Method for detecting and judging security vulnerability of operating system based on source code

Abstract

The invention provides an operating system security vulnerability detection and judgment method based on a source code. The method comprises the following steps: establishing a security vulnerability discrimination rule set of an operating system source code, each security vulnerability discrimination rule comprising a serial number, a rule description and a focus operation item, converting the description of the specific focus operation item and the rule in the security vulnerability discrimination rule set of the operating system source code into a logic judgment statement, establishing a vulnerability discrimination model, and counting the total number of times of focus operation items related to each security vulnerability discrimination rule in the source code; and carrying out security vulnerability judgment on the related source code of the focus operation item found by scanning by utilizing the vulnerability judgment model, counting the times and the position of the source code violating a security vulnerability judgment rule, and calculating the security vulnerability of the source code of the tested operating system. According to the method provided by the invention, the corresponding source code security vulnerability index value can be calculated, and the index value has the characteristics of being objective, standard, stable and repeatable.

Description

Technical Field

[0001] The present invention relates to the field of computer application technology, and in particular to a source code-based operating system security vulnerability detection and evaluation method. Background Art

[0002] The operating system is the core basic system software of the computer system. It undertakes the heavy responsibility of software and hardware resource management and constitutes the key foundation of the entire computer system security, network security and information security. With the rapid development of Internet technology and the widespread application of computer systems, various security issues have emerged in an endless stream and become increasingly prominent. Tracing back to the source, many security issues can be attributed to the security vulnerabilities in the operating system. Given the scale and complexity of the operating system, its security vulnerability detection and security vulnerability assessment is also an extremely arduous task. Considering the important position of open source operating systems in existing actual computer systems, it is of great practical significance to construct a source code-based operating system security vulnerability detection method and assessment method.

[0003] At present, the vulnerability detection and security vulnerability assessment methods of operating systems in the existing technology focus on realizing the discovery and repair of operating system security vulnerabilities, but lack a method for testing the security vulnerability assessment of the operating system. How to implement the security vulnerability assessment of the tested operating system is a technical problem that needs to be solved.

[0004] The existing operating system vulnerability detection and security vulnerability assessment methods lack a unified standard and process for evaluating the security vulnerabilities of the operating system. Most vulnerability management systems collect existing vulnerability information and compare it with local vulnerability information to scan for vulnerabilities. Such vulnerability information is very complex and cannot systematically evaluate the security vulnerabilities of the operating system. Summary of the invention

[0005] The embodiment of the present invention provides a source code-based operating system security vulnerability detection and evaluation method to achieve effective security vulnerability detection and evaluation of the operating system.

[0006] In order to achieve the above object, the present invention adopts the following technical scheme.

[0007] A source code-based operating system security vulnerability detection and evaluation method, comprising:

[0008] Establish a set of security vulnerability identification rules for the operating system source code. Each security vulnerability identification rule includes a serial number, a rule description, and key operation items.

[0009] Set the weight of each security vulnerability judgment rule. The sum of the weights of all security vulnerability judgment rules is 1.

[0010] The specific focus operations and rule descriptions in the operating system source code security vulnerability identification rule set are converted into logical judgment statements, and a vulnerability identification model is established based on the logical judgment statements of the security vulnerability identification rules and their weights;

[0011] Scan the source code of the tested operating system for key operation items associated with the security vulnerability identification rules, and count the total number of key operation items involved in each security vulnerability identification rule in the source code;

[0012] The vulnerability identification model is used to identify the security vulnerabilities of the source codes related to the focus operation items found by scanning, the number and location of the source codes violating the security vulnerability identification rules are counted, and the source code security vulnerability of the tested operating system is calculated.

