Static stain analysis device and method based on semantic harmless recognition

Abstract

According to the static stain analysis device and analysis method based on semantic harmless recognition, a traditional data flow analysis framework is abandoned, a corresponding pollution propagation rule is formulated, and a pollution path diagram related to a pollution variable relation is abstracted; and a user-defined Sanitizer set is recognized based on semantics, so that the pollution path diagram is further verified and pruned through the Sanitizer set. According to the analysis method, a corresponding pollution path diagram is constructed through a defined pollution propagation rule analysis program, and the device is only focused in a data stream of a stain source and a leakage point, so that the time cost for analyzing redundant nodes and edges is reduced. According to the method, the detection capability and analysis efficiency of static taint analysis on vulnerabilities in the Web application program can be improved, and more accurate input data is provided for subsequent security analysis.

Description

Technical Field

[0001] The present invention relates to the technical field of program static analysis and information security, and in particular to a static taint analysis method and device based on semantic harmless identification. Background Art

[0002] A large number of practical applications have proved that taint analysis technology is significantly effective in software vulnerability detection.

[0003] At present, taint analysis technology can be divided into two categories according to whether the program under inspection is monitored at runtime: static taint analysis and dynamic taint analysis. Among them, dynamic taint analysis can accurately capture the real taint propagation path at runtime by actually running the program, thereby reducing the false alarm rate. However, its disadvantage is that it needs to execute the program itself, which may lead to high running overhead and time consumption, especially when facing large programs or complex input conditions. In addition, dynamic taint analysis needs to cover all possible execution paths, and uncovered paths may lead to missed reports, thus affecting the comprehensiveness of detection; while static taint analysis analyzes possible taint propagation paths in advance based on the source code or intermediate representation of the program. Its advantage is that it does not rely on program operation, so the analysis speed is fast and it is insensitive to input conditions and program size. However, the accuracy of static analysis may be lower because it needs to make assumptions about all possible paths of the program, which may lead to a high false alarm rate. In addition, static analysis tools find it difficult to capture dynamic characteristics at runtime, such as dynamically loaded code or environment-dependent behavior.

[0004] The main research direction of this invention is to develop an improved static taint analysis method for PHP Web applications. A review of the implementation process of the existing traditional static taint analysis method shows that although static taint analysis is widely used in academia and industry due to its high coverage, its accuracy and operating efficiency are not satisfactory. This unsatisfactory performance is specifically manifested in the following two aspects:

[0005] First, the current mainstream taint analysis tools mainly focus on the analysis accuracy, and often ignore the improvement of analysis efficiency. When faced with some complex applications, they are often conservative and tend to build complete control flow graphs, data flow graphs, call graphs and other directed graphs for program code analysis, which contain a large number of edges and nodes that are not related to taints. Excessive focus on accuracy may cause problems such as high analysis costs, slow running speed, running timeouts or program crashes. Generally speaking, the more sensitivity is supported, the higher the analysis accuracy, but the slower the analysis speed. There needs to be a balance between analysis accuracy and analysis speed.

[0006] Secondly, most static taint analysis tools only focus on taint sources and leakage points, and do not care about the needs of analysts to explore and check harmless treatment (Sanitizer). The necessity of paying attention to Sanitizer is that some contaminated data often does not reach the leakage point after being filtered by Sanitizer. Therefore, correctly identifying user-defined Sanitizers and further pruning the contamination path graph based on certain rules can improve the efficiency of the analysis tool and reduce the missed and false positive rates. Summary of the invention

[0007] In view of the problems of low analysis efficiency and low analysis accuracy in the existing static taint analysis methods mentioned in the background technology, the present invention provides a static taint analysis method and device based on semantic harmless identification, abandons the traditional data flow analysis framework, formulates corresponding pollution propagation rules to abstract the pollution path graph related to the pollution variable relationship, and recognizes the user's customized Sanitizer set based on semantics, thereby further verifying and pruning the pollution path graph through the Sanitizer set. The method of the present invention can improve the vulnerability detection capability and analysis efficiency of static taint analysis in Web applications.

