Data set expansion method and system for password misuse detector

Abstract

The invention discloses a data set expansion method and system for a password misuse detector, and belongs to the field of password misuse detector performance detection calculation. The method comprises the following steps: collecting open source items related to password misuse, and sorting out an API (Application Program Interface) related to password misuse and a password library used by the API; the method comprises the following steps: collecting open source codes related to a password algorithm in a Githhub warehouse, and screening out the open source codes related to password misuse from the open source codes related to the password algorithm based on an API (Application Program Interface) related to password misuse and a password library used by the API; wherein the programming language used by the open source code comprises a Java language, a C / C + + language, a Go language and a Python language; performing variation on the open source code using the Java language; a dataset of a password misuse detector is constructed based on the open source code associated with password misuse and the variant open source code using the Java language. The password misuse data set can be expanded.

Description

Technical Field

[0001] The present invention belongs to the field of performance detection and calculation of password misuse detectors, and in particular, relates to a data set expansion method and system for password misuse detectors. Background Art

[0002] With the development of the Internet, the secure transmission of network users' private data has become increasingly important. In order to meet the needs of availability, confidentiality and integrity of information transmission, cryptographic algorithms are playing an increasingly important role in secure information transmission. Nowadays, many programming languages ​​have provided corresponding cryptographic algorithm usage interfaces, and developers can use cryptographic algorithms efficiently and conveniently through these interfaces. However, since most developers lack the corresponding cryptographic knowledge reserves, these algorithm interfaces are often not used correctly and in a standardized manner, which leads to the misuse of passwords and increases the risk of user privacy data leakage.

[0003] Researchers have developed a variety of password misuse detectors for the misuse of cryptographic algorithms. Password misuse detectors can help developers promptly discover and report potential API misuse problems in the code, and can effectively ensure the security of the use of cryptographic algorithms. Current password misuse detection is mainly divided into rule-based static detection, dynamic detection for code operation, and neural network-based misuse detection. CryptoGuard proposes a new on-demand slicing method, which detects password misuse in Java and Android apps through static analysis combining forward and reverse slicing, classifies password misuse according to its characteristics, and develops corresponding static analysis methods for each type of password misuse. CRYLOGGER is the first open source tool for dynamic detection of cryptographic misuse. It records the parameters passed to the cryptographic API during execution and checks offline whether they have been misused through a list of cryptographic rules. CryptoDetection is a Bi-LSTM-based password misuse detector that identifies password misuse by extracting information and features from the source code and training classifiers. Most of the static and dynamic password misuse detectors detect password misuse vulnerabilities based on password misuse rules, so they do not require a large number of password misuse data sets. However, since password misuse detectors need to design different misuse identification processes according to different programming languages, these password misuse detectors can only detect password misuse in a single language and cannot be applied to password misuse detection in multiple programming languages. In addition, since the data structure in the data set is not rich enough, password misuse detectors lack comprehensive evaluation tests. Unlike the first two password misuse detectors, the neural network-based password misuse detector can detect password misuse in multiple languages ​​by training the neural network, but its detection performance depends on the size of the training data set. The larger the size of the training data set, the higher the detection performance of the detector. The current open source password misuse data set is small in size, and there is still a certain gap from the ideal training data set size.

[0004] Collecting a password misuse dataset requires a lot of manpower, so a new technology is needed to narrow the scope of password misuse data retrieval to improve the efficiency of dataset construction. Because most developers use Java language for project development, researchers have studied a mutation technology for the Java programming language that can reconstruct the content of the dataset to expand the scale of the Java dataset, but the mutation types in the existing mutation technology cannot cover all types of password misuse, and further expansion is needed to improve the quality of dataset generation. Summary of the invention

[0005] The present invention provides a data set expansion method and system for a password misuse detector. Based on the common characteristics of the cryptographic algorithm API, similar codes are quickly collected to expand the password misuse data set, thereby more comprehensively detecting the performance of the current password misuse detector, making up for the current research status of small password misuse data sets and few types, and providing a good evaluation basis for the password misuse detector.

[0006] In order to achieve the goal of relatively comprehensively expanding the password misuse data set, the present invention adopts the following technical solutions:

[0007] A data set expansion method for a password misuse detector, the method comprising:

[0008] Collect open source projects related to password misuse, sort out the APIs involved in password misuse and the password libraries used by the APIs;

[0009] Collect open source codes related to cryptographic algorithms in Github repositories, and screen out open source codes related to cryptographic misuse from the open source codes related to cryptographic algorithms based on the APIs involved in cryptographic misuse and the cryptographic libraries used by the APIs; wherein the programming languages ​​used by the open source codes include: Java, C / C++, Go, and Python;

[0010] Mutate open source code using the Java language;

[0011] Based on the open source code related to password misuse and the variant open source code using Java language, a data set of password misuse detector is constructed.

