Vulnerability verification method, system and device based on static security test and medium

Abstract

The invention relates to the technical field of security testing, and discloses a vulnerability verification method, system and device based on a static security test and a medium, the method comprises the following steps: performing static vulnerability analysis on a security test code obtained in advance to obtain a suspicious vulnerability code; performing vulnerability feature extraction and trigger verification on the suspicious vulnerability code to obtain a vulnerability trigger code; performing monitoring execution and vulnerability verification on the suspicious vulnerability code by utilizing the vulnerability trigger code to obtain a real vulnerability log; and performing log analysis and security analysis on the real vulnerability log to obtain a security verification report. Through trigger code verification, virtual environment execution and log analysis of the execution result, the vulnerability detection accuracy can be effectively improved, the vulnerability detection reliability is improved, and the security test efficiency is improved.

Description

Technical Field

[0001] The present invention relates to the field of security testing technology, and in particular to a vulnerability verification method, system, device and medium based on static security testing. Background Art

[0002] During the software development process, the developed software code needs to be security tested, that is, a series of testing activities are carried out on the software or application code to discover and fix potential security vulnerabilities and risks to ensure that the code will not be maliciously exploited or attacked during runtime. Static security testing tools play a vital role in security testing to identify and locate potential security risks in the code.

[0003] Traditional security testing methods are mainly based on traditional detection tools. For example, security testing is performed using detection tools such as Fortify, Checkmarx, and SonarQube. In actual use, security testing methods based on traditional detection tools cannot verify whether the vulnerabilities they discover actually exist. Even if the detection tools give the vulnerabilities in the code, developers cannot confirm whether these vulnerabilities really pose a threat to the application. As a result, a lot of time and effort are required to perform manual vulnerability verification, which may lead to low efficiency in security testing of the code. Summary of the invention

[0004] The present invention provides a vulnerability verification method, system, device and medium based on static security testing, the main purpose of which is to solve the problem of low efficiency when performing security testing on codes in related technologies.

[0005] To achieve the above-mentioned purpose, the present invention provides a vulnerability verification method based on static security testing, including: performing static vulnerability analysis on a pre-acquired security test code to obtain a suspected vulnerability code; performing vulnerability feature extraction and trigger verification on the suspected vulnerability code to obtain a vulnerability trigger code; using the vulnerability trigger code to monitor the execution and vulnerability verification of the suspected vulnerability code to obtain a real vulnerability log; performing log parsing and security analysis on the real vulnerability log to obtain a security verification report.

[0006] In order to solve the above problems, the present invention also provides a vulnerability verification system based on static security testing, the system comprising: a static analysis module, used to perform static vulnerability analysis on the pre-acquired security test code to obtain suspicious vulnerability code; a trigger analysis module, used to extract vulnerability features and perform trigger verification on the suspicious vulnerability code to obtain vulnerability trigger code; a vulnerability verification module, used to monitor the execution and vulnerability verification of the suspicious vulnerability code using the vulnerability trigger code to obtain a real vulnerability log; a report generation module, used to perform log parsing and security analysis on the real vulnerability log to obtain a security verification report.

[0007] In order to solve the above problem, the present invention further provides an electronic device, the electronic device comprising:

[0008] at least one processor; and,

[0009] a memory communicatively connected to at least one processor; wherein,

[0010] The memory stores a computer program that can be executed by at least one processor, and the computer program is executed by at least one processor so that the at least one processor can execute the above-mentioned vulnerability verification method based on static security testing.

[0011] In order to solve the above problems, the present invention also provides a computer-readable storage medium storing a computer program, which implements the above-mentioned vulnerability verification method based on static security testing when executed by a processor.

[0012] The embodiment of the present invention can identify and mark suspicious vulnerability codes by performing static vulnerability analysis, realize primary vulnerability detection for security testing, and improve the efficiency of security testing. By performing vulnerability feature extraction and trigger verification, corresponding vulnerability triggering codes can be generated according to the vulnerability features of different vulnerability codes, which is convenient for subsequent targeted vulnerability security testing. By performing simulated execution and behavior monitoring, targeted vulnerability triggering tests and test result recording can be performed on codes that may have vulnerabilities, and the authenticity verification of vulnerability codes can be realized using the test results, thereby improving the accuracy of vulnerability verification in security testing. By performing log parsing and security analysis, a complete process introduction of security testing for real vulnerability codes and an introduction to corresponding vulnerability principles and information can be provided, thereby improving the intuitiveness of security verification. Therefore, the vulnerability verification method, system, device, and medium based on static security testing proposed by the present invention can solve the problem of low efficiency when performing security testing on codes. BRIEF DESCRIPTION OF THE DRAWINGS

