 50 key execution points. Each probe captures 10 thread state parameters, 20 shared variable access sequences, and 5 types of synchronization operation information. The vector clock algorithm is used to maintain a vector of length 8 for each thread to record the logical timestamp of access to shared resources. By comparing the vector clocks of different threads, three resource accesses that violate the happened-before relationship are found, and the race condition is determined to be triggered. The program state 100ms before and after the trigger point is taken as a memory snapshot, and 15 tampered data items are identified using a binary difference comparison tool. The dynamic taint analysis method is applied to mark the tampered data as the taint source, and 40 program basic blocks are tracked. It is found that the tainted data affects three key control flow branches and two memory allocation operations. The analysis results show that there are two possible attack vectors: type confusion and use-after-free. A special input sequence of 100 bytes is constructed, including a 32-byte ROP chain and a 68-byte shellcode. By adjusting the thread priority, the probability of tainted data being read in the critical section is increased to 80%. Repeated execution 100 times in the target environment, the success rate reached 65%, of which 30% caused the program to crash and 35% achieved arbitrary code execution. Using the CVSS3.1 scoring system, the basic score is 9.8 (low attack complexity, wide impact range), corresponding to the "severe" level.The successfully executed shellcode attempts to obtain root privileges through privilege escalation operations, exploiting the kernel vulnerability CVE-2021-3156 on Linux systems, with a privilege escalation success rate of 20%.

[0033] Step S105 , obtaining race condition anti-patterns for memory models and synchronization primitives of different programming languages, and extracting general exploitation primitives covering various race condition vulnerabilities.

[0034] Obtain the memory model characteristics and synchronization primitive implementation information of mainstream programming languages, and construct a language characteristic comparison matrix based on the information, wherein the language characteristic comparison matrix includes dimensions such as memory consistency model, atomic operation support, lock mechanism and memory barrier; analyze the application of language characteristics in actual code through the language characteristic comparison matrix, and obtain the usage frequency and distribution data of different synchronization mechanisms; extract concurrent programming related code snippets from the open source project code library, use static code analysis tools to identify critical sections and resource competition points in the code snippets, and judge the usage frequency and distribution characteristics of different types of synchronization operations; construct a test case set containing race conditions based on concurrent programming patterns, and trigger potential race conditions through dynamic execution and concurrent scheduling control, wherein the concurrent scheduling control includes thread priority adjustment and time slice control; classify and summarize race condition cases, extract common characteristics and triggering patterns, and construct a race condition anti-pattern library, wherein the race condition anti-pattern library is organized according to the dimensions of vulnerability type, triggering condition and impact range.

[0035] For example, for mainstream programming languages ​​such as C / C++, Java, Python, and Go, analyze their memory model characteristics and synchronization primitive implementations, build a language feature comparison matrix, including memory consistency model, atomic operation support, lock mechanism, memory barrier and other dimensions, and identify the advantages and potential risk points of each language in concurrent programming. Based on the constructed language feature comparison matrix, analyze the application of specific language features in actual code, and count the frequency and distribution of different synchronization mechanisms. Extract concurrent programming related code snippets from the open source project code base, use static code analysis tools such as Clang Static Analyzer and Coverity to identify critical sections and resource competition points, and count the frequency and distribution characteristics of different types of synchronization operations. Based on the identified concurrent programming patterns, construct a test case set containing race conditions, trigger potential race condition problems through dynamic execution and concurrent scheduling control, such as using thread priority adjustment and time slice control, and record the triggering conditions and impact range. Classify and summarize the collected race condition cases, extract common features and trigger patterns, build a race condition anti-pattern library, organize them by vulnerability type, trigger condition and impact scope, establish a code template generation mechanism based on abstract syntax tree, build a general race condition exploitation primitive, and cover different types of concurrency vulnerabilities. For four languages, C / C++, Java, Python and Go, build a 10x10 language feature comparison matrix, including memory consistency model, such as sequential consistency, loose consistency, atomic operation support, such as CAS, memory barrier, lock mechanism, such as mutex lock, read-write lock and other 10 dimensions, and assign a score of 1-5 to each feature. Analyze the top 1000 projects with the most stars on GitHub, extract 1 million lines of concurrency-related code, and find that synchronized is used most frequently in Java projects, accounting for 35%, while channel usage accounts for 40% in Go projects. Use Clang Static Analyzer to analyze C / C++ projects and identify 2000 potential data competition points; use Coverity to analyze Java projects and find 1500 possible deadlock scenarios. Based on the identified concurrency patterns, 10,000 test cases containing race conditions were generated, covering read-write conflicts, atomicity violations, order violations, and other types. By adjusting the thread priority level 1-10 and the time slice 1ms-100ms, the test cases were executed 1 million times, triggering 8,000 race conditions, with an average trigger rate of 8%. Cluster analysis was performed on the triggered race conditions, 50 typical anti-patterns were extracted, and a 5-layer deep decision tree was built to organize the anti-pattern library. Based on the abstract syntax tree, 100 code templates were designed, covering 20 common concurrency vulnerability types in 5 languages, and 1,000 general exploit primitives were generated, with an applicability rate of 85% in different programming languages.

