Static full-system taint source analysis method and system

Abstract

The invention discloses a static full-system taint source analysis method and system. The method comprises the following steps: acquiring a static representation of a source code; extracting a propagation rule of the control flow, and searching to obtain at least one global propagation path; iteratively analyzing variable introduction in a code statement of the precursor node in the global propagation path, and determining a pollution source node; when the code statement contains the pointer assignment, executing an alias acquisition algorithm; when it is judged that the precursor node is a terminal node, taint source analysis on the global propagation path is terminated; and traversing all global propagation paths, and outputting a pollution source node set. According to the method, paths irrelevant to taint analysis are effectively filtered out by combining reverse and forward search propagation paths on the basis of a propagation rule of a control flow. According to the method, global pollution source information is obtained by combining intra-process and inter-process analysis methods, precursor node calculation and alias acquisition are fused in a propagation path, and how taint data influence a global program state can be tracked, so that all taint sources are effectively determined.

Description

Technical Field

[0001] The present invention relates to the field of taint analysis, and in particular to a static full-system taint source analysis method and system. Background Art

[0002] Taint analysis is one of the most effective methods for detecting software security vulnerabilities. Some software defects originate from certain external input data. Analyzing the taint source and the data flow propagation information from the taint source to the defect point through static analysis methods helps to understand the causes of software defects and reduce the difficulty of debugging software defects.

[0003] Current taint analysis techniques mainly rely on specific taint models for static taint analysis, with a focus on web applications and Android applications. Most existing techniques first build directed graphs based on program code, such as control flow graphs and data flow graphs, and then perform reachability analysis on these graphs to obtain taint propagation paths and issue alerts for detected taint leaks. These methods mainly focus on analyzing the taint propagation process rather than identifying potential taint sources that may cause security vulnerabilities. Due to the "ripple effect", directly applying taint propagation methods to taint source analysis rules may generate a large number of irrelevant nodes and edges, which unnecessarily increases the time and memory overhead of the analysis process. In addition, these analysis techniques do not provide formal analysis algorithms for target points in the program or nodes in the control flow graph. Summary of the invention

[0004] In view of the problems existing in the above-mentioned prior art, the present invention provides a static full-system taint source analysis method and system, the purpose of which is to combine intra-process and inter-process analysis methods to obtain global taint source information, integrate predecessor node calculation and alias analysis in the propagation path, and effectively reduce the negative impact of irrelevant code on taint analysis performance. This method can not only help detect errors that lead to vulnerabilities, but also analyze the impact of vulnerable input data on the system.

[0005] To achieve the above object, the present invention provides the following technical solutions:

[0006] In a first aspect, the present invention provides a static system-wide taint source analysis method, comprising:

[0007] Perform static program modeling on the source code file containing the tainted data to obtain a static representation of the source code;

[0008] Extracting a control flow propagation rule based on the static representation of the source code, starting from the current tainted node, obtaining at least one global propagation path based on the control flow propagation rule by searching nodes in a reverse direction and searching directed edges in a forward direction;

[0009] In the global propagation path, iteratively analyze the variable introduction in the code statement of the predecessor node of the tainted node to determine the pollution source node;

[0010] Among them, when the code statement of the current driver node contains a pointer type assignment, the alias acquisition algorithm is executed;

[0011] When the predecessor node is determined to be the terminal node, the taint source analysis on the global propagation path is terminated;

[0012] Traverse all global propagation paths of tainted nodes and output the set of tainted source nodes.

[0013] Preferably, the static program modeling method includes but is not limited to lexical analysis, syntax analysis, intermediate code generation, and program dependency analysis, and the static representation of the source code includes at least an abstract syntax tree, a control flow graph, a function call graph, a global variable information table, and a function summary.

[0014] Preferably, the function call graph uses two HashMap data structures to store function call relationship information, which is expressed in the form of "<function name, called function list>" and "<function name, calling function list>"; wherein the "function name" is stored in the String type, and the "called function list" and the "calling function list" are stored in the ArrayList data structure.