[0013] Figure 1 A schematic diagram of a process flow of a vulnerability verification method based on static security testing provided by an embodiment of the present invention;

[0014] Figure 2 A schematic diagram of a process for performing static vulnerability analysis provided by an embodiment of the present invention;

[0015] Figure 3 A schematic diagram of a process for generating a real vulnerability log according to an embodiment of the present invention;

[0016] Figure 4 A functional module diagram of a vulnerability verification system based on static security testing provided by an embodiment of the present invention;

[0017] Figure 5 A schematic diagram of the structure of an electronic device for implementing a vulnerability verification method based on static security testing provided by an embodiment of the present invention.

[0018] The realization of the purpose, functional features and advantages of the present invention will be further explained in conjunction with embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0019] It should be understood that the specific embodiments described herein are only used to explain the present invention, and are not used to limit the present invention.

[0020] The embodiment of the present application provides a vulnerability verification method based on static security testing. The execution subject of the vulnerability verification method based on static security testing includes but is not limited to at least one of the electronic devices that can be configured to execute the method provided by the embodiment of the present application, such as a server, a terminal, etc. In other words, the vulnerability verification method based on static security testing can be executed by software or hardware installed on a terminal device or a server device. The server includes but is not limited to: a single server, a server cluster, a cloud server or a cloud server cluster, etc. The server can be an independent server, or it can be a cloud server that provides cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, content delivery networks (Content Delivery Network, CDN), and basic cloud computing services such as big data and artificial intelligence platforms.

[0021] Reference Figure 1 FIG. 1 is a flow chart of a vulnerability verification method based on static security testing provided by an embodiment of the present invention. In this embodiment, the vulnerability verification method based on static security testing includes:

[0022] S1. Perform static vulnerability analysis on the pre-acquired security test code to obtain suspicious vulnerability code.

[0023] In detail, security testing code refers to software code that needs to be security tested. The software code includes the code itself and dependencies. The software code can be a web application code, a mobile application code or a client application code. The software code may have potential vulnerabilities or design flaws, which can allow attackers to exploit these vulnerabilities to gain unauthorized access to the system, leak data, deny service or other malicious behaviors.

[0024] Specifically, suspicious vulnerability code refers to some code fragments in the security test code that may have vulnerabilities or involve defects. Suspicious vulnerability code may execute system commands, read / modify files, steal data, etc.

[0025] In the embodiment of the present invention, refer to Figure 2As shown, the above step of performing static vulnerability analysis on the pre-acquired security test code to obtain suspicious vulnerability code further includes:

[0026] S21, performing abstract syntax analysis on the pre-acquired security test code to obtain a code syntax tree;

[0027] S22, performing semantic vulnerability analysis on the security test code according to the code syntax tree to obtain a semantic vulnerability code;

[0028] S23, performing static vulnerability scanning on the security test code according to the code syntax tree to obtain static vulnerability code;

[0029] S24. Generate a suspected vulnerability code according to the semantic vulnerability code and the static vulnerability code.

[0030] In detail, abstract syntax parsing includes lexical decomposition of the security test code to obtain a code lexical unit set, grammatical parsing of the code lexical unit set to obtain a code syntax tree, wherein each lexical unit in the lexical unit set refers to tokens, which are the smallest meaningful units in the code, such as keywords, identifiers, operators, separators, and literals.

[0031] Specifically, regular expressions or finite state machines (FSM) can be used for lexical decomposition, and recursive descent parsing, LL parser or LR parser can be used for syntax parsing. The code syntax tree is a tree representation of the code syntax structure. Each node in the code syntax tree represents a grammatical structure. For example, the code syntax tree of the code "int a=5;" is "Assignment, Type: int, Variable: a, Value: 5".

[0032] In detail, a semantic vulnerability analysis is performed on the security test code according to the code syntax tree to obtain a semantic vulnerability code, including: performing symbol extraction on the security test code according to the code syntax tree to obtain code syntax symbols; performing definition vulnerability analysis and reference vulnerability analysis on the code syntax symbols and code classes to obtain symbolic semantic vulnerability code; performing type consistency analysis on the code syntax symbols to obtain type semantic vulnerability code; performing scope vulnerability analysis on the code syntax symbols to obtain scope semantic vulnerability code; and generating a semantic vulnerability code based on the symbolic semantic vulnerability code, the type semantic vulnerability code and the scope semantic vulnerability code.

