De-serialization vulnerability detection method and device, computer equipment and storage medium

Abstract

The invention relates to a deserialization vulnerability detection method and device, computer equipment and a storage medium. The method comprises the following steps: identifying a deserialization vulnerability entry in source code data to be detected; identifying a target fragment in the source code data according to the deserialization vulnerability entry; determining multiple types of nodes in the target fragment, and generating a vulnerability utilization relation graph according to the multiple types of nodes; the multi-class nodes comprise class nodes, method nodes and field nodes; and performing fuzzy testing on the target fragment according to the vulnerability utilization relation graph, and determining an available chain. By adopting the method, the deserialization vulnerabilities can be effectively detected.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a deserialization vulnerability detection method, apparatus, computer equipment and storage medium. Background Art

[0002] With the development of the Internet, applications are becoming more and more important and have become the main driving force for online businesses in many fields such as finance, healthcare, and education. However, as the functional interfaces of applications become more and more complex, the security maintenance coverage of applications by many companies has gradually decreased, resulting in more and more potential security vulnerabilities in application components, affecting key businesses in many industries.

[0003] Traditional technology detects deserialization vulnerabilities through manual auditing. However, deserialization vulnerability detection is a complex process and is highly hidden, dynamic, diverse, and adversarial, which makes manual detection methods unable to effectively detect deserialization vulnerabilities. Summary of the invention

[0004] Based on this, it is necessary to provide a deserialization vulnerability detection method, device, computer equipment and readable storage medium that can effectively detect deserialization vulnerabilities in response to the above technical problems.

[0005] In a first aspect, the present application provides a deserialization vulnerability detection method, comprising:

[0006] Identify the deserialization vulnerability entry point in the source code data to be detected;

[0007] Identify the target segment in the source code data based on the deserialization vulnerability entry point;

[0008] Determine multiple types of nodes in the target segment, and generate a vulnerability exploitation relationship graph based on the multiple types of nodes; the multiple types of nodes include class nodes, method nodes, and field nodes;

[0009] Fuzz test the target fragment according to the vulnerability exploitation relationship graph to determine the exploitable chain.

[0010] In one embodiment, identifying a deserialization vulnerability entry in source code data to be detected includes:

[0011] Identify whether there is a preset deserialization method in the source code data to be detected; the preset deserialization method includes at least one of a deserialization method of a development tool file and a deserialization method of a third-party library;

[0012] In the case where there is a preset deserialization method in the source code data, the preset deserialization method is determined as a deserialization vulnerability entry.

[0013] In one embodiment, identifying a target segment in source code data according to a deserialization vulnerability entry includes:

[0014] Perform static analysis on the source code data based on the deserialization vulnerability entry point to obtain fragments starting and ending with methods;

[0015] The fragments starting and ending with a method are determined as target fragments.

[0016] In one embodiment, determining multiple types of nodes in the target segment and generating a vulnerability exploitation relationship graph based on the multiple types of nodes includes:

[0017] Create an initial graph and traverse the target fragment to determine the classes, methods, and fields in the target fragment;

[0018] According to the class, method and field, corresponding class nodes, method nodes and field nodes are added to the initial graph; the class node includes class name information and attribute information associated with the target fragment corresponding to the class name information, the method node includes call information between methods, and the field node includes constraint information associated with the field;

[0019] The class nodes, method nodes and field nodes are connected layer by layer to obtain the chain to be detected corresponding to the target fragment, and the vulnerability exploitation relationship diagram is obtained based on the chain to be detected.

[0020] In one embodiment, a fuzz test is performed on a target segment according to a vulnerability exploitation relationship graph to determine that the exploitable chain includes:

[0021] Generate the initial injection object based on the vulnerability exploitation relationship graph;

[0022] Generate test data based on the constraints of each node in the vulnerability exploitation relationship graph;

[0023] Through the mutation strategy, the initial injection object is mutated according to the nested object structure of the test data and the vulnerability exploitation relationship graph to obtain the mutated object data;

[0024] When the mutated object data is exploitable, the chain to be detected in the vulnerability exploitation relationship graph is determined to be an exploitable chain.

[0025] In one embodiment, the method further comprises:

[0026] Through the mutation strategy, the test feedback information is obtained during the process of mutating the initial injection object according to the test data and the structure of the vulnerability exploitation relationship graph;

[0027] Adjust the mutation strategy based on test feedback.

