Protocol generation method and device, computer program product and electronic equipment

Abstract

The invention discloses a protocol generation method and device, a computer program product and electronic equipment. The method relates to the field of software testing or other related fields, and comprises the following steps: acquiring a first class of functions for system calling and a second class of functions for file operation processing from a kernel source code of an operating system, and determining parameters in the first class of functions to obtain calling parameters; performing taint propagation analysis on the calling parameter to obtain a macro definition flag bit, and performing taint propagation analysis on the parameter in the second-class function to obtain a system calling prefix; the protocol parameter type of the calling parameter is determined, a system calling protocol is generated according to the system calling prefix, the protocol parameter type and the macro definition flag bit, and the system calling protocol is used for conducting fuzzy testing on the operating system. Through the method and the device, the problems of low generation efficiency and low accuracy when the system call protocol is generated in related technologies are solved.

Description

Technical Field

[0001] The present application relates to a field or other related fields, and in particular, to a method, device, computer program product, and electronic device for generating a protocol. Background Art

[0002] Fuzz testing (Fuzz Testing, Fuzzing) is a software testing technology widely used in software security development process. It can ensure the security and stability of the underlying operating system. It generates random data in an automatic or semi-automatic way, and then submits the random data as input to the software or system to detect potential vulnerabilities and errors in the software operating system, such as detecting whether there are memory leaks, data processing anomalies, etc. The objects of fuzz testing can include file formats, network protocols, operating systems, environment variables, mouse and keyboard events, etc. When fuzz testing the Linux system kernel, you can use kernel fuzz testing tools such as syzkaller to operate. It can use the coverage-guided method to fully cover the kernel code path, thereby improving the efficiency and effectiveness of fuzz testing.

[0003] However, the above-mentioned syzkaller tool relies on the syzlang programming language to describe the system call protocol, that is, the syzlang programming language is used to define the calling kernel function and its parameter type and format. Then the syzkaller tool uses different protocols to guide fuzz testing, deeply explores different execution paths of the kernel, and thus improves the comprehensiveness and pertinence of the test. However, writing syzlang protocols requires experts to have a deep understanding of the kernel code and analyze the functions and details of different functions, which is a huge and time-consuming task. In order to solve the above problems, the related art implements fuzz testing of the system kernel and kernel driver through interface recovery and fuzzy engine, but this method is a system call protocol generation and fuzz testing tool specifically for a specific system, which has strong customization and insufficient scalability; and in order to solve this problem, the LLVM compiler tool can also generate IR intermediate language and LLVM Bitcode, and obtain the function execution logic and the function parameter type by parsing the IR language and LLVM Bitcode, thereby generating a calling protocol, but this method can only process the parameter type of the explicit stream, resulting in the generated protocol being inaccurate.

[0004] With regard to the problems of low generation efficiency and low accuracy when generating system call specifications in related technologies, no effective solution has been proposed yet. Summary of the invention

[0005] The main purpose of the present application is to provide a method, device, computer program product and electronic device for generating a protocol, so as to solve the problems of low generation efficiency and low accuracy when generating system call protocols in related technologies.

[0006] In order to achieve the above-mentioned purpose, according to one aspect of the present application, a method for generating a protocol is provided. The method comprises: obtaining a first-class function for system calls and a second-class function for file operation processing from the kernel source code of the operating system, and determining the parameters in the first-class function to obtain the call parameters; performing taint propagation analysis on the call parameters to obtain the macro definition flag, and performing taint propagation analysis on the parameters in the second-class function to obtain the system call prefix; determining the protocol parameter type of the call parameter, and generating a system call protocol according to the system call prefix, the protocol parameter type and the macro definition flag, wherein the system call protocol is used to perform fuzzy testing on the operating system.

[0007] Furthermore, a first-class function for system calls and a second-class function for file operation processing are obtained from the kernel source code of the operating system, including: obtaining a file pointer data structure of the kernel source code, and determining a device file associated with the file pointer data structure; obtaining a preset function name, and extracting the first-class function from the file pointer data structure according to the preset function name; determining a function structure according to the device file, and extracting the second-class function from the kernel source code according to the function structure.

[0008] Furthermore, performing taint propagation analysis on the calling parameters to obtain macro definition flags includes: using an explicit flow analysis algorithm to process the calling parameters to obtain explicit tainted variables, wherein the explicitly tainted variables refer to function variables in the operating system whose values ​​are directly affected by the calling parameters; using an implicit flow analysis algorithm to process the calling parameters to obtain implicitly tainted variables, wherein the implicitly tainted variables refer to function variables in the operating system whose values ​​are affected by the calling parameters under a preset probability; and generating macro definition flags based on the explicitly tainted variables and the implicitly tainted variables.

[0009] Furthermore, generating a macro definition flag based on explicit pollution variables and implicit pollution variables includes: obtaining a header file associated with the explicit pollution variable to obtain a first header file, and obtaining a header file associated with the implicit pollution variable to obtain a second header file; determining a definition of the explicit pollution variable in the first header file, and determining a definition of the implicit pollution variable in the second header file; in a case where the definition of the explicit pollution variable in the first header file is a flag definition, generating a macro definition flag according to the explicit pollution variable; in a case where the definition of the implicit pollution variable in the second header file is a flag definition, generating a macro definition flag according to the implicit pollution variable.

[0010] Furthermore, performing taint propagation analysis on the parameters in the second type of function to obtain a system call prefix includes: obtaining a function type of the second type of function, wherein the function type is one of the following: a first function type and a second function type; when the function type is the first function type, obtaining a function name of the second type of function to obtain a processing function name; extracting the parameters in the processing function from the kernel source code according to the processing function name to obtain the processing function parameters, determining the processing function parameters as tainted data, and obtaining a conditional statement associated with the tainted data; determining a definition of the tainted data in the conditional statement, and when the definition of the tainted data is a flag definition, determining a system call prefix according to the flag definition; when the definition of the tainted data is not a flag definition, processing the tainted data using an implicit flow analysis algorithm, and determining a system call prefix based on the processing result; when the function type is the second function type, obtaining a preset function, and generating a system call prefix according to the preset function.

