Memory vulnerability detection method and device for embedded operating system, equipment and medium

Abstract

The invention relates to the technical field of computer security, in particular to a memory vulnerability detection method, device and equipment of an embedded operating system and a medium, and the memory vulnerability detection method of the embedded operating system comprises the steps of obtaining vulnerability codes of embedded operating systems of different memory vulnerability types; performing feature analysis on the vulnerability code, and constructing a multi-dimensional variable information table based on a feature analysis result; constructing a memory vulnerability rule set based on the multi-dimensional variable information table; and performing vulnerability detection on a to-be-detected embedded operating system code by utilizing the memory vulnerability rule set. According to the technical scheme, the multi-dimensional variable information table specially aiming at typical memory vulnerabilities of a network protocol stack, a driving program and memory operation is introduced, and the corresponding self-defined checking rule is constructed, so that main defects of an existing static code analysis tool during processing of complex system components are overcome.

Description

Technical Field

[0001] The present disclosure relates to the field of computer security technology, and in particular to a memory vulnerability detection method, device, equipment and medium for an embedded operating system. Background Art

[0002] As the complexity of embedded operating systems continues to increase, the code of key components such as network protocol stacks, drivers, and memory operations has become larger and more complex. Compared with general application software code, these operating system components involve underlying hardware interactions and system resource management, such as memory allocation and release, page table management, and buffer management. Therefore, it is very easy to introduce security vulnerabilities during the development process. These vulnerabilities include but are not limited to buffer overflows, memory leaks, repeated memory releases, read-write after release, etc. Once these problems occur, they will have a serious impact on the stability and security of the system.

[0003] In order to find and fix these potential security vulnerabilities early, developers often use static code analysis tools. These tools do not run the code during vulnerability analysis, but identify possible vulnerabilities by analyzing the source code, which can perform a more comprehensive analysis of the source code than dynamic analysis.

[0004] There are many static code analysis tools on the market that can detect some common security issues in the code. Analysis and testing show that mainstream open source static code analysis tools on the market, such as Clang Static Analyzer, Cppcheck, Infer, and Tscancode, provide some basic code security checking functions, which can find potential defects and some code standardization issues in the operating system code. The open source community version of Sonarqube does not support the detection of C# code and cannot detect operating system code. Moreover, their common feature is that the default check rules are mainly aimed at general programming errors, and the detection capabilities are limited for memory-related security vulnerabilities in the network protocol stack, driver, and memory operation components of the operating system. In actual tests on mainstream embedded operating systems, memory-related vulnerabilities are often not detected. Summary of the invention

[0005] In order to solve the problems in the related art, the embodiments of the present disclosure provide a memory vulnerability detection method, apparatus, device and medium for an embedded operating system.

[0006] In a first aspect, the present disclosure provides a method for detecting a memory vulnerability in an embedded operating system, including: Get vulnerability codes of embedded operating systems with different memory vulnerability types; Performing feature analysis on the vulnerability code, and constructing a multidimensional variable information table based on the feature analysis result, wherein the multidimensional variable information table records function variables corresponding to different vulnerability types, variable features corresponding to the function variables, and variable feature values; Constructing a memory vulnerability rule set based on the multidimensional variable information table; The memory vulnerability rule set is used to perform vulnerability detection on the embedded operating system code to be detected.

[0007] In one embodiment of the present disclosure, the performing feature analysis on the vulnerability code and constructing a multidimensional variable information table based on the feature analysis result includes: Determine the type characteristics of different memory vulnerability types; Based on the type features, feature analysis is performed on embedded operating system vulnerability codes of different memory vulnerability types, function variables of different memory vulnerability types, variable features corresponding to the function variables and variable feature values ​​are extracted, and a multidimensional variable information table is constructed based on the extracted information.

[0008] In one embodiment of the present disclosure, the type characteristics of determining different memory vulnerability types include: Obtain vulnerability information of embedded operating system memory-related vulnerabilities from public vulnerability databases; Based on the vulnerability information, vulnerability triggering conditions of different memory vulnerability types and typical code patterns of vulnerability generation are analyzed, and type characteristics of different memory vulnerability types are determined based on the analysis results.

[0009] In one embodiment of the present disclosure, the variable characteristics corresponding to the function variable include: at least one of variable type, scope, life cycle, data flow direction, constraint condition, pointer alias, and pointer usage information; Correspondingly, the function variables of different memory vulnerability types are extracted, and the variable features and variable feature values ​​corresponding to the function variables include: Utilize an analysis tool or a combination of analysis tools to extract variable features and variable feature values ​​corresponding to function variables of the corresponding memory vulnerability type.

[0010] In one embodiment of the present disclosure, constructing a memory vulnerability rule set based on the multidimensional variable information table includes: Determine variable features and corresponding variable feature values ​​associated with the same vulnerability type from the multidimensional variable information table; Constructing detection rules for corresponding memory vulnerability types based on variable features associated with the same vulnerability type and corresponding variable feature values; The constructed detection rules for the corresponding memory vulnerability types are combined into a memory vulnerability rule set.

[0011] In one embodiment of the present disclosure, performing vulnerability detection on the embedded operating system code to be detected by using the memory vulnerability rule set includes: Performing feature analysis on the embedded operating system code to be detected, extracting function variables, variable features corresponding to the function variables and variable feature values ​​in the embedded operating system code to be detected, and constructing a vulnerability analysis information table based on the extracted information; The vulnerability analysis information table is matched one by one with the detection rules in the memory vulnerability rule set. If the match is successful, it indicates that a memory vulnerability of the corresponding memory vulnerability type exists.