[0036] Step S106, during the penetration test, static analysis, dynamic monitoring, and symbolic execution are applied to the target application system to discover race condition vulnerabilities, and the exploitability of the vulnerabilities is verified to assist in completing the assessment of system security.

[0037] According to the preset rule set, static code analysis is performed on the target application system to obtain a list of potential race condition risk points, including unsynchronized shared variable access and improper lock usage order; dynamic monitoring probes are implanted to obtain key event information such as thread creation, resource allocation, and lock operation, and a concurrent behavior model of the system is constructed during runtime; the constructed concurrent behavior model is analyzed to determine whether there are potential deadlocks, resource competition, and synchronization anomalies; if there are potential anomalies, symbolic execution is performed on the risk points and analysis results to simulate different thread scheduling scenarios and generate input sequences and scheduling strategies that trigger race conditions; matching exploit primitives are selected based on the input sequence and scheduling strategy, and targeted attack payloads are constructed to verify the exploitability of the vulnerability in a controlled environment configured with a sandbox and virtualization method.

[0038] For example, the target application system is subjected to static code analysis using the Coverity static application security testing (SAST) tool and the Fortify static code analysis tool to identify multi-threaded operations, shared resource access, and synchronization mechanism usage. Potential race condition risk points are marked according to the preset rule set, including unsynchronized shared variable access, improper lock usage order, etc., to generate a preliminary vulnerability candidate list. During the operation of the target system, AspectJ is used to perform bytecode instrumentation, implant dynamic monitoring probes, capture key events such as thread creation, resource allocation, and lock operations, record the interaction sequence and resource access mode between threads, and build a concurrent behavior model during system operation. The constructed concurrent behavior model is analyzed using Petri nets to identify potential deadlocks, resource competition, and synchronization anomalies. Based on the marked risk points and Petri net analysis results, the KLEE symbolic execution tool is used to explore possible program execution paths, simulate different thread scheduling scenarios, generate input sequences and scheduling strategies that trigger race conditions, and combine fuzz testing technology to explore boundary conditions and expand the vulnerability candidate list. The generated vulnerability candidates are matched with the pre-built general exploit primitive library based on common vulnerability types and attack vectors, and appropriate exploit primitives are selected to construct targeted attack payloads. The exploitability of the vulnerability is verified in a controlled environment equipped with sandbox and virtualization technology. The discovered vulnerabilities are quantitatively evaluated using the CVSS scoring system to assess the severity and potential impact of the vulnerability. Static code analysis is performed on the target application system using Coverity and Fortify, scanning 1 million lines of code to identify 500 multi-threaded operations, 200 shared resource access points, and 300 synchronization mechanism usage scenarios. According to the preset 15 rule sets, 150 potential race condition risk points are marked, including 80 unsynchronized shared variable accesses and 70 improper lock usage sequences, generating a preliminary vulnerability candidate list containing 150 items. AspectJ was used to implant dynamic monitoring probes at the entrances of 1,000 key methods. During the system operation, key events such as 50,000 thread creations, 100,000 resource allocations, and 200,000 lock operations were captured, and a 10GB thread interaction sequence log was recorded. A concurrent behavior model containing 500 places and 1,000 transitions was built using the Petri net modeling tool. Through reachability analysis, 20 potential deadlock scenarios, 50 resource competitions, and 30 synchronization anomalies were identified. For these 100 high-risk points, the KLEE symbolic execution tool was used to generate 10,000 test cases, covering 1,000 different program execution paths and simulating 500 thread scheduling scenarios. Combined with fuzz testing technology, an additional 5,000 edge case test cases were generated, expanding the vulnerability candidate list to 300 items. From the pre-built library containing 1,000 exploit primitives, suitable exploit primitives were selected for 300 vulnerability candidates, and 250 targeted attack payloads were constructed.In a sandbox environment with 10 virtual machine instances, the 250 attack payloads were executed 100 times each, successfully reproducing 180 vulnerabilities. The CVSS3.1 scoring system was used to quantitatively evaluate the 180 vulnerabilities, with an average basic score of 7.5, of which 30 vulnerabilities scored higher than 9.0, which is a serious level.