[0011] Furthermore, determining the system call prefix based on the processing result includes: introducing tainted data into a sub-function in the second type of function, and performing taint analysis on the sub-function to obtain a taint analysis result; when the taint analysis result indicates that the parameters in the sub-function are obtained by processing the tainted data, determining whether the parameters in the sub-function are macro definition flags; when the parameters in the sub-function are defined as flags, determining the system call prefix based on the parameters in the sub-function.

[0012] Further, determining the reduced parameter type of the calling parameter includes: using an explicit flow analysis algorithm to determine the parameters affected by the called parameters in the second type of function, obtaining M polluted variables, and determining the pollution types of the M polluted variables, wherein M is a positive integer; determining the polluted variables whose pollution type is direct pollution from the M polluted variables to obtain N polluted variables, and determining the reduced parameter type according to the parameter types of the N polluted variables, wherein N is a positive integer less than or equal to M; determining the polluted variables whose pollution type is indirect pollution from the M polluted variables to obtain MN polluted variables, performing taint propagation analysis on the MN polluted variables, and obtaining correlation data of the MN polluted variables and the calling parameters, wherein the correlation data characterizes the degree of association between each polluted variable and the calling parameter, and the correlation data includes a first correlation index and a second correlation index, the first correlation index refers to an index greater than or equal to a correlation data threshold, and the second correlation index refers to an index less than the correlation data threshold; when the correlation data is the first correlation index, determining the reduced parameter type according to the parameter types of the MN polluted variables.

[0013] In order to achieve the above-mentioned purpose, according to another aspect of the present application, a device for generating a protocol is provided. The device comprises: an acquisition unit, which is used to acquire a first-class function for system calls and a second-class function for file operation processing from the kernel source code of the operating system, and determine the parameters in the first-class function to obtain the call parameters; an analysis unit, which is used to perform taint propagation analysis on the call parameters to obtain the macro definition flag, and perform taint propagation analysis on the parameters in the second-class function to obtain the system call prefix; a determination unit, which is used to determine the protocol parameter type of the call parameter, and generate the system call protocol according to the system call prefix, the protocol parameter type and the macro definition flag, wherein the system call protocol is used to perform fuzzy testing on the operating system.

[0014] According to another aspect of an embodiment of the present invention, a computer storage medium is provided. The computer storage medium is used to store a program, wherein when the program is running, the device where the computer storage medium is located is controlled to execute a method for generating a protocol.

[0015] According to another aspect of an embodiment of the present invention, there is also provided an electronic device comprising one or more processors and a memory; the memory stores computer-readable instructions, and the processor is used to run the computer-readable instructions, wherein the computer-readable instructions execute a method for generating a protocol when they are run.

[0016] According to another aspect of an embodiment of the present invention, a computer program product is provided, including a computer program, and when the computer program is executed by a processor, a method for generating a protocol is executed.

[0017] Through the present application, the following steps are adopted: obtaining a first-class function for system calls and a second-class function for file operation processing from the kernel source code of the operating system, and determining the parameters in the first-class function to obtain the call parameters; performing taint propagation analysis on the call parameters to obtain macro definition flags, and performing taint propagation analysis on the parameters in the second-class function to obtain the system call prefix; determining the specification parameter type of the call parameters, and generating a system call specification according to the system call prefix, the specification parameter type and the macro definition flag, wherein the system call specification is used to perform fuzzy testing on the operating system, and solves the problems of low generation efficiency and low accuracy in generating system call specifications in the related art, by obtaining the first-class function and the second-class function, and performing taint propagation analysis on the parameters of the first-class function and the second-class function, so as to obtain the system call prefix, the specification parameter type and the macro definition flag set, and finally generating the system call specification based on the above data, thereby achieving the effect of improving the efficiency and accuracy of generating the system call specification. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] The drawings constituting a part of the present application are used to provide a further understanding of the present application. The illustrative embodiments and descriptions of the present application are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0019] Figure 1 is a flowchart of a method for generating a protocol according to an embodiment of the present application;

[0020] Figure 2 is a schematic diagram of a method for generating a flag bit set according to an embodiment of the present application;

[0021] Figure 3 It is a schematic diagram of a method for generating a system call prefix according to an embodiment of the present application;

[0022] Figure 4 is a schematic diagram of a method for determining a protocol parameter type provided in an embodiment of the present application;

[0023] Figure 5 is a schematic diagram of a system for generating an optional flag bit set according to an embodiment of the present application;

[0024] Figure 6 is a schematic diagram of a device for generating a protocol according to an embodiment of the present application;

[0025] Figure 7 is a schematic diagram of an electronic device provided according to an embodiment of the present application. DETAILED DESCRIPTION

[0026] It should be noted that, in the absence of conflict, the embodiments and features in the embodiments of the present application can be combined with each other. The present application will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0027] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present application.

[0028] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0029] It should be noted that the relevant information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data for display, data for analysis, etc.) involved in this disclosure are all information and data authorized by the user or fully authorized by all parties. For example, an interface is set between this system and the relevant user or organization. Before obtaining relevant information, it is necessary to send an acquisition request to the aforementioned user or organization through the interface, and obtain relevant information after receiving the consent information fed back by the aforementioned user or organization.