[0008] The static taint analysis device based on semantic harmless identification of the present invention mainly comprises: an initial Sanitizer set, a harmless processing detection module connected thereto, the module comprising a natural semantic analysis module and a program semantic analysis module;

[0009] Natural semantic analysis module: Based on the known Sanitizer sets in existing literature and tools (such as PHP official documents, RIPS and phpSAFE, etc.), a predefined initial Sanitizer set is constructed and recorded as InitSann;

[0010] Segment the keywords in InitSan, filter out the frequently appearing negative semantic words, remove the words that may cause false positives, and build a more accurate keyword set keywords;

[0011] Use the filtered keyword set keywords to match the source code of the target program, identify the functions and expressions related to these keywords, and finally identify the suspicious set SusSan of the potential Sanitizer set for further verification and classification by the program semantic analysis module;

[0012] Program semantic analysis module: traverses the functions in the input suspicious set SusSan and constructs a data flow graph (DFG) to determine whether the function has a return value, whether there is an obvious data flow relationship between the return value and the input data, or whether it satisfies the DTF semantic model (DTF is a semantic model defined for data conversion type functions). After confirming that the function has a return value, judge and analyze whether the semantics of the return value has a direct or indirect connection with the input data;

[0013] Specifically, by performing reverse data flow analysis on the return value, the source of the return value is traced to determine its relevance to the input data. If it is relevant, the function is retained, otherwise it is removed from the SusSan set;

[0014] The static taint analysis device also includes a pollution path map generation module, into which a set of taint sources and a set of leakage points are input, and the module includes pollution propagation rules and a pollution path map construction module;

[0015] The pollution propagation rules are as shown in Table 1 below:

[0016] Table 1

[0017]

[0018] The :- symbol represents logical implication. When all predicates on the right side of the :- symbol are true, the contamination propagation relation or predicate of a certain property on the left side of the :- symbol is established. The relevant rules are as follows:

[0019] 1) Taint source determination rules, which define taint source detection methods, where stmt represents a program statement, and sensitive_class_or_function represents the entry point in the program that receives external input or untrusted data. These data may come from user input, network requests, file reading, or environment variables, etc.;

[0020] 2) Tainted variable propagation rules, which define the general propagation methods of tainted variables through assignment, function call, etc.;

[0021] 3) Alias ​​rules, which define how tainted variables are propagated through alias relationships;

[0022] 4) Function calling rules and function return rules, which describe the pollution relationship between variables generated by calling different functions;

[0023] 5) Taint leakage rules, which summarize the methods for detecting leakage points.

[0024] 6) Taint removal judgment rules, used to determine whether the tainted variable has been processed by Sanitizer related statements;

[0025] Taint Path Graph Construction Module: Analyze all statements in the program based on taint propagation rules. When a statement in the program meets a certain taint propagation rule, a taint propagation node is generated or the corresponding statement is replaced. If a new statement that meets the rule is found, the taint path graph (TPG) will continue to expand and iterate until the final statement that meets R8 or R9 is encountered, or all statements are traversed to the end;

[0026] The static taint analysis device also includes a contaminated path pruning and aggregation module, which includes a contaminated path slicing module and a contaminated path aggregation module;

[0027] Tainted path slicing module: extracts the path subset most relevant to potential vulnerabilities from the complete tainted path graph, "slices" the sub-paths, retains the key path parts related to taint propagation, and removes the parts that are not related to vulnerability detection;

[0028] Pollution path aggregation module: aggregates and merges the pollution information propagated from different paths, eliminates the redundant parts between paths, and forms a streamlined and globally consistent pollution propagation view.

[0029] The pollution propagation rules of the present invention are used to discover the pollution source Source, pollution variables and leakage point Sink, and perform semantic judgment while analyzing the source code. For the pollution variable relationship that meets the pollution propagation rules, the corresponding TPG nodes and edges are constructed, and a language similar to Prolog (a programming language based on the logic programming paradigm, mainly used in symbolic computing, knowledge representation and reasoning, etc.) is used to define the pollution propagation rules. Unlike traditional imperative programming languages ​​such as C and Java, Prolog programs usually describe the logical structure and rules of the problem, express logical assertions and queries through facts and rules, and do not explicitly specify the steps executed by the computer. In the context of pollution propagation analysis, the use of Prolog-style rules can intuitively and accurately define how to track sensitive data flows in the program and how to identify potential security vulnerabilities.

[0030] The static stain analysis method based on semantic harmless identification of the present invention includes the above-mentioned static stain analysis device, and the analysis method includes the following steps:

[0031] Step 1: Construction of pollution pathway map;

[0032] Step 2: Identification of Sanitizer;

[0033] Step 3: Verify and prune the contaminated flow.