[0012] In one embodiment of the present disclosure, the different memory vulnerability types include at least one or more of the following types: use and release confusion, memory leak, integer / buffer overflow and uninitialized variable.

[0013] In a second aspect, the present disclosure provides a memory vulnerability detection device for an embedded operating system, including: An acquisition module is configured to acquire vulnerability codes of embedded operating systems of different memory vulnerability types; A first construction module is configured to perform feature analysis on the vulnerability code and construct a multidimensional variable information table based on the feature analysis result, wherein the multidimensional variable information table records function variables corresponding to different vulnerability types, variable features corresponding to the function variables, and variable feature values; A second construction module is configured to construct a memory vulnerability rule set based on the multidimensional variable information table; The detection module is configured to perform vulnerability detection on the embedded operating system code to be detected by using the memory vulnerability rule set.

[0014] In one embodiment of the present disclosure, the first construction module performs feature analysis on the vulnerability code, and constructs a multidimensional variable information table based on the feature analysis result, and is configured as follows: A first determining unit is configured to determine type characteristics of different memory vulnerability types; The first construction unit is configured to perform feature analysis on embedded operating system vulnerability codes of different memory vulnerability types based on the type features, extract function variables of different memory vulnerability types, variable features corresponding to the function variables, and variable feature values, and construct a multidimensional variable information table based on the extracted information.

[0015] In one embodiment of the present disclosure, the determining unit includes: an acquisition subunit, configured to acquire vulnerability information of memory-related vulnerabilities of the embedded operating system from a public vulnerability database; The determination subunit is configured to analyze vulnerability triggering conditions of different memory vulnerability types and typical code patterns of vulnerability generation based on the vulnerability information, and determine type characteristics of different memory vulnerability types based on the analysis results.

[0016] In one embodiment of the present disclosure, the variable characteristics corresponding to the function variable include: at least one of variable type, scope, life cycle, data flow direction, constraint condition, pointer alias, and pointer usage information; Accordingly, the construction unit extracts function variables of different memory vulnerability types, variable features corresponding to the function variables, and the part of the variable feature values, which are configured as follows: Utilize an analysis tool or a combination of analysis tools to extract variable features and variable feature values ​​corresponding to function variables of the corresponding memory vulnerability type.

[0017] In one embodiment of the present disclosure, the second building block includes: A second determining unit is configured to determine variable features and corresponding variable feature values ​​associated with the same vulnerability type from the multidimensional variable information table; A second construction unit is configured to construct a detection rule for a corresponding memory vulnerability type based on variable features associated with the same vulnerability type and corresponding variable feature values; The composition unit is configured to form a memory vulnerability rule set by combining the constructed detection rules of the corresponding memory vulnerability types.

[0018] In one embodiment of the present disclosure, the detection module includes: An analysis unit is configured to perform feature analysis on the embedded operating system code to be detected, extract function variables, variable features corresponding to the function variables, and variable feature values ​​in the embedded operating system code to be detected, and construct a vulnerability analysis information table based on the extracted information; The matching unit is configured to match the vulnerability analysis information table with the detection rules in the memory vulnerability rule set one by one. If the match is successful, it indicates that a memory vulnerability of the corresponding memory vulnerability type exists.

[0019] In one embodiment of the present disclosure, the different memory vulnerability types include at least one or more of the following types: use and release confusion, memory leak, integer / buffer overflow and uninitialized variable.

[0020] In a third aspect, an embodiment of the present disclosure provides an electronic device, comprising a memory and a processor, wherein the memory is used to store one or more computer instructions, and wherein the one or more computer instructions are executed by the processor to implement a method as described in any one of the first aspects.

[0021] In a fourth aspect, an embodiment of the present disclosure provides a computer-readable storage medium on which computer instructions are stored. When the computer instructions are executed by a processor, the method described in any one of the first aspects is implemented.

[0022] In a fifth aspect, an embodiment of the present disclosure provides a chip, the chip including a processor, the processor being used to call a computer program in a memory to execute the memory vulnerability detection method of the above-mentioned embedded operating system.

[0023] The technical effects provided by the embodiments of the present disclosure may include the following beneficial effects: According to the technical solution provided by the embodiment of the present disclosure, the memory vulnerability detection method of the embedded operating system includes obtaining the vulnerability code of the embedded operating system of different memory vulnerability types; performing feature analysis on the vulnerability code, and constructing a multidimensional variable information table based on the feature analysis result, wherein the multidimensional variable information table records the function variables corresponding to different vulnerability types, the variable features corresponding to the function variables, and the variable feature values; constructing a memory vulnerability rule set based on the multidimensional variable information table; and using the memory vulnerability rule set to perform vulnerability detection on the embedded operating system code to be detected. In the above technical solution, by introducing a multidimensional variable information table specifically for typical memory vulnerabilities of network protocol stacks, drivers, and memory operations, and constructing corresponding custom inspection rules, the main defects of existing static code analysis tools in processing these complex system components are overcome. When detecting memory-related vulnerabilities in the operating system, the constructed memory vulnerability rule set is used to detect typical memory vulnerabilities such as integer / buffer overflows and use / release confusion, which has strong pertinence and practicality, and can help developers locate and repair vulnerabilities more quickly, thereby improving the security and stability of the system.