[0028] In one embodiment, the method further comprises:

[0029] During the fuzz testing process, if the exploitable chain cannot be determined or the test times out, the current test is terminated and the next round of testing begins.

[0030] In a second aspect, the present application also provides a deserialization vulnerability detection device, comprising:

[0031] An entry identification module is used to identify the entry of deserialization vulnerability in the source code data to be detected;

[0032] A fragment identification module is used to identify the target fragment in the source code data according to the deserialization vulnerability entry;

[0033] A relationship graph generation module is used to determine multiple types of nodes in the target segment and generate a vulnerability exploitation relationship graph based on the multiple types of nodes; the multiple types of nodes include class nodes, method nodes, and field nodes;

[0034] The fuzz testing module is used to perform fuzz testing on the target fragment according to the vulnerability exploitation relationship graph to determine the exploitable chain.

[0035] In a third aspect, the present application further provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the following steps are implemented:

[0036] Identify the deserialization vulnerability entry point in the source code data to be detected;

[0037] Identify the target segment in the source code data based on the deserialization vulnerability entry point;

[0038] Determine multiple types of nodes in the target segment, and generate a vulnerability exploitation relationship graph based on the multiple types of nodes; the multiple types of nodes include class nodes, method nodes, and field nodes;

[0039] Fuzz test the target fragment according to the vulnerability exploitation relationship graph to determine the exploitable chain.

[0040] In a fourth aspect, the present application further provides a computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the following steps are implemented:

[0041] Identify the deserialization vulnerability entry point in the source code data to be detected;

[0042] Identify the target segment in the source code data based on the deserialization vulnerability entry point;

[0043] Determine multiple types of nodes in the target segment, and generate a vulnerability exploitation relationship graph based on the multiple types of nodes; the multiple types of nodes include class nodes, method nodes, and field nodes;

[0044] Fuzz test the target fragment according to the vulnerability exploitation relationship graph to determine the exploitable chain.

[0045] In a fifth aspect, the present application further provides a computer program product, including a computer program, which implements the following steps when executed by a processor:

[0046] Identify the deserialization vulnerability entry point in the source code data to be detected;

[0047] Identify the target segment in the source code data based on the deserialization vulnerability entry point;

[0048] Determine multiple types of nodes in the target segment, and generate a vulnerability exploitation relationship graph based on the multiple types of nodes; the multiple types of nodes include class nodes, method nodes, and field nodes;

[0049] Fuzz test the target fragment according to the vulnerability exploitation relationship graph to determine the exploitable chain.

[0050] The above-mentioned deserialization vulnerability detection method, apparatus, computer device, storage medium and computer program product, by determining multiple types of nodes in the target segment, the multiple types of nodes include class nodes, method nodes and field nodes, and generating a vulnerability exploitation relationship graph based on the multiple types of nodes, provides a structured way to understand and display classes, methods, fields and the complex relationships between them, which helps to analyze vulnerabilities and potential exploitation chains more deeply. Fuzz testing is performed on the target segment according to the vulnerability exploitation relationship graph, taking into account the constraints between fields and the nested object structure, improving the pertinence and effectiveness of the fuzz test, thereby improving the effectiveness and accuracy of vulnerability detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0051] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the related technologies, the drawings required for use in the embodiments or the related technical descriptions are briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0052] Figure 1 An application environment diagram of a deserialization vulnerability detection method in an embodiment;

[0053] Figure 2 A schematic diagram of a process of a deserialization vulnerability detection method in one embodiment;

[0054] Figure 3 A schematic diagram of a process of determining multiple types of nodes in a target segment and generating a vulnerability exploitation relationship graph according to the multiple types of nodes in an embodiment;

[0055] Figure 4 A structural block diagram of a deserialization vulnerability detection device in one embodiment;

[0056] Figure 5 FIG. 4 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0057] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0058] Traditional technology detects JAVA deserialization vulnerabilities through manual auditing. However, JAVA deserialization vulnerability detection is a complex process and faces many challenges, including: Concealment: Deserialization vulnerabilities may be hidden in the code of normal functions and are difficult to detect through traditional code review. Complexity: The JAVA ecosystem is huge, with numerous class libraries and frameworks, which increases the complexity of vulnerability detection. Dynamicity: The gadget chain may involve complex dynamic calls, making static analysis more difficult. Diversity: Deserialization vulnerabilities are triggered in various ways and may depend on a specific class loading order or a specific object state. Update frequency: JAVA and its third-party libraries are frequently updated, and new vulnerabilities continue to emerge, requiring detection methods to quickly adapt to new changes. Adversariality: Attackers may use complex techniques to bypass detection, such as using obfuscation, encryption, and other means to hide malicious behavior. Polymorphism: JAVA's polymorphism allows the execution of methods to be determined at runtime, which may mask the true source of the vulnerability and make it more difficult to track and identify the vulnerability. The above challenges make manual detection methods unable to effectively detect deserialization vulnerabilities.