[0030] It should be noted that the collected information used in this application is information and data authorized by the user or fully authorized by all parties, and the collection, storage, use, processing, transmission, provision, disclosure and application of the relevant data comply with the relevant laws, regulations and standards of the relevant regions, take necessary confidentiality measures, do not violate public order and good morals, and provide corresponding operation entrances for users to choose to authorize or refuse to use it.

[0031] The present invention is described below in conjunction with preferred implementation steps. Figure 1 is a flow chart of a method for generating a protocol according to an embodiment of the present application, such as Figure 1 As shown, the method comprises the following steps:

[0032] Step S101, obtaining a first type of function for system call and a second type of function for file operation processing from the kernel source code of the operating system, and determining parameters in the first type of function to obtain calling parameters.

[0033] In some examples, the operating system may be a Linux operating system, which includes a Linux kernel and GNU software (also known as GNU's Not Unix software, a Unix-like operating system). The first type of function may be a system call function, and the second type of function may be a file operation processing function. In order to iteratively develop the main line and discover potential operating system vulnerabilities and errors, the operating system kernel may be fuzz tested at this time. When fuzz testing the kernel, multiple system call specifications may be used to guide the fuzz testing tool to cover more paths, thereby improving the depth of exploration and fuzz testing coverage of the Linux kernel code. In order to reduce the complexity of writing system call specifications, the system call functions and file operation processing functions may be obtained from the kernel source code, and then the system calls and file operation processing functions may be processed using static taint propagation analysis to obtain the corresponding system call specifications.

[0034] It can be understood that the first type of function, for example, refers to the function called by the kernel when the user initiates a system call request to the kernel. The first function contains various parameters passed in by the user. The first function can be regarded as an "entry" for a user to operate the operating system kernel; and the "second function" refers to the specific processing function of the kernel when processing a file processing request initiated by the user.

[0035] Step S102, performing taint propagation analysis on the call parameters to obtain the macro definition flag, and performing taint propagation analysis on the parameters in the second type of function to obtain the system call prefix.

[0036] In some examples, when performing taint propagation analysis on the call parameters of the system call function (i.e., the first type of function) and the parameters of the file operation processing function (i.e., the second type of function), different branch codes are obtained by the judgment statements through which the taint propagation passes, and then different system call prefixes and macro definition flags are determined by different judgment conditions and different branch codes. For example, the ioctl interface includes three branch codes: TUNGETFEATURES, TUNSETQUEUE, and SIOCGSKNS, and each branch code can generate a different system call prefix: ioctl$TUNGETFEATURES, ioctl$TUNSETQUEUE, ioctl$SIOCGSKNS.

[0037] It should be noted that after extracting the system call function and the file operation processing function from the kernel source code, the macro definition flag set in the judgment statement associated with the system call can also be obtained to generate a flag set. For example, tun_setiff_flags represents multiple flag sets of syzlang syntax, where each element is separated by a comma and is represented as a macro definition flag in the kernel source code: tun_setiff_flags = IFF_TUN, IFF_TAP, IFF_NAPI, IFF_NAPI_FRAGS, IFF_NO_PI, IFF_ONE_QUEUE, IFF_VNET_HDR, IFF_TUN_EXCL, IFF_MULTI_QUEUE, IFF_ATTACH_QUEUE, IFF_DETACH_QUEUE, IFF_PERSIST, IFF_NOFILTER.

[0038] Step S103, determining the specification parameter type of the call parameter, and generating a system call specification according to the system call prefix, the specification parameter type and the macro definition flag, wherein the system call specification is used to perform fuzz testing on the operating system.

[0039] In some examples, when performing taint propagation analysis on the parameters of system calls and file operation processing functions, the two parameters can be used as tainted data to mark the data set that is explicitly or implicitly contaminated during the tainted data propagation process, and then the definition of the data type of the contaminated data set elements in the kernel source code is parsed to obtain the specification parameter type of the call parameter management. The macro definition flag bit is further used to form a flag bit set, and then the system call specification is generated based on the system call prefix, the specification parameter type and the flag bit set, so that the system call specification can be used to perform fuzzy testing operations on the operating system.

[0040] Figure 2 is a schematic diagram of a method for generating a flag bit set according to an embodiment of the present application, such as Figure 2 As shown, when generating the flag bit set of the specification parameter, the macro definition flag bits in the corresponding header file can be obtained through the explicit flow analysis algorithm and the implicit flow analysis algorithm, and then combined based on the macro definition flag bits to obtain the macro definition flag bit set. In some examples, the parameters associated with the identified system call function are used as tainted data, and the tainted data is determined to be a user pointer type through the associated system call function and the system call implementation function in the kernel code, and then the left value that is explicitly and implicitly contaminated by the user pointer is obtained, that is, the parameters that have been assigned, copied, and other operations by the user pointer parameter are added as elements to the set to be analyzed, and the left value that is not explicitly and implicitly contaminated by the user pointer is used as an invalid element.

[0041] Furthermore, the position where each element in the above set to be analyzed appears in the kernel code can be obtained. If the position where it appears belongs to a judgment statement and the judgment condition is a macro definition flag, the judged macro definition flag is added as a valid element to the valid set, wherein the judgment statement can be an if-else statement and a switch-case statement; on the contrary, if the judgment condition is not a macro definition flag, the judged macro definition flag is discarded as an invalid element. Finally, the macro definition of the elements in the valid set is searched in the kernel source terminal file, and the macro definition flag is obtained, and the macro definition flag is converted based on the macro definition flag to convert it into a specification parameter flag set in syzlang format.