[0024] It is to be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] Figure 1 A flow chart of a memory vulnerability detection method for an embedded operating system according to an embodiment of the present disclosure is shown.

[0026] Figure 2 A schematic diagram of a vulnerability code of an uninitialized variable according to an embodiment of the present disclosure is shown.

[0027] Figure 3 A structural block diagram of a memory vulnerability detection device for an embedded operating system according to an embodiment of the present disclosure is shown.

[0028] Figure 4 A structural block diagram of an electronic device according to an embodiment of the present disclosure is shown.

[0029] Figure 5 A schematic diagram showing the structure of a computer system suitable for implementing the method according to an embodiment of the present disclosure is shown. DETAILED DESCRIPTION

[0030] Hereinafter, exemplary embodiments of the present disclosure will be described in detail with reference to the accompanying drawings so that those skilled in the art can easily implement them. In addition, for the sake of clarity, parts not related to the description of the exemplary embodiments are omitted in the accompanying drawings.

[0031] In the present disclosure, it should be understood that terms such as "include" or "have" are intended to indicate the presence of features, numbers, steps, behaviors, components, parts, or a combination thereof disclosed in the present specification, and are not intended to exclude the possibility that one or more other features, numbers, steps, behaviors, components, parts, or a combination thereof exist or are added.

[0032] It should also be noted that, in the absence of conflict, the embodiments and features in the embodiments of the present disclosure may be combined with each other. The present disclosure will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0033] There are many static code analysis tools on the market that can detect some common security issues in the code. Analysis and testing show that mainstream open source static code analysis tools on the market, such as Clang Static Analyzer, Cppcheck, Infer, and Tscancode, provide some basic code security checking functions, which can find potential defects and some code standardization issues in the operating system code. The open source community version of Sonarqube does not support the detection of C# code and cannot detect operating system code. Moreover, their common feature is that the default check rules are mainly aimed at general programming errors, and the detection capabilities are limited for memory-related security vulnerabilities in the network protocol stack, driver, and memory operation components of the operating system. In actual tests on mainstream embedded operating systems, memory-related vulnerabilities are often not detected.

[0034] In view of the above defects, the memory vulnerability detection method of the embedded operating system provided by the present disclosure includes obtaining the vulnerability code of the embedded operating system of different memory vulnerability types; performing feature analysis on the vulnerability code, and constructing a multidimensional variable information table based on the feature analysis results, wherein the multidimensional variable information table records the function variables corresponding to different vulnerability types, the variable features corresponding to the function variables, and the variable feature values; constructing a memory vulnerability rule set based on the multidimensional variable information table; and using the memory vulnerability rule set to perform vulnerability detection on the embedded operating system code to be detected. In the above technical solution, by introducing a multidimensional variable information table specifically for typical memory vulnerabilities of network protocol stacks, drivers, and memory operations, and constructing corresponding custom inspection rules, the main defects of existing static code analysis tools in processing these complex system components are overcome. When detecting memory-related vulnerabilities in the operating system, the constructed memory vulnerability rule set is used to detect typical memory vulnerabilities such as integer / buffer overflows and use / release confusion, which has strong pertinence and practicality, and can help developers locate and repair vulnerabilities more quickly, thereby improving the security and stability of the system.

[0035] Figure 1 A flow chart of a memory vulnerability detection method for an embedded operating system according to an embodiment of the present disclosure is shown.

[0036] like Figure 1 As shown, the memory vulnerability detection method of the embedded operating system includes the following steps S110-S140: In step S110, vulnerability codes of embedded operating systems of different memory vulnerability types are obtained; In step S120, feature analysis is performed on the vulnerability code, and a multidimensional variable information table is constructed based on the feature analysis result, wherein the multidimensional variable information table records function variables corresponding to different vulnerability types, variable features corresponding to the function variables, and variable feature values; In step S130, a memory vulnerability rule set is constructed based on the multidimensional variable information table; In step S140, vulnerability detection is performed on the embedded operating system code to be detected using the memory vulnerability rule set.

[0037] In embedded operating system code, memory-related security vulnerabilities in key system components such as network protocol stacks, drivers, and memory operations are crucial and determine the security and stability of the system. Typical memory vulnerability types include use and release confusion, memory leaks, integer / buffer overflows, and uninitialized variables. Existing static code analysis tools have the following shortcomings in analyzing the above memory vulnerability types: static analysis tools do not have a sufficient understanding of the complex pointer usage, memory allocation, and release strategies in operating system code; they cannot accurately track the life cycle of objects, and may miss problems such as memory leaks or repeated releases; there is insufficient boundary checking of sensitive variables, and vulnerabilities such as buffer overflows and memory out-of-bounds access cannot be detected, especially in the processing of complex data structures (such as linked lists, trees, etc.); many operating system codes do not initialize memory before using it, and static analysis tools often find it difficult to track the initialization status of variables, which may lead to potential security vulnerabilities.

[0038] In the disclosed method, feature analysis is performed on the embedded operating system vulnerability code of at least two vulnerability types of different memory vulnerability types, such as use and release confusion, memory leakage, integer / buffer overflow and variable uninitialization, to construct a multidimensional variable information table. The variable features and variable feature values ​​in the multidimensional variable information table are extracted from the vulnerability codes of different memory vulnerability types, reflecting the characteristics of different memory vulnerability types. Then, a memory vulnerability rule set is constructed based on the multidimensional variable information table, in which the detection rules can detect memory-related security vulnerabilities in key system components in the embedded operating system, overcoming the defect that existing static code analysis tools cannot detect vulnerabilities when processing these complex system components.