[0034] The static stain analysis method of the present invention, the construction of the pollution path map described in step 1, specifically comprises the following steps:

[0035] Step 1.1: Predefine the pollution propagation rules according to the Prolog language, as shown in Table 1 above. The pollution propagation rules are used to discover the pollution source Source, pollution variables and leakage points Sink;

[0036] Step 1.2: Analyze all statements in the program based on the predefined pollution propagation rules and Source / Sink lists. When a statement in the program meets a certain rule, a pollution propagation node is generated or the corresponding statement is replaced, and finally a pollution path graph TPG is constructed;

[0037] The pollution path graph is represented as: TPG: = (v∈TaintVertex, p∈TaintPath) two-tuple form for storage,

[0038] in:

[0039] TaintVertex is a taint propagation node, which indicates the code statement corresponding to a taint value propagation in the code. The structure of the node can be described as a four-tuple: TaintVertex: =<number,stmt,path,isSanitizer> ;

[0040] number, which indicates the line number of the statement mapped by the node;

[0041] stmt, represents the program statement of node mapping;

[0042] path is a combination of the class name and method name to which the statement belongs, in the format of className.methodName;

[0043] isSanitizer, used to identify whether the program statement mapped by the node is related to Sanitizer;

[0044] TaintPath is a pollution propagation edge, which represents a pollution propagation behavior between pollution propagation nodes. The structure of the pollution propagation edge can be described as a four-tuple: TaintPath: =<pre_taint,nex_taint,taintway,type> ;

[0045] pre_taint, which indicates the line number of the statement mapped by the node that propagates the taint value;

[0046] nex_taint, which indicates the line number of the statement mapped to the polluted target node;

[0047] taintway, which means the propagation mode of polluted data includes rule types from R1 to R8;

[0048] type, indicating the type of pollution propagation edge;

[0049] At this point, the pollution path map construction step is completed.

[0050] The static taint analysis method of the present invention, the identification of the Sanitizer described in step 2, optimizes the shortcomings of most of the static taint analysis methods mentioned in the background technology. Considering the existing Sanitizer identification method, it simply collects the library function API of the language and constitutes a part of the pollution specification, the false alarm rate is high, and some developer-defined Sanitizer functions and security check statements cannot be identified. Therefore, the Sanitizer identification stage will further screen and construct the Sanitizer set through natural semantic analysis and program semantic analysis on the basis of the existing keyword matching method, thereby improving the accuracy of the Sanitizer set identification to a certain extent, thereby reducing false alarms and missed alarms in vulnerability detection.

[0051] The identification of the Sanitizer described in step 2 includes the following specific steps:

[0052] Step 2.1: In order to design a method that can automatically identify Sanitizers, first collect and classify well-known Sanitizers based on library functions, existing open source web application source codes and known literature, and construct a set of predefined initial Sanitizer sets denoted as InitSan;

[0053] Step 2.2: Segment the functions and statements in InitSan to construct a set of keywords related to the official definition of Sanitizer. Use this set of keywords with Sanitizer characteristics to match the keywords of the inspected PHP source code, thereby obtaining a new and suspicious set of keywords in the source code, recorded as SusSan.

[0054] Step 2.3: In the SusSan set that has been matched with the keyword set, some common high-frequency neutral words such as "to", "get", and "post" often appear. These high-frequency neutral words that are not helpful in building or inferring the Sanitizer are called "stop words", which usually refer to words that have no practical meaning for keyword set extraction in a specific context. Therefore, in SusSan, high-frequency words with negative semantics are selected as keywords, and stop words that are useless for inferring the Sanitizer are removed to improve the effectiveness and accuracy of the analysis;

[0055] Step 2.4: The module constructs a set of SusSan sets related to Sanitier through natural semantic analysis. However, a set based on keyword matching alone may have a high false positive rate. In short, natural semantic analysis cannot accurately capture the actual data conversion function, and most Sanitizers encrypt and filter data. Therefore, in order to accurately identify such data conversion functions, it is necessary to further analyze and filter in combination with program semantics to improve the accuracy and reliability of recognition.

[0056] A semantic model DTF Model is defined for the data conversion type function, which is described as:

[0057]

[0058] Functions that satisfy the DTF Model are considered data transformation type functions;

[0059] First, traverse the functions in SusSan and build a data flow graph (DFG) to determine whether the function has a return value, whether the return value has an obvious data flow relationship with the input data, or whether it satisfies the DTF semantic model. After confirming that the function has a return value, judge and analyze whether the semantics of the return value has a direct or indirect connection with the input data;

[0060] Specifically, by performing reverse data flow analysis on the return value, the source of the return value is traced to determine its relevance to the input data. If it is relevant, the function is retained, otherwise it is removed from the SusSan set;

[0061] At this point, the Sanitizer's identification is complete.