[0042] The method for generating a protocol provided in an embodiment of the present application obtains a first-class function for system calls and a second-class function for file operation processing from the kernel source code of the operating system, and determines the parameters in the first-class function to obtain the call parameters; performs taint propagation analysis on the call parameters to obtain macro definition flags, and performs taint propagation analysis on the parameters in the second-class function to obtain the system call prefix; determines the protocol parameter type of the call parameters, and generates a system call protocol according to the system call prefix, the protocol parameter type and the macro definition flag, wherein the system call protocol is used to perform fuzzy testing on the operating system, and solves the problems of low generation efficiency and low accuracy in generating system call protocols in the related art, obtains the first-class function and the second-class function, and performs taint propagation analysis on the parameters of the first-class function and the second-class function, so as to obtain the system call prefix, the protocol parameter type and the macro definition flag set, and finally generates the system call protocol based on the above data, thereby achieving the effect of improving the efficiency and accuracy of generating the system call protocol.

[0043] Optionally, in the protocol generation method provided in an embodiment of the present application, a first-class function for system calls and a second-class function for file operation processing are obtained from the kernel source code of the operating system, including: obtaining the file pointer data structure of the kernel source code, and determining the device file associated with the file pointer data structure; obtaining a preset function name, and extracting the first-class function from the file pointer data structure according to the preset function name; determining a function structure according to the device file, and extracting the second-class function from the kernel source code according to the function structure.

[0044] In the embodiment of the present application, the first type of function is different from the second type of function. The "first type of function" refers to, for example, a specific function that the kernel processes when the user initiates a system call. For example, when the user initiates an open system call, it may become a specific function such as do_open in the kernel. The "second type of function" means that different files may have different processing functions. For example, to open file1 and file2, they both need to be opened through the user's open system call first, but the specific implementation may be different, and the specific implementation function may be do_open_file1 or do_open_file2.

[0045] It should be noted that since function calls are divided into direct calls and indirect calls, there are a large number of indirect calls in the kernel code. Indirect calls are declared in the form of function pointers. Initialization operations will be performed before indirect calls to point the function pointer to the function to be called. These functions will be called through the pointer later to achieve dynamic function calls. The file pointer data structure defined by the kernel source code contains the module function structure, the module name of the current module, and the device file name. The module function structure refers to the function pointer structure initialized during the module initialization process.

[0046] Therefore, when performing static code analysis on the kernel source code, the file pointer structure can be associated with the function structure of the module, and the module name of the current module and the corresponding device file can be associated. When the corresponding device file is opened in the system call specification of the fuzzy test, the real processing function of the indirect call can be obtained through the file pointer structure associated with the device file and the function structure of the module. That is, when determining the system call, the file pointer data structure in the source code can be obtained, and then the device file can be determined therefrom, and then the system call can be extracted based on the preset function name set by the administrator, wherein the file pointer in the Linux kernel can be represented by the struct file structure. When determining the second type of function (i.e., the file operation processing function), the function structure can be determined, and then the file operation processing function associated with the device file can be screened out from the source code using the type of the structure. This embodiment lays the foundation for the subsequent generation of the system call specification by using the file pointer data structure to determine the first type of function and the second type of function.

[0047] Optionally, in the specification generation method provided in the embodiment of the present application, performing taint propagation analysis on the calling parameters to obtain the macro definition flag includes: using an explicit flow analysis algorithm to process the calling parameters to obtain explicit tainted variables, wherein the explicitly tainted variables refer to function variables in the operating system whose values ​​are directly affected by the calling parameters; using an implicit flow analysis algorithm to process the calling parameters to obtain implicitly tainted variables, wherein the implicitly tainted variables refer to function variables in the operating system whose values ​​are affected by the calling parameters under a preset probability; and generating a macro definition flag based on the explicit tainted variables and the implicitly tainted variables.

[0048] In some examples, when using taint propagation analysis for processing, the call parameters associated with the system call can first be used as "tainted data", and then based on the "tainted data", the taint mark is analyzed to propagate along with the data dependency relationship between the variables in the program, that is, the call parameters are processed using an explicit flow analysis algorithm to obtain explicit tainted variables; further, the taint mark can be analyzed to propagate along with the control dependency relationship between the variables in the program to obtain implicit tainted variables, that is, implicit tainted variables refer to variables that may be affected by tainted data, but need to be analyzed for the function. For example, in "struct file*file", *file can be used as "tainted data", and based on the data, explicit tainted variables whose values ​​are directly affected by tainted data can be found. Furthermore, by determining the code associated with the above-mentioned explicit tainted variables and implicit tainted variables, and then determining the corresponding parameter type from the code, and then determining the definition in the header file according to the parameter type, and then determining the macro definition flag.

[0049] Optionally, in the method for generating the specification provided in the embodiment of the present application, generating a macro definition flag based on explicit pollution variables and implicit pollution variables includes: obtaining a header file associated with the explicit pollution variable to obtain a first header file, and obtaining a header file associated with the implicit pollution variable to obtain a second header file; determining the definition of the explicit pollution variable in the first header file, and determining the definition of the implicit pollution variable in the second header file; when the definition of the explicit pollution variable in the first header file is a flag definition, generating a macro definition flag according to the explicit pollution variable; when the definition of the implicit pollution variable in the second header file is a flag definition, generating a macro definition flag according to the implicit pollution variable.

[0050] In some examples, after using explicit flow analysis and implicit flow analysis to determine explicit tainted variables and implicit tainted variables, since implicit flow taint propagation may lead to under-contamination (that is, the problem of not marking variables that should be marked) or over-contamination (that is, the problem of taint diffusion caused by too many marks), when using explicit tainted variables and implicit tainted variables to generate macro definition flags, these tainted variables can be specially processed first. For example, these tainted variables can be added to a set, and their definitions in the header file can be found through the elements in the set, that is, the first header file and the second header file are determined.

[0051] If the definition of the explicitly polluted variable in the first header file is a flag definition, that is, the definition of the explicitly polluted variable in the first header file is a preset variable or constant, or a command for different data processing operations, it will be marked as a valid type set, and then a macro definition flag is generated according to the explicitly polluted variable, while the type of the non-macro definition flag can be processed by the harmless processing module, thereby reducing the number of taint marks and improving analysis efficiency.