[0039] In the disclosed method, when constructing a multidimensional variable information table, the function variables can be used as rows, the variable features corresponding to the function variables can be used as columns, and the variable feature values ​​can be filled into the cells where the rows and columns intersect to obtain a multidimensional variable information table. Of course, the positions of the rows and columns can also be exchanged to construct a multidimensional variable information table, and the disclosed method does not limit this.

[0040] In the disclosed method, the different memory vulnerability types include at least one or more of the following types: use and release confusion, memory leak, integer / buffer overflow and uninitialized variables.

[0041] In one embodiment of the present disclosure, the feature analysis of the vulnerability code in step S120 and the construction of a multidimensional variable information table based on the feature analysis result include: Determine the type characteristics of different memory vulnerability types; Based on the type features, feature analysis is performed on embedded operating system vulnerability codes of different memory vulnerability types, function variables of different memory vulnerability types, variable features corresponding to the function variables and variable feature values ​​are extracted, and a multidimensional variable information table is constructed based on the extracted information.

[0042] In the disclosed method, a memory vulnerability type often has multiple type features, and by identifying these type features, it can be determined whether the memory vulnerability type exists. The type features of the memory vulnerability type determined in the present disclosure are to perform feature analysis on the memory vulnerability as a whole, and then specifically analyze the embedded operating system vulnerability code of the memory vulnerability type. The variable features corresponding to the function variables extracted therefrom are extracted with reference to the type features of the memory vulnerability type. For example, the type features of the memory vulnerability type that determines that the variable is not initialized include the variable type, scope, life cycle, and data flow direction. Figure 2 A schematic diagram of vulnerability code of uninitialized variables according to an embodiment of the present disclosure is shown. When analyzing the vulnerability code of uninitialized variables, the extracted function variable is the result variable, and then the variable characteristics of the result variable are extracted, which are the same as the type characteristics of the memory vulnerability type of the uninitialized variable, specifically including the variable type, scope, life cycle and data flow direction. The above variable characteristics and corresponding variable characteristic values ​​are extracted, and finally the extracted result variable, the variable characteristics corresponding to the result variable and the variable characteristic values ​​are added to the multidimensional variable information table.

[0043] In one embodiment of the present disclosure, the type characteristics of determining different memory vulnerability types include: Obtain vulnerability information of embedded operating system memory-related vulnerabilities from public vulnerability databases; Based on the vulnerability information, vulnerability triggering conditions of different memory vulnerability types and typical code patterns of vulnerability generation are analyzed, and type characteristics of different memory vulnerability types are determined based on the analysis results.

[0044] In the disclosed method, vulnerability information of memory-related vulnerabilities of embedded operating systems is extracted from public vulnerability databases (such as CVE vulnerability database, NVD vulnerability database, etc.), including but not limited to vulnerability description, impact scope, vulnerability patch and related software version information, etc., and then the characteristics and exploitability principles of memory-related vulnerabilities are analyzed, including but not limited to: triggering conditions of vulnerabilities (for example, specific function calls, incorrect parameter passing, pointer state confusion), typical code patterns generated by vulnerabilities such as use and release confusion, memory leaks, integer / buffer overflows and uninitialized variables, etc., and the type characteristics of different memory vulnerability types are determined based on the analysis results. In the present disclosure, for the four types of memory vulnerabilities, namely use and release confusion, memory leaks, integer / buffer overflows and uninitialized variables, the determined type characteristics include at least variable type, scope, life cycle, data flow direction, constraints, pointer aliases and pointer usage information.

[0045] In one embodiment of the present disclosure, the variable characteristics corresponding to the function variable include: at least one of variable type, scope, life cycle, data flow direction, constraint condition, pointer alias, and pointer usage information; Correspondingly, the function variables of different memory vulnerability types are extracted, and the variable features and variable feature values ​​corresponding to the function variables include: Utilize an analysis tool or a combination of analysis tools to extract variable features and variable feature values ​​corresponding to function variables of the corresponding memory vulnerability type.

[0046] Specifically, we use a combination of analysis tools to extract variable features corresponding to function variables as an example. We use the analysis tool Clang to track the assignment, transfer, and use of function variables to obtain variable status information, including variable type, scope, and life cycle. We use the analysis tool Joern to deeply track the flow path of data in the program, generate a data flow graph (DFG) and a control flow graph (CFG), and determine the data flow direction based on the DFG and CFG; we use the analysis tool Frama-C to obtain the constraints of function variables; and we use the analysis tool LLVM to obtain pointer aliases and pointer usage information (involving memory operations, such as allocation and release).

[0047] Still Figure 2 Taking the vulnerability code of uninitialized variables as an example, the variable features of the detected result variable and the corresponding variable feature values ​​are: Variable type: integer int type.

[0048] Scope: local variables inside a function.

[0049] Lifecycle: The lifecycle of result is the entire function, but the initialization path is missing.

[0050] Data flow direction: result is the output direction in the entire function, and its status will be returned to the caller.