[0012] Furthermore, the open source projects related to password misuse are collected, and the APIs involved in password misuse and the password libraries used by the APIs are sorted out, including:

[0013] Generate a basic password misuse dataset based on the open source datasets included in the password misuse detector related articles;

[0014] Collect password libraries;

[0015] According to the password misuse involved in the password misuse basic data set, the API that causes the password misuse and the password library used by the API are obtained.

[0016] Furthermore, the open source codes related to cryptographic algorithms in the Github repository are collected, and based on the APIs involved in the cryptographic misuse and the cryptographic libraries used by the APIs, the open source codes related to the cryptographic misuse are screened out from the open source codes related to the cryptographic algorithms, including:

[0017] Construct a Github query statement, and search the Github repository based on the Github query statement to obtain all Github repositories within a specified time range; wherein the Github query statement includes: a query start time, a query end time, and a specified sorting order;

[0018] Filter all Github repositories within the specified time range based on set conditions; wherein the set conditions include: whether the code is open source, the number of submissions, non-IOS Github repositories and non-Android Github repositories;

[0019] Constructing a github3 query statement to obtain open source code related to the cryptographic algorithm in the screening results; wherein the github3 query statement includes: the header file that the code must contain, the file type, and the programming language used by the code;

[0020] According to the header file of the open source code related to the cryptographic algorithm, determining whether the open source code related to the cryptographic algorithm references the cryptographic library;

[0021] In the case where the open source code related to the cryptographic algorithm references the cryptographic library, after integrating the API that may appear in the open source code related to the cryptographic algorithm according to the name of the cryptographic library, the open source code related to the cryptographic algorithm is traversed line by line, and by determining whether the function contains the possible API, the open source code related to the cryptographic misuse is obtained; wherein, in the case where the programming language of the open source code is Java language, the function is a function that implements the X509TrustManage interface or the HostnameVerifier interface.

[0022] Further, the mutation includes: character string mutation;

[0023] The string mutation of the open source code using the Java language includes:

[0024] Modify the case of the password algorithm;

[0025] and / or,

[0026] Add noise characters to the string;

[0027] and / or,

[0028] Convert a secure cryptographic algorithm into an insecure one;

[0029] and / or,

[0030] Change the string used directly into a string that needs to be passed through parameters.

[0031] Further, the mutation includes: unsafe array mutation;

[0032] The unsafe array mutation of the open source code using the Java language includes:

[0033] Construct a constant key through a for loop, and only add fixed characters to the constant key in each loop;

[0034] and / or,

[0035] Construct a constant key using system time;

[0036] and / or,

[0037] Generate a constant key from an array; the values ​​in the array are fixed.

[0038] Further, the variation includes: conditional statement variation;

[0039] The conditional statement mutation of the open source code using the Java language includes:

[0040] Get the if conditional statement in the open source code;

[0041] The safe API parameters and the unsafe API parameters are respectively added to the branch conditions of the if conditional statement, and the judgment condition is set to true before the program enters the if conditional statement.

[0042] Further, the mutation includes: cross-function mutation;

[0043] The cross-function mutation of the open source code using the Java language includes:

[0044] When the Main function calls the first function of the encryption API, it assigns the insecure cryptographic algorithm parameter value to a variable and passes the variable to the first function of the encryption API;

[0045] and / or,

[0046] When the Main function calls an intermediate function, it assigns the insecure cryptographic algorithm parameter value to a variable, and passes the variable to the first function of the encryption API via the intermediate function.

[0047] Further, the mutation includes: constructor mutation;

[0048] The method of performing constructor mutation on the open source code using the Java language includes:

[0049] In the same Java file, construct a custom class;

[0050] When initializing the custom class, the Main function passes an unsafe cryptographic algorithm so that the constructor uses the unsafe cryptographic algorithm when calling the encryption API.

[0051] and / or,

[0052] In the same Java file, construct a first custom class and a second custom class; wherein the first custom class includes a static variable, a constructor and a custom method, the custom method uses the static variable initialized in the constructor when calling the encryption API, the static variable is a parameter of the encryption API, and the second custom class includes a Main function;

[0053] When initializing the first custom class, the Main function passes an insecure cryptographic algorithm to the custom method.