[0059] In order to solve the above problems, a deserialization vulnerability detection method is proposed.

[0060] The deserialization vulnerability detection method provided in the embodiment of the present application can be applied to Figure 1In the application environment shown. Among them, the terminal 102 communicates with the server 104 through the network. The data storage system can store the data that the server 104 needs to process. The data storage system can be integrated on the server 104, or it can be placed on the cloud or other network servers. The terminal 102 sends a deserialization vulnerability detection request to the server 104, and the server 104 identifies the deserialization vulnerability entry in the source code data to be detected, identifies the target segment in the source code data according to the deserialization vulnerability entry, determines the multiple types of nodes in the target segment, and generates a vulnerability exploitation relationship graph according to the multiple types of nodes; the multiple types of nodes include class nodes, method nodes, and field nodes, and then performs fuzzy testing on the target segment according to the vulnerability exploitation relationship graph to determine the exploitable chain. Among them, the terminal 102 can be, but is not limited to, various personal computers, laptops, smart phones, and tablet computers. The server 104 can be implemented with an independent server or a server cluster consisting of multiple servers.

[0061] In an exemplary embodiment, Figure 2 As shown, a deserialization vulnerability detection method is provided, which is applied to Figure 1 The server in the example is used to illustrate, including the following steps 202 to 208. Among them:

[0062] Step 202: Identify the deserialization vulnerability entry in the source code data to be detected.

[0063] The source code data to be detected refers to the code data that needs to be tested for deserialization vulnerabilities. For example, the source code data to be detected can be the source code data of a JAVA application. The deserialization vulnerability entry point refers to the entry point where a vulnerability in the application's deserialization operation is exploited to construct malicious serialized data and inject it into the application, thereby performing unauthorized operations or executing malicious code as an application, causing the system to be attacked.

[0064] Optionally, by identifying whether a deserialization method exists in the source code data to be detected, if a deserialization method exists in the source code data, the identified deserialization method is determined as a deserialization vulnerability entry.

[0065] Step 204: Identify the target segment in the source code data according to the deserialization vulnerability entry.

[0066] Optionally, code semantic analysis is performed on the source code data according to the deserialization vulnerability entry to identify the target segment in the source code data. The target segment is a Gadget segment, which refers to a sequence of method calls that can be exploited during the JAVA deserialization process. These methods can be triggered by externally controlled data, thereby potentially executing malicious behaviors predetermined by the attacker. Gadget segments are the basic units that constitute a more complex vulnerability exploitation chain.

[0067] Step 206, determining multiple types of nodes in the target segment, and generating a vulnerability exploitation relationship graph based on the multiple types of nodes; the multiple types of nodes include class nodes, method nodes, and field nodes.

[0068] Optionally, the target fragments are connected to construct a vulnerability exploitation relationship graph. Specifically, in JAVA deserialization vulnerability detection, the constraint relationship between classes, the constraint relationship between classes and fields, the constraint relationship between fields, and the calling relationship between methods help to discover vulnerabilities to a great extent. In the process of constructing the vulnerability exploitation relationship graph, multiple types of nodes in the target fragment are determined. Multiple types of nodes include class nodes, method nodes, and field nodes. Among them, the class node represents a class, which is the basic structure of an object and is an object type that can be exploited by attackers. The method node represents a method in a class, which is usually a function or procedure, and can be a code snippet used by attackers to perform specific operations. The field node represents a field in a class, which is usually an attribute or variable of the class, which can be used to store data or as part of an attack.

[0069] Connect the class nodes, method nodes and field nodes through directed edges to connect the target fragments and obtain the chain to be detected. According to the chain to be detected, the vulnerability exploitation relationship graph is constructed. The directed edges can be the constraint relationship between nodes. The chain to be detected refers to the gadget chain formed by connecting the gadget fragments.