[0051] In one embodiment of the present disclosure, constructing a memory vulnerability rule set based on the multidimensional variable information table in step S130 includes: Determine variable features and corresponding variable feature values ​​associated with the same vulnerability type from the multidimensional variable information table; Constructing detection rules for corresponding memory vulnerability types based on variable features associated with the same vulnerability type and corresponding variable feature values; The constructed detection rules for the corresponding memory vulnerability types are combined into a memory vulnerability rule set.

[0052] In the disclosed method, the detection rules are customized by combining the multidimensional variable information table, and the detection capability of memory-related vulnerabilities is improved by defining customized rules for the code features of the embedded operating system. The constructed rules include but are not limited to the following:

[0053] Use-after-free detection rule: After detecting the memory release operation, the pointer cannot perform any read or write operations. If the variable is still used after being released, it will be marked as a use-after-free vulnerability;

[0054] Memory leak detection rules: Check that dynamically allocated memory is released on all possible exit paths to ensure that pointers do not lose references and are not repeatedly allocated. If the release operation is not called in any path, it is marked as a memory leak vulnerability;

[0055] Buffer overflow detection rule: Check the buffer size and the actual size of the stored data to ensure that there is no out-of-bounds writing and reading. When data flows into the buffer, if it exceeds the buffer limit, it is marked as a buffer overflow vulnerability;

[0056] Uninitialized variable detection rule: Check the initialization status of all variables before use to ensure that any data flow direction (input / output) goes through a complete initialization path. If a variable is used without being assigned a value in some branches, mark the path as a possible uninitialized vulnerability.

[0057] In one embodiment of the present disclosure, a test code library can also be used to verify the effect of the memory vulnerability rule set. The test code library contains actual or simulated vulnerability code to test whether the memory vulnerability rules can correctly identify the problem. The test code library also contains vulnerability-free code to verify that the memory vulnerability rules do not generate false positives. After testing and verification, the rules are adjusted to optimize their accuracy, reduce false positives and missed negatives, and the rules can also be simplified to improve detection efficiency.

[0058] In one embodiment of the present disclosure, performing vulnerability detection on the embedded operating system code to be detected by using the memory vulnerability rule set in step S140 includes: Performing feature analysis on the embedded operating system code to be detected, extracting function variables, variable features corresponding to the function variables and variable feature values ​​in the embedded operating system code to be detected, and constructing a vulnerability analysis information table based on the extracted information; The vulnerability analysis information table is matched one by one with the detection rules in the memory vulnerability rule set. If the match is successful, it indicates that a memory vulnerability of the corresponding memory vulnerability type exists.

[0059] In the disclosed method, when vulnerability detection is performed on the embedded operating system code to be detected, a vulnerability analysis information table for the embedded operating system code to be detected can be constructed with reference to the multidimensional variable information table. The variable features corresponding to the function variables included in the vulnerability analysis information table include at least the variable features in the multidimensional variable information table. For example, the vulnerability analysis information table may include variable type, scope, life cycle, data flow direction, constraints, pointer alias and pointer usage information. Then, based on the vulnerability analysis information table and the detection rules in the memory vulnerability rule set, such as the use-after-release detection rule, the memory leak detection rule, the buffer overflow detection rule and the variable uninitialized detection rule, a one-to-one match is performed. If the match is successful, it indicates that a memory vulnerability of the corresponding memory vulnerability type exists.

[0060] In the disclosed method, the constructed memory vulnerability rule set can be imported into the analysis tool Clang, and the analysis tool Clang can be used to detect whether there is a memory vulnerability in the embedded operating system code to be detected, and a detailed report is generated, listing the context information of the violation and repair suggestions, thereby helping developers to repair potential vulnerabilities in a timely manner.

[0061] The memory vulnerability detection method for embedded operating systems provided by the present disclosure adds a multidimensional variable information table through data flow analysis and other technologies to the code, which includes information that affects security vulnerability detection, such as variable type, scope, life cycle, data flow direction, constraint conditions, pointer alias, and pointer usage information. The memory vulnerability rule set built based on the multidimensional variable information table is used to comprehensively track and analyze memory-related security vulnerabilities in key system components. By providing detailed context and status information, developers can locate and repair vulnerabilities more quickly, thereby improving the security and stability of the system.

[0062] Figure 3 The structural block diagram of the memory vulnerability detection device of the embedded operating system according to the embodiment of the present disclosure is shown. The device can be implemented as part or all of the electronic device through software, hardware or a combination of both.

[0063] like Figure 3 As shown, the memory vulnerability detection device 300 of the embedded operating system includes: An acquisition module 310 is configured to acquire vulnerability codes of embedded operating systems of different memory vulnerability types; The first construction module 320 is configured to perform feature analysis on the vulnerability code and construct a multidimensional variable information table based on the feature analysis result, wherein the multidimensional variable information table records function variables corresponding to different vulnerability types, variable features corresponding to the function variables, and variable feature values; A second construction module 330 is configured to construct a memory vulnerability rule set based on the multidimensional variable information table; The detection module 340 is configured to perform vulnerability detection on the embedded operating system code to be detected by using the memory vulnerability rule set.

[0064] According to the technical solution provided by the embodiment of the present disclosure, by introducing a multidimensional variable information table specifically targeting typical memory vulnerabilities of network protocol stacks, drivers and memory operations, and constructing corresponding custom inspection rules, the main defects of existing static code analysis tools in processing these complex system components are overcome. When detecting memory-related vulnerabilities in the operating system, the constructed memory vulnerability rule set is used to detect typical memory vulnerabilities such as integer / buffer overflows and use / release confusion, which is highly targeted and practical, and can help developers locate and repair vulnerabilities more quickly, thereby improving the security and stability of the system.