[0054] Further, the mutation includes: cross-class call mutation;

[0055] The cross-class call mutation of the open source code using the Java language includes:

[0056] For normal cross-class calls, change the private variables in a class from secure cryptographic algorithm parameter values ​​to insecure cryptographic algorithm parameter values, and when the encryption API is used through the Main function in another class, the parameter values ​​used by the encryption API are implemented by calling the insecure cryptographic algorithm parameter values;

[0057] and / or,

[0058] For calls across anonymous inner classes, cross-class call mutation is achieved by implementing interfaces across files, implementing interfaces in the same file, or inheriting interfaces across files.

[0059] A data set augmentation system for a password misuse detector, the system comprising:

[0060] The data collection module is used to collect open source projects related to password misuse, sort out the APIs involved in password misuse and the password libraries used by the APIs;

[0061] A code acquisition module is used to collect open source codes related to cryptographic algorithms in Github repositories, and based on the APIs involved in cryptographic misuse and the cryptographic libraries used by the APIs, screen out open source codes related to cryptographic misuse from the open source codes related to cryptographic algorithms; wherein the programming languages ​​used by the open source codes include: Java, C / C++, Go, and Python;

[0062] Code mutation module, used to mutate open source code using Java language;

[0063] The data set construction module is used to construct a data set of a password misuse detector based on the open source code related to password misuse and the variant open source code using the Java language.

[0064] Compared with the prior art, the present invention has at least the following beneficial effects.

[0065] 1) The collected data sets can include four programming languages: Python, C / C++, GO, and Java, which can more comprehensively train and evaluate the performance of password misuse detectors.

[0066] 2) It can quickly collect and locate the code of specific APIs, reducing the manpower consumed in the data collection process.

[0067] 3) By utilizing the characteristics of Java's API encapsulation interface, it can mutate into multiple API misuses to detect whether the password misuse detector has the ability to detect deep-level password misuse. BRIEF DESCRIPTION OF THE DRAWINGS

[0068] Figure 1 The present invention is a flow chart of a data set expansion method for a password misuse detector.

[0069] Figure 2 Flowchart of the screening process for collecting open source code for this invention.

[0070] Figure 3 Flowchart of locating API where password misuse may occur for the present invention.

[0071] Figure 4 Flowchart for generating variant codes for the present invention. DETAILED DESCRIPTION

[0072] In order to enable those skilled in the art to better understand the technical solution of the present invention, the present invention will be further described in detail below through its specific embodiments in conjunction with the accompanying drawings.

[0073] The present invention proposes a data set expansion method for password misuse detectors, the purpose of which is to more comprehensively evaluate existing password misuse detectors and improve the ability of password misuse detectors to analyze and discover password misuse. This data set expansion method solves the problem of the difficulty in collecting current password misuse data sets and provides a good training data set for password misuse detectors based on large models.

[0074] The present invention proposes a data set expansion method for password misuse detector, such as Figure 1 As shown, the following steps are included.

[0075] Step 1: Collect open source projects related to cryptographic algorithms and summarize APIs involving cryptographic misuse.

[0076] 1) Collect open source password misuse datasets. By reading articles related to password misuse detectors in the past five years, we obtain the open source datasets contained in the articles and organize them in a unified manner to generate a relatively comprehensive password misuse basic dataset.

[0077] 2) According to different programming languages, open source cryptographic library codes widely used by developers are collected. The collected cryptographic library names are shown in Table 1.

[0078] Table 1 Algorithm library related to cryptographic algorithms collected in this invention

[0079]

[0080] 3) Sort out the APIs that may cause password misuse. According to the password misuse involved in the password misuse basic data set, filter out the API names that may cause password misuse from the collected open source algorithm library. Store the collected API names in a json file in the form of a dictionary, in the form of {programming language 1: {password library name 1: [API_name1, API_name2]}}. The collected password algorithm API names for the four programming languages ​​are shown in Table 2.

[0081] Table 2 Collected API names

[0082]

[0083]

[0084]

[0085] Step 2: Collect open source codes in Github and filter out codes related to cryptographic algorithms.