[0039] Before penetration testing, collect and analyze the architecture, components, and communication protocol information of the target system. For code snippets that are prone to race conditions due to multi-threaded concurrency, shared resource access, and synchronization mechanisms, monitor the application's running status and resource access in real time. Further analyze and verify the captured suspected race condition events, construct targeted attack payloads based on the symbolic execution results, verify the exploitability of race condition vulnerabilities, evaluate the impact of race condition vulnerabilities on the system, and propose corresponding risk levels and repair suggestions.

[0040] Perform a comprehensive scan of the target system to obtain the system architecture, component information, and communication protocol data of the target system. Based on the obtained system information, select a static code analysis tool that supports multiple programming languages ​​and concurrent pattern analysis capabilities, scan the source code or decompiled code of the target system, and mark potential race condition risk points. Monitor the running applications of the target system in real time, and inject delays and error conditions at the risk points marked by static analysis. Use symbolic execution tools to analyze the captured suspected race condition events and generate input sequences and thread scheduling schemes that can trigger race conditions. Combined with the pre-built general exploit primitive library, construct a targeted attack payload to verify the exploitability of the race condition vulnerability in a controlled environment. If it is verified that the race condition vulnerability can be exploited, evaluate the impact scope of the vulnerability and give a risk level.

[0041] For example, Nmap and Wireshark are used to perform a comprehensive scan of the target system, collect system architecture, component information, and communication protocol data, build a system topology map and component dependency map, and identify potential concurrent processing modules and shared resource access points. Based on the collected system information, a static code analysis tool that supports multiple programming languages ​​and concurrent pattern analysis capabilities, such as Coverity or Fortify, is selected to scan the source code or decompiled code of the target system, focusing on code snippets related to multi-threaded concurrency, shared resource access, and synchronization mechanisms, and marking potential race condition risk points. The static analysis results are processed to generate a risk report and a list of suspicious code locations as input for dynamic analysis. Dynamic instrumentation technology and fault injection tools, such as PIN and FAIL*, are used to monitor running applications in real time, inject delays and error conditions at risk points marked by static analysis, capture key events such as thread creation, resource allocation, and lock operations, record the interaction sequence and resource access pattern between threads, and build a concurrent behavior model of the system during runtime. For the captured suspected race condition events, the KLEE symbolic execution tool is used for in-depth analysis to generate input sequences and thread scheduling schemes that may trigger race conditions. Combined with the pre-built general exploit primitive library based on common vulnerability types and attack vectors, targeted attack payloads are constructed to verify the exploitability of race condition vulnerabilities in a controlled environment. The CVSS3.1 scoring system is used to assess the impact of the vulnerability and give a risk level. The automated repair suggestion generation tool is used to provide targeted repair solutions. A comprehensive port scan of the target system is performed using Nmap, and 1,000 open TCP ports and 50 UDP ports are found. 