[0015] Preferably, the propagation rule based on the control flow acquires at least one global propagation path by reversely searching nodes and forwardly searching directed edges, including:

[0016] Based on the control flow graph, search from the current tainted node to obtain at least one intra-process propagation path;

[0017] If the code statement of the current tainted node is a function call statement or contains a global variable, a plurality of intra-process propagation paths are obtained by jumping to the control flow graph of the corresponding function based on the function call graph and the global variable information table;

[0018] Splice at least one intra-process propagation path to obtain the global propagation path of the tainted node;

[0019] Wherein, searching and obtaining at least one intra-process propagation path starting from the current tainted node based on the control flow graph includes:

[0020] (41) Obtain the control flow graph of the current tainted node and multiple processes;

[0021] (42) The nodes in the control flow graph are divided into levels based on the execution order of the code, and the nodes connected by directed edges starting from the same node are considered to be of the same level;

[0022] (43) Identify loops in the control flow graph;

[0023] (44) determining the directed edge terminating at the current tainted node on the control flow graph;

[0024] (45) If there is no directed edge, add the current tainted node to the target node set and then execute step (410); otherwise, execute step (46);

[0025] (46) If there is at least one directed edge, obtain the highest-level node P connected by each of the directed edges, and determine the maximum cycle A that includes both the node P and the current tainted node;

[0026] (47) Obtain all loops that can be formed by each node on the loop A layer by layer to form a loop set, remove the loop that does not contain the current tainted node in the loop set, and obtain the target loop set;

[0027] (48) Add all nodes in the target loop set to the target node set, where each node is recorded only once;

[0028] (49) Return the highest-level node in the target loop set as a new tainted node to execute step (44);

[0029] (410) Connect the nodes in the target node set that have directed edges with each other to obtain at least one intra-process propagation path.

[0030] Preferably, the alias acquisition algorithm starts from the polluted object on the left side of the assignment statement of the current predecessor node, and searches upward for the polluted aliases associated with the polluted object to construct alias sets of different categories until reaching the starting node of the polluted object scope;

[0031] The elements in the alias set are composed of five-tuple τ, expressed as

[0032] τ=<Var1,Scope1,Var2,Scope2,Pos>

[0033] Among them: Var1 represents a pointer; Scope1 corresponds to the scope of the pointer Var1; Var2 is the variable pointed to by the pointer; Scope2 corresponds to the scope of Var2; Pos is the line information of the statement that assigns the address information of Var2 to Var1;

[0034] The different categories of alias sets refer to sets formed by aliases of different scopes, including global scope and local scope.

[0035] Preferably, the steps of the alias acquisition algorithm include:

[0036] (61) obtaining a target variable pointed to by a pointer in a pointer type assignment statement of the current predecessor node; if the variable pointed to by the pointer is a structure or a nested variable, decomposing the variable pointed to by the pointer into multiple sub-variables, and using the multiple sub-variables as multiple target variables;

[0037] (62) Obtaining scope information of the target variable based on the global variable information table;

[0038] (63) If the target variable of the current predecessor node is a local scope variable, then in the current function, determine the target statement when the target variable is on the right side of the assignment statement;

[0039] Obtain the line number of the target statement and the variable name on the left side of the target statement, and store them in an alias set;

[0040] (64) If the target variable of the current predecessor node is a global scope variable, the target function that uses the target variable is retrieved from the global variable information table;

[0041] In each objective function, determine the objective statement when the objective variable is on the right side of the assignment statement;

[0042] The line number where the target is located and the variable name on the left side of the target statement are obtained and stored in an alias set.

[0043] Preferably, the method for determining the end node is:

[0044] (71) Determine whether the code statement of the predecessor node is a definition statement;

[0045] If yes, the predecessor node is the terminal node; otherwise, execute step (72);

[0046] (72) Determine whether the code statement of the predecessor node is an assignment statement;

[0047] If yes, identify the type of each data on the right side of the assignment operator according to the data source;

[0048] (73) The predecessor node is a terminal node only when all the data on the right side of the assignment operator of the code statement are of the terminal type; the terminal type includes the input value and the initialization value.

[0049] Preferably, the analysis of the predecessor nodes includes intra-process predecessor node analysis and inter-process predecessor node analysis;

[0050] The intra-process predecessor node analysis is to determine the intra-process predecessor node through all the starting nodes connected by the edges pointing to the current node in the control flow graph;

[0051] In the global propagation path, when the code statement of the predecessor node involves a function call or a global variable, an inter-procedural predecessor node analysis is performed based on the function call graph and the global variable information table.

[0052] Preferably, the output pollution source node set includes:

[0053] PN n (T) ∪PN n (NT) =PN n

[0054] PN0=F(tp)

[0055] PN1=G(PN0 (NT) )

[0056] PN n =F(PN n-1 (NT) )

[0057] Source = PN0 (T) ∪PN1 (T) ∪…∪PN n (T)

[0058] Among them, PN n represents the pollution source node obtained from the analysis of the nth predecessor node, where PN n (T) Indicates the end node in the nth analysis result, PN n (NT) Represents the non-terminal node in the nth analysis result; tp represents the tainted node containing tainted data, F represents the method of calculating the intra-process and inter-process predecessor nodes in the propagation path, and Source represents the set of pollution source nodes.