[0086] 1) Figure 2It is a screening flow chart for collecting open source code. The present invention retrieves open source projects in Github by using the github3 interface provided by Github. First, a Github query statement is constructed, which includes the start time, end time, and specified arrangement order of the query, and all Github repositories within the specified time range are obtained through the constructed query statement. After that, the obtained warehouses are further screened under specific conditions to screen out Github repositories with open source code, more than 100 submissions, non-IOS and non-Android, and store the warehouse names, submissions, submission links, number of stars, and number of Forks that meet the conditions, and then filter out the code related to the cryptographic algorithm from the warehouse that meets the screening conditions. In order to filter out the code that meets the conditions, it is necessary to reconstruct the github3 query statement, which includes the header files that the code must contain, the file type, and the programming language used by the code. Finally, the code information that meets the screening conditions is stored, and the code is downloaded to the specified path according to the code address.

[0087] 2) Locate the algorithms related to possible password misuse. According to the relevant codes collected from Github, each code is analyzed accordingly, and different string matching methods are used according to the different programming languages ​​used in the code. Figure 3 Flowchart of locating API where password misuse may occur for the present invention.

[0088] First, determine whether the code references the relevant cryptographic library based on the header files introduced in the code. This is because if a program code wants to use the API interface defined by the developer, it must introduce the corresponding header file at the beginning of the file, so if you want to use the cryptographic algorithm API, you must reference the corresponding cryptographic library. Methods for determining whether the code contains a specific cryptographic algorithm API through specific string matching technology and obtaining the specific API code location include:

[0089] 1) Get the cryptographic library used in the code according to the header file referenced by the code;

[0090] 2) Based on the cryptographic library, summarize the cryptographic misuse APIs that may be included in the code;

[0091] 3) Divide the code into functions and obtain the function name of a specific API;

[0092] 4) Match the API strings in the code and summarize the cryptographic algorithm APIs actually used in the code.

[0093] Next, if a password library is included, the corresponding name of the password library is obtained, and all API names that may appear in the code are integrated according to the password library name. Since different programming languages ​​have different creation formats for methods, the present invention distinguishes different functions in the code by defining different function matching methods. In the process of traversing the function code, a specific string is matched to determine whether a specified API exists in the line of code. If a specified API exists, the relevant location information of the API is temporarily stored, and when all the code traversals of the file are completed, the matched API strings are uniformly stored in the corresponding files.

[0094] Specifically, the present invention traverses the code line by line. For Java, C / C++, and Go languages, "{}" is used to determine whether a function ends. For Python language, "def" is used for string matching. While traversing the function content, it is determined whether the function contains the API name specified in Table 2. If it is contained, the line where the API is located and the line where the function starts are recorded. Due to the interface inheritance feature of Java, it is necessary to additionally determine whether the function implements the "X509TrustManage" or "HostnameVerifier" interface. If the function implements the "X509TrustManage" or "HostnameVerifier" interface, the line where the function name that implements the interface is located is recorded. If the function does not implement the above two interfaces but implements other interfaces, the interface implementation is ignored and no processing is performed. Finally, the API-related information obtained by string matching, as well as the file path, file size, and programming language used by the file are stored in a jsonl file.

[0095] Step 3: According to the possible password misuse types in the Java dataset, select some password misuse types that can be quickly generated by code (i.e., the mutation types in Table 3) and construct a new Java password misuse mutation code.

[0096] Figure 4 A flowchart of generating variant codes for the present invention. Cryptographic API misuse includes the use of unsafe cryptographic algorithms and the unsafe use of secure cryptographic algorithms. Mutation technology is based on this, adding variants containing cryptographic misuse to the collected code, thereby generating new cryptographic misuse codes. Java is currently the most widely used programming language in the field of cryptographic algorithm API. In order to comprehensively evaluate and detect Java-based cryptographic misuse detectors, the present invention constructs a new code mutation method based on the MASC framework, which includes the following 6 types of mutations, as shown in Table 3.

[0097] Table 3 Mutation types of Java mutation technology

[0098]

[0099] 1) String mutation.

[0100] Due to the encapsulation characteristics of the Java cryptographic algorithm API, Cipher.getInstance() can define the cryptographic algorithm used for encryption and decryption through a string. String mutation is to convert a secure cryptographic algorithm string into an unsafe cryptographic algorithm string when using the API, or directly use a cryptographic algorithm string that does not seem to comply with the API usage specifications. In other words, because most cryptographic algorithm API calls use strings to declare the cryptographic algorithm to be used later, string mutation is to modify the string content to produce new misuses, which includes a total of 4 mutation methods. The first is to modify the case of the cryptographic algorithm, changing the case of a character in the string, such as changing "DES" to "des". The second is to add interference characters to the string, such as changing "DES" to "D~ES". The third is to convert a secure cryptographic algorithm into an unsafe cryptographic algorithm, such as changing "AES" to "DES". The fourth method is to change the string used directly into a string that needs to be passed through a parameter, for example, change "javax.crypto.Cipher.getInstance("DES")" to "String cryptoVariable="AES";javax.crypto.Cipher.getInstance(cryptoVariable);".