[0013] Preferably, the security vulnerability identification rule set for the operating system source code is established, and each security vulnerability identification rule includes three items: a sequence number, a rule description, and a focus operation item, including:

[0014] Establishing a security vulnerability judgment rule set for operating system source code, wherein the security vulnerability judgment rule set includes 33 rules of 13 categories, including: pointer type variable related statements, resource application and recovery, division expression, function pointer reference, function call, function common type parameter (non-read-write pointer) read-write reference, array element read-write reference, common variable read-write reference, judgment statement, switch statement, judgment statement always true, assignment expression and shared data read-write reference;

[0015] Each security vulnerability identification rule includes three contents: a serial number, a rule description and a focus operation item. The focus operation item is a key operation statement in the operating system that may cause a vulnerability, and the rule description is an incorrect use identification rule corresponding to the focus operation item.

[0016] Preferably, the sequence number, rule description, focus operation items and weight settings of each security vulnerability identification rule include:

[0017] Serial number: A01, rule description: The pointer type variable is not initialized and the content pointed to by the pointer is written, focus operation item: write the content pointed to by the reference pointer type variable, weight 0.03;

[0018] Serial number: A02, rule description: pointer type variable is not initialized and the content pointed to by the pointer is read and referenced, focus operation item: pointer type variable is not initialized and the content pointed to by the pointer is read and referenced, weight 0.03;

[0019] Serial number: A03, rule description: After the pointer type variable applies for space, the content it points to is not initialized and is read referenced, focus operation item: The pointer type variable has been initialized and the content it points to is read referenced, weight 0.02;

[0020] No.: A04, rule description: When allocating space for pointer type variables, the rationality of allocation is not fully checked. Focus operation item: Allocation of space for pointer type variables, weight 0.05;

[0021] Serial number: A05, rule description: The validity of the content pointed to by the initialized pointer type variable is not checked when writing the reference, focus operation item: The content pointed to by the initialized pointer type variable is written to the reference, weight 0.02;

[0022] Serial number: A06, rule description: When releasing space of pointer type variable, it does not check whether the space has been released. Focus operation item: releasing space of pointer type variable, weight 0.03;

[0023] Serial number: A07, rule description: When releasing the space of a pointer type variable, the pointer type variable is not set to null at the same time. Focus operation item: releasing the space of a pointer type variable, weight 0.03;

[0024] Serial number: B01, rule description: memory application and recycling operation pairing check, focus operation items: memory application and recycling operation, weight 0.05;

[0025] Serial number: B02, rule description: file descriptor application and recovery operation pairing check, focus operation items: file descriptor application and recovery operation, weight 0.03;

[0026] Serial number: B03, rule description: check the pairing of lock application and recovery operation, focus operation items: lock application and recovery operation, weight 0.05;

[0027] Serial number: B04, rule description: check the pairing of semaphore application and recycling operations, focus operation items: semaphore application and recycling operations, weight 0.05;

[0028] Serial number: B05, rule description: Check the pairing of process control block application and recovery operations, focus operation items: process control block application and recovery operations, weight 0.03;

[0029] Serial number: B06, rule description: thread control block application and recovery operation pairing check, focus operation items: thread control block application and recovery operation, weight 0.03;

[0030] Serial number: C01, rule description: The division expression does not check the rationality of the value of the divisor expression, focus operation item: division expression, weight 0.02;

[0031] No.: D01, rule description: The pointer parameter of the function is read and referenced without being checked, focus operation item: The pointer parameter of the function is read and referenced, weight 0.03;

[0032] No.: D02, rule description: The pointer parameter of the function is referenced without being checked, focus operation item: The pointer parameter of the function is referenced, weight 0.03;

[0033] Serial number: D03, rule description: The pointer type return value of the function is read without checking the reference address, focus operation item: the pointer type return value of the function is read, the weight is 0.03;

[0034] Serial number: D04, rule description: The pointer type return value of the function is written to the reference address without being checked, focus operation item: The pointer type return value of the function is written to the reference address, weight 0.05;

[0035] No.: E01, rule description: The actual parameter and formal parameter types are inconsistent when calling a function. Focus operation: corresponding function call, weight 0.02;

[0036] No.: F01, rule description: Function common type parameters are read and referenced without being checked, focus operation item: Function common (non-pointer) type parameter read and referenced, weight 0.03;