[0059] In a second aspect, the present invention provides a static system-wide taint source analysis system, comprising:

[0060] A static modeling module, used for performing static program modeling on source code files containing tainted data to obtain a static representation of the source code;

[0061] A propagation path calculation module extracts the propagation rules of the control flow based on the static representation of the source code, and starts from the current tainted node, and obtains at least one global propagation path based on the propagation rules of the control flow by searching the nodes in a reverse direction and searching the directed edges in a forward direction;

[0062] A predecessor node analysis module, used for iteratively analyzing the variable introduction in the predecessor node code statement of the tainted node in the global propagation path to determine the pollution source node;

[0063] An alias acquisition module, used to execute an alias acquisition algorithm when it is determined that the code statement of the predecessor node contains a pointer type assignment;

[0064] The taint source output module is used to terminate the taint source analysis on the propagation path when the predecessor node is determined to be the terminal node; traverse all propagation paths of the taint node and output the taint source node set.

[0065] The static whole-system taint source analysis method and system of the present invention have the following beneficial effects:

[0066] 1. The present invention first determines a propagation path calculation method for taint source analysis, which uses the propagation rules of control flow to track the propagation path of the taint source in the function, focusing on the taint source analysis path on the control flow graph, and aims to track the propagation path of untrusted data in the program. Through reachability analysis, the calculation of the propagation path effectively filters out the paths that are not related to the taint analysis. And in the subsequent analysis of the global propagation path, the calculation of the taint source within the process and between processes is integrated, providing a new solution for system-level taint analysis.

[0067] 2. The present invention proposes an alias acquisition algorithm to capture the tainted aliases generated during the taint propagation process. By constructing an alias set, collecting the reference relationship between global variables, and the address transfer between function parameters, it helps to reduce the false negatives caused by tainted aliases. After the alias acquisition algorithm is completed, it returns the alias set acquired by the contaminated variable to the taint source search algorithm to continue to build the global propagation path. Combining the alias acquisition algorithm with the propagation search algorithm instead of a completely independent alias analysis algorithm reduces the algorithm complexity and the additional overhead of a separate alias analysis, thereby improving the overall taint source analysis efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0068] Figure 1 It is a schematic flow chart of a static system-wide contamination source analysis method of the present invention;

[0069] Figure 2 It is a program code diagram provided by an embodiment of the present invention;

[0070] Figure 3 It is a schematic diagram of a control flow graph of a program provided by an embodiment of the present invention;

[0071] Figure 4 It is a schematic diagram of a process of obtaining an alias of a section of code provided by an embodiment of the present invention;

[0072] Figure 5 It is a structural block diagram of a static full-system contamination source analysis system of the present invention. DETAILED DESCRIPTION

[0073] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0074] To facilitate understanding of this embodiment, a static system-wide taint source analysis method disclosed in an embodiment of the present invention is first described in detail. Figure 1 As shown, including:

[0075] Perform static program modeling on the source code file containing the tainted data to obtain a static representation of the source code;

[0076] Extracting a control flow propagation rule based on the static representation of the source code, starting from the current tainted node, obtaining at least one global propagation path based on the control flow propagation rule by searching nodes in a reverse direction and searching directed edges in a forward direction;

[0077] In the global propagation path, iteratively analyze the variable introduction in the code statement of the predecessor node of the tainted node to determine the pollution source node;

[0078] Among them, when the code statement of the current driver node contains a pointer type assignment, the alias acquisition algorithm is executed;

[0079] When the predecessor node is determined to be the terminal node, the taint source analysis on the global propagation path is terminated;

[0080] Traverse all global propagation paths of tainted nodes and output the set of tainted source nodes.

[0081] This method first determines the code file containing tainted data from the taint information report, reports the code statement with data errors or defects as the initial taint node, extracts the variables involved, analyzes which untrusted or harmful data these variables come from, which are the intermediate taint nodes, and iteratively searches the initial input position of the taint node to obtain the pollution source. The program code is first converted into the static representation required for taint analysis. The static representation contains the propagation rules of data flow and control flow, from which the global propagation path is extracted, and the predecessor node is iteratively analyzed in the global propagation path. By traversing the abstract syntax tree (AST) or control flow graph (CFG) of the program, all statements that may affect the propagation of taint are found, so that the source input of the taint can be traced back through these nodes. When the predecessor node on the propagation path is determined to be a terminal symbol, the analysis ends. This method searches the source node from the taint in reverse to avoid the problem that the sink analysis will cause path explosion. By combining the intra-procedural and inter-procedural analysis methods, the global pollution source information is obtained, and the predecessor node calculation and alias analysis are integrated in the propagation path, which effectively reduces the negative impact of irrelevant code on the performance of taint analysis.