[0101] 2) Unsafe array mutation.

[0102] If a secure cryptographic algorithm is not used correctly, it can still lead to password misuse. Unsafe array mutation and anonymous inner class mutation are examples of this. Some cryptographic algorithms require keys to perform encryption and decryption operations. The generation of keys generally requires the use of random arrays to ensure the strong security of the cryptographic algorithm. Unsafe array mutation is to apply a fixed array to the generation of keys, thereby generating new password misuse.

[0103] This variation is aimed at developers using constant keys for encryption, which leads to misuse. The present invention constructs constant keys in three ways. The first is to construct a constant string through a for loop, and only add fixed characters to the string in each loop. The second is to construct a string by obtaining the system time, and the generated string is still not random for the password. The third is to generate a key through an array, and the values ​​in the array are fixed and not randomly generated.

[0104] 3) Conditional statement variation.

[0105] Conditional statement mutation is to modify the parameter value through the if conditional statement to generate password misuse. This mutation is to embed the password misuse into the if conditional statement (as shown in Code 1), that is, to add safe API parameters and unsafe API parameters to the branch conditions respectively, and set the judgment condition to true before the program enters the conditional statement, so that the if conditional statement always executes the statement containing the password misuse.

[0106] Code 1 Conditional statement variation.

[0107]

[0108]

[0109] 4) Cross-function variation.

[0110] Cross-function mutation is to generate password misuse by adding multiple functions to pass insecure parameter values. This mutation adds misuse by calling different functions to pass the parameter values ​​required in the API, that is, passing insecure cryptographic algorithm parameters to the cryptographic algorithm API. This mutation is mainly divided into two ways. The first is to pass parameter values ​​only at intervals of one function (as shown in Code 2), and the second is to pass parameter values ​​at intervals of two functions (as shown in Code 3). For the first cross-function mutation that only intervals a single function, this mutation involves two functions in total. The first function is used to use a specific encryption API. The Main function is used to assign the insecure cryptographic algorithm parameter value to a variable. The calling process is that the Main function calls the first function. The Main function passes the insecure variable to the first function that uses the encryption API through a single call, thereby generating password misuse. For the second cross-function mutation that intervals two functions, this mutation involves three functions in total. The first function is only responsible for passing variables, the second function is responsible for using specific encryption APIs, and the Main function is used to define variables containing unsafe parameter values. The calling process is that the Main function calls the first function, and the first function calls the second function. That is, the Main function passes the unsafe variables to the second function that uses the encryption API through two calls, thereby causing password misuse.

[0111] Code 2 Cross-function mutation across a function.

[0112]

[0113] java.lang.System.out.println("Hello");

[0114] String url="http: / / www.google.com";

[0115] method1(url);

[0116] }

[0117] }

[0118] Code 3 cross-function mutation across two functions.

[0119] public class CryptoTest1{

[0120] public static void method1(java.lang.String url)throwsjava.lang.Exception{

[0121] String arg2 = url;

[0122] method2(arg2);

[0123] }

[0124] public static void method2(java.lang.String url)throwsjava.lang.Exception{

[0125] System.out.println(new URL(url));

[0126] }

[0127] public static void main(java.lang.String[]args)throwsjava.lang.Exception{

[0128] java.lang.System.out.println("Hello");

[0129] String url="http: / / www.google.com";

[0130] method1(url);

[0131] }

[0132] }

[0133] 5) Constructor mutation.

[0134] Constructor mutation is to generate password misuse by adding a constructor to pass an unsafe parameter value. The constructor is mainly used to initialize the object when the object is created. It is automatically called when the object is created and has the same name as the class. Therefore, this feature can be used to construct a custom class in the same Java file, and pass an unsafe cryptographic algorithm parameter during initialization to generate new password misuse. This mutation is mainly divided into two forms. The first is to use unsafe parameters directly in the constructor (as shown in code 4), and the second is to create a function in the custom class (as shown in code 5). For the first type, it only contains one class. The constructor in the class directly calls the encryption API, and the Main function passes an unsafe cryptographic algorithm when initializing the class. In this way, the encryption API in the constructor will use this unsafe cryptographic algorithm to generate password misuse. For the second type, it contains two classes. The first class contains a static variable, a constructor and a custom method, and the second class only contains the Main function. In the first class, the function of the constructor is to assign values ​​to static variables when the class is initialized, and the function of the other custom method is to use a specific encryption API, and the parameter of the encryption API is a static variable. The purpose of the Main function in the second class is to pass an insecure cryptographic algorithm when initializing the first class, and then call the custom method in the first class, resulting in password misuse.