[0052] Figure 3 is a schematic diagram of a method for generating a system call prefix according to an embodiment of the present application, such as Figure 3 As shown, optionally, in the method for generating the protocol provided in the embodiment of the present application, a taint propagation analysis is performed on the parameters in the second type of function to obtain a system call prefix, including: obtaining a function type of the second type of function, wherein the function type is one of the following: a first function type, a second function type; when the function type is the first function type, obtaining a function name of the second type of function to obtain a processing function name; extracting parameters in the processing function from the kernel source code according to the processing function name to obtain processing function parameters, determining the processing function parameters as tainted data, and obtaining a conditional statement associated with the tainted data; determining a definition of the tainted data in the conditional statement, and when the definition of the tainted data is a flag definition, determining a system call prefix according to the flag definition; when the definition of the tainted data is not a flag definition, processing the tainted data using an implicit flow analysis algorithm, and determining a system call prefix based on the processing result; when the function type is the second function type, obtaining a preset function, and generating a system call prefix according to the preset function.

[0053] In some examples, the first function type may refer to an ioctl function, and the second function type may refer to a non-ioctl function. Non-ioctl type functions handle basic file operations, such as open to open a file, read to read file contents, and write to write file contents. The ioctl function handles device-specific control operations, which are usually more complex than basic file operations and require more parameters and specific control commands. Therefore, concentrating these operations in the ioctl function can better organize the code. For example, the ioctl function can be ioctl$TUNGETFEATURES, ioctl$TUNSETQUEUE, and ioctl$SIOCGSKNS, which represent three different operations on device files, and the parameters they receive are also different.

[0054] In this embodiment, firstly, the function structure of the module can be found in the source code through static code analysis or text matching, and the real function name corresponding to the ioctl function is obtained through the function pointer assignment in the function structure of the module, that is, the processing function name of the file operation processing function (that is, the second type of function) is obtained. Then, the real function is found in the source code through static code analysis or text matching, and the parameters of the real function are used as tainted data, and explicit taint propagation analysis is performed on the parameters of the real function.

[0055] In the process of explicit flow taint propagation analysis, tainted data can be used as a judgment conditional statement. The tainted data is used as an element, and then static code analysis or text matching is used to determine whether the element is a macro definition flag in the header file, that is, to determine whether the statement associated with the tainted data is a conditional statement, and then to determine whether the tainted data is a macro definition flag. If the element is a macro definition flag, it is regarded as a valid system call prefix; if it is not a macro definition flag, implicit flow analysis is performed. When performing implicit flow analysis, it can be determined whether the parameters that may be contaminated by tainted data are subjected to operations such as assignment and copying of tainted data, and then it is determined whether the contaminated parameters are macro definition flags, and finally a system call prefix is ​​generated based on the judgment result.

[0056] When the function type is a non-ioctl function, the system call prefix can be directly generated according to the preset function, such as open, read, write, poll, close and other functions. It should be noted that these functions are different from ioctl functions in that they do not have complex macro definition flags and branch codes, so there is no need for too many system call prefixes, and the system call can be directly parsed and generated. For example, the / dev / net / tun device file can generate the following system call prefixes: openat$tun, write$tun, read$tun.

[0057] Optionally, in the method for generating the protocol provided in the embodiment of the present application, determining the system call prefix based on the processing result includes: introducing tainted data into a sub-function in the second-category function, and performing taint analysis on the sub-function to obtain a taint analysis result; when the taint analysis result indicates that the parameters in the sub-function are obtained by processing the tainted data, determining whether the parameters in the sub-function are macro definition flags; when the parameters in the sub-function are defined as flags, determining the system call prefix based on the parameters in the sub-function.

[0058] In some examples, each parameter of the real function needs to be regarded as tainted data during implicit flow analysis. During the propagation of each tainted data, the parameters that may be contaminated by the tainted data are substituted into the sub-function for taint analysis, and the parameters that may be contaminated by the tainted data are analyzed to see whether they are subjected to operations such as assignment and copying of the tainted data. If they are subjected to operations such as assignment and copying, it is confirmed that the parameter is indeed contaminated, and it can be determined whether the contaminated parameter is a macro definition flag. If it is found that the contaminated parameter is a macro definition flag, the macro definition flag is regarded as a valid system call prefix and added to the valid system call prefix set. If neither the tainted data nor the parameters contaminated by the tainted data are macro definition flags at the end of implicit flow analysis, the parameters are rendered harmless, that is, they are regarded as irrelevant conditions, and no system call prefix is ​​generated. The corresponding system call prefix is ​​generated according to the syzlang syntax format for all valid elements obtained by explicit flow analysis and implicit flow analysis.

[0059] Figure 4 is a schematic diagram of a method for determining a protocol parameter type according to an embodiment of the present application, such as Figure 4 As shown, optionally, in the method for generating a specification provided in an embodiment of the present application, determining the specification parameter type of the calling parameter includes: using an explicit flow analysis algorithm to determine the parameters affected by the called parameters in the second type of function, obtaining M polluted variables, and determining the pollution types of the M polluted variables, wherein M is a positive integer; determining the polluted variables whose pollution type is direct pollution from the M polluted variables to obtain N polluted variables, and determining the specification parameter type according to the parameter types of the N polluted variables, wherein N is a positive integer less than or equal to M; determining the polluted variables whose pollution type is indirect pollution from the M polluted variables to obtain MN polluted variables, performing taint propagation analysis on the MN polluted variables, and obtaining correlation data of the MN polluted variables and the calling parameters, wherein the correlation data characterizes the degree of association between each polluted variable and the calling parameter, and the correlation data includes a first correlation index and a second correlation index, wherein the first correlation index refers to an index greater than or equal to a correlation data threshold, and the second correlation index refers to an index less than the correlation data threshold; when the correlation data is the first correlation index, determining the specification parameter type according to the parameter types of the MN polluted variables.