[0082] It should be understood that as a preprocessing operation for taint source analysis, the static representation of source code refers to the abstract representation of data structure and information flow propagation. The calculation of the propagation path described below involves the analysis process of control flow, and the program code analysis of the predecessor node involves the analysis process of data flow.

[0083] Preferably, the static program modeling method includes but is not limited to lexical analysis, syntax analysis, intermediate code generation, and program dependency analysis, and the static representation of the source code includes at least an abstract syntax tree, a control flow graph, a function call graph, a global variable information table, and a function summary.

[0084] In one implementation, an abstract syntax tree is first constructed for the target project, and a control flow graph is obtained by traversing the syntax tree. The control flow graph clearly visualizes the control flow between different code blocks in the program, including conditional branches, loops, etc.

[0085] Next, in order to support cross-function and cross-file inter-procedural taint source analysis, it is necessary to calculate and store the function call relationship of the entire software system. In this embodiment, a HashMap data structure is used to store function call relationship information. Two HashMaps can accurately record the relationship between the calling function and the called function, which are "<function name, called function list>" and "<function name, calling function list>". For a function in a program, its function name is stored as a variable of type String, and the list of called functions contains other functions called in the function. The called function list is stored using an ArrayList data structure. The elements in the calling function list are all other functions that call this function in the program, and are also stored using an ArrayList data structure. In the process of building the function call relationship, when a library function is encountered, the analysis will stop.

[0086] At the same time, when analyzing taint propagation, it is crucial to consider the impact of global variables on the entire program execution process to fully evaluate potential security risks. If the global variables of a program contain potential taints (or untrusted data), these taints may propagate to different functions or modules during program execution, so a global variable information table needs to be established for analysis. On the abstract syntax tree and control flow graph, whether a variable is a global variable is determined based on the declaration, scope, and whether the global variable is used or modified in multiple functions. First, the global variables are collected in the abstract syntax tree and stored in the global variable table, and then the global variable information table is combined with the control flow graph node information of each function to determine which functions have modified these variables. After analyzing all files in a project, a summary of global variable usage information can be obtained. Similar to the function call graph, an ArrayList data structure is used to store information about which functions and on which lines these global variables are used. Since each global variable may be used in multiple functions, a HashMap is used to store this information. The key of the HashMap is each global variable, and the value is an ArrayList containing information about the functions that use this variable.

[0087] As a preferred implementation, this method obtains the propagation path within a function by connecting points on a control flow graph. At the same time, the paths passing through different functions are merged through a function call graph or global variable information, namely:

[0088] Based on the control flow graph, search from the current tainted node to obtain at least one intra-process propagation path;

[0089] If the code statement of the current tainted node is a function call statement or contains a global variable, a plurality of intra-process propagation paths are obtained by jumping to the control flow graph of the corresponding function based on the function call graph and the global variable information table;

[0090] At least one intra-process propagation path is spliced ​​to obtain the global propagation path of the tainted node.

[0091] Wherein, searching and obtaining at least one intra-process propagation path starting from the current tainted node based on the control flow graph includes:

[0092] (41) Obtain the control flow graph of the current tainted node and multiple processes;

[0093] (42) The nodes in the control flow graph are divided into levels based on the execution order of the code, and the nodes connected by directed edges starting from the same node are considered to be of the same level.

[0094] As an example, Figure 2 A section of program code is shown, and a control flow graph of the program code is drawn as follows Figure 3 As shown in the figure, the control flow graph is divided into six levels according to the execution order of the code, with the highest being level 1 and the lowest being level 6. For example, two nodes 3 and 4 connected by a directed edge starting from the same node 2 are at the same level 3.

[0095] (43) Identify loops in the control flow graph.

[0096] It should be noted that when determining the loop in step (43) of the method, the directedness of the control flow graph is ignored, and the nodes that can form a ring connection form a loop, such as Figure 3 The middle nodes 5, 7, 8, and 9 form a loop, and 4, 5, 8, 9, and 6 form a loop.

[0097] (44) Determine the directed edge terminating at the current tainted node on the control flow graph.

[0098] (45) If there is no directed edge, add the current tainted node to the target node set and then execute step (410); otherwise, execute step (46).

[0099] For example, if node 1 is analyzed as a tainted node, there is no directed edge terminating at it, and node 1 is the tainted source node and is directly output.

[0100] (46) If there is at least one directed edge, obtain the highest-level node P connected by each of the directed edges, and determine the maximum cycle A that includes both the node P and the current tainted node;

[0101] For example, in this embodiment, node 9 is analyzed as a tainted node, and the directed edge ending at the current tainted node 9 has four directed edges, namely, f, j, k, and i. Among the starting nodes of these four directed edges, the starting node 3 of edge f is level 3, the starting node 7 of edge j is level 5, the starting node 8 of edge k is level 5, and the starting node 6 of edge i is level 4. Therefore, the node with the highest level is 3 (level 3). That is, in this embodiment, the largest loop A is a loop composed of edges bfiec, involving nodes 2, 3, 4, 6, and 9.