[0070] Step 208, perform fuzz testing on the target segment according to the vulnerability exploitation relationship graph to determine the exploitable chain.

[0071] Optionally, fuzz testing is a software testing technique that automatically or semi-automatically inputs abnormal or unexpected data into the system in order to discover security vulnerabilities in the software, operating system crashes, or application errors. According to the constraints and nested object structures between fields in the vulnerability exploitation relationship graph, fuzz testing is performed on the target fragment to identify whether the gadget chain is exploitable. If the gadget chain is exploitable, an exploitable chain is obtained, which means that the deserialization vulnerability is identified.

[0072] In the above deserialization vulnerability detection method, by determining multiple types of nodes in the target segment, the multiple types of nodes include class nodes, method nodes and field nodes, and generating a vulnerability exploitation relationship graph based on the multiple types of nodes, a structured way is provided to understand and display classes, methods, fields and the complex relationships between them, which helps to analyze vulnerabilities and potential exploitation chains more deeply. Fuzz testing is performed on the target segment according to the vulnerability exploitation relationship graph, taking into account the constraints between fields and the nested object structure, which improves the pertinence and effectiveness of the fuzz test, thereby improving the effectiveness and accuracy of vulnerability detection.

[0073] In an exemplary embodiment, identifying a deserialization vulnerability entry in source code data to be detected includes: identifying whether a preset deserialization method exists in the source code data to be detected; the preset deserialization method includes at least one of a deserialization method of a development tool file and a deserialization method of a third-party library; in the case that a preset deserialization method exists in the source code data, determining the preset deserialization method as a deserialization vulnerability entry.

[0074] Optionally, the entry point of the deserialization vulnerability refers to the deserialization method. By identifying whether there is a preset deserialization method in the source code data to be detected. The preset deserialization method may include at least one of the deserialization method of the JAVA development tool file and the deserialization method of the third-party library. The deserialization method of the JAVA development tool file refers to the deserialization method that comes with the JAVA JDK.

[0075] In this embodiment, not only the deserialization methods of common development tool files are identified, but also the deserialization methods in third-party libraries are included, providing a more comprehensive vulnerability entry identification method.

[0076] In an exemplary embodiment, identifying a target segment in source code data according to a deserialization vulnerability entry includes: performing static analysis on the source code data according to the deserialization vulnerability entry to obtain segments starting and ending with a method; and determining the segment starting and ending with a method as a target segment.

[0077] Optionally, a Gadget fragment has a start method (header) and an end method (tailer). The start method is usually an entry point that can be called externally, while the end method may be a method that may have a security vulnerability or a dynamic method call pointing to another fragment. Static analysis tools are used to perform static analysis on source code data based on the deserialization vulnerability entry. Static analysis refers to a method that evaluates program quality and discovers potential problems by analyzing source code without running the program. Static analysis is used to discover potential errors, vulnerabilities, coding style, and structural problems in the code. Static analysis usually relies on an in-depth understanding of the syntax and semantics of the source code to find possible violations of programming rules or standards. These rules may include improper use of variables, logical errors, potential memory leaks, etc.

[0078] Through static analysis, the fragments starting and ending with the method are determined, and thus the fragments starting and ending with the method are determined as target fragments.

[0079] In this embodiment, the gadget fragments are automatically identified by using a static analysis tool, which reduces the need for manual analysis and improves efficiency and accuracy.

[0080] In an exemplary embodiment, Figure 3 As shown, determining multiple types of nodes in the target segment and generating a vulnerability exploitation relationship graph according to the multiple types of nodes includes steps 302 to 306. Among them:

[0081] Step 302, create an initial graph, and traverse the target segment to determine the classes, methods and fields in the target segment.

[0082] Step 304, add corresponding class nodes, method nodes and field nodes to the initial graph according to the classes, methods and fields; the class node includes the class name information, the attribute information associated with the target fragment corresponding to the class name information, the method node includes the call information between methods, and the field node includes the constraint information associated with the field.

[0083] Step 306, connect the class nodes, method nodes and field nodes layer by layer to obtain the to-be-detected chain corresponding to the target fragment, and obtain a vulnerability exploitation relationship graph based on the to-be-detected chain.