[0037] No.: F02, rule description: Function common type parameters are referenced without being checked, focus operation item: Function common type parameters are referenced, weight 0.03;

[0038] Sequence number: G01, rule description: Array elements are read and referenced without checking the legitimacy of the subscripts, focus operation item: array element read reference, weight 0.02;

[0039] Sequence number: G02, array element is referenced without checking the legitimacy of the subscript, focus operation item: array element reference, weight 0.02;

[0040] Serial number: H01, rule description: ordinary variables are not initialized and are read and referenced, focus operation item: ordinary variables are read and referenced, weight 0.02;

[0041] Serial number: H02, rule description: Common variable write reference but no validity check, focus operation item: Common variable write reference, weight 0.02;

[0042] Serial number: I01, rule description: Conditional statement conditional expression is always true or false, focus operation item: conditional statement, weight 0.01;

[0043] Serial number: I02, rule description: while loop condition expression is always false, focus operation item: while loop statement, weight 0.01;

[0044] Serial number: I03, rule description: for loop condition expression is always false, focus operation item: for loop statement, weight 0.01;

[0045] No.: J01, rule description: The switch statement lacks a default branch, focus operation item: switch statement, weight 0.02;

[0046] No.: K01, rule description: while loop condition expression is always true and there is no break statement in the loop body, focus operation item: while loop statement, weight 0.02;

[0047] No.: L01, rule description: The types of the left and right sides of the assignment expression are inconsistent, focus operation item: assignment expression, weight 0.01;

[0048] Serial number: M01, rule description: No synchronization and mutual exclusion protection is provided when reading shared data, focus operation item: shared data read access, weight 0.05;

[0049] Serial number: M02, rule description: No synchronization and mutual exclusion protection is provided when writing shared data, focus operation item: writing shared data, weight 0.10.

[0050] Preferably, the vulnerability identification model is used to identify the security vulnerabilities of the source codes related to the focus operation items found by scanning, the number and location of the source codes violating the security vulnerability identification rules are counted, and the source code security vulnerability of the tested operating system is calculated, including:

[0051] After scanning and confirming the focus operation items, the vulnerability identification model is used to perform application analysis on the source code related to the focus operation items, the number of times the source code violates the security vulnerability identification rules is counted, and the specific location where the focus operation items occur and the specific location where the rules are violated are saved, and the corresponding number of violations is counted;

[0052] The calculation formula for the source code security vulnerability of the tested operating system is: n represents the total number of security vulnerability identification rules, w i represents the weight of the i-th security vulnerability judgment rule, R WGRi It represents the proportion of violations of the i-th security vulnerability identification rule, that is, the ratio of the number of times the source code violates the i-th security vulnerability identification rule to the total number of focus operations involved in the i-th security vulnerability identification rule in the source code.

[0053] It can be seen from the technical solution provided by the above-mentioned embodiments of the present invention that the present invention provides a standard and specific method for evaluating operating system security vulnerabilities by establishing an operating system source code security vulnerability judgment rule set, namely a source code vulnerability detection rule set, thereby evaluating operating system security vulnerabilities more scientifically and effectively.

[0054] Additional aspects and advantages of the present invention will be given in part in the following description, which will become obvious from the following description, or may be learned through practice of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0055] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying creative work.

[0056] Figure 1 A processing flow chart of a source code-based operating system security vulnerability detection and evaluation method provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0057] The embodiments of the present invention are described in detail below, examples of which are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain the present invention, and cannot be interpreted as limiting the present invention.

[0058] It will be understood by those skilled in the art that, unless expressly stated, the singular forms "one", "said", and "the" used herein may also include plural forms. It should be further understood that the term "comprising" used in the specification of the present invention refers to the presence of the features, integers, steps, operations, elements and / or components, but does not exclude the presence or addition of one or more other features, integers, steps, operations, elements, components and / or groups thereof. It should be understood that when we refer to an element as being "connected" or "coupled" to another element, it may be directly connected or coupled to the other element, or there may be intermediate elements. In addition, the "connection" or "coupling" used herein may include wireless connection or coupling. The term "and / or" used herein includes any unit and all combinations of one or more associated listed items.