[0033] In detail, symbol extraction refers to extracting symbols such as variables, functions, and classes in the security test code and compiling them into code syntax symbols. Definition vulnerability analysis refers to analyzing whether the definition of the code syntax symbols is wrong, and using the erroneous part of the code as the symbolic semantic vulnerability code. Reference vulnerability analysis refers to analyzing whether the reference relationship of the code syntax symbols is wrong, and using the erroneous part of the code as the symbolic semantic vulnerability code. Definition vulnerability analysis and reference vulnerability analysis can be performed using the symbol table method or the symbol lookup method.

[0034] Specifically, type consistency analysis refers to checking the type correspondence of variables and functions. Type consistency analysis can be performed using type inference and type matching methods, and the erroneous part of the code can be treated as type semantic vulnerability code.

[0035] In detail, scope vulnerability analysis refers to checking whether the scope of variables and functions is correct, and taking the wrong part of the code as the scope semantic vulnerability code. Scope vulnerability analysis can be performed by using scope rule application, nested scope resolution or scope stack maintenance methods.

[0036] Specifically, a static vulnerability scan is performed on the security test code according to the code syntax tree to obtain a static vulnerability code, including: performing a data flow scan on the security test code according to the code syntax tree to obtain a data flow vulnerability code; performing a control flow analysis on the security test code according to the code syntax tree to obtain a control flow vulnerability code; performing pattern matching on the security test code according to a preset security rule library and the code syntax tree to obtain a rule vulnerability code; and generating a static vulnerability code based on the data flow vulnerability code, the control flow vulnerability code and the rule vulnerability code.

[0037] In detail, data flow scanning includes identifying the variable definition and variable position of each variable in the security test code according to the code syntax tree, generating a data flow graph according to the variable definition and variable position, and performing taint analysis on the security test code according to the data flow graph to obtain data flow vulnerability code, wherein a data flow graph (DFG for short) is a graphical representation that shows the flow relationship of data between various operations in a program. The data flow graph focuses on the production and consumption of data. Taint analysis refers to tracing the propagation path of unprocessed user input in the security test code to detect potential injection vulnerabilities.

[0038] Specifically, control flow analysis refers to analyzing the execution path of the security test code, identifying logical vulnerabilities and problems corresponding to the execution path. Control flow analysis includes constructing the execution path of the security test code according to the code syntax tree to obtain a control flow graph, performing path analysis and logical vulnerability detection on the control flow graph to obtain control flow vulnerability code. Among them, the control flow graph (Control Flow Graph, abbreviated as CFG) is a graphical representation that shows the control flow transfer relationship between each basic block in the program.

[0039] In detail, the security rule base is a preset database containing a set of security rules. The security rules describe common security vulnerabilities and their identification patterns. Each security rule contains the conditions and methods for detecting a specific type of vulnerability, and pattern matching can be performed using static security testing tools or dynamic security testing tools.

[0040] Specifically, security rules include rule descriptions, detection conditions, and trigger codes. The rule description is a detailed description of each security rule, describing the vulnerability type, impact, and repair suggestions. The detection conditions are used to match code patterns or conditions to identify vulnerabilities. The trigger code is the code used to trigger the corresponding vulnerability. Vulnerability types include coding errors, injection vulnerabilities, access control, and configuration errors.

[0041] In the embodiment of the present invention, by performing static vulnerability analysis, suspicious vulnerability codes can be identified and marked, primary vulnerability detection for security testing can be achieved, and the efficiency of security testing is improved.

[0042] S2. Extract vulnerability features and perform trigger verification on the suspicious vulnerability code to obtain the vulnerability trigger code.

[0043] In detail, the vulnerability triggering code is the Proof of Concept (POC) code. The Proof of Concept code refers to the code used to trigger a code vulnerability of a specific type and characteristic. The main purpose of the Proof of Concept code is to verify the existence of a vulnerability and show how to exploit the vulnerability. It is usually a short sample code that directly targets a specific vulnerability, through which the exploitability of the vulnerability can be confirmed.

[0044] In an embodiment of the present invention, vulnerability feature extraction and trigger verification are performed on suspicious vulnerability codes to obtain vulnerability triggering codes, including: performing type feature detection on the suspicious vulnerability code to obtain vulnerability type features; performing input feature detection on the suspicious vulnerability code to obtain vulnerability input features; generating triggering vulnerability features based on vulnerability type features and vulnerability input features; and performing verification code construction on the suspicious vulnerability code based on the triggering vulnerability features to obtain vulnerability triggering codes.