[0065] In one embodiment of the present disclosure, the first construction module performs feature analysis on the vulnerability code, and constructs a multidimensional variable information table based on the feature analysis result, and is configured as follows: A first determining unit is configured to determine type characteristics of different memory vulnerability types; The first construction unit is configured to perform feature analysis on embedded operating system vulnerability codes of different memory vulnerability types based on the type features, extract function variables of different memory vulnerability types, variable features corresponding to the function variables, and variable feature values, and construct a multidimensional variable information table based on the extracted information.

[0066] In one embodiment of the present disclosure, the determining unit includes: an acquisition subunit, configured to acquire vulnerability information of memory-related vulnerabilities of the embedded operating system from a public vulnerability database; The determination subunit is configured to analyze vulnerability triggering conditions of different memory vulnerability types and typical code patterns of vulnerability generation based on the vulnerability information, and determine type characteristics of different memory vulnerability types based on the analysis results.

[0067] In one embodiment of the present disclosure, the variable characteristics corresponding to the function variable include: at least one of variable type, scope, life cycle, data flow direction, constraint condition, pointer alias, and pointer usage information; Accordingly, the construction unit extracts function variables of different memory vulnerability types, variable features corresponding to the function variables, and the part of the variable feature values, which are configured as follows: Utilize an analysis tool or a combination of analysis tools to extract variable features and variable feature values ​​corresponding to function variables of the corresponding memory vulnerability type.

[0068] In one embodiment of the present disclosure, the second building block includes: A second determining unit is configured to determine variable features and corresponding variable feature values ​​associated with the same vulnerability type from the multidimensional variable information table; A second construction unit is configured to construct a detection rule for a corresponding memory vulnerability type based on variable features associated with the same vulnerability type and corresponding variable feature values; The composition unit is configured to form a memory vulnerability rule set by combining the constructed detection rules of the corresponding memory vulnerability types.

[0069] In one embodiment of the present disclosure, the detection module includes: An analysis unit is configured to perform feature analysis on the embedded operating system code to be detected, extract function variables, variable features corresponding to the function variables, and variable feature values ​​in the embedded operating system code to be detected, and construct a vulnerability analysis information table based on the extracted information; The matching unit is configured to match the vulnerability analysis information table with the detection rules in the memory vulnerability rule set one by one. If the match is successful, it indicates that a memory vulnerability of the corresponding memory vulnerability type exists.

[0070] In one embodiment of the present disclosure, the different memory vulnerability types include at least one or more of the following types: use and release confusion, memory leak, integer / buffer overflow and uninitialized variable.

[0071] The present disclosure also discloses an electronic device, Figure 4 A structural block diagram of an electronic device according to an embodiment of the present disclosure is shown.

[0072] like Figure 4 As shown, the electronic device includes a memory and a processor, wherein the memory is used to store one or more computer instructions, wherein the one or more computer instructions are executed by the processor to implement the method according to an embodiment of the present disclosure.

[0073] The memory vulnerability detection method of the embedded operating system comprises: Get vulnerability codes of embedded operating systems with different memory vulnerability types; Performing feature analysis on the vulnerability code, and constructing a multidimensional variable information table based on the feature analysis result, wherein the multidimensional variable information table records function variables corresponding to different vulnerability types, variable features corresponding to the function variables, and variable feature values; Constructing a memory vulnerability rule set based on the multidimensional variable information table; The memory vulnerability rule set is used to perform vulnerability detection on the embedded operating system code to be detected.

[0074] In one embodiment of the present disclosure, the performing feature analysis on the vulnerability code and constructing a multidimensional variable information table based on the feature analysis result includes: Determine the type characteristics of different memory vulnerability types; Based on the type features, feature analysis is performed on embedded operating system vulnerability codes of different memory vulnerability types, function variables of different memory vulnerability types, variable features corresponding to the function variables and variable feature values ​​are extracted, and a multidimensional variable information table is constructed based on the extracted information.

[0075] In one embodiment of the present disclosure, the type characteristics of determining different memory vulnerability types include: Obtain vulnerability information of embedded operating system memory-related vulnerabilities from public vulnerability databases; Based on the vulnerability information, vulnerability triggering conditions of different memory vulnerability types and typical code patterns of vulnerability generation are analyzed, and type characteristics of different memory vulnerability types are determined based on the analysis results.

[0076] In one embodiment of the present disclosure, the variable characteristics corresponding to the function variable include: at least one of variable type, scope, life cycle, data flow direction, constraint condition, pointer alias, and pointer usage information; Correspondingly, the function variables of different memory vulnerability types are extracted, and the variable features and variable feature values ​​corresponding to the function variables include: Utilize an analysis tool or a combination of analysis tools to extract variable features and variable feature values ​​corresponding to function variables of the corresponding memory vulnerability type.

[0077] In one embodiment of the present disclosure, constructing a memory vulnerability rule set based on the multidimensional variable information table includes: Determine variable features and corresponding variable feature values ​​associated with the same vulnerability type from the multidimensional variable information table; Constructing detection rules for corresponding memory vulnerability types based on variable features associated with the same vulnerability type and corresponding variable feature values; The constructed detection rules for the corresponding memory vulnerability types are combined into a memory vulnerability rule set.