[0059] It will be understood by those skilled in the art that, unless otherwise defined, all terms (including technical and scientific terms) used herein have the same meaning as those generally understood by those skilled in the art in the art to which the present invention belongs. It should also be understood that terms such as those defined in common dictionaries should be understood to have meanings consistent with the meanings in the context of the prior art, and will not be interpreted with idealized or overly formal meanings unless defined as herein.

[0060] To facilitate understanding of the embodiments of the present invention, several specific embodiments will be further explained below with reference to the accompanying drawings, and each embodiment does not constitute a limitation on the embodiments of the present invention.

[0061] In conjunction with the accompanying drawings, the present invention is described in detail:

[0062] The processing flow of a source code-based operating system security vulnerability detection and evaluation method provided by an embodiment of the present invention is as follows: Figure 1 As shown, the processing steps include the following:

[0063] Step S10: Establish a security vulnerability identification rule set for the operating system source code, i.e., a source code vulnerability detection rule set. Each security vulnerability identification rule includes three items: a serial number, a rule description, and a focus operation item. At the same time, the number of times that the initialization (source code) violates each security vulnerability identification rule is 0, and the total number of focus operations involved in each security vulnerability identification rule in the source code is 0.

[0064] Step S20: Set the weight of each security vulnerability judgment rule, and the sum of the weights of all security vulnerability judgment rules is 1.

[0065] Step S30, convert the specific focus operation items and rule descriptions in the operating system source code security vulnerability judgment rule set into a logic judgment statement, and establish a vulnerability judgment model based on the logic judgment statement of the security vulnerability judgment rule and its weight. For example, the rule described in serial number A01 can be converted into the following logic judgment statement: if the content pointed to by a write reference pointer type variable similar to *ptr=10 is identified, it is recorded as an A01 focus operation item and the total number of focus operations involved in the A01 security vulnerability judgment rule in the source code is increased by 1, and then it is determined whether the pointer variable ptr has been initialized (that is, at least one integer-sized space has been applied for or has pointed to a certain integer variable address). If it is not initialized, it means that the security vulnerability judgment rule A01 is violated, and the number of times the source code violates the A01 security vulnerability judgment rule is increased by 1.

[0066] For example, the rules described in sequence numbers A02 and A03 can be converted into the following logical judgment statements: if an event similar to int value = *ptr is identified, it is determined whether the pointer variable ptr has been initialized (i.e., at least one integer-sized space has been applied for or has pointed to a certain integer variable address). If it has not been initialized, it means that the security vulnerability judgment rule A02 is violated, and it is recorded as the number of A02 focus operations and the total number of focus operations involved in the A02 security vulnerability judgment rule in the source code is increased by 1; otherwise, it is recorded as A03 focus operations and the total number of focus operations involved in the A03 security vulnerability judgment rule in the source code is increased by 1, and then it is determined whether the pointer type variable ptr is initialized using the space application allocation method. If it is and the content pointed to by the pointer variable has not been initialized, it means that the security vulnerability judgment rule A03 is violated, and the number of times the source code violates the A03 security vulnerability judgment rule is increased by 1. The vulnerability judgment model specifically includes all the logic judgment modules generated by the conversion of the rule descriptions and the summary statistics module about the security vulnerability of the system source code. The logic judgment module corresponding to each rule is responsible for scanning the source code and obtaining the number of focus items and rule violations of the corresponding rule, and saving the specific location of the focus operation items and the specific location of the rule violations. The summary statistics module is responsible for using formulas to calculate the source code security vulnerability of the entire system.

[0067] Step S40: Scan the source code of the operating system under test for key operation items associated with the security vulnerability identification rule, and count the total number of key operation items involved in each security vulnerability identification rule in the source code.

[0068] Step S50, using the vulnerability identification model to identify the security vulnerability of the source code related to the focus operation items found by scanning, counting the number of times the source code violates the security vulnerability identification rules and saving the specific location of the focus operation items and the specific location of the violation of the rules. Further, based on the focus operation items (e.g., writing the content pointed to by the reference pointer type variable *ptr=10) established by scanning in S40, the application analysis of the corresponding security vulnerability identification rules (i.e. A01) is carried out, and the corresponding number of violations is counted.