[0045] Specifically, type feature detection refers to the use of methods such as keyword matching or code feature vector matching to detect vulnerability types that may exist in vulnerable code. Vulnerability types include coding errors, injection vulnerabilities, access control, and configuration errors.

[0046] In detail, input feature detection is performed on the suspected vulnerability code to obtain vulnerability input features, including: input point detection is performed on the suspected vulnerability code to obtain vulnerability location features; conditional structure detection is performed on the suspected vulnerability code to obtain vulnerability structure features; resource dependency detection is performed on the suspected vulnerability code to obtain vulnerability dependency features; sensitive operation detection is performed on the suspected vulnerability code to obtain vulnerability sensitive features; vulnerability input features are generated based on vulnerability location features, vulnerability structure features, vulnerability dependency features and vulnerability sensitive features.

[0047] Specifically, input point detection refers to detecting vulnerabilities in input obtained by users, such as form input, URL parameters, and HTTP requests. Conditional structure detection refers to vulnerability detection of loop structures or judgment conditions in suspected vulnerability codes. Resource dependency detection refers to detecting vulnerabilities in the context information of suspected vulnerability codes, accessed files, databases, or resource states. Sensitive operation detection refers to detecting vulnerabilities in the sensitive operation part of suspected vulnerability codes. Generating vulnerability input features refers to aggregating and fusing vulnerability location features, vulnerability structure features, vulnerability dependency features, and vulnerability sensitivity features into vulnerability input features.

[0048] In detail, generating trigger vulnerability features refers to aggregating vulnerability type features and vulnerability input features into trigger vulnerability features. Verification code construction refers to generating trigger code that can trigger the corresponding trigger vulnerability features in the suspicious vulnerability code based on the trigger vulnerability features. The verification code construction can be performed using the trained Transformer model or by matching features with a preset trigger code database.

[0049] In the embodiment of the present invention, by performing vulnerability feature extraction and trigger verification, corresponding vulnerability triggering codes can be generated according to the vulnerability features of different vulnerability codes, which facilitates subsequent implementation of targeted vulnerability security testing.

[0050] S3. Use the vulnerability triggering code to monitor the execution of the suspicious vulnerability code and verify the vulnerability to obtain the real vulnerability log.

[0051] In detail, the real vulnerability log refers to the log corresponding to the vulnerability behavior that is actually triggered, that is, the behavior log recorded when a real execution vulnerability occurs after being triggered by the vulnerability triggering code in a preset simulation environment.

[0052] In the embodiment of the present invention, refer to Figure 3As shown, the above step of using the vulnerability triggering code to monitor the execution of the suspicious vulnerability code and verify the vulnerability to obtain the real vulnerability log further includes:

[0053] S31, initializing the simulation environment sandbox, and configuring the monitoring script for the simulation environment sandbox to obtain the monitoring environment sandbox;

[0054] S32, deploying code to the monitoring environment sandbox according to the suspicious vulnerability code to obtain a deployment environment sandbox;

[0055] S33, triggering execution and behavior monitoring of the deployment environment sandbox according to the vulnerability trigger code to obtain the execution result;

[0056] S34. Verify the authenticity of the vulnerability on the execution result to obtain a real vulnerability log.

[0057] In detail, the simulation environment sandbox can be an isolated sandbox tool such as a VM virtual machine, Docker container or environment sandbox that can independently execute code virtually. Initializing the simulation environment refers to selecting the corresponding isolated sandbox tool, installing and configuring the virtual environment, installing the compiler, interpreter and running environment.

[0058] Specifically, monitoring scripts can be configured using monitoring tools such as strace, lsof, and tcpdump. Code deployment refers to deploying suspicious vulnerability codes into the monitoring environment sandbox, and compiling and configuring the suspicious vulnerability codes to make them executable.

[0059] In detail, the deployment environment sandbox is triggered to execute and the behavior is monitored according to the vulnerability triggering code to obtain the execution result, including: injecting code into the deployment environment sandbox according to the vulnerability triggering code to obtain the injected environment sandbox; monitoring and waking up the injected environment sandbox to obtain a trigger monitoring script; performing vulnerability triggering execution on the vulnerability triggering code in the injected environment sandbox to obtain the execution behavior; and recording the execution behavior according to the trigger monitoring script to obtain the execution result.

[0060] Specifically, code injection refers to deploying the vulnerability triggering code in the deployment environment sandbox, and monitoring wakeup refers to waking up the monitoring tool configured when the monitoring script is configured, and using the monitoring script corresponding to the monitoring tool as the trigger monitoring script.