[0062] The static taint analysis method of the present invention, the verification and pruning of the tainted flow described in step 3, first of all, the tainted path graph set TPGs, the tainted path construction module provides the Sanitizer set, and the program semantic analysis module provides it as input, then traverses each path in TPGs, and checks one by one whether each tainted variable in the path is actually accessed by the program execution flow. If a node in the tainted variable path is not triggered or accessed during the execution process, it is determined to be a false path and needs to be removed from the path graph, and a simplified tainted path set (Taint flows) is generated. In the merging process, the paths with the same taint source and leakage point are aggregated according to the similarity of the tainted flows to avoid repeated analysis. The optimized tainted flow set is used for subsequent vulnerability verification or analysis.

[0063] The verification and pruning of the contaminated flow described in step 3 specifically includes the following steps:

[0064] Step 3.1: Through the contaminated path aggregation module, similar or redundant contaminated paths are integrated to generate an aggregation tree containing all path information;

[0065] Specifically, first, the set of contaminated paths is grouped according to the contamination source and the leakage point. For each group of paths, a new tree is created, where the root node of the tree represents the common prefix of the group of paths;

[0066] Next, traverse each node in each path and check whether the node in the current path already exists in the child node of the aggregation tree. If the node already exists, update the current operation point to the existing child node. If the node does not exist, create a new TaintVertex node and use it as the child node of the current operation point. At the same time, update the current operation point to the newly created node. When all path nodes are added to the aggregation tree, insert the aggregation tree into the final aggregation tree set.

[0067] Finally, the constructed aggregation tree is returned;

[0068] Step 3.2: Based on the constructed aggregation tree, matching the tainted paths with SusSan may lead to path explosion, so it is necessary to filter out certain statements that neither change the taint value nor are absolutely irrelevant to harmless processing.

[0069] Beneficial effects of the present invention:

[0070] 1. The present invention proposes an efficient and accurate taint analysis method based on a taint path graph, that is, a corresponding taint path graph is constructed through a defined taint propagation rule analysis program. This method enables the device to focus only on the data stream of the taint source and the leakage point, thereby reducing the time spent on analyzing redundant nodes and edges.

[0071] 2. The present invention proposes a Sanitizer identification method combined with semantic analysis. Specifically, by using the function signature and annotation information of the program for natural language processing (NLP), semantic features related to the Sanitizer function are extracted. At the same time, the calling relationship and data flow path of the function are analyzed to verify its actual security check behavior, thereby significantly improving the recognition ability and accuracy of the developer's customized Sanitizer. This method can effectively reduce the false alarm rate and missed alarm rate of vulnerability detection, and provide more accurate input data for subsequent security analysis.

[0072] 3. The present invention proposes an efficient vulnerability detection method that combines pollution flow verification and aggregation, thereby improving the accuracy of vulnerability detection and the analysis efficiency of the tool. Specifically, in the process of constructing the pollution path graph TPG, potential pollution paths are preliminarily identified. These paths may contain some paths that are not actually executed or have been processed by Sanitizer, but cannot be eliminated in the preliminary analysis stage. To this end, the present invention introduces a pollution flow verification mechanism to further verify the authenticity of the pollution path, and eliminates redundant or false pollution paths, thereby reducing the false alarm rate and improving the accuracy of vulnerability detection. And for redundant or similar pollution paths, the present invention proposes a pollution path aggregation method to integrate multiple similar paths into an aggregation tree containing all path information. Specifically, by analyzing the common prefixes of the pollution paths (i.e., shared pollution sources and sinks), the paths are grouped and an aggregation tree is constructed to avoid repeated analysis of each independent path, significantly optimizing the representation and processing efficiency of the path. This aggregation method reduces unnecessary repeated calculations during the analysis process, reduces the resource consumption of the tool, and ensures the integrity of the pollution path information. BRIEF DESCRIPTION OF THE DRAWINGS

[0073] Figure 1 This is a flow chart of the analysis method based on the analysis device of the present invention;

[0074] Figure 2 This is a diagram of the construction and pruning process of the pollution path diagram in the analysis method of the present invention. DETAILED DESCRIPTION

[0075] The present invention is further described below with reference to the accompanying drawings and embodiments, but the present invention is not limited thereto.

[0076] Example 1

[0077] Static taint analysis device based on semantic harmless identification, such as Figure 1 As shown:

[0078] The dotted box is outside the Preparation part, which mainly completes some preparatory work required for the implementation of the present invention, including predefining pollution propagation rules, pollution specifications, building a corresponding pollution path graph for the inspected program, and pre-building an initial Sanitizer set InitSan. The pollution path graph construction module constructs a corresponding pollution path graph TPG based on the input inspected program code, which is used to represent the potential pollution propagation path in the program, clarify the relationship between pollution sources, pollution variables, intermediate nodes and leakage points, and provide support for path verification, pruning and vulnerability detection of subsequent modules.