[0069] Step S60: Calculate the source code security vulnerability of the operating system under test. The calculation formula is: n represents the total number of security vulnerability identification rules, w i represents the weight of the i-th security vulnerability judgment rule. Obviously, R WGRi It represents the proportion of violations of the i-th security vulnerability identification rule, that is, the ratio of the number of times the source code violates the i-th security vulnerability identification rule to the total number of focus operations involved in the i-th security vulnerability identification rule in the source code.

[0070] The above-mentioned step S20 specifically includes: the security vulnerability judgment rule set in the above-mentioned security vulnerability judgment rule set contains 33 rules, totaling 13 categories: pointer type variable related statements, resource application and recovery, division expression, function pointer reference, function call, function common type parameter (non-read-write pointer) read-write reference, array element read-write reference, common variable read-write reference, judgment statement, switch statement, judgment statement is always true, assignment expression and shared data read-write reference.

[0071] Each security vulnerability identification rule includes three contents: serial number, rule description and key operation items. The key operation items involved refer to some key operation statements in the operating system that are prone to vulnerabilities. The rule description is the incorrect use identification rule of the corresponding key operation items.

[0072] Set the weight of the security vulnerability judgment rule. Each security vulnerability judgment rule has a recommended weight value, and the sum of the weight values ​​of all judgment rules is 1. The weight value is used to calculate the source code security vulnerability of the tested operating system.

[0073] The specific rules and initial weights are as follows:

[0074] Serial number: A01, rule description: The pointer type variable is not initialized and the content pointed to by the pointer is written, focus operation item: write the content pointed to by the reference pointer type variable, weight 0.03;

[0075] Serial number: A02, rule description: pointer type variable is not initialized and the content pointed to by the pointer is read and referenced, focus operation item: pointer type variable is not initialized and the content pointed to by the pointer is read and referenced, weight 0.03;

[0076] Serial number: A03, rule description: After the pointer type variable applies for space, the content it points to is not initialized and is read referenced, focus operation item: The pointer type variable has been initialized and the content it points to is read referenced, weight 0.02;

[0077] No.: A04, rule description: When allocating space for pointer type variables, the rationality of allocation is not fully checked. Focus operation item: Allocation of space for pointer type variables, weight 0.05;

[0078] Serial number: A05, rule description: The validity of the content pointed to by the initialized pointer type variable is not checked when writing the reference, focus operation item: The content pointed to by the initialized pointer type variable is written to the reference, weight 0.02;

[0079] Serial number: A06, rule description: When releasing space of pointer type variable, it does not check whether the space has been released. Focus operation item: releasing space of pointer type variable, weight 0.03;

[0080] Serial number: A07, rule description: When releasing the space of a pointer type variable, the pointer type variable is not set to null at the same time. Focus operation item: releasing the space of a pointer type variable, weight 0.03;

[0081] Serial number: B01, rule description: memory application and recycling operation pairing check, focus operation items: memory application and recycling operation, weight 0.05;

[0082] Serial number: B02, rule description: file descriptor application and recovery operation pairing check, focus operation items: file descriptor application and recovery operation, weight 0.03;

[0083] Serial number: B03, rule description: check the pairing of lock application and recovery operation, focus operation items: lock application and recovery operation, weight 0.05;

[0084] Serial number: B04, rule description: check the pairing of semaphore application and recycling operations, focus operation items: semaphore application and recycling operations, weight 0.05;

[0085] Serial number: B05, rule description: Check the pairing of process control block application and recovery operations, focus operation items: process control block application and recovery operations, weight 0.03;

[0086] Serial number: B06, rule description: thread control block application and recovery operation pairing check, focus operation items: thread control block application and recovery operation, weight 0.03;

[0087] Serial number: C01, rule description: The division expression does not check the rationality of the value of the divisor expression, focus operation item: division expression, weight 0.02;