[0102] (47) Obtain all loops that can be formed by each node on the loop A layer by layer to form a loop set, remove the loops in the loop set that do not contain the current tainted node, and obtain the target loop set.

[0103] Specifically, in this embodiment, the loop formed by node 2 on loop A has bfiec, the loop formed by node 3 has bfiec, the loop formed by node 4 has bfiec and dhkie, and the loop formed by node 6 has bfiec and dhkie.

[0104] Then we go to the next layer, where nodes 5 and 8 involved in loop dhkie are components of loop ghkj.

[0105] In this embodiment, loops bfiec, dhkie, and ghkj form a loop set, all of which contain the current tainted node 9, so these are also the target loop sets.

[0106] (48) Add all nodes in the target loop set to the target node set, where each node is recorded only once. Figure 3 The target cycle set in includes nodes 2, 3, 4, 5, 6, 7, 8, and 9, which are added to the target node set.

[0107] (49) Return the highest-level node in the target loop set as a new tainted node to execute step (44);

[0108] In this embodiment, the highest level node in the target loop set is 2, which is used as a new tainted node, and the search step is performed cyclically. The node search is in reverse direction, and the connection of the directed edge is in forward direction.

[0109] (410) Connect the nodes in the target node set that have directed edges with each other to obtain at least one intra-process propagation path.

[0110] Since this method is a code-based path search process, the focus is on determining the source of the tainted node rather than strictly determining the order of the path. Therefore, if the depth-first algorithm in conventional technology is used, the same path will be searched multiple times, for example Figure 3 When searching for node 9, searching from nodes 7 and 8 will duplicate the path dca. However, this method directly determines the nodes above the tainted node, and then connects the nodes in the order of the directed graph. Since the path is determined, there is no need to deduce the construction of the specific path, which can effectively remove the search of the path involving irrelevant nodes and improve the search efficiency.

[0111] A tainted node can contain multiple data, each of which comes from a different source, and multiple global paths may be searched. m In the analysis, n+1 function jumps are executed, and the global propagation path is constructed as follows:

[0112]

[0113] in, Represents the intra-function propagation path in the n+1th function.

[0114] Propagation path search is the basis of taint source analysis. The purpose of finding the path is to understand how sensitive data propagates in the program and determine the contaminated areas it may affect. Finding the propagation path can reveal potential security risks, such as data leakage, injection attacks, etc. In this method, a method for obtaining the propagation path of the entire system is proposed. When function jumps and global variables are found on the path, the algorithm can track how the tainted data propagates between functions and how it affects the program state globally. At the same time, the reverse search alleviates the problem of path explosion, so that the critical path can be identified more effectively.

[0115] This method focuses on source code analysis of the C programming language. In C language programs, due to the nature of pointer types, different variable names may point to the same actual object, resulting in aliasing problems. Specifically, when a contaminated variable or contaminated object is propagated (assigned) to another object through a pointer, alias analysis needs to begin.

[0116] Preferably, the alias acquisition algorithm starts from the polluted object on the left side of the assignment statement of the current predecessor node, and searches upward for the polluted aliases associated with the polluted object to build alias sets of different categories until the starting node of the polluted object scope is reached; each time a polluted alias is found in this process, a new polluted alias acquisition is triggered. The new polluted alias acquisition algorithm also follows the start and end rules of the above algorithm. The pollution search association algorithm takes into account all elements in the pollution alias set and the propagation range, including all pollution aliases and original pollution variables.

[0117] The elements in the alias set are composed of five-tuple τ, expressed as

[0118] τ=<Var1,Scope1,Var2,Scope2,Pos>

[0119] Among them: Var1 represents a pointer; Scope1 corresponds to the scope of the pointer Var1; Var2 is the variable pointed to by the pointer; Scope2 corresponds to the scope of Var2; Pos is the line information of the statement that assigns the address information of Var2 to Var1;

[0120] The different categories of alias sets refer to sets formed by aliases of different scopes, including global scope and local scope.

[0121] Preferably, the steps of the alias acquisition algorithm include:

[0122] (61) Obtain the target variable pointed to by the pointer in the pointer type assignment statement of the current predecessor node; wherein the target variable is the variable at the address pointed to by the pointer.