[0084] Optionally, in the process of constructing the vulnerability exploitation relationship graph, an initial graph is first created. The target segment is traversed to determine the classes, methods, and fields in the target segment. Corresponding class nodes, method nodes, and field nodes are added to the initial graph according to the classes, methods, and fields. The information of the class node includes the class name information, and the attribute information associated with the target segment corresponding to the class name information is added to the initial graph. The attribute information associated with the target segment corresponding to the class name information refers to the attribute information associated with the target segment under the class. The information of the method node includes the call information between the method and other methods. The information of the field node includes the constraint information associated with the field when it is used.

[0085] The class nodes, method nodes and field nodes are connected layer by layer according to the constraint relationship between the nodes to obtain the chain to be detected corresponding to the target fragment, and the vulnerability exploitation relationship diagram is obtained based on the chain to be detected.

[0086] In this embodiment, by determining the classes, methods and fields in the target fragment and constructing corresponding class nodes, method nodes and field nodes, the nodes are connected according to the constraint relationship or call relationship between the nodes, so as to understand and display the classes, methods, fields and the complex relationships between them in a structured manner, which helps to analyze vulnerabilities and potential exploit chains more deeply.

[0087] In an exemplary embodiment, a target segment is fuzz tested according to a vulnerability exploitation relationship graph, and determining an exploitable chain includes: generating an initial injection object according to the vulnerability exploitation relationship graph; generating test data according to the constraints of each node in the vulnerability exploitation relationship graph; mutating the initial injection object according to the test data and the nested object structure of the vulnerability exploitation relationship graph through a mutation strategy to obtain mutated object data; and when the mutated object data is exploitable, determining that the chain to be detected in the vulnerability exploitation relationship graph is an exploitable chain.

[0088] The initial injection object refers to the initial input data set used in the fuzz testing process, which is used to start the fuzz testing process and considers the constraints between fields and the nested object structure. Starting from the root node in the vulnerability exploitation relationship graph, each node is traversed, the constraints are extracted, and the constraint solver is used to generate test data, which is then assigned to the corresponding fields. If a complex constraint that cannot be solved is encountered, a preset value is used instead. For example, the preset value can be a default empirical value.

[0089] Through the mutation strategy, the vulnerability exploitation relationship graph is used to select the target field for mutation, which can reduce the uncertainty of the mutation space. In the mutation process, field dependencies and nested object structures are considered through constraint relationships. The mutation strategy is shown in Table 1 below. Mutation methods can include mutation based on conditional constraints, mutation based on object structure constraints, and mutation based on field dependency constraints. Mutation based on conditional constraints refers to selectively guiding the structural mutation of the injected object. Mutation based on object structure constraints refers to adjusting the object structure to maintain validity. Mutation based on field dependency constraints refers to making minimal modifications to avoid destroying valid information.

[0090] Table 1 Mutation strategy

[0091]

[0092] During the mutation process, when one field is adjusted, other fields affected by this field are checked and adjusted in cascade to maintain the structural validity of the injected object.

[0093] After the mutation object data is obtained, if the convergence point is reached and the malicious instructions are captured to be written, it indicates that the initial injection object is exploitable, and the corresponding Gadget chain is classified as exploitable, that is, the chain to be detected is an exploitable chain.

[0094] In this embodiment, alternative use of empirical values ​​can be achieved: when encountering complex constraints that cannot be solved, the default empirical values ​​are used instead, which ensures the continuity of the test process and avoids test interruptions caused by complex constraints that cannot be solved. Cascade adjustment and validity maintenance: when adjusting fields, other affected fields can be checked and adjusted in cascade, which helps maintain the structural validity of the injected object and increases the possibility of discovering exploitable vulnerabilities. Rapid determination of exploitability: when malicious instructions are captured and written, the exploitability of the gadget chain can be quickly determined, accelerating the generation process of vulnerability exploit code.

[0095] Furthermore, the above method also includes: obtaining test feedback information in the process of mutating the initial object data according to the test data and the structure of the vulnerability exploitation relationship graph through a mutation strategy; and adjusting the mutation strategy according to the test feedback information.

[0096] During the mutation process of the initial injected object, test feedback information of the injected object is obtained. Test feedback information can include the conditions for successfully capturing vulnerabilities or the reasons for failure. Select or adjust the mutation strategy based on the test feedback information. Dynamically adjust the mutation strategy based on the test feedback to make the fuzz testing process more intelligent and adaptable to different test scenarios and requirements.

[0097] Furthermore, the above method also includes: during the fuzz testing process, if the exploitable chain cannot be determined or the test times out, terminating the current test and entering the next round of testing.