[0135] Code 4 constructor mutation is called directly.

[0136] public class CryptoFieldFieldSingleClass{

[0137] static java.lang.String algo;

[0138] public CryptoFieldFieldSingleClass(java.lang.String defAlgo)throwsjava.lang.Exception{

[0139] this.algo = defAlgo;

[0140] Cipher cipher=Cipher.getInstance(algo);

[0141] }

[0142] public static void main(java.lang.String[]args){

[0143] java.lang.System.out.println("Hello");

[0144] CryptoFieldFieldSingleClass fieldClass = new CryptoFieldFieldSingleClass("DES");

[0145] }

[0146] }

[0147] Code 5 constructor mutation indirect call.

[0148] class CryptoFieldFieldClass {

[0149] static java.lang.String algo;

[0150] public CryptoFieldFieldClass(java.lang.String defAlgo) {

[0151] this.algo = defAlgo;

[0152] }

[0153] public static void method1(java.lang.String passedAlgo) throws

[0154] javax.crypto.NoSuchPaddingException, java.security.NoSuchAlgorithmException {

[0155] passedAlgo = algo;

[0156] Cipher cipher = Cipher.getInstance(passedAlgo);

[0157] }

[0158] }

[0159] public class CryptoFieldField {

[0160] public static void main(java.lang.String[]args)throwsjava.lang.Exception{

[0161] java.lang.System.out.println("Hello");

[0162] CryptoFieldFieldClass fieldClass=new CryptoFieldFieldClass("DES");

[0163] fieldClass.method1("AES");

[0164] }

[0165] }

[0166] 6) Cross-class call mutation. This type of mutation is mainly divided into two types: normal cross-class call and cross-anonymous inner class call. Normal cross-class call is to directly call methods in different files to achieve password misuse, and cross-anonymous inner class call is a type of mutation based on Java language characteristics.

[0167] For normal cross-class calls (such as code 6), it contains two files in total. In the first file, a class (named CipherPack for example) is constructed. The class contains three methods and a private variable. The private variable is first assigned a secure cryptographic algorithm parameter value, and the three methods in the class are used to reassign the private variable. In the first method (named A() for example), the secure parameter value of the private variable remains unchanged. In the second method (named B() for example), the private variable is assigned an unsafe parameter value. In the third method (named C() for example), the private variable is returned. For the second file, a class is also constructed. The encryption API is used through the Main function in the class. The parameter values ​​used by the encryption API are obtained by calling the three methods in the first file. The calling method is "CipherPack.A().B().C()". Through this calling method, the private variables in the CipherPack class will change from the original secure parameter values ​​to unsafe parameter values, resulting in password misuse.

[0168] For the call across anonymous inner classes, the use of anonymous inner classes is involved, and the password misuse occurs in this anonymous inner class. Anonymous inner class mutation is specifically for the misuse mutation of Java interfaces, which generates new password misuse by incorrectly implementing the parent class interface. In the process of software development, parameter values ​​can be called and changed in various ways. The password misuse detector should be able to detect the final result of the password algorithm parameter value in this process. This mutation is only for the special case where the password algorithm itself is an interface, such as X509TrustManage, HostnameVerifier. An anonymous inner class is an inner class without a name. The class will be used immediately after the definition and will not be reused elsewhere. This type of call across anonymous inner classes is mainly divided into three ways, including implementing interfaces across files, implementing interfaces in the same file, and inheriting interfaces across files. For implementing interfaces across files (as shown in Code 7), it contains two files. In the first file, a class (for example, named CryptoTestExt) is constructed, which implements an interface. In the second file, a class (named CryptoTest in the example) is also constructed, but an anonymous inner class CryptoTestExt is constructed in this class. CryptoTest indirectly implements the interface in the first file through the anonymous inner class and rewrites it. However, the rewriting of this anonymous inner class will cause password misuse. For example, when implementing the HostnameVerifier interface, the verify method is not rewritten, but True is directly returned. For implementing the interface in the same file (as shown in code 8), the interface is directly implemented in the same file through an anonymous inner class, such as "newjavax.net.ssl.HostnameVerifier(){}". While implementing the interface, password misuse is caused by insecure rewriting. For the cross-file inheritance interface (as shown in code 9), it contains two files. Unlike the cross-file implementation interface, the cross-file inheritance interface creates an interface (named CryptoTestExt1 in the example) in the first file. This interface inherits an interface related to the cryptographic algorithm, such as the HostnameVerifier interface. In the second file, although it also builds a class and implements the interface by building an anonymous inner class in the class, this time it implements the interface CryptoTestExt1 created in the first file instead of the HostnameVerifier interface. The subsequent rewriting process of the CryptoTestExt1 interface is the same as the previous two methods, and the password misuse occurs through an unsafe rewriting method.