10GB of network traffic is captured through Wireshark, and 15 different communication protocols are identified. Based on the scan results, a system topology diagram containing 50 nodes and a component diagram of 100 dependencies are constructed to locate 20 potential concurrent processing modules and 30 shared resource access points. The Coverity static analysis tool is selected, 50 concurrency-related check rules are configured, 1 million lines of source code and 200,000 lines of decompiled code are scanned, and 500 potential race condition risk points are marked. Generate an 80-page PDF report with risk details and a 2,000-line list of suspicious code locations. Use the PIN dynamic instrumentation tool to insert monitoring probes at 1,000 key execution points, and use the Failpoints fault injection tool to inject 10-100ms random delays and 5 error conditions at 200 high-risk points marked by static analysis. Run the application 100 times, each lasting 10 minutes, capture 500,000 thread creations, 1 million resource allocations, and 2 million lock operation events, and record 1GB of thread interaction sequence logs.The KLEE symbolic execution tool was used to conduct an in-depth analysis of the 100 most suspicious events, exploring 1,000 possible execution paths for each event and generating 10,000 potential input sequences that could trigger race conditions. From a pre-built library of 1,000 exploit primitives, 5 most matching primitives were selected for each suspicious event to construct 500 attack payloads. The attack payloads were verified in a sandbox environment configured with 10 virtual machine instances, and 80 race condition vulnerabilities were successfully reproduced. The CVSS3.1 scoring system was used to evaluate the 80 vulnerabilities, resulting in an average base score of 7.5, of which 15 vulnerabilities scored higher than 9.0, which is considered severe. An automated remediation suggestion generation tool based on deep learning was used to provide 3-5 specific code-level remediation suggestions for each vulnerability.

[0042] Step S107, obtain typical race condition vulnerability cases of multi-threaded applications, summarize the causes, triggering conditions, exploitation methods and repair solutions of the vulnerabilities, improve the race condition vulnerability knowledge base, and integrate the summarized race condition vulnerability knowledge and exploitation primitives into automated vulnerability mining and penetration testing tools.

[0043] Acquire race condition vulnerability cases of multi-threaded applications in a database, the vulnerability cases including vulnerability type, impact scope, severity, trigger condition and repair suggestion fields; perform static code analysis and dynamic execution tracking according to the vulnerability cases; obtain a complete triggering process of the vulnerability through the static code analysis and dynamic execution tracking, the triggering process includes key thread interaction points and resource competition scenarios; establish a race condition vulnerability exploitation primitive for the triggering process, the exploitation primitive includes a thread scheduling control module, a memory access sequence construction module and an abnormal state triggering module; integrate the exploitation primitive into an automated vulnerability mining tool, the automated vulnerability mining tool performs code pattern matching; if the code pattern matching result matches a preset threshold, perform a heuristic search to obtain identification and verification results of a new race condition vulnerability.