[0061] In detail, vulnerability trigger execution refers to running the vulnerability trigger code, using the vulnerability trigger code to trigger the execution of the suspicious vulnerability code. The execution behavior is the various behaviors of the suspicious vulnerability code after being triggered. The execution results include data such as system calls, file operations, and network traffic of the execution behavior.

[0062] In detail, the authenticity of the vulnerability is verified on the execution result to obtain a real vulnerability log, including: determining whether the execution result is the vulnerability result corresponding to the vulnerability triggering code; if so, taking the part of the execution result that triggers the vulnerability in the execution result as the vulnerability execution result, taking the part of the code corresponding to the vulnerability execution result in the suspected vulnerability code as the real vulnerability code, taking the part of the code corresponding to the vulnerability execution result in the vulnerability triggering code as the real triggering code, and generating a real vulnerability log based on the vulnerability execution result, the real vulnerability code and the real triggering code.

[0063] In detail, the vulnerability execution result refers to the result that can realize the vulnerability corresponding to the suspicious vulnerability code. For example, the suspicious code snippet is "Object result = engine.eval(userInput);", where engine.eval(userInput) allows the direct execution of the code entered by the user, and the corresponding vulnerability triggering code of the suspicious code snippet is "java.lang.Runtime.getRuntime().exec('calc.exe');", which is used to directly start the calculator application ('calc.exe'). When the execution result is that the calculator application is opened, the execution result is the vulnerability execution result.

[0064] In the embodiment of the present invention, by performing simulated execution and behavior monitoring, targeted vulnerability triggering testing and test result recording can be performed on codes that may have vulnerabilities, and the test results are used to verify the authenticity of the vulnerability code, thereby improving the accuracy of vulnerability verification in security testing.

[0065] S4. Perform log parsing and security analysis on the real vulnerability log to obtain a security verification report.

[0066] In detail, a security verification report refers to a readable text report that is used to show the detailed process and results of security testing.

[0067] In an embodiment of the present invention, log parsing and security analysis are performed on real vulnerability logs to obtain a security verification report, including: traversing log parsing of the real vulnerability log to obtain vulnerability execution results, real vulnerability codes, and real trigger codes; matching vulnerability information on the real vulnerability codes to obtain vulnerability information text; matching repair suggestion on the real vulnerability codes to obtain repair suggestion text; generating a security verification report based on the vulnerability execution results, real vulnerability codes, real trigger codes, vulnerability information text, and repair suggestion text.

[0068] In detail, traversal log parsing refers to extracting the log structure of the real vulnerability log in a traversal manner, and performing log parsing according to the log structure. The log parsing method may be a YAML parsing tool or an XML parsing tool.

[0069] Specifically, vulnerability information matching refers to matching the vulnerability impact and attack scenario information of the real vulnerability code from the preset vulnerability database as the vulnerability information text. For example, the vulnerability information text of the real vulnerability code "Object result = engine.eval (userInput);" is:

[0070] Vulnerability impact: This vulnerability allows a remote attacker to execute arbitrary code, which may lead to complete control of the system, thereby leaking sensitive information, performing malicious operations, or compromising system integrity. An attacker may exploit this vulnerability by tricking a user into executing a malicious script or exploiting other vulnerabilities to inject malicious code into the affected system.

[0071] Specifically, repair suggestion matching refers to matching the repair suggestion and other information of the real vulnerability code from the preset vulnerability database as the repair suggestion text. For example, the repair suggestion text of the real vulnerability code "Object result = engine.eval (userInput);" is:

[0072] Repair suggestions: In order to fix this RCE vulnerability, we recommend taking the following measures: User input validation: Strictly validate and sanitize user input to ensure that only expected input types are accepted, and filter or escape special characters or patterns that may lead to code execution; Avoid executing dynamic code: Avoid directly executing user-provided dynamic code in a production environment as much as possible. If dynamic code must be executed, a secure sandbox environment should be used to limit the execution permissions of the code; Principle of least privilege: Ensure that the application runs as a service account that has only the minimum permissions required to complete its tasks to reduce potential security risks.

[0073] In the embodiment of the present invention, by performing log parsing and security analysis, a complete process introduction of security testing for real vulnerability codes and an introduction to corresponding vulnerability principles and information can be provided, thereby improving the intuitiveness of security verification.