[0060] In some examples, different parameters of system calls are taken as multiple taints. First, explicit flow taint analysis is performed to obtain the obviously tainted left values ​​in the system call, and these tainted data are added as valid elements to a set, called the valid set. Implicit flow taint analysis is performed on the left values ​​that are not obviously tainted, and the implicitly tainted parameters are added as suspicious elements to the suspicious set.

[0061] Furthermore, the position where each element in the suspicious set appears in the function is searched in turn, and these positions are usually manifested as a sub-function call. The suspicious element is taken as a new taint and substituted into the sub-function for analysis, that is, the parameters of the sub-function are taken as tainted data for explicit flow analysis. If the suspicious element does not pollute any other left value in the sub-function, the suspicious element is harmlessly processed and determined to be an invalid parameter type. If the suspicious element pollutes the left value in the sub-function, the polluted left value is recorded and the correlation between the polluted left value and the system call parameter is analyzed. High correlation (i.e., the first correlation index) is usually reflected in the memory copy operation such as directly or indirectly copying data and assigning data to the polluted left value of the system call parameter; low correlation (i.e., the second correlation index) is reflected in the reference and dereference of the left value to the system call parameter. The polluted variable with high correlation is added to the valid set as a valid element, and the left value with low correlation is harmlessly processed. Find the data structure of the elements in the valid set from the source docker file, parse the data structure of the valid elements, combine all the valid data structures according to the minimum set, and generate the specification parameter type of the syzlang syntax.

[0062] It should be noted that in order to prevent suspicious elements from causing excessive pollution, a sub-function iteration depth can be set in the implementation stage. Polluted variables greater than the iteration depth will be harmlessly processed and no longer used as valid elements. Polluted variables less than or equal to the iteration depth will be judged to determine whether the polluted variable has caused pollution to other left values. The polluted left values ​​will be recorded and processed in the above manner to generate the specification parameter type.

[0063] It should be noted that the steps shown in the flowcharts of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and that, although a logical order is shown in the flowcharts, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0064] The present application also provides a method for generating a protocol. Figure 5 is a schematic diagram of a system for generating an optional flag bit set according to an embodiment of the present application, such as Figure 5As shown, the system includes: a static code analysis module, a protocol prefix generation module, a protocol parameter type identification module and a protocol parameter type flag bit generation module.

[0065] Among them, the static code analysis module is used to search through function names to obtain all system calls, and search through module structures to find all module names and their file processing function structures in the kernel source code, and associate module structures with their file operation processing functions; the protocol prefix generation module is used to perform taint propagation analysis on the parameters of system calls and file operation processing functions, obtain commands to enter different branch codes, and generate system call prefixes; the protocol parameter type identification module is used to perform taint propagation analysis on the parameters of system calls and file operation processing functions, and determine the protocol parameter type through the data type definition in the source code; the protocol parameter type flag generation module is used to obtain the macro definition flag set in the judgment statement, generate a flag set, and finally combine based on the above system call prefix, protocol parameter type and flag set to finally generate a complete system call protocol.

[0066] This embodiment obtains system call and file operation processing functions, and performs taint propagation analysis on the parameters of the system call and file operation processing functions, so as to obtain the system call prefix, specification parameter type and macro definition flag set, and finally generates a system call specification based on the above data, thereby achieving the effect of improving the efficiency and accuracy of generating system call specifications.

[0067] The embodiment of the present application also provides a device for generating a protocol. It should be noted that the device for generating a protocol in the embodiment of the present application can be used to execute the method for generating a protocol provided in the embodiment of the present application. The device for generating a protocol provided in the embodiment of the present application is introduced below.

[0068] Figure 6 is a schematic diagram of a device for generating a protocol according to an embodiment of the present application, such as Figure 6 As shown, the device includes: an acquisition unit 60, an analysis unit 61, and a determination unit 62.

[0069] The acquisition unit 60 is used to acquire the first type of function for system call and the second type of function for file operation processing from the kernel source code of the operating system, and determine the parameters in the first type of function to obtain the call parameters;

[0070] The analysis unit 61 is used to perform taint propagation analysis on the call parameters to obtain the macro definition flag, and perform taint propagation analysis on the parameters in the second type of function to obtain the system call prefix;

[0071] The determination unit 62 is used to determine the specification parameter type of the call parameter, and generate a system call specification according to the system call prefix, the specification parameter type and the macro definition flag, wherein the system call specification is used to perform fuzz testing on the operating system.

[0072] The protocol generation device provided in the embodiment of the present application obtains the first type of function for system call and the second type of function for file operation processing from the kernel source code of the operating system through the acquisition unit 60, and determines the parameters in the first type of function to obtain the call parameters; the analysis unit 61 performs taint propagation analysis on the call parameters to obtain the macro definition flag, and performs taint propagation analysis on the parameters in the second type of function to obtain the system call prefix; the determination unit 62 determines the protocol parameter type of the call parameter, and generates the system call protocol according to the system call prefix, the protocol parameter type and the macro definition flag, wherein the system call protocol is used to perform fuzzy testing on the operating system, which solves the problems of low generation efficiency and low accuracy in generating system call protocols in the related art, by obtaining the first type of function and the second type of function, and performing taint propagation analysis on the parameters of the first type of function and the second type of function, so as to obtain the system call prefix, the protocol parameter type and the macro definition flag set, and finally generates the system call protocol based on the above data, thereby achieving the effect of improving the efficiency and accuracy of generating the system call protocol.