[0078] In one embodiment of the present disclosure, performing vulnerability detection on the embedded operating system code to be detected by using the memory vulnerability rule set includes: Performing feature analysis on the embedded operating system code to be detected, extracting function variables, variable features corresponding to the function variables and variable feature values ​​in the embedded operating system code to be detected, and constructing a vulnerability analysis information table based on the extracted information; The vulnerability analysis information table is matched one by one with the detection rules in the memory vulnerability rule set. If the match is successful, it indicates that a memory vulnerability of the corresponding memory vulnerability type exists.

[0079] In one embodiment of the present disclosure, the different memory vulnerability types include at least one or more of the following types: use and release confusion, memory leak, integer / buffer overflow and uninitialized variable.

[0080] Figure 5 A schematic diagram showing the structure of a computer system suitable for implementing the method according to an embodiment of the present disclosure is shown.

[0081] like Figure 5 As shown, the computer system includes a processing unit, which can execute various methods in the above-mentioned embodiments according to a program stored in a read-only memory (ROM) or a program loaded from a storage part into a random access memory (RAM). In the RAM, various programs and data required for the operation of the computer system are also stored. The processing unit, ROM and RAM are connected to each other through a bus. An input / output (I / O) interface is also connected to the bus.

[0082] The following components are connected to the I / O interface: an input part including a keyboard, a mouse, etc.; an output part including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker; a storage part including a hard disk, etc.; and a communication part including a network interface card such as a LAN card, a modem, etc. The communication part performs a communication process via a network such as the Internet. The drive is also connected to the I / O interface as needed. Removable media, such as disks, optical disks, magneto-optical disks, semiconductor memories, etc., are installed on the drive as needed so that the computer program read therefrom can be installed into the storage part as needed. Among them, the processing unit can be implemented as a processing unit such as a CPU, a GPU, a TPU, an FPGA, an NPU, etc.

[0083] In particular, according to an embodiment of the present disclosure, the method described above can be implemented as a computer software program. For example, an embodiment of the present disclosure includes a computer program product, which includes a computer program tangibly contained on a machine-readable medium, and the computer program includes a program code for executing the above method. In such an embodiment, the computer program can be downloaded and installed from a network through a communication part, and / or installed from a removable medium.

[0084] The flowcharts and block diagrams in the accompanying drawings illustrate the possible architecture, functions and operations of the systems, methods and computer program products according to various embodiments of the present disclosure. In this regard, each box in the flowchart or block diagram can represent a module, a program segment or a part of a code, and the module, a program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flowchart, and the combination of boxes in the block diagram and / or flowchart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0085] The units or modules involved in the embodiments described in the present disclosure may be implemented by software or programmable hardware. The units or modules described may also be set in a processor, and the names of these units or modules do not constitute limitations on the units or modules themselves in some cases.

[0086] As another aspect, the present disclosure further provides a chip, which includes at least one processor and can be used to implement the method involved in the above system embodiment.

[0087] In one possible design, the chip also includes a memory, which is used to store program instructions and data, and the memory is located inside or outside the processor.

[0088] As another aspect, the present disclosure further provides a computer-readable storage medium, which may be a computer-readable storage medium included in the electronic device or computer system in the above embodiment; or a computer-readable storage medium that exists independently and is not assembled into a device. The computer-readable storage medium stores one or more programs, and the programs are used by one or more processors to execute the method described in the present disclosure.

[0089] The above description is only a preferred embodiment of the present disclosure and an explanation of the technical principles used. Those skilled in the art should understand that the scope of the invention involved in the present disclosure is not limited to the technical solution formed by a specific combination of the above technical features, but should also cover other technical solutions formed by any combination of the above technical features or their equivalent features without departing from the inventive concept. For example, the above features are replaced with the technical features with similar functions disclosed in the present disclosure (but not limited to) by each other.

Claims

1. A memory vulnerability detection method for an embedded operating system, characterized in that: include: Get vulnerability codes of embedded operating systems with different memory vulnerability types; Performing feature analysis on the vulnerability code, and constructing a multidimensional variable information table based on the feature analysis result, wherein the multidimensional variable information table records function variables corresponding to different vulnerability types, variable features corresponding to the function variables, and variable feature values; Constructing a memory vulnerability rule set based on the multidimensional variable information table; The memory vulnerability rule set is used to perform vulnerability detection on the embedded operating system code to be detected.

2. The memory vulnerability detection method according to claim 1, characterized in that: The feature analysis of the vulnerability code and constructing a multidimensional variable information table based on the feature analysis result includes: Determine the type characteristics of different memory vulnerability types; Based on the type features, feature analysis is performed on embedded operating system vulnerability codes of different memory vulnerability types, function variables of different memory vulnerability types, variable features corresponding to the function variables and variable feature values ​​are extracted, and a multidimensional variable information table is constructed based on the extracted information.

3. The memory vulnerability detection method according to claim 2, characterized in that: The type characteristics for determining different memory vulnerability types include: Obtain vulnerability information of embedded operating system memory-related vulnerabilities from public vulnerability databases; Based on the vulnerability information, vulnerability triggering conditions of different memory vulnerability types and typical code patterns of vulnerability generation are analyzed, and type characteristics of different memory vulnerability types are determined based on the analysis results.