[0074] The embodiment of the present invention can identify and mark suspicious vulnerability codes by performing static vulnerability analysis, realize primary vulnerability detection for security testing, and improve the efficiency of security testing. By performing vulnerability feature extraction and trigger verification, corresponding trigger vulnerability codes can be generated according to the vulnerability features of different vulnerability codes, which is convenient for subsequent targeted vulnerability security testing. By performing simulated execution and behavior monitoring, targeted vulnerability trigger tests can be performed on codes that may have vulnerabilities and test result records can be recorded, and the authenticity verification of vulnerability codes can be realized using the test results, thereby improving the accuracy of vulnerability verification in security testing. By performing log parsing and security analysis, a complete process introduction of security testing for real vulnerability codes and an introduction to corresponding vulnerability principles and information can be provided, thereby improving the intuitiveness of security verification. Therefore, the vulnerability verification method based on static security testing proposed by the present invention can solve the problem of low efficiency when performing security testing on codes.

[0075] like Figure 4 , which is a functional module diagram of a vulnerability verification system based on static security testing provided by an embodiment of the present invention.

[0076] The vulnerability verification system 400 based on static security testing of the present invention can be installed in an electronic device. According to the functions implemented, the vulnerability verification system 400 based on static security testing can include a static analysis module 401, a trigger analysis module 402, a vulnerability verification module 403 and a report generation module 404. The module of the present invention can also be called a unit, which refers to a series of computer program segments that can be executed by an electronic device processor and can complete fixed functions, which are stored in the memory of the electronic device.

[0077] In this embodiment, the functions of each module / unit are as follows:

[0078] Static analysis module 401, used to perform static vulnerability analysis on the pre-acquired security test code to obtain suspicious vulnerability code;

[0079] The trigger analysis module 402 is used to extract vulnerability features and perform trigger verification on suspicious vulnerability codes to obtain vulnerability trigger codes;

[0080] The vulnerability verification module 403 is used to monitor the execution of the suspicious vulnerability code and verify the vulnerability by using the vulnerability triggering code to obtain the real vulnerability log;

[0081] The report generation module 404 is used to perform log parsing and security analysis on the real vulnerability log to obtain a security verification report.

[0082] In detail, each module in the vulnerability verification system 400 based on static security testing in the embodiment of the present invention is used in the same manner as described above. Figure 1The vulnerability verification method based on static security testing in the present invention has the same technical means and can produce the same technical effect, so it will not be repeated here.

[0083] like Figure 5 , is a schematic diagram of the structure of an electronic device for implementing a vulnerability verification method based on static security testing provided by an embodiment of the present invention.

[0084] The electronic device 501 may include a processor 510, a memory 511, a communication bus 512, and a communication interface 513, and may also include a computer program stored in the memory 511 and executable on the processor 510, such as a vulnerability verification program based on static security testing.

[0085] In some embodiments, the processor 510 may be composed of an integrated circuit, for example, a single packaged integrated circuit, or a plurality of packaged integrated circuits with the same or different functions, including one or more central processing units (CPUs), microprocessors, digital processing chips, graphics processors, and combinations of various control chips. The processor 510 is the control core (Control Unit) of the electronic device, and uses various interfaces and lines to connect various components of the entire electronic device, and executes various functions of the electronic device and processes data by running or executing programs or modules stored in the memory 511 (for example, executing vulnerability verification programs based on static security testing, etc.), and calling data stored in the memory 511.

[0086] The memory 511 includes at least one type of readable storage medium, and the readable storage medium includes a flash memory, a mobile hard disk, a multimedia card, a card-type memory (for example, SD or DX memory, etc.), a magnetic memory, a disk, an optical disk, etc. In some embodiments, the memory 511 may be an internal storage unit of an electronic device, such as a mobile hard disk of the electronic device. In other embodiments, the memory 511 may also be an external storage device of an electronic device, such as a plug-in mobile hard disk, a smart memory card (Smart Media Card, SMC), a secure digital (Secure Digital, SD) card, a flash card (Flash Card), etc. equipped on the electronic device. Further, the memory 511 may also include both an internal storage unit of the electronic device and an external storage device. The memory 511 can not only be used to store application software and various types of data installed in the electronic device, such as the code of a vulnerability verification program based on static security testing, but also can be used to temporarily store data that has been output or is to be output.

[0087] The communication bus 512 may be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus, etc. The bus may be divided into an address bus, a data bus, a control bus, etc. The bus is configured to realize connection and communication between the memory 511 and at least one processor 510, etc.