[0088] No.: D01, rule description: The pointer parameter of the function is read and referenced without being checked, focus operation item: The pointer parameter of the function is read and referenced, weight 0.03;

[0089] No.: D02, rule description: The pointer parameter of the function is referenced without being checked, focus operation item: The pointer parameter of the function is referenced, weight 0.03;

[0090] Serial number: D03, rule description: The pointer type return value of the function is read without checking the reference address, focus operation item: the pointer type return value of the function is read, the weight is 0.03;

[0091] Serial number: D04, rule description: The pointer type return value of the function is written to the reference address without being checked, focus operation item: The pointer type return value of the function is written to the reference address, weight 0.05;

[0092] No.: E01, rule description: The actual parameter and formal parameter types are inconsistent when calling a function. Focus operation: corresponding function call, weight 0.02;

[0093] No.: F01, rule description: Function common (non-pointer) type parameters are read and referenced without being checked, focus operation item: Function common (non-pointer) type parameter read and referenced, weight 0.03;

[0094] No.: F02, rule description: Function common (non-pointer) type parameters are referenced without being checked, focus operation item: Function common (non-pointer) type parameters are referenced, weight 0.03;

[0095] Sequence number: G01, rule description: Array elements are read and referenced without checking the legitimacy of the subscripts, focus operation item: array element read reference, weight 0.02;

[0096] Sequence number: G02, array element is referenced without checking the legitimacy of the subscript, focus operation item: array element reference, weight 0.02;

[0097] Serial number: H01, rule description: Common (non-pointer type) variables are not initialized and are read referenced, focus operation item: Common (non-pointer type) variables are read referenced, weight 0.02;

[0098] Serial number: H02, rule description: Common (non-pointer type) variable write reference but no validity check, focus operation item: Common (non-pointer type) variable write reference, weight 0.02;

[0099] Serial number: I01, rule description: Conditional statement conditional expression is always true or false, focus operation item: conditional statement, weight 0.01;

[0100] Serial number: I02, rule description: while loop condition expression is always false, focus operation item: while loop statement, weight 0.01;

[0101] Serial number: I03, rule description: for loop condition expression is always false, focus operation item: for loop statement, weight 0.01;

[0102] No.: J01, rule description: The switch statement lacks a default branch, focus operation item: switch statement, weight 0.02;

[0103] No.: K01, rule description: while loop condition expression is always true and there is no break statement in the loop body, focus operation item: while loop statement, weight 0.02;

[0104] No.: L01, rule description: The types of the left and right sides of the assignment expression are inconsistent, focus operation item: assignment expression, weight 0.01;

[0105] Serial number: M01, rule description: No synchronization and mutual exclusion protection is provided when reading shared data, focus operation item: shared data read access, weight 0.05;

[0106] Serial number: M02, rule description: No synchronization and mutual exclusion protection is provided when writing shared data, focus operation item: writing shared data, weight 0.10.

[0107] In summary, the embodiments of the present invention lack a unified standard and process for evaluating the security vulnerability of the operating system. Most vulnerability management systems collect existing vulnerability information and compare it with local vulnerability information to scan vulnerabilities. Such vulnerability information is very complex and cannot systematically evaluate the security vulnerability of the operating system. The present invention provides a standard and specific method for evaluating the security vulnerability of the operating system by establishing an operating system source code security vulnerability discrimination rule set, namely a source code vulnerability detection rule set, so as to more scientifically and effectively evaluate the security vulnerability of the operating system.

[0108] Those skilled in the art can understand that the accompanying drawings are only schematic diagrams of an embodiment, and the modules or processes in the accompanying drawings are not necessarily required to implement the present invention.

[0109] It can be known from the description of the above implementation methods that those skilled in the art can clearly understand that the present invention can be implemented by means of software plus a necessary general hardware platform. Based on such an understanding, the technical solution of the present invention is essentially or the part that contributes to the prior art can be embodied in the form of a software product, which can be stored in a storage medium such as ROM / RAM, a magnetic disk, an optical disk, etc., and includes a number of instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in the various embodiments of the present invention or certain parts of the embodiments.