[0123] If the variable pointed to by the pointer is a structure or a nested variable, the variable pointed to by the pointer is decomposed into multiple sub-variables, and the multiple sub-variables are used as multiple target variables;

[0124] (62) Obtaining scope information of the target variable based on the global variable information table;

[0125] (63) If the target variable of the current predecessor node is a local scope variable, then in the current function, determine the target statement when the target variable is on the right side of the assignment statement;

[0126] Obtain the line number of the target statement and the variable name on the left side of the target statement, and store them in an alias set;

[0127] (64) If the target variable of the current predecessor node is a global scope variable, the target function that uses the target variable is retrieved from the global variable information table;

[0128] In each objective function, determine the objective statement when the objective variable is on the right side of the assignment statement;

[0129] The line number where the target is located and the variable name on the left side of the target statement are obtained and stored in an alias set.

[0130] Once a set of tainted aliases exists, all elements in the set must be considered in the subsequent taint source analysis. These aliases should be considered tainted within their respective scopes in order to find all taint sources. Static taint analysis including alias analysis is implemented by integrating the alias acquisition algorithm as a sub-algorithm into the taint source search algorithm. The taint source search algorithm calls the alias acquisition algorithm to obtain the necessary tainted aliases. After obtaining the tainted aliases, the original tainted variables and aliases are further analyzed. After the alias acquisition algorithm is completed, it returns the alias set obtained by the tainted variable to the taint source search algorithm to continue to build the taint propagation path. Combining the alias acquisition algorithm with the taint source search algorithm instead of a completely independent alias analysis algorithm reduces the algorithm complexity and the additional overhead of a separate alias analysis, thereby improving the overall taint analysis efficiency.

[0131] like Figure 4 As shown, this implementation provides the alias acquisition process in the taint source analysis of a piece of code:

[0132] 1. The taint source analysis algorithm identifies the tainted variable "taintAAlias.s.taintString" and finds that the tainted variable propagates to the object field "taintAAlias", triggering the alias acquisition algorithm.

[0133] 2. The alias acquisition algorithm identifies the pointer variable "taintA" corresponding to "taintAAlias".

[0134] 3. No other aliases for "taintAAlias" are found, and the alias acquisition algorithm terminates.

[0135] 4. The taint search association algorithm identifies the tainted object "taintA.s" that originates from the object "taintBAlias", thereby initiating the alias acquisition algorithm.

[0136] 5. The alias acquisition algorithm identifies the pointer variable "taintB" corresponding to "taintBAlias".

[0137] 6. No other aliases for "taintBAlias" are found, and the alias acquisition algorithm terminates.

[0138] 7. It is found that the variable "t" is propagated to the object field "taintB.taintString".

[0139] 8. The variable "t" is derived from the taint source "taintSource()", completing the source analysis.

[0140] In the data flow-based taint source analysis, when the end node is encountered during the backward traversal along a propagation path, the source analysis on the path is terminated. Preferably, the method for determining the end node is:

[0141] (71) Determine whether the code statement of the predecessor node is a definition statement;

[0142] If yes, the predecessor node is the terminal node; otherwise, execute step (72);

[0143] (72) Determine whether the code statement of the predecessor node is an assignment statement;

[0144] If yes, identify the type of each data on the right side of the assignment operator according to the data source;

[0145] (73) The predecessor node is a terminal node only when all the data on the right side of the assignment operator of the code statement are of the terminal type; the terminal type includes the input value and the initialization value.

[0146] Input streams or initialized variables may be potential sources of tainted data. Common input stream or initialization statement types include: 1) user input, 2) file input, 3) external libraries or dependencies, 4) system calls and external programs, and 5) database input. Taint sources are usually assigned in a variety of ways, such as a combination of constant assignment and input through library functions. In this embodiment, the input value or initialization value corresponding to the above statement is called endpoint type data.

[0147] Not all variables in the assignment statement are terminal type data. The analysis of the source will terminate only when the current node contains only terminal types and no non-terminal types. If there are any non-terminal types, the source analysis on the path should not be terminated, and its predecessor node will continue to be used for further analysis.

[0148] Preferably, the analysis of the predecessor nodes includes intra-process predecessor node analysis and inter-process predecessor node analysis;

[0149] The intra-process predecessor node analysis is to determine the intra-process predecessor node through all the starting nodes connected by the edges pointing to the current node in the control flow graph;

[0150] In the global propagation path, when the code statement of the predecessor node involves a function call or a global variable, an inter-procedural predecessor node analysis is performed based on the function call graph and the global variable information table.

[0151] Intra-procedural analysis exploits data flow to capture taint propagation information within a function. Inter-procedural analysis builds on intra-procedural analysis and combines global information tables and function call relationships to complete a more comprehensive view of taint sources.