4. The memory vulnerability detection method according to claim 2, characterized in that: The variable characteristics corresponding to the function variable include: at least one of: variable type, scope, life cycle, data flow direction, constraint condition, pointer alias and pointer usage information; Correspondingly, the function variables of different memory vulnerability types are extracted, and the variable features and variable feature values ​​corresponding to the function variables include: Utilize analysis tools or a combination of analysis tools to extract variable features and variable feature values ​​corresponding to function variables of corresponding memory vulnerability types.

5. The memory vulnerability detection method according to claim 1, characterized in that: The constructing of a memory vulnerability rule set based on the multidimensional variable information table includes: Determine variable features and corresponding variable feature values ​​associated with the same vulnerability type from the multidimensional variable information table; Constructing detection rules for corresponding memory vulnerability types based on variable features associated with the same vulnerability type and corresponding variable feature values; The constructed detection rules for the corresponding memory vulnerability types are combined into a memory vulnerability rule set.

6. The memory vulnerability detection method according to claim 1, characterized in that: The method of using the memory vulnerability rule set to perform vulnerability detection on the embedded operating system code to be detected includes: Performing feature analysis on the embedded operating system code to be detected, extracting function variables, variable features corresponding to the function variables and variable feature values ​​in the embedded operating system code to be detected, and constructing a vulnerability analysis information table based on the extracted information; The vulnerability analysis information table is matched one by one with the detection rules in the memory vulnerability rule set. If the match is successful, it indicates that a memory vulnerability of the corresponding memory vulnerability type exists.

7. The memory vulnerability detection method according to claim 1, characterized in that: The different memory vulnerability types include at least one or more of the following types: use and release confusion, memory leakage, integer / buffer overflow and uninitialized variables.

8. A memory vulnerability detection device for an embedded operating system, characterized in that: include: An acquisition module is configured to acquire vulnerability codes of embedded operating systems of different memory vulnerability types; A first construction module is configured to perform feature analysis on the vulnerability code and construct a multidimensional variable information table based on the feature analysis result, wherein the multidimensional variable information table records function variables corresponding to different vulnerability types, variable features corresponding to the function variables, and variable feature values; A second construction module is configured to construct a memory vulnerability rule set based on the multidimensional variable information table; The detection module is configured to perform vulnerability detection on the embedded operating system code to be detected by using the memory vulnerability rule set.

9. The memory vulnerability detection device according to claim 8, characterized in that: The first construction module performs feature analysis on the vulnerability code and constructs a multi-dimensional variable information table based on the feature analysis result, and is configured as follows: A first determining unit is configured to determine type characteristics of different memory vulnerability types; The first construction unit is configured to perform feature analysis on embedded operating system vulnerability codes of different memory vulnerability types based on the type features, extract function variables of different memory vulnerability types, variable features corresponding to the function variables, and variable feature values, and construct a multidimensional variable information table based on the extracted information.

10. The memory vulnerability detection device according to claim 9, characterized in that: The determining unit comprises: an acquisition subunit, configured to acquire vulnerability information of memory-related vulnerabilities of the embedded operating system from a public vulnerability database; The determination subunit is configured to analyze vulnerability triggering conditions of different memory vulnerability types and typical code patterns of vulnerability generation based on the vulnerability information, and determine type characteristics of different memory vulnerability types based on the analysis results.

11. The memory vulnerability detection device according to claim 9, characterized in that: The variable characteristics corresponding to the function variable include: at least one of: variable type, scope, life cycle, data flow direction, constraint condition, pointer alias and pointer usage information; Accordingly, the construction unit extracts function variables of different memory vulnerability types, variable features corresponding to the function variables, and the part of the variable feature values, which are configured as follows: Utilize analysis tools or a combination of analysis tools to extract variable features and variable feature values ​​corresponding to function variables of corresponding memory vulnerability types.

12. The memory vulnerability detection device according to claim 8, characterized in that: The second building block comprises: A second determining unit is configured to determine variable features and corresponding variable feature values ​​associated with the same vulnerability type from the multidimensional variable information table; A second construction unit is configured to construct a detection rule for a corresponding memory vulnerability type based on variable features associated with the same vulnerability type and corresponding variable feature values; The composition unit is configured to form a memory vulnerability rule set by combining the constructed detection rules of the corresponding memory vulnerability types.

13. The memory vulnerability detection device according to claim 8, characterized in that: The detection module comprises: An analysis unit is configured to perform feature analysis on the embedded operating system code to be detected, extract function variables, variable features corresponding to the function variables, and variable feature values ​​in the embedded operating system code to be detected, and construct a vulnerability analysis information table based on the extracted information; The matching unit is configured to match the vulnerability analysis information table with the detection rules in the memory vulnerability rule set one by one. If the match is successful, it indicates that a memory vulnerability of the corresponding memory vulnerability type exists.

14. The memory vulnerability detection device according to claim 8, characterized in that: The different memory vulnerability types include at least one or more of the following types: use and release confusion, memory leakage, integer / buffer overflow and uninitialized variables.

15. An electronic device, characterized in that: The method comprises a memory and a processor; wherein the memory is used to store one or more computer instructions, wherein the one or more computer instructions are executed by the processor to implement the method according to any one of claims 1 to 7.

16. A computer-readable storage medium having computer instructions stored thereon, characterized in that: When the computer instructions are executed by a processor, the method according to any one of claims 1 to 7 is implemented.

17. A chip, characterized in that: include: At least one processor, configured to implement the method according to any one of claims 1 to 7.

Images