[0079] The dotted box contains the core technical solution of the analysis device of the present invention, which mainly includes:

[0080] The initial Sanitizer set, and the harmless processing detection module connected to it, which includes the natural semantic analysis module and the program semantic analysis module;

[0081] Program source code, including function signatures and comments, is used as the input of the module. The natural semantic analysis module extracts all function signatures from the program source code and performs word segmentation on their names. The result of the word segmentation will form a tokens set for subsequent semantic analysis. Stop words (such as "to" and "get") are common words in function names but have little semantic meaning. These words that have no analytical value are filtered out through a predefined stop word list, thereby improving the accuracy of the analysis. Based on the filtered tokens set, negative semantic fragments and other related fragments are added to the keyword set keywords to form a keyword set for identifying suspicious sanitizers. Using the constructed keyword set, the function names in the program are matched, and the functions containing the keywords are identified as the suspicious sanitizer set SusSan for further verification and classification by the program semantic analysis module.

[0082] The program semantic analysis module extracts the local control flow and data flow information of each Sanitizer candidate function from the source code of the inspected program according to the input suspicious set SusSan. First, the corresponding function definition in the source code is located through the function signature (name, parameter type, etc.), and a control flow graph (CFG) is constructed for the candidate function and the directly related functions in its call chain to ensure that the analysis scope covers the function's call point and its internal logic. A local data flow graph (DFG) is constructed for the candidate function. From function parameters, local variables to return values, the read-write relationship and data dependency of each variable in the function are extracted. The constructed CFG and DFG are analyzed using a predefined semantic model (DTF Model) to determine whether the candidate function has the characteristics of a Sanitizer.

[0083] The static taint analysis device also includes a pollution path map generation module, into which a set of taint sources and a set of leakage points are input, and the module includes pollution propagation rules and a pollution path map construction module;

[0084] The pollution broadcast rules are shown in Table 1 in the Summary of the Invention;

[0085] The pollution path graph construction module analyzes all statements in the program based on the pollution propagation rules. When a statement in the program meets a pollution propagation rule, a pollution propagation node is generated or the corresponding statement is replaced. If a new statement that meets the rule is found, the pollution path graph will continue to expand and iterate until the final statement that meets R8 or R9 is encountered, or all statements are traversed to the end.

[0086] The static taint analysis device also includes a contaminated path pruning and aggregation module, which includes a contaminated path slicing module and a contaminated path aggregation module;

[0087] The core function of the Tainted Path Slicing module is to extract the path subset most relevant to potential vulnerabilities from the complete Tainted Path Graph (TPG) through the "slicing" operation, thereby solving the security issues in the positioning program. Specifically, the module implements the following functions:

[0088] "Slice" the subpaths in the complete tainted path graph, retain the critical path parts related to taint propagation, and remove the parts that are not related to vulnerability detection. This allows the analysis tool to focus on the most critical paths when processing larger programs and avoid redundant calculations;

[0089] The core function of the pollution path aggregation module is to aggregate and merge the pollution information propagated from different paths to form a global pollution propagation view. This module mainly implements its functions through the following aspects:

[0090] This module merges the taint information on multiple taint paths, eliminates the redundant parts between paths, and generates a more concise and globally consistent taint path graph. Through this aggregation operation, the number of paths can be reduced, thereby improving the operating efficiency of the analysis tool.

[0091] The taint path aggregation module helps to simplify the complex taint propagation paths in the program and reduce the computational complexity during the analysis process. When facing large-scale programs, it avoids repeated calculations by merging paths, thereby improving the analysis speed of the tool.

[0092] Example 2

[0093] Static taint analysis methods based on semantically harmless identification, such as Figure 1 As shown, the following steps are included:

[0094] Step 1: Construction of pollution pathway map, including:

[0095] Step 1.1: predefine pollution propagation rules according to the Prolog language, as shown in Table 1 in the invention content, and the pollution propagation rules are used to discover the pollution source Source, the pollution variable and the leakage point Sink;

[0096] Step 1.2: Analyze all statements in the program based on the predefined pollution propagation rules and Source / Sink lists. When a statement in the program meets a certain rule, a pollution propagation node is generated or the corresponding statement is replaced, and finally a pollution path graph TPG is constructed.

[0097] Step 2: Identification of Sanitizer, including:

[0098] Step 2.1: In order to design a method that can automatically identify Sanitizers, first collect and classify well-known Sanitizers based on library functions, existing open source web application source codes and known literature, and construct a set of predefined initial Sanitizer sets denoted as InitSan;

[0099] Step 2.2: Segment the functions and statements in InitSan to construct a set of keywords related to the official definition of Sanitizer. Use this set of keywords with Sanitizer characteristics to match the keywords of the inspected PHP source code, thereby obtaining a new and suspicious set of keywords in the source code, recorded as SusSan.