[0169] Code 6 shows the normal cross-class call in the cross-class call variant.

[0170] public class CipherPack {

[0171] private String propertyName="AES";

[0172] public CipherPack A(){

[0173] propertyName = "AES";

[0174] return this;

[0175] }

[0176] public CipherPack B(){

[0177] propertyName = "DES";

[0178] return this;

[0179] }

[0180] public String C(){

[0181] return propertyName;

[0182] }

[0183] }

[0184] public class CryptoTest {

[0185] public static void main(java.lang.String[]args)throwsjava.lang.Exception{

[0186]

[0187] Code 7 implements the interface across files in a cross-class call mutation.

[0188]

[0189] Code 8 implements the interface in the same file in a cross-class call variant.

[0190]

[0191]

[0192] Code 9 calls the cross-file inheritance interface in the cross-class mutation.

[0193]

[0194] Step 4: Use the mutated framework built in step 3 to expand the Java dataset collected in step 2.

[0195] First, locate the jsonl document according to the password algorithm obtained in step 2, determine the context code related to the misuse, and add the relevant code that needs to be added to the txt file. The identifier that needs to be added before the misuse code is "BeforeCode", and the identifier that needs to be added after the misuse code is "AfterCode". Second, construct the corresponding properties file according to the type of misuse that needs to be generated. The properties file uses key-value pairs to store information. The specific meanings of the parameters are described in Table 4. Third, input the constructed properties file and txt file into the mutation framework. The mutation framework will first generate a new code containing password misuse according to the properties file, and then check whether the "AfterCode" and "BeforeCode" contents in the txt file are empty. If the content is not empty, the context code related to the misuse is added to the code generated by the mutation framework according to the "AfterCode" and "BeforeCode" identifiers, and finally output the new misuse code. If the content is empty, ignore the txt file and directly output the new misuse code.

[0196] Table 4 Parameter description of properties configuration file

[0197]

[0198]

[0199]

[0200] Those skilled in the art will readily appreciate other embodiments of the present disclosure after considering the specification and practicing the present disclosure. The present disclosure is intended to cover any variations, uses or adaptations of the present disclosure, which follow the general principles of the present disclosure and include common knowledge or customary technical means in the art that are not disclosed in the present disclosure. The specification and examples are intended to be exemplary only, and the present disclosure is not limited to the precise structures described above and shown in the accompanying drawings, and various modifications and changes may be made without departing from the scope thereof.

Claims

1. A data set expansion method for a password misuse detector, characterized in that: The method comprises: Collect open source projects related to password misuse, sort out the APIs involved in password misuse and the password libraries used by the APIs; Collect open source codes related to cryptographic algorithms in Github repositories, and screen out open source codes related to cryptographic misuse from the open source codes related to cryptographic algorithms based on the APIs involved in cryptographic misuse and the cryptographic libraries used by the APIs; wherein the programming languages ​​used by the open source codes include: Java, C / C++, Go, and Python; Mutate open source code using the Java language; Based on the open source code related to password misuse and the variant open source code using Java language, a data set of password misuse detector is constructed.

2. The method according to claim 1, characterized in that The open source projects related to password misuse are collected, and the APIs involved in password misuse and the password libraries used by the APIs are sorted out, including: Generate a basic password misuse dataset based on the open source datasets included in the password misuse detector related articles; Collect password libraries; According to the password misuse involved in the password misuse basic data set, the API that causes the password misuse and the password library used by the API are obtained.