[0110] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the device or system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment. The device and system embodiments described above are merely schematic, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative labor.

[0111] The above is only a preferred specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any changes or substitutions that can be easily thought of by a person skilled in the art within the technical scope disclosed by the present invention should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention should be based on the protection scope of the claims.

Claims

1. A source code-based operating system security vulnerability detection and evaluation method, characterized in that: include: Establish a set of security vulnerability identification rules for the operating system source code. Each security vulnerability identification rule includes a serial number, a rule description, and key operation items. Set the weight of each security vulnerability judgment rule. The sum of the weights of all security vulnerability judgment rules is 1. The specific focus operations and rule descriptions in the operating system source code security vulnerability identification rule set are converted into logical judgment statements, and a vulnerability identification model is established based on the logical judgment statements of the security vulnerability identification rules and their weights; Scan the source code of the tested operating system for key operation items associated with the security vulnerability identification rules, and count the total number of key operation items involved in each security vulnerability identification rule in the source code; The vulnerability identification model is used to identify the security vulnerabilities of the source codes related to the focus operation items found by scanning, and the number and location of the source codes violating the security vulnerability identification rules are counted to calculate the source code security vulnerability of the tested operating system.

2. The method according to claim 1, characterized in that The security vulnerability identification rule set for establishing the operating system source code, each security vulnerability identification rule includes three items: a serial number, a rule description, and a focus operation item, including: Establishing a security vulnerability judgment rule set for operating system source code, wherein the security vulnerability judgment rule set includes 33 rules of 13 categories, including: pointer type variable related statements, resource application and recovery, division expression, function pointer reference, function call, function common type parameter (non-read-write pointer) read-write reference, array element read-write reference, common variable read-write reference, judgment statement, switch statement, judgment statement always true, assignment expression and shared data read-write reference; Each security vulnerability identification rule includes three contents: a serial number, a rule description and a focus operation item. The focus operation item is a key operation statement in the operating system that may cause a vulnerability, and the rule description is an incorrect use identification rule corresponding to the focus operation item.