[0100] Step 2.3: In the SusSan set that has been matched with the keyword set, high-frequency words with negative semantics are selected as keywords, and stop words that are useless for inferring the Sanitizer are removed to improve the effectiveness and accuracy of the analysis;

[0101] Step 2.4: Define a semantic model DTF Model for the data conversion type function, described as:

[0102]

[0103] Functions that satisfy the DTF Model are considered data transformation type functions;

[0104] First, traverse the functions in SusSan and build a data flow graph (DFG) to determine whether the function has a return value, whether the return value has an obvious data flow relationship with the input data, or whether it satisfies the DTF semantic model. After confirming that the function has a return value, judge and analyze whether the semantics of the return value has a direct or indirect connection with the input data;

[0105] Specifically, by performing reverse data flow analysis on the return value, the source of the return value is traced and its relevance to the input data is determined. If it is relevant, the function is retained, otherwise it is removed from the SusSan collection.

[0106] Step 3: Verification and pruning of tainted flows. First, the tainted path graph set (TPGs) is provided by the tainted path construction module, and the Sanitizer set is provided by the program semantic analysis module as input. Then, each path in the TPGs is traversed, and each tainted variable in the path is checked one by one to see whether it is actually accessed by the program execution flow. If a node in the tainted variable path is not triggered or accessed during the execution process, it is determined to be a false path and needs to be removed from the path graph. A simplified tainted path set (Taint flows) is generated. During the merging process, paths with the same taint source and leakage point are aggregated according to the similarity of the tainted flows to avoid repeated analysis. The optimized tainted flow set is used for subsequent vulnerability verification or analysis.

[0107] Verification and pruning of polluted flows, including:

[0108] Step 3.1: Through the contaminated path aggregation module, similar or redundant contaminated paths are integrated to generate an aggregation tree containing all path information;

[0109] Specifically, first, the set of contaminated paths is grouped according to the contamination source and the leakage point. For each group of paths, a new tree is created, where the root node of the tree represents the common prefix of the group of paths;

[0110] Next, traverse each node in each path and check whether the node in the current path already exists in the child node of the aggregation tree. If the node already exists, update the current operation point to the existing child node. If the node does not exist, create a new TaintVertex node and use it as the child node of the current operation point. At the same time, update the current operation point to the newly created node. When all path nodes are added to the aggregation tree, insert the aggregation tree into the final aggregation tree set.

[0111] Finally, the constructed aggregation tree is returned;

[0112] Step 3.2: Based on the constructed aggregation tree, matching the tainted paths with SusSan may lead to path explosion, so it is necessary to filter out certain statements that neither change the taint value nor are absolutely irrelevant to harmless processing.

[0113] Example 3

[0114] In this embodiment, the process of constructing and pruning the pollution path graph of a sample program code is described in detail, such as Figure 2 As shown in the figure. There are the same taint sources or leakage points in many programs, and the propagation paths of tainted variables are often very similar. Therefore, by aggregating and pruning the tainted paths, the analysis efficiency can be improved and redundant operations can be reduced.

[0115] The pollution path diagram is shown in 2(b), which is composed of Figure 2 The source code build in (a) shows the process of tainted data propagating from the source() function to different leakage points in the program. In the figure, the three tainted paths show how tainted data propagates through different paths in the program. Although these paths appear independent, their propagation paths partially overlap because they have the same tainted source s and shared intermediate variables a. For example, statements 1, 3, and 4 all appear in these paths, so they can be aggregated in subsequent analysis to avoid repeated processing, thereby improving analysis efficiency.

[0116] In traditional pollution path analysis, each path is processed independently. This method will lead to duplication of work, especially when the program structure is complex. Redundant path processing will significantly increase analysis time and resource consumption. In order to solve this problem, the present invention proposes a pollution path aggregation method. By aggregating the paths of the same pollution source and propagation node, all paths sharing the pollution propagation are simplified into an aggregate structure, avoiding repeated representation and processing of each independent path. Figure 2 (c) However, the aggregated paths obviously still have redundancy, such as Figure 2 (c) The graph nodes marked by the red box. These graph nodes do not change the tainted value of the tainted variable in essence, nor do they make the tainted variable harmless. Therefore, it can be inferred that such statements are not conducive to the matching of the Sanitizer. Based on this finding, by filtering such statements to reduce redundant nodes and paths, the final TPG is as follows: Figure 2 (d) Therefore, it is necessary to filter out certain statements that neither change the taint value nor are absolutely irrelevant to harmless processing. This not only simplifies the structure of the graph, but also improves the efficiency of vulnerability detection.