[0044] For example, typical race condition vulnerability cases of multi-threaded applications are collected from GitHub and CVE databases, and each case is analyzed in depth to extract the code features, trigger conditions and impact scope of the vulnerability, and a structured vulnerability description model containing fields such as vulnerability type, impact scope, severity, trigger conditions and repair suggestions is constructed. For the collected vulnerability cases, Coverity is used for static code analysis, and the Pin tool is used for dynamic execution tracking to restore the complete triggering process of the vulnerability, identify key thread interaction points and resource competition scenarios, and summarize the general causes and typical patterns of race conditions. Based on the analysis results of the vulnerability cases, a set of race condition vulnerability exploitation primitives is established and implemented, including modules such as thread scheduling control, memory access sequence construction and abnormal state triggering, and tested under different operating systems and hardware environments to verify the effectiveness and stability of the exploitation primitives. The implemented exploitation primitives are systematically organized and classified, and an exploitation primitive library is established. The Neo4j graph database is used to store the relationship between vulnerability knowledge and exploitation primitives. The vulnerability knowledge and exploit primitives obtained by analysis are integrated into the automated vulnerability mining tool. The KMP algorithm is used for code pattern matching, combined with the A* algorithm for heuristic search, to improve the tool's ability to identify and verify new race condition vulnerabilities. Finally, the developed functional module is integrated into the Metasploit penetration testing framework. 500 typical race condition vulnerability cases of multi-threaded applications are screened from 1,000 open source projects with more than 10,000 stars on GitHub and records in the CVE database in the past five years. Each case is analyzed in depth, 20 key code features, 10 trigger condition patterns and 5 types of impact ranges are extracted, and a structured vulnerability description model containing 15 fields is constructed. Coverity is used to perform static analysis on 5 million lines of source code to identify 2,000 potential race condition points. Combined with the Pin tool, 100 hours of dynamic execution tracking is performed, 100,000 thread interaction events are captured, and 300 complete vulnerability trigger processes are restored. 50 key thread interaction patterns and 30 resource competition scenarios are identified, and the general causes of 10 types of race conditions are summarized. The design implements a set of primitives for exploiting race conditions, which includes 5 core modules and 20 sub-functions. It is tested 1,000 times on three operating systems, Windows, Linux, and macOS, and two hardware architectures, x86 and ARM, to verify that the effectiveness of the primitives reaches 95% and the stability reaches 90%. The Neo4j graph database is used to build a vulnerability knowledge graph containing 1,000 nodes and 5,000 relationships to store the relationship between vulnerability cases, trigger conditions, and exploit primitives. The KMP algorithm is integrated into the automated vulnerability mining tool, 50 feature patterns are set, and the target code is scanned, which improves the matching efficiency by 30%. The A* algorithm is combined for heuristic search, and 8 heuristic functions are set, which reduces the number of exploration paths by 50% and improves the accuracy by 20%.Eventually, the three core modules and 10 auxiliary functions developed will be integrated into the Metasploit framework, and 20 new vulnerability exploitation modules will be expanded.

[0045] Although the present invention has been described in detail above by general description and specific embodiments, it is obvious to those skilled in the art that some modifications or improvements can be made to the present invention. Therefore, these modifications or improvements made without departing from the spirit of the present invention all belong to the scope of protection claimed by the present invention.

Claims

1. A security data penetration testing method, characterized in that: The method comprises: Pre-establish a multi-threaded application race condition vulnerability feature library, perform static analysis on the target application source code, identify potential race condition vulnerability points, and obtain a preliminary set of vulnerability candidates; Based on the vulnerability candidate set, a multi-threaded interaction scenario that can trigger race conditions is established and constructed. Through dynamic instrumentation, the access of multiple threads to shared resources is monitored in real time during the application runtime to capture suspected static condition events. For suspected race condition events monitored, the event context information is abstracted into constraints, and the constraint solver is used to explore the input combination of suspected static conditions to determine the minimum input set that stably triggers the race condition. Monitor whether a race condition is triggered. If a race condition is triggered, analyze the impact of the race condition on the data integrity and behavior correctness of the application, construct an attack payload that uses the race condition to execute arbitrary code or elevate permissions, and evaluate the harmfulness of the race condition vulnerability. Targeting the memory models and synchronization primitives of different programming languages, we can obtain race condition anti-patterns and extract common exploit primitives that cover various race condition vulnerabilities. During the penetration test, static analysis, dynamic monitoring, and symbolic execution are used to discover race condition vulnerabilities in the target application system and verify the exploitability of the vulnerabilities to assist in completing the assessment of system security. Obtain typical race condition vulnerability cases of multi-threaded applications, summarize the causes, triggering conditions, exploitation methods and repair solutions of the vulnerabilities, improve the race condition vulnerability knowledge base, and integrate the summarized race condition vulnerability knowledge and exploitation primitives into automated vulnerability mining and penetration testing tools.