[0073] Optionally, in the protocol generation device provided in the embodiment of the present application, the acquisition unit 60 includes: a first acquisition module, used to acquire the file pointer data structure of the kernel source code, and determine the device file associated with the file pointer data structure; a second acquisition module, used to acquire a preset function name, and extract a first type of function from the file pointer data structure according to the preset function name; a first determination module, used to determine a function structure according to the device file, and extract a second type of function from the kernel source code according to the function structure.

[0074] Optionally, in the protocol generation device provided in the embodiment of the present application, the analysis unit 61 includes: a first processing module, used to process the call parameters using an explicit flow analysis algorithm to obtain explicit contaminated variables, wherein the explicit contaminated variables refer to function variables in the operating system whose values ​​are directly affected by the call parameters; a second processing module, used to process the call parameters using an implicit flow analysis algorithm to obtain implicit contaminated variables, wherein the implicit contaminated variables refer to function variables in the operating system whose values ​​are affected by the call parameters under a preset probability; a first generation module, used to generate a macro definition flag based on the explicit contaminated variables and the implicit contaminated variables.

[0075] Optionally, in the protocol generation device provided in the embodiment of the present application, the analysis unit 61 includes: a third acquisition module, used to acquire the header file associated with the explicit polluted variable to obtain the first header file, and acquire the header file associated with the implicit polluted variable to obtain the second header file; a second determination module, used to determine the definition of the explicit polluted variable in the first header file, and determine the definition of the implicit polluted variable in the second header file; a second generation module, used to generate a macro definition flag according to the explicit polluted variable when the definition of the explicit polluted variable in the first header file is a flag definition; a third generation module, used to generate a macro definition flag according to the implicit polluted variable when the definition of the implicit polluted variable in the second header file is a flag definition.

[0076] Optionally, in the protocol generation device provided in the embodiment of the present application, the analysis unit 61 includes: a fourth acquisition module, used to obtain the function type of the second type of function, wherein the function type is one of the following: the first function type, the second function type; a fifth acquisition module, used to obtain the function name of the second type of function and obtain the processing function name when the function type is the first function type; an extraction module, used to extract the parameters in the processing function from the kernel source code according to the processing function name, obtain the processing function parameters, determine the processing function parameters as tainted data, and obtain the conditional statement associated with the tainted data; a third determination module, used to determine the definition of the tainted data in the conditional statement, and determine the system call prefix according to the flag definition when the definition of the tainted data is a flag definition; a third processing module, used to process the tainted data using an implicit flow analysis algorithm when the definition of the tainted data is not a flag definition, and determine the system call prefix based on the processing result; a sixth acquisition module, used to obtain a preset function when the function type is the second function type, and generate a system call prefix according to the preset function.

[0077] Optionally, in the protocol generation device provided in the embodiment of the present application, the analysis unit 61 includes: an introduction module, used to introduce tainted data into a sub-function in the second type of function, and perform taint analysis on the sub-function to obtain a taint analysis result; a judgment module, used to judge whether the parameters in the sub-function are macro definition flags when the taint analysis result indicates that the parameters in the sub-function are obtained by processing the tainted data; and a fourth determination module, used to determine the system call prefix according to the parameters in the sub-function when the parameters in the sub-function are defined as flags.

[0078] Optionally, in the generation device of the specification provided in the embodiment of the present application, the determination unit 62 includes: a fifth determination module, which is used to determine the parameters affected by the called parameters by using the explicit flow analysis algorithm, obtain M polluted variables, and determine the pollution types of the M polluted variables, where M is a positive integer; a sixth determination module, which is used to determine the polluted variables whose pollution type is direct pollution from the M polluted variables, obtain N polluted variables, and determine the specification parameter type according to the parameter type of the N polluted variables, where N is a positive integer less than or equal to M; a seventh determination module, which is used to determine the pollution type from the M polluted variables. Indirectly contaminated contaminated variables, MN contaminated variables are obtained, taint propagation analysis is performed on the MN contaminated variables, and correlation data between the MN contaminated variables and the calling parameters are obtained, wherein the correlation data characterizes the degree of association between each contaminated variable and the calling parameter, and the correlation data includes a first correlation index and a second correlation index, wherein the first correlation index refers to an index greater than or equal to a correlation data threshold, and the second correlation index refers to an index less than the correlation data threshold; an eighth determination module is used to determine the specification parameter type according to the parameter type of the MN contaminated variables when the correlation data is the first correlation index.

[0079] The above-mentioned protocol generation device includes a processor and a memory. The above-mentioned acquisition unit 60, analysis unit 61, determination unit 62, etc. are all stored in the memory as program units, and the processor executes the above-mentioned program units stored in the memory to realize corresponding functions.

[0080] The processor includes a kernel, which calls the corresponding program unit from the memory. One or more kernels can be set, and the problems of low generation efficiency and low accuracy when generating system call specifications in related technologies are solved by adjusting kernel parameters.

[0081] The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM, and the memory includes at least one memory chip.

[0082] An embodiment of the present invention provides a computer storage medium, which is used to store a program. When the program is running, the device where the computer storage medium is located is controlled to execute a method for generating a protocol.

[0083] Figure 7 is a schematic diagram of an electronic device provided according to an embodiment of the present application, such as Figure 7As shown, an embodiment of the present invention provides an electronic device, the electronic device 70 includes a processor, a memory, and a program stored in the memory and executable on the processor, the processor is used to execute computer-readable instructions, wherein the computer-readable instructions execute a method for generating a protocol when executed. The device in this article can be a server, a PC, a PAD, a mobile phone, etc.

[0084] The present application also provides a computer program product, including a computer program, which, when executed by a processor, implements the steps of a method for generating a protocol in each embodiment of the present application.