3. The method according to claim 1, characterized in that The open source codes related to cryptographic algorithms in the Github repository are collected, and based on the API involved in the cryptographic misuse and the cryptographic library used by the API, the open source codes related to the cryptographic misuse are screened out from the open source codes related to the cryptographic algorithms, including: Construct a Github query statement, and search the Github repository based on the Github query statement to obtain all Github repositories within a specified time range; wherein the Github query statement includes: a query start time, a query end time, and a specified sorting order; Filter all Github repositories within the specified time range based on set conditions; wherein the set conditions include: whether the code is open source, the number of submissions, non-IOS Github repositories and non-Android Github repositories; Constructing a github3 query statement to obtain open source code related to the cryptographic algorithm in the screening results; wherein the github3 query statement includes: the header file that the code must contain, the file type, and the programming language used by the code; According to the header file of the open source code related to the cryptographic algorithm, determining whether the open source code related to the cryptographic algorithm references the cryptographic library; In the case where the open source code related to the cryptographic algorithm references the cryptographic library, after integrating the API that may appear in the open source code related to the cryptographic algorithm according to the name of the cryptographic library, the open source code related to the cryptographic algorithm is traversed line by line, and by determining whether the function contains the possible API, the open source code related to the cryptographic misuse is obtained; wherein, in the case where the programming language of the open source code is Java language, the function is a function that implements the X509TrustManage interface or the HostnameVerifier interface.

4. The method according to claim 1, characterized in that The mutations include: string mutations; The string mutation of the open source code using the Java language includes: Modify the case of the password algorithm; and / or, Add noise characters to the string; and / or, Convert a secure cryptographic algorithm into an insecure one; and / or, Change the string used directly into a string that needs to be passed through parameters.

5. The method according to claim 1, characterized in that The mutations include: unsafe array mutations; The unsafe array mutation of the open source code using the Java language includes: Construct a constant key through a for loop, and only add fixed characters to the constant key in each loop; and / or, Construct a constant key using system time; and / or, Generate a constant key from an array; the values ​​in the array are fixed.

6. The method according to claim 1, characterized in that The mutations include: conditional statement mutations; The conditional statement mutation of the open source code using the Java language includes: Get the if conditional statement in the open source code; The safe API parameters and the unsafe API parameters are respectively added to the branch conditions of the if conditional statement, and the judgment condition is set to true before the program enters the if conditional statement.

7. The method according to claim 1, characterized in that The mutation includes: cross-function mutation; The cross-function mutation of the open source code using the Java language includes: When the Main function calls the first function of the encryption API, it assigns the insecure cryptographic algorithm parameter value to a variable and passes the variable to the first function of the encryption API; and / or, When the Main function calls an intermediate function, it assigns the insecure cryptographic algorithm parameter value to a variable, and passes the variable to the first function of the encryption API via the intermediate function.

8. The method according to claim 1, characterized in that The mutations include: constructor mutations; The method of performing constructor mutation on the open source code using the Java language includes: In the same Java file, construct a custom class; When initializing the custom class, the Main function passes an unsafe cryptographic algorithm so that the constructor uses the unsafe cryptographic algorithm when calling the encryption API. and / or, In the same Java file, construct a first custom class and a second custom class; wherein the first custom class includes a static variable, a constructor and a custom method, the custom method uses the static variable initialized in the constructor when calling the encryption API, the static variable is a parameter of the encryption API, and the second custom class includes a Main function; When initializing the first custom class, the Main function passes an insecure cryptographic algorithm to the custom method.

9. The method according to claim 1, characterized in that: The mutations include: cross-class call mutations; The cross-class call mutation of the open source code using the Java language includes: For normal cross-class calls, change the private variables in a class from secure cryptographic algorithm parameter values ​​to insecure cryptographic algorithm parameter values, and when the encryption API is used through the Main function in another class, the parameter values ​​used by the encryption API are implemented by calling the insecure cryptographic algorithm parameter values; and / or, For calls across anonymous inner classes, cross-class call mutation is achieved by implementing interfaces across files, implementing interfaces in the same file, or inheriting interfaces across files.

10. A data set expansion system for a password misuse detector, characterized in that: The system comprises: The data collection module is used to collect open source projects related to password misuse, sort out the APIs involved in password misuse and the password libraries used by the APIs; A code acquisition module is used to collect open source codes related to cryptographic algorithms in Github repositories, and based on the APIs involved in cryptographic misuse and the cryptographic libraries used by the APIs, screen out open source codes related to cryptographic misuse from the open source codes related to cryptographic algorithms; wherein the programming languages ​​used by the open source codes include: Java, C / C++, Go, and Python; Code mutation module, used to mutate open source code using Java language; The data set construction module is used to construct a data set of a password misuse detector based on the open source code related to password misuse and the variant open source code using the Java language.

Images