[0152] There are three main types of interprocedural predecessor nodes: 1) Global variables: nodes where statements inside a function modify the value of a global variable. 2) Function return values: nodes where the current target point contains the function return value. 3) Function parameters: these involve the value and address passing methods in function calls. When these three specified node types are encountered, interprocedural predecessor nodes need to be calculated.

[0153] Integrating the calculation of intra-procedural predecessor nodes with inter-procedural predecessor nodes enables pollution source analysis across functions and files.

[0154] Preferably, the output pollution source node set includes:

[0155] PN n (T) ∪PN n (NT) =PN n

[0156] PN0=F(tp)

[0157] PN1=F(PN0 (NT) )

[0158] PN n =F(PN n-1 (NT) )

[0159] Source = PN0 (T) ∪PN1 (T) ∪…∪PN n (T)

[0160] Among them, PN n represents the pollution source node obtained from the analysis of the nth predecessor node, where PN n (T) Indicates the end node in the nth analysis result, PN n (NT) Represents the non-terminal node in the nth analysis result; tp represents the tainted node containing tainted data, F represents the method of calculating the intra-process and inter-process predecessor nodes in the propagation path, and Source represents the set of pollution source nodes.

[0161] By iteratively analyzing the predecessor nodes, all the contaminated source points are finally obtained. Intra-procedural taint source analysis focuses on data flow analysis within a single function or procedure. It focuses on sensitive data flow paths within a function and analyzes data dependencies, including constants, local variables, function parameters, etc. Inter-procedural taint source analysis derives data transfer between different functions or procedures based on function call relationships and global variable tables. This method combines intra-procedural and inter-procedural taint source analysis to complete a comprehensive system-wide taint source analysis.

[0162] The beneficial effects of this method are further illustrated by experimental data below.

[0163] This method is used for static taint source analysis of C language programs. The operating system used is Windows, and the JDK is the 64-bit 1.8.0 version. The performance of this method is evaluated on five open source C program projects, namely antiword-0.37, barcode-0.98, spell-1.0, sphinxbase-0.3, and uucp-1.07. Table 1 shows the project name, download link, number of files, and number of lines of code for each project.

[0164] Table 1: Basic information of the evaluation project

[0165]

[0166] The indicators for evaluating the effectiveness of taint source analysis technology include precision, recall and F value, namely:

[0167]

[0168]

[0169]

[0170] Among them, ATSS represents the actual taint source set, which consists of a set of real taint source elements. ETSS represents the estimated taint source set, which is calculated by the analysis method and may include elements that are not actually sources, or may ignore elements of the actual source. Tables 2 and 3 show the results of the intra-process and inter-process taint source analysis of this method, respectively.

[0171] Table 2. Results of in-process contamination source analysis

[0172]

[0173] Table 3. Inter-process taint source analysis results

[0174]

[0175] Through the testing of the above five cases, the results show that this method improves the accuracy of taint propagation path analysis without additional time overhead, confirming its effectiveness in identifying taint sources.

[0176] It should be understood that, although the various steps in the flowcharts involved in the above-mentioned embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps does not have a strict order restriction, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above-mentioned embodiments can include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0177] Based on the same inventive concept, the embodiment of the present application also provides a system for implementing the static full-system taint source analysis method involved above. The implementation scheme for solving the problem provided by the system is similar to the implementation scheme recorded in the above method, so the specific limitations in the embodiment of the static full-system taint source analysis system provided below can refer to the limitations of the method above, and will not be repeated here.

[0178] like Figure 5 As shown, the present invention also provides a static system-wide taint source analysis system, comprising:

[0179] A static modeling module, used for performing static program modeling on source code files containing tainted data to obtain a static representation of the source code;

[0180] A propagation path calculation module extracts the propagation rules of the control flow based on the static representation of the source code, and starts from the current tainted node, and obtains at least one global propagation path based on the propagation rules of the control flow by searching the nodes in a reverse direction and searching the directed edges in a forward direction;

[0181] A predecessor node analysis module, used for iteratively analyzing the variable introduction in the predecessor node code statement of the tainted node in the global propagation path to determine the pollution source node;

[0182] An alias acquisition module, used to execute an alias acquisition algorithm when it is determined that the code statement of the predecessor node contains a pointer type assignment;

[0183] The taint source output module is used to terminate the taint source analysis on the propagation path when the predecessor node is determined to be the terminal node; traverse all propagation paths of the taint node and output the taint source node set.

[0184] It should be noted that: the static full-system taint source analysis system provided in this embodiment only uses the division of the above-mentioned functional modules as an example when processing taint analysis. In actual applications, the above-mentioned functions can be assigned to different functional modules as needed, that is, the internal structure of the system can be divided into different functional modules. Each functional module can be composed of a single execution unit, or two or more execution units can be integrated into one functional module to realize all the functions of the functional module.