[0085] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0086] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0087] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0088] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0089] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0090] The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0091] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0092] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0093] The above are only embodiments of the present application and are not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application should be included within the scope of the claims of the present application.

Claims

1. A method for generating a specification, characterized in that: include: Obtaining a first-class function for system calls and a second-class function for file operation processing from the kernel source code of the operating system, and determining parameters in the first-class function to obtain calling parameters; Performing taint propagation analysis on the call parameters to obtain a macro definition flag, and performing taint propagation analysis on the parameters in the second type of function to obtain a system call prefix; Determine the protocol parameter type of the call parameter, and generate a system call protocol according to the system call prefix, the protocol parameter type and the macro definition flag, wherein the system call protocol is used to perform fuzz testing on the operating system.

2. The method according to claim 1, characterized in that Get the first-class functions for system calls and the second-class functions for file operation processing from the kernel source code of the operating system, including: Obtaining a file pointer data structure of the kernel source code, and determining a device file associated with the file pointer data structure; Obtaining a preset function name, and extracting the first type of function from the file pointer data structure according to the preset function name; A function structure is determined according to the device file, and the second type of function is extracted from the kernel source code according to the function structure.

3. The method according to claim 1, characterized in that The call parameters are subjected to taint propagation analysis, and the macro definition flags obtained include: Processing the calling parameters using an explicit flow analysis algorithm to obtain explicit contaminated variables, wherein the explicit contaminated variables refer to function variables in the operating system whose values ​​are directly affected by the calling parameters; Using an implicit flow analysis algorithm to process the call parameters to obtain implicit contaminated variables, wherein the implicit contaminated variables refer to function variables whose values ​​are affected by the call parameters in the operating system under a preset probability; The macro definition flag is generated based on the explicit pollution variable and the implicit pollution variable.

4. The method according to claim 3, characterized in that Generating the macro definition flag bit based on the explicit pollution variable and the implicit pollution variable includes: Obtaining a header file associated with the explicit pollution variable to obtain a first header file, and obtaining a header file associated with the implicit pollution variable to obtain a second header file; Determine the definition of the explicit contamination variable in the first header file, and determine the definition of the implicit contamination variable in the second header file; In a case where the definition of the explicit pollution variable in the first header file is a flag definition, generating the macro definition flag according to the explicit pollution variable; In the case where the definition of the implicit pollution variable in the second header file is the flag definition, the macro definition flag is generated according to the implicit pollution variable.

5. The method according to claim 1, characterized in that Performing taint propagation analysis on the parameters in the second type of function, the system call prefixes include: Obtaining a function type of the second-category function, wherein the function type is one of the following: a first function type, a second function type; When the function type is the first function type, obtaining a function name of the second type of function to obtain a processing function name; Extracting parameters in the processing function from the kernel source code according to the processing function name to obtain processing function parameters, determining the processing function parameters as tainted data, and obtaining conditional statements associated with the tainted data; Determine the definition of the tainted data in the conditional statement, and when the definition of the tainted data is a flag bit definition, determine the system call prefix according to the flag bit definition; In the case where the definition of the tainted data is not the definition of the flag bit, the tainted data is processed using an implicit flow analysis algorithm, and the system call prefix is ​​determined based on the processing result; When the function type is the second function type, a preset function is obtained, and the system call prefix is ​​generated according to the preset function.

6. The method according to claim 5, characterized in that Determining the system call prefix based on the processing result includes: Introducing the tainted data into a sub-function in the second type of function, and performing taint analysis on the sub-function to obtain a taint analysis result; In the case where the taint analysis result indicates that the parameter in the sub-function is obtained by processing the tainted data, determining whether the parameter in the sub-function is the macro definition flag; In the case where the parameter in the sub-function is defined as the flag bit, the system call prefix is ​​determined according to the parameter in the sub-function.

7. The method according to claim 1, characterized in that Determining the specification parameter type of the call parameter includes: Determine the parameters in the second type of function that are affected by the calling parameters using an explicit flow analysis algorithm to obtain M polluted variables, and determine the pollution types of the M polluted variables, where M is a positive integer; Determine a polluted variable whose pollution type is direct pollution from the M polluted variables to obtain N polluted variables, and determine the specification parameter type according to the parameter types of the N polluted variables, wherein N is a positive integer less than or equal to M; Determine a polluted variable whose pollution type is indirect pollution from the M polluted variables to obtain MN polluted variables, perform taint propagation analysis on the MN polluted variables, and obtain correlation data between the MN polluted variables and the calling parameters, wherein the correlation data characterizes the degree of association between each polluted variable and the calling parameter, and the correlation data includes a first correlation index and a second correlation index, wherein the first correlation index refers to an index greater than or equal to a correlation data threshold, and the second correlation index refers to an index less than the correlation data threshold; In a case where the relevant data is the first relevant index, the specification parameter type is determined according to the parameter types of the MN contaminated variables.

8. A device for generating a protocol, characterized in that: include: An acquisition unit, used to acquire a first type of function for system calls and a second type of function for file operation processing from the kernel source code of the operating system, and determine parameters in the first type of function to obtain call parameters; An analysis unit, configured to perform a taint propagation analysis on the call parameters to obtain a macro definition flag, and perform a taint propagation analysis on the parameters in the second type of function to obtain a system call prefix; A determination unit is used to determine the specification parameter type of the call parameter, and generate a system call specification according to the system call prefix, the specification parameter type and the macro definition flag, wherein the system call specification is used to perform fuzz testing on the operating system.

9. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the method for generating a protocol according to any one of claims 1 to 7 is implemented.

10. An electronic device, characterized in that: It includes one or more processors and a memory, wherein the memory is used to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement the method for generating a protocol as described in any one of claims 1 to 7.

Images