[0117] Polluted path pruning, Figure 2 The program code in (a) shows the propagation of the pollution source among multiple leakage points (such as statements 7, 11 and 13). Figure 2The ITPG (Inter-procedural Taint Propagation Graph) in (d) shows the propagation process of the tainted path, but many paths will not cause tainted data leakage after being filtered by the Sanitizer, so they need to be eliminated. These paths processed by the Sanitizer should not be counted in the vulnerability detection results because they will not affect the leakage of tainted data. In order to reduce false positives, it is necessary to effectively identify and filter out these harmless paths and prune those paths processed by the Sanitizer. By constructing a tainted path subgraph (SlicedGraph), only tainted paths that are not related to the Sanitizer are retained, thereby removing redundant paths and avoiding false positives. Finally, the redundant paths in the tainted path graph are eliminated to generate an optimized tainted path subgraph, as shown in Figure 2 (e) to improve the accuracy and efficiency of vulnerability detection.

Claims

1. A static taint analysis device based on semantic harmless identification, characterized in that: The analysis device mainly includes: an initial Sanitizer set, a harmless processing detection module connected thereto, the module including a natural semantic analysis module and a program semantic analysis module; Natural semantic analysis module: Based on the known Sanitizer sets in existing literature and tools, a predefined initial Sanitizer set is constructed, denoted as InitSann; Segment the keywords in InitSan, filter out the frequently appearing negative semantic words, remove the words that may cause false positives, and build a more accurate keyword set keywords; Use the filtered keyword set keywords to match the source code of the target program, identify the functions and expressions related to these keywords, and finally identify the suspicious set SusSan of the potential Sanitizer set for further verification and classification by the program semantic analysis module; Program semantic analysis module: traverses the functions in the input suspicious set SusSan and constructs a data flow graph DFG to determine whether the function has a return value and whether there is an obvious data flow relationship between the return value and the input data. After confirming that the function has a return value, judge and analyze whether the semantics of the return value has a direct or indirect connection with the input data, that is, whether it satisfies the DTF semantic model; Specifically, by performing reverse data flow analysis on the return value, tracing the source of the return value, and judging its relevance to the input data, if relevant, the function is retained, otherwise it is removed from the SusSan set; the analysis device also includes a pollution path graph generation module, the pollution source set and the leakage point set are input into the module, and the module includes pollution propagation rules and pollution path graph construction modules; The pollution propagation rules are as shown in Table 1 below: Table 1 The :- symbol represents logical implication. When all predicates on the right side of the :- symbol are true, the contamination propagation relation or predicate of a certain property on the left side of the :- symbol is established. The relevant rules are as follows: 1) The taint source determination rule defines the taint source detection method, where stmt represents a program statement and sensitive_class_or_function represents the entry point in the program that receives external input or untrusted data; 2) Tainted variable propagation rules, which define how tainted variables are propagated through assignment and function calls; 3) Alias ​​rules, which define how tainted variables are propagated through alias relationships; 4) Function calling rules and function return rules, which describe the pollution relationship between variables generated by calling different functions; 5) Taint leakage rules, which summarize the methods for detecting leakage points. 6) Taint removal judgment rules, used to determine whether tainted variables have been processed by Sanitizer related statements; Taint path graph construction module: Analyze all statements in the program based on the taint propagation rules. When a statement in the program meets a certain taint propagation rule, a taint propagation node is generated or the corresponding statement is replaced. If a new statement that meets the rule is found, the taint path graph will continue to expand and iterate until the final statement that meets R8 or R9 is encountered, or all statements are traversed to the end; The analysis device also includes a contaminated path pruning and aggregation module, which includes a contaminated path slicing module and a contaminated path aggregation module; Tainted path slicing module: extracts the path subset most relevant to potential vulnerabilities from the complete tainted path graph, "slices" the sub-paths, retains the key path parts related to taint propagation, and removes the parts that are not related to vulnerability detection; Pollution path aggregation module: aggregates and merges the pollution information propagated from different paths, eliminates the redundant parts between paths, and forms a streamlined and globally consistent pollution propagation view.