[0088] The communication interface 513 is used for communication between the above-mentioned electronic device and other devices, including a network interface and a user interface. Optionally, the network interface may include a wired interface and / or a wireless interface (such as a WI-FI interface, a Bluetooth interface, etc.), which is generally used to establish a communication connection between the electronic device and other electronic devices. The user interface may be a display (Display), an input unit (such as a keyboard (Keyboard)), and optionally, the user interface may also be a standard wired interface, a wireless interface. Optionally, in some embodiments, the display may be an LED display, a liquid crystal display, a touch-sensitive liquid crystal display, and an OLED (Organic Light-Emitting Diode, organic light-emitting diode) touch device, etc. Among them, the display may also be appropriately referred to as a display screen or a display unit, which is used to display information processed in the electronic device and to display a visual user interface.

[0089] The figure only shows an electronic device with components. Those skilled in the art will understand that the structure shown in the figure does not constitute a limitation on the electronic device, and may include fewer or more components than shown in the figure, or combine certain components, or arrange the components differently.

[0090] For example, although not shown, the electronic device may also include a power source (such as a battery) for supplying power to each component. Preferably, the power source may be logically connected to at least one processor 510 through a power management system, so that the power management system can realize functions such as charging management, discharging management, and power consumption management. The power source may also include any components such as one or more DC or AC power sources, recharging systems, power failure detection circuits, power converters or inverters, and power status indicators. The electronic device may also include a variety of sensors, Bluetooth modules, Wi-Fi modules, etc., which will not be repeated here.

[0091] It should be understood that the embodiment is for illustration only and the scope of the patent application is not limited by this structure.

[0092] Specifically, the specific implementation method of the processor 510 for the above instructions can refer to the description of the relevant steps in the corresponding embodiment of the accompanying drawings, which will not be repeated here.

[0093] Furthermore, if the module / unit integrated in the electronic device 501 is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. The computer-readable storage medium can be volatile or non-volatile. For example, the computer-readable medium can include: any entity or system capable of carrying computer program code, recording medium, USB flash drive, mobile hard disk, magnetic disk, optical disk, computer memory, read-only memory (ROM, Read-Only Memory).

[0094] It is obvious to those skilled in the art that the present invention is not limited to the details of the above exemplary embodiments, and that the present invention can be implemented in other specific forms without departing from the spirit or essential characteristics of the present invention.

[0095] Therefore, no matter from which point of view, the embodiments should be regarded as illustrative and non-restrictive, and the scope of the present invention is limited by the appended claims rather than the above description, so it is intended that all changes falling within the meaning and scope of the equivalent elements of the claims are included in the present invention. Any attached figure mark in the claims should not be regarded as limiting the claims involved.

[0096] Finally, it should be noted that the above embodiments are only used to illustrate the technical solution of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solution of the present invention can be modified or replaced by equivalents without departing from the spirit and scope of the technical solution of the present invention.

Claims

1. A vulnerability verification method based on static security testing, characterized in that: The method comprises: Perform static vulnerability analysis on the pre-acquired security test code to obtain suspicious vulnerability code; Extract vulnerability features and perform trigger verification on the suspected vulnerability code to obtain a vulnerability trigger code; Utilize the vulnerability trigger code to monitor the execution of the suspicious vulnerability code and verify the vulnerability to obtain a real vulnerability log; Perform log parsing and security analysis on the real vulnerability log to obtain a security verification report.

2. The vulnerability verification method based on static security testing according to claim 1, characterized in that: The static vulnerability analysis is performed on the pre-acquired security test code to obtain the suspicious vulnerability code, including: Perform abstract syntax analysis on the pre-acquired security test code to obtain a code syntax tree; Performing semantic vulnerability analysis on the security test code according to the code syntax tree to obtain a semantic vulnerability code; Performing static vulnerability scanning on the security test code according to the code syntax tree to obtain static vulnerability code; A suspicious vulnerability code is generated according to the semantic vulnerability code and the static vulnerability code.

3. The vulnerability verification method based on static security testing according to claim 2, characterized in that: The performing semantic vulnerability analysis on the security test code according to the code syntax tree to obtain a semantic vulnerability code includes: Perform symbol extraction on the security test code according to the code syntax tree to obtain code syntax symbols; Performing definition vulnerability analysis and reference vulnerability analysis on the code syntax symbol and the code class to obtain symbol semantic vulnerability code; Performing type consistency analysis on the code syntax symbols to obtain type semantic vulnerability codes; Performing scope vulnerability analysis on the code syntax symbols to obtain scope semantic vulnerability code; A semantic vulnerability code is generated according to the symbolic semantic vulnerability code, the type semantic vulnerability code, and the scope semantic vulnerability code.