[0098] During the fuzz testing process, if the time threshold is exceeded or the exploitable chain cannot be determined, the chain to be tested can be directly determined as a non-exploitable chain, the current test can be terminated, and a new round of testing can be started. By setting the time threshold and judging based on the test results, invalid tests can be terminated in time, saving resources and improving the overall test efficiency. It can also perform iterative testing to continuously optimize and improve the test results, providing a structured, automated and iterative method to improve the efficiency and accuracy of JAVA deserialization vulnerability detection and exploitation.

[0099] It should be understood that, although the various steps in the flowcharts involved in the above-mentioned embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps does not have a strict order restriction, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above-mentioned embodiments can include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0100] Based on the same inventive concept, the embodiment of the present application also provides a deserialization vulnerability detection device for implementing the above-mentioned deserialization vulnerability detection method. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above-mentioned method, so the specific limitations in one or more deserialization vulnerability detection device embodiments provided below can refer to the limitations of the deserialization vulnerability detection method above, and will not be repeated here.

[0101] In an exemplary embodiment, Figure 4 As shown, a deserialization vulnerability detection device is provided, including: an entry identification module 402, a fragment identification module 404, a relationship graph generation module 406 and a fuzzy testing module 408, wherein:

[0102] The entry identification module 402 is used to identify the deserialization vulnerability entry in the source code data to be detected.

[0103] The segment identification module 404 is used to identify the target segment in the source code data according to the deserialization vulnerability entry.

[0104] The relationship graph generation module 406 is used to determine multiple types of nodes in the target segment and generate a vulnerability exploitation relationship graph based on the multiple types of nodes; the multiple types of nodes include class nodes, method nodes and field nodes.

[0105] The fuzz testing module 408 is used to perform fuzz testing on the target segment according to the vulnerability exploitation relationship graph to determine the exploitable chain.

[0106] In an exemplary embodiment, the entry identification module 402 is also used to identify whether there is a preset deserialization method in the source code data to be detected; the preset deserialization method includes at least one of the deserialization method of the development tool file and the deserialization method of the third-party library; when there is a preset deserialization method in the source code data, the preset deserialization method is determined as the deserialization vulnerability entry.

[0107] In an exemplary embodiment, the fragment identification module 404 is also used to perform static analysis on the source code data according to the deserialization vulnerability entry to obtain fragments starting and ending with methods; and determine the fragments starting and ending with methods as target fragments.

[0108] In an exemplary embodiment, the relationship graph generation module 406 is also used to create an initial graph, and traverse the target fragment to determine the classes, methods and fields in the target fragment; add corresponding class nodes, method nodes and field nodes to the initial graph according to the classes, methods and fields; the class node includes class name information, attribute information associated with the target fragment corresponding to the class name information, the method node includes call information between methods, and the field node includes constraint information associated with the field; the class nodes, method nodes and field nodes are connected layer by layer to obtain the chain to be detected corresponding to the target fragment, and the vulnerability exploitation relationship graph is obtained according to the chain to be detected.

[0109] In an exemplary embodiment, the fuzz testing module 408 is also used to generate an initial injection object based on the vulnerability exploitation relationship graph; generate test data based on the constraints of each node in the vulnerability exploitation relationship graph; mutate the initial injection object according to the test data and the nested object structure of the vulnerability exploitation relationship graph through a mutation strategy to obtain mutated object data; and when the mutated object data is exploitable, determine that the chain to be detected in the vulnerability exploitation relationship graph is an exploitable chain.

[0110] In an exemplary embodiment, the method further includes:

[0111] The mutation strategy adjustment module is used to obtain test feedback information during the process of mutating the initial injection object according to the test data and the structure of the vulnerability exploitation relationship graph through the mutation strategy; and adjust the mutation strategy according to the test feedback information.

[0112] In an exemplary embodiment, the method further includes:

[0113] The timeout monitoring module is used to terminate the current test and enter the next round of testing when the exploitable chain cannot be determined or the test times out during the fuzz testing process.

[0114] Each module in the above-mentioned deserialization vulnerability detection device can be implemented in whole or in part by software, hardware, or a combination thereof. Each of the above-mentioned modules can be embedded in or independent of a processor in a computer device in the form of hardware, or can be stored in a memory in a computer device in the form of software, so that the processor can call and execute the operations corresponding to each of the above modules.