3. The method according to claim 2, characterized in that The serial number, rule description, key operation items and weight settings of each security vulnerability identification rule include: Serial number: A01, rule description: The pointer type variable is not initialized and the content pointed to by the pointer is written, focus operation item: write the content pointed to by the reference pointer type variable, weight 0.03; Serial number: A02, rule description: pointer type variable is not initialized and the content pointed to by the pointer is read and referenced, focus operation item: pointer type variable is not initialized and the content pointed to by the pointer is read and referenced, weight 0.03; Serial number: A03, rule description: After the pointer type variable applies for space, the content it points to is not initialized and is read referenced, focus operation item: The pointer type variable has been initialized and the content it points to is read referenced, weight 0.02; No.: A04, rule description: When allocating space for pointer type variables, the rationality of allocation is not fully checked. Focus operation item: Allocation of space for pointer type variables, weight 0.05; Serial number: A05, rule description: The validity of the content pointed to by the initialized pointer type variable is not checked when writing the reference, focus operation item: The content pointed to by the initialized pointer type variable is written to the reference, weight 0.02; Serial number: A06, rule description: When releasing space of pointer type variable, it does not check whether the space has been released. Focus operation item: releasing space of pointer type variable, weight 0.03; Serial number: A07, rule description: When releasing the space of a pointer type variable, the pointer type variable is not set to null at the same time. Focus operation item: releasing the space of a pointer type variable, weight 0.03; Serial number: B01, rule description: memory application and recycling operation pairing check, focus operation items: memory application and recycling operation, weight 0.05; Serial number: B02, rule description: file descriptor application and recovery operation pairing check, focus operation items: file descriptor application and recovery operation, weight 0.03; Serial number: B03, rule description: check the pairing of lock application and recovery operation, focus operation items: lock application and recovery operation, weight 0.05; Serial number: B04, rule description: check the pairing of semaphore application and recycling operations, focus operation items: semaphore application and recycling operations, weight 0.05; Serial number: B05, rule description: Check the pairing of process control block application and recovery operations, focus operation items: process control block application and recovery operations, weight 0.03; Serial number: B06, rule description: thread control block application and recovery operation pairing check, focus operation items: thread control block application and recovery operation, weight 0.03; Serial number: C01, rule description: The division expression does not check the rationality of the value of the divisor expression, focus operation item: division expression, weight 0.02; No.: D01, rule description: The pointer parameter of the function is read and referenced without being checked, focus operation item: The pointer parameter of the function is read and referenced, weight 0.03; No.: D02, rule description: The pointer parameter of the function is referenced without being checked, focus operation item: The pointer parameter of the function is referenced, weight 0.03; Serial number: D03, rule description: The pointer type return value of the function is read without checking the reference address, focus operation item: the pointer type return value of the function is read, the weight is 0.03; Serial number: D04, rule description: The pointer type return value of the function is written to the reference address without being checked, focus operation item: The pointer type return value of the function is written to the reference address, weight 0.05; No.: E01, rule description: The actual parameter and formal parameter types are inconsistent when calling a function. Focus operation: corresponding function call, weight 0.02; No.: F01, rule description: Function common type parameters are read and referenced without being checked, focus operation item: Function common (non-pointer) type parameter read and referenced, weight 0.03; No.: F02, rule description: Function common type parameters are referenced without being checked, focus operation item: Function common type parameters are referenced, weight 0.03; Sequence number: G01, rule description: Array elements are read and referenced without checking the legitimacy of the subscripts, focus operation item: array element read reference, weight 0.02; Sequence number: G02, array element is referenced without checking the legitimacy of the subscript, focus operation item: array element reference, weight 0.02; Serial number: H01, rule description: ordinary variables are not initialized and are read and referenced, focus operation item: ordinary variables are read and referenced, weight 0.02; Serial number: H02, rule description: Common variable write reference but no validity check, focus operation item: Common variable write reference, weight 0.02; Serial number: I01, rule description: Conditional statement conditional expression is always true or false, focus operation item: conditional statement, weight 0.01; Serial number: I02, rule description: while loop condition expression is always false, focus operation item: while loop statement, weight 0.01; Serial number: I03, rule description: for loop condition expression is always false, focus operation item: for loop statement, weight 0.01; No.: J01, rule description: The switch statement lacks a default branch, focus operation item: switch statement, weight 0.02; No.: K01, rule description: while loop condition expression is always true and there is no break statement in the loop body, focus operation item: while loop statement, weight 0.02; No.: L01, rule description: The types of the left and right sides of the assignment expression are inconsistent, focus operation item: assignment expression, weight 0.01; Serial number: M01, rule description: No synchronization and mutual exclusion protection is provided when reading shared data, focus operation item: shared data read access, weight 0.05; Serial number: M02, rule description: No synchronization and mutual exclusion protection is provided when writing shared data, focus operation item: writing shared data, weight 0.

10.

4. The method according to claim 1, 2 or 3, characterized in that: The method of using the vulnerability identification model to identify the security vulnerabilities of the source codes related to the focus operation items found by scanning, counting the number and location of the source codes violating the security vulnerability identification rules, and calculating the source code security vulnerability of the tested operating system includes: After scanning and confirming the focus operation items, the vulnerability identification model is used to perform application analysis on the source code related to the focus operation items, the number of times the source code violates the security vulnerability identification rules is counted, and the specific location where the focus operation items occur and the specific location where the rules are violated are saved, and the corresponding number of violations is counted; The calculation formula for the source code security vulnerability of the tested operating system is: n represents the total number of security vulnerability identification rules, w i represents the weight of the i-th security vulnerability judgment rule, R WGRi It represents the proportion of violations of the i-th security vulnerability identification rule, that is, the ratio of the number of times the source code violates the i-th security vulnerability identification rule to the total number of focus operations involved in the i-th security vulnerability identification rule in the source code.

Images