2. The method according to claim 1, characterized in that The multi-threaded application race condition vulnerability feature library is pre-established, the source code of the target application is statically analyzed, potential race condition vulnerability points are identified, and a preliminary vulnerability candidate set is obtained, including: Extracting key features based on a pre-established multi-threaded application race condition vulnerability feature library, wherein the key features include vulnerability patterns, code structures, and variable dependencies; Receiving source code of a target application, performing static analysis on the source code using a matching method based on regular expressions and syntax analysis, identifying potential race condition vulnerabilities, and obtaining a preliminary set of vulnerability candidates; Performing deep semantic analysis on the preliminary vulnerability candidate set, performing code structure analysis through an abstract syntax tree, simulating the program execution path, extracting context information of each candidate vulnerability point, and generating a vulnerability feature vector; Data preprocessing and feature selection are performed on the vulnerability feature vector, and the feature vector is mapped to a high-dimensional feature space using a support vector machine algorithm to construct an optimal classification hyperplane to obtain a preliminary race condition vulnerability list.

3. The method according to claim 1, characterized in that According to the vulnerability candidate set, a multi-threaded interaction scenario that can trigger a race condition is established and constructed, and the access of multiple threads to shared resources is monitored in real time during the application runtime by dynamic instrumentation, and suspected static condition events are captured, including: Generate test cases according to multi-threaded interaction scenarios, wherein the test cases include thread creation, resource allocation, and concurrent operation information; Performing code injection on the target application, wherein the code injection inserts monitoring probes at shared resource access points, thread synchronization operation calls, and key control flow nodes; Acquire the execution status and resource access information of multiple threads through monitoring probes, wherein the resource access information includes thread identification, operation type, access address and timestamp; Performing data filtering, deduplication and classification processing on the resource access information to obtain a standardized event sequence; Analyzing the thread interaction pattern in the event sequence using temporal logic rules, the analysis comprising: modeling the thread behavior using a finite state machine; Determine whether there is concurrent access that violates synchronization constraints; If there is concurrent access that violates synchronization constraints, the type of race condition, the location where it occurs, and related thread information are determined.

4. The method according to claim 1, characterized in that For the monitored suspected race condition events, the event context information is abstracted into constraint conditions, and the constraint solver is used to explore the input combination of the suspected static conditions to determine the minimum input set that stably triggers the race condition, including: Obtaining the program path and variable information related to the monitored suspected race condition event, performing variable symbolization processing according to the program path and variable information, and obtaining an initial path condition including a variable value range and an operation sequence; Performing breadth-first traversal on the initial path condition to determine all executable paths, and if an execution path is determined, converting the branch conditions, variable assignments, and thread operations on the execution path into logical expressions; Solving the logical expression using a constraint solver to obtain a specific input value combination that satisfies the constraint condition; Perform simulation execution according to the specific input value combination, and determine a high-potential input combination whose triggering probability is greater than a preset threshold by calculating the probability of each input combination triggering the race condition; Verifying and streamlining the high-potential input combinations, and screening out a minimum input subset that can stably trigger a race condition from the high-potential input combinations by repeatedly executing the target program and adjusting the thread scheduling strategy; It also includes: recording and classifying the captured suspected race condition events, extracting key context information, abstracting the variables, conditions, and synchronization operations involved in the events into symbolic expressions, and generating constraints and constraint systems; Use the constraint solver to solve the constraint system and obtain the input combinations that meet the constraints. Divide the input combinations into equivalence classes. By testing different input combinations, evaluate the stability and reproducibility of different input combinations triggering race conditions, and select the target input set as the basis for subsequent vulnerability exploitation and verification.