2. A static taint analysis method based on semantic harmless identification, comprising the static taint analysis device according to claim 1, characterized in that: The analytical method comprises the following steps: Step 1: Construction of pollution pathway map; Step 2: Identification of Sanitizer; Step 3: Verification and pruning of contaminated flows; The construction of the pollution path map described in step 1 includes the following specific steps: Step 1.1: predefine pollution propagation rules according to the Prolog language, as shown in Table 1 in claim 1, the pollution propagation rules are used to discover the pollution source Source, the pollution variable and the leakage point Sink; Step 1.2: analyze all statements in the program based on the predefined pollution propagation rules and the Source / Sink list, when the statement in the program meets a certain rule, a pollution propagation node is generated or the corresponding statement is replaced, and finally a pollution path graph TPG is constructed; The pollution path graph is represented as: TPG: = (v∈TaintVertex, p∈TaintPath) two-tuple form for storage, where: TaintVertex is a taint propagation node, which indicates the code statement corresponding to a taint value propagation in the code. The structure of the node can be described as a four-tuple: TaintVertex: =<number,stmt,path,isSanitizer> ; number, indicating the line number of the statement mapped by the node; stmt, represents the program statement of node mapping; path is a combination of the class name and method name to which the statement belongs, in the format of className.methodName; isSanitizer, used to identify whether the program statement mapped by the node is related to Sanitizer; TaintPath is a pollution propagation edge, which represents a pollution propagation behavior between pollution propagation nodes. The structure of the pollution propagation edge can be described as a four-tuple: TaintPath: =<pre_taint,nex_taint,taintway,type> ; pre_taint, indicating the line number of the statement mapped by the node that propagates the taint value; nex_taint, which indicates the line number of the statement mapped to the polluted target node; taintway, which means the propagation mode of polluted data includes rule types R1 to R8; type, indicating the type of pollution propagation edge; At this point, the pollution path map construction step is completed; The identification of the Sanitizer described in step 2 includes the following specific steps: Step 2.1: Collect, classify and summarize well-known Sanitizers based on library functions, existing open source web application source codes and known literature, and construct a set of predefined initial Sanitizer sets denoted as InitSan; Step 2.2: Segment the functions and statements in InitSan to construct a set of keywords related to the official definition of Sanitizer. Use this set of keywords with Sanitizer characteristics to match the keywords of the inspected PHP source code, thereby obtaining a new and suspicious set of keywords in the source code, recorded as SusSan; Step 2.3: In the SusSan set that has been matched with the keyword set, select high-frequency words with negative semantics as keywords and remove stop words that are useless for inferring the Sanitizer; Step 2.4: Define a semantic model DTF Model for the data conversion type function, described as: Functions that satisfy the DTF Model are considered data transformation type functions; First, traverse the functions in SusSan and build a data flow graph (DFG) to determine whether the function has a return value, whether the return value has an obvious data flow relationship with the input data, or whether it satisfies the DTF semantic model. After confirming that the function has a return value, judge and analyze whether the semantics of the return value has a direct or indirect connection with the input data; Specifically, by performing reverse data flow analysis on the return value, tracing the source of the return value, and judging its relevance to the input data, if it is relevant, retain the function, otherwise remove it from the SusSan set; for the verification and pruning of the tainted flow described in step 3, first the tainted path graph set TPGs is provided by the tainted path construction module with the Sanitizer set provided by the program semantic analysis module as input, and then each path in TPGs is traversed to check whether each tainted variable in the path is actually accessed by the program execution flow. If a node in the tainted variable path is not triggered or accessed during the execution process, it is judged to be a false path and needs to be removed from the path graph to generate a simplified tainted path set. During the merging process, paths with the same taint source and leakage point are aggregated according to the similarity of the tainted flow to avoid repeated analysis. The optimized tainted flow set is used for subsequent vulnerability verification or analysis.

3. The static taint analysis method based on semantic harmless identification according to claim 2 is characterized in that: The verification and pruning of the contaminated flow described in step 3 specifically includes the following steps: Step 3.1: Through the contaminated path aggregation module, similar or redundant contaminated paths are integrated to generate an aggregation tree containing all path information; Specifically, first, the set of contaminated paths is grouped according to the contamination source and the leakage point. For each group of paths, a new tree is created, where the root node of the tree represents the common prefix of the group of paths; Next, traverse each node in each path and check whether the node in the current path already exists in the child node of the aggregation tree. If the node already exists, update the current operation point to the existing child node. If the node does not exist, create a new TaintVertex node and use it as the child node of the current operation point. At the same time, update the current operation point to the newly created node. When all path nodes are added to the aggregation tree, insert the aggregation tree into the final aggregation tree set. Finally, the constructed aggregation tree is returned; Step 3.2: Based on the constructed aggregation tree, matching the tainted paths with SusSan may lead to path explosion, so it is necessary to filter out certain statements that neither change the taint value nor are absolutely irrelevant to harmless processing.

Images