4. The vulnerability verification method based on static security testing according to claim 2, characterized in that: The step of performing static vulnerability scanning on the security test code according to the code syntax tree to obtain a static vulnerability code includes: Performing data flow scanning on the security test code according to the code syntax tree to obtain a data flow vulnerability code; Perform control flow analysis on the security test code according to the code syntax tree to obtain a control flow vulnerability code; Perform pattern matching on the security test code according to a preset security rule library and the code syntax tree to obtain a rule vulnerability code; A static vulnerability code is generated according to the data flow vulnerability code, the control flow vulnerability code and the rule vulnerability code.

5. The vulnerability verification method based on static security testing according to claim 1, characterized in that: The extracting vulnerability features and performing trigger verification on the suspicious vulnerability code to obtain the vulnerability trigger code includes: Performing type feature detection on the suspected vulnerability code to obtain vulnerability type features; Performing input feature detection on the suspected vulnerability code to obtain vulnerability input features; Generate a trigger vulnerability feature according to the vulnerability type feature and the vulnerability input feature; Verify the code structure of the suspected vulnerability code according to the vulnerability triggering feature to obtain the vulnerability triggering code.

6. The vulnerability verification method based on static security testing according to claim 5, characterized in that: The performing input feature detection on the suspected vulnerability code to obtain the vulnerability input feature includes: Performing input point detection on the suspected vulnerability code to obtain vulnerability location features; Performing conditional structure detection on the suspected vulnerability code to obtain vulnerability structure features; Performing resource dependency detection on the suspected vulnerability code to obtain vulnerability dependency features; Perform sensitive operation detection on the suspected vulnerability code to obtain vulnerability sensitive features; A vulnerability input feature is generated according to the vulnerability location feature, the vulnerability structure feature, the vulnerability dependency feature, and the vulnerability sensitivity feature.

7. The vulnerability verification method based on static security testing according to claim 1, characterized in that: The use of the vulnerability triggering code to monitor the execution of the suspicious vulnerability code and verify the vulnerability to obtain a real vulnerability log includes: Initialize the simulation environment sandbox, and configure the monitoring script for the simulation environment sandbox to obtain the monitoring environment sandbox; Deploy code to the monitoring environment sandbox according to the suspected vulnerability code to obtain a deployment environment sandbox; Trigger execution and behavior monitoring of the deployment environment sandbox according to the vulnerability trigger code to obtain an execution result; The execution result is verified for vulnerability authenticity to obtain a real vulnerability log.

8. The vulnerability verification method based on static security testing according to claim 7, characterized in that: The triggering execution and behavior monitoring of the deployment environment sandbox according to the vulnerability triggering code to obtain the execution result includes: Inject code into the deployment environment sandbox according to the vulnerability trigger code to obtain an injected environment sandbox; Monitor and wake up the injection environment sandbox to obtain a trigger monitoring script; Perform vulnerability triggering execution on the vulnerability triggering code in the injection environment sandbox to obtain execution behavior; The execution behavior is recorded according to the trigger monitoring script to obtain the execution result.

9. The vulnerability verification method based on static security testing according to claim 1, characterized in that: The log parsing and security analysis of the real vulnerability log is performed to obtain a security verification report, including: Perform log analysis on the real vulnerability log to obtain the vulnerability execution result, the real vulnerability code and the real trigger code; Matching the vulnerability information on the real vulnerability code to obtain vulnerability information text; Matching the real vulnerability code with repair suggestions to obtain repair suggestion text; A security verification report is generated according to the vulnerability execution result, the real vulnerability code, the real trigger code, the vulnerability information text and the repair suggestion text.

10. A vulnerability verification system based on static security testing, characterized in that: The system comprises: The static analysis module is used to perform static vulnerability analysis on the pre-acquired security test code to obtain suspicious vulnerability code; A trigger analysis module is used to extract vulnerability features and perform trigger verification on the suspicious vulnerability code to obtain a vulnerability trigger code; A vulnerability verification module is used to monitor the execution of the suspected vulnerability code and verify the vulnerability using the vulnerability triggering code to obtain a real vulnerability log; The report generation module is used to perform log parsing and security analysis on the real vulnerability log to obtain a security verification report.

11. An electronic device, characterized in that: The electronic device comprises: at least one processor; and, a memory communicatively connected to the at least one processor; wherein, The memory stores a computer program that can be executed by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the vulnerability verification method based on static security testing as described in any one of claims 1 to 9.

12. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the vulnerability verification method based on static security testing as described in any one of claims 1 to 9 is implemented.

Images