[0115] In an exemplary embodiment, a computer device is provided. The computer device may be a server, and its internal structure diagram may be as shown in FIG. Figure 5 As shown. The computer device includes a processor, a memory, an input / output interface (Input / Output, referred to as I / O) and a communication interface. Among them, the processor, the memory and the input / output interface are connected through a system bus, and the communication interface is connected to the system bus through the input / output interface. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store data such as vulnerability exploitation relationship diagrams and exploitable chains. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a deserialization vulnerability detection method is implemented.

[0116] Those skilled in the art will understand that Figure 5 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0117] In one embodiment, a computer device is provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the steps in the above-mentioned method embodiments when executing the computer program.

[0118] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps in the above method embodiments are implemented.

[0119] In one embodiment, a computer program product is provided, including a computer program, which implements the steps in the above method embodiments when executed by a processor.

[0120] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant regulations.

[0121] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetoresistive random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, etc., but are not limited to this.

[0122] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0123] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A deserialization vulnerability detection method, characterized in that: The method comprises: Identify the deserialization vulnerability entry point in the source code data to be detected; Identify a target segment in the source code data according to the deserialization vulnerability entry; Determine multiple types of nodes in the target segment, and generate a vulnerability exploitation relationship graph according to the multiple types of nodes; the multiple types of nodes include class nodes, method nodes, and field nodes; The target segment is fuzz tested according to the vulnerability exploitation relationship graph to determine an exploitable chain.

2. The method according to claim 1, characterized in that The identification of the deserialization vulnerability entry in the source code data to be detected includes: Identify whether there is a preset deserialization method in the source code data to be detected; the preset deserialization method includes at least one of a deserialization method of a development tool file and a deserialization method of a third-party library; In the case where a preset deserialization method exists in the source code data, the preset deserialization method is determined as a deserialization vulnerability entry.

3. The method according to claim 1, characterized in that The identifying the target segment in the source code data according to the deserialization vulnerability entry includes: Performing static analysis on the source code data according to the deserialization vulnerability entry to obtain a fragment starting and ending with a method; The fragments starting and ending with the method are determined as target fragments.

4. The method according to claim 1, characterized in that: Determining multiple types of nodes in the target segment and generating a vulnerability exploitation relationship graph according to the multiple types of nodes includes: Creating an initial graph and traversing the target segment to determine the classes, methods, and fields in the target segment; According to the classes, methods and fields, corresponding class nodes, method nodes and field nodes are added to the initial graph; the class nodes include class name information and attribute information associated with the target fragment corresponding to the class name information, the method nodes include call information between methods, and the field nodes include constraint information associated with the field; The class nodes, the method nodes and the field nodes are connected layer by layer to obtain a chain to be detected corresponding to the target fragment, and a vulnerability exploitation relationship graph is obtained according to the chain to be detected.

5. The method according to claim 1, characterized in that The performing fuzz testing on the target segment according to the vulnerability exploitation relationship graph to determine the exploitable chain comprises: Generate an initial injection object according to the vulnerability exploitation relationship graph; Generate test data according to the constraint conditions of each node in the vulnerability exploitation relationship graph; By using a mutation strategy, the initial injection object is mutated according to the test data and the nested object structure of the vulnerability exploitation relationship graph to obtain mutated object data; In the case that the mutated object data is exploitable, the chain to be detected in the vulnerability exploitation relationship graph is determined to be an exploitable chain.

6. The method according to claim 5, characterized in that The method further comprises: In the process of mutating the initial injection object according to the test data and the structure of the vulnerability exploitation relationship graph through a mutation strategy, test feedback information is obtained; The mutation strategy is adjusted according to the test feedback information.

7. The method according to claim 5, characterized in that The method further comprises: During the fuzz testing process, if the exploitable chain cannot be determined or the test times out, the current test is terminated and the next round of testing begins.

8. A deserialization vulnerability detection device, characterized in that: The device comprises: An entry identification module is used to identify the entry of deserialization vulnerability in the source code data to be detected; A fragment identification module, used to identify a target fragment in the source code data according to the deserialization vulnerability entry; A relationship graph generation module, used to determine multiple types of nodes in the target segment, and generate a vulnerability exploitation relationship graph according to the multiple types of nodes; the multiple types of nodes include class nodes, method nodes and field nodes; The fuzzy testing module is used to perform fuzzy testing on the target segment according to the vulnerability exploitation relationship graph to determine an exploitable chain.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images