5. The method according to claim 4, characterized in that The captured suspected race condition events are recorded and classified respectively, key context information is extracted, variables, conditions, and synchronization operations involved in the events are abstracted into symbolic expressions, and constraints and constraint systems are generated; Use the constraint solver to solve the constraint system and obtain the input combinations that meet the constraint conditions. Divide the input combinations into equivalence classes. By testing different input combinations, evaluate the stability and reproducibility of different input combinations triggering race conditions. Select the target input set as the basis for subsequent vulnerability exploitation and verification, including: Based on the captured suspected race condition events, the program execution path, variable status and thread interaction information when the event occurs are extracted, the relevant variables are replaced with symbolic expressions, the conditional statements are converted into logical constraints, the synchronization operations are identified and converted into timing constraints, and the symbolic execution path is constructed; Analyze the constructed symbolic execution path, generate path constraints, and combine the thread interaction constraints and resource access constraints to form a constraint system; Solving the constraint system, setting a maximum solution time and a maximum number of solutions, and obtaining a combination of input values ​​that meets the constraint conditions; The obtained input combinations are clustered using the K-means algorithm. The number of clusters is set to the square root of the number of input combinations. Equivalence classes are divided and the center point of each equivalence class is selected as the representative input. The test is executed for the selected representative inputs, the race condition triggering situation of each execution is recorded, the triggering probability and reproducibility index are calculated, and the input combination with stable triggering is screened out according to the preset threshold as the target input set.

6. The method according to claim 1, characterized in that The monitoring determines whether a race condition is triggered. If a race condition is triggered, the impact of the race condition on the data integrity and behavior correctness of the application is analyzed, an attack payload that uses the race condition to execute arbitrary code or elevate permissions is constructed, and the harmfulness of the race condition vulnerability is evaluated, including: Acquire key execution point information of the application program, insert monitoring probes at the key execution points, and the monitoring probes are used to capture thread execution status, shared variable access sequence, and synchronization operation information in real time; According to the information captured by the monitoring probe, the resource access sequence and timing relationship between threads are compared to determine whether a race condition is triggered; If the race condition is triggered, a snapshot comparison is performed on the data state before and after the program is executed to obtain the tampered data item and track the propagation path of the tampered data; According to the obtained propagation path, analyze the attack vector and select the most matching attack method; For the selected attack method, a corresponding input sequence and thread scheduling scheme are constructed to introduce the tampered data into the control flow decision points or memory operations of the program, and the control flow decision points or memory operations are used to achieve control flow hijacking or buffer overflow.

7. The method according to claim 1, characterized in that The memory models and synchronization primitives of different programming languages ​​are used to obtain race condition anti-patterns and extract general exploit primitives covering various race condition vulnerabilities, including: Obtain memory model characteristics and synchronization primitive implementation information of mainstream programming languages, and construct a language characteristic comparison matrix based on the information, wherein the language characteristic comparison matrix includes dimensions such as memory consistency model, atomic operation support, locking mechanism, and memory barrier; Analyze the application of language features in actual code through the language feature comparison matrix to obtain the usage frequency and distribution data of different synchronization mechanisms; Extract concurrent programming related code snippets from the open source project code base, use static code analysis tools to identify critical sections and resource contention points in the code snippets, and determine the usage frequency and distribution characteristics of different types of synchronization operations; Constructing a test case set containing race conditions according to a concurrent programming model, triggering potential race conditions through dynamic execution and concurrent scheduling control, wherein the concurrent scheduling control includes thread priority adjustment and time slice control; The race condition cases are classified and summarized, common features and triggering patterns are extracted, and a race condition anti-pattern library is constructed. The race condition anti-pattern library is organized according to the dimensions of vulnerability type, triggering condition, and impact scope.

8. The method according to claim 1, characterized in that During the penetration test, static analysis, dynamic monitoring, and symbolic execution are used to discover race condition vulnerabilities in the target application system and verify the exploitability of the vulnerabilities to assist in completing the assessment of system security, including: Perform static code analysis on the target application system according to the preset rule set to obtain a list of potential race condition risk points, including unsynchronized shared variable access and improper lock usage order; Implant dynamic monitoring probes to obtain key event information on thread creation, resource allocation, and lock operations, and build a concurrent behavior model during system runtime; Analyze the constructed concurrent behavior model to determine whether there are potential deadlocks, resource competition, and synchronization anomalies; If there are potential abnormal situations, symbolic execution is performed on risk points and analysis results to simulate different thread scheduling scenarios and generate input sequences and scheduling strategies that trigger race conditions. Select matching exploit primitives based on input sequences and scheduling strategies, construct targeted attack payloads, and verify the exploitability of vulnerabilities in a controlled environment configured with sandbox and virtualization methods; It also includes: before the penetration test, collect and analyze the architecture, components, and communication protocol information of the target system, monitor the application running status and resource access in real time for code snippets that are prone to race conditions due to multi-threaded concurrency, shared resource access, and synchronization mechanisms, further analyze and verify the captured suspected race condition events, construct targeted attack payloads based on the symbolic execution results, verify the exploitability of race condition vulnerabilities, evaluate the impact of race condition vulnerabilities on the system, and propose corresponding risk levels and repair suggestions.

9. The method according to claim 8, characterized in that Before the penetration test, the target system's architecture, components, and communication protocol information are collected and analyzed. For code snippets that are prone to race conditions in multi-threaded concurrency, shared resource access, and synchronization mechanisms, the application's running status and resource access are monitored in real time. The captured suspected race condition events are further analyzed and verified. According to the symbolic execution results, a targeted attack payload is constructed to verify the exploitability of the race condition vulnerability, evaluate the impact of the race condition vulnerability on the system, and propose corresponding risk levels and repair suggestions, including: Perform a comprehensive scan on the target system to obtain the system architecture, component information and communication protocol data of the target system; According to the obtained system information, a static code analysis tool that supports multiple programming languages ​​and concurrent pattern analysis capabilities is selected to scan the source code or decompiled code of the target system to mark potential race condition risk points; Performing real-time monitoring of running applications of the target system, injecting delays and error conditions at risk points flagged by static analysis; For captured suspected race condition events, use symbolic execution tools to analyze and generate input sequences and thread scheduling schemes that can trigger race conditions; Combined with the pre-built common exploit primitive library, targeted attack payloads are constructed to verify the exploitability of race condition vulnerabilities in a controlled environment. If it is verified that the race condition vulnerability can be exploited, the impact scope of the vulnerability is evaluated and a risk level is given.

10. The method according to claim 1, characterized in that The method of obtaining typical race condition vulnerability cases of multi-threaded applications, summarizing the causes, triggering conditions, exploitation methods and repair solutions of the vulnerabilities, improving the race condition vulnerability knowledge base, and integrating the summarized race condition vulnerability knowledge and exploitation primitives into automated vulnerability mining and penetration testing tools includes: Obtain race condition vulnerability cases of multi-threaded applications in the database, wherein the vulnerability cases include vulnerability type, impact scope, severity, triggering condition, and repair suggestion fields; Perform static code analysis and dynamic execution tracking based on the vulnerability cases described; The complete triggering process of the vulnerability is obtained through the static code analysis and dynamic execution tracking, and the triggering process includes key thread interaction points and resource competition scenarios; Establishing a race condition vulnerability exploitation primitive for the triggering process, wherein the exploitation primitive includes a thread scheduling control module, a memory access sequence construction module, and an abnormal state triggering module; Integrating the exploit primitive into an automated vulnerability mining tool, the automated vulnerability mining tool performing code pattern matching; If the code pattern matching result matches a preset threshold, a heuristic search is performed to obtain identification and verification results of the new race condition vulnerability.

Images