[0185] Those skilled in the art will appreciate that the above modules may be implemented in whole or in part by software, hardware, or a combination thereof. The above modules may be embedded in or independent of a processor in a computer device in the form of hardware, or may be stored in a memory in a computer device in the form of software, so that the processor may call and execute operations corresponding to the above modules.

[0186] The present invention is not limited to the above-mentioned specific implementation modes. Various changes made by ordinary technicians in this field based on the above-mentioned concepts without creative work are all within the protection scope of the present invention.

Claims

1. A static system-wide taint source analysis method, characterized in that: The steps include: Perform static program modeling on the source code file containing the tainted data to obtain a static representation of the source code; Extracting a control flow propagation rule based on the static representation of the source code, starting from the current tainted node, obtaining at least one global propagation path based on the control flow propagation rule by searching nodes in a reverse direction and searching directed edges in a forward direction; In the global propagation path, iteratively analyze the variable introduction in the code statement of the predecessor node of the tainted node to determine the pollution source node; Among them, when the code statement of the current driver node contains a pointer type assignment, the alias acquisition algorithm is executed; When the predecessor node is determined to be the terminal node, the taint source analysis on the global propagation path is terminated; Traverse all global propagation paths of tainted nodes and output the set of tainted source nodes.

2. The static system-wide taint source analysis method according to claim 1, characterized in that: The static program modeling method includes but is not limited to lexical analysis, syntax analysis, intermediate code generation, and program dependency analysis. The static representation of the source code includes at least an abstract syntax tree, a control flow graph, a function call graph, a global variable information table, and a function summary.

3. The static system-wide taint source analysis method according to claim 2, characterized in that: The function call graph uses two HashMap data structures to store function call relationship information, which is expressed in the form of "<function name, called function list>" and "<function name, calling function list>"; the "function name" is stored in String type, and the "called function list" and "calling function list" are stored in ArrayList data structure.

4. The static system-wide taint source analysis method according to claim 3, characterized in that: The propagation rule based on the control flow acquires at least one global propagation path by reversely searching nodes and forwardly searching directed edges, including: Based on the control flow graph, search from the current tainted node to obtain at least one intra-process propagation path; If the code statement of the current tainted node is a function call statement or contains a global variable, a plurality of intra-process propagation paths are obtained by jumping to the control flow graph of the corresponding function based on the function call graph and the global variable information table; Splice at least one intra-process propagation path to obtain the global propagation path of the tainted node; Wherein, searching and obtaining at least one intra-process propagation path starting from the current tainted node based on the control flow graph includes: (41) Obtain the control flow graph of the current tainted node and multiple processes; (42) The nodes in the control flow graph are divided into levels based on the execution order of the code, and the nodes connected by directed edges starting from the same node are considered to be of the same level; (43) Identify loops in the control flow graph; (44) determining the directed edge terminating at the current tainted node on the control flow graph; (45) If there is no directed edge, add the current tainted node to the target node set and then execute step (410); otherwise, execute step (46); (46) If there is at least one directed edge, obtain the highest-level node P connected by each of the directed edges, and determine the maximum cycle A that includes both the node P and the current tainted node; (47) Obtain all loops that can be formed by each node on the loop A layer by layer to form a loop set, remove the loop that does not contain the current tainted node in the loop set, and obtain the target loop set; (48) Add all nodes in the target loop set to the target node set, where each node is recorded only once; (49) Return the highest-level node in the target loop set as a new tainted node to execute step (44); (410) Connect the nodes in the target node set that have directed edges with each other to obtain at least one intra-process propagation path.

5. The static system-wide taint source analysis method according to claim 4, characterized in that: The alias acquisition algorithm starts from the polluted object on the left side of the assignment statement of the current predecessor node, and searches upward for the polluted aliases associated with the polluted object to construct alias sets of different categories until reaching the starting node of the polluted object scope; The elements in the alias set are composed of five-tuple τ, expressed as τ= <Var1,Scope1, Var2,Scope2,Pos> Among them: Var1 represents a pointer; Scopel corresponds to the scope of the pointer Var1; Var2 is the variable pointed to by the pointer; Scope2 corresponds to the scope of Var2; Pos is the line information of the statement that assigns the address information of Var2 to Var1; The different categories of alias sets refer to sets formed by aliases of different scopes, including global scope and local scope.

6. The static system-wide taint source analysis method according to claim 5, characterized in that: The steps of the alias acquisition algorithm include: (61) obtaining a target variable pointed to by a pointer in a pointer type assignment statement of the current predecessor node; if the variable pointed to by the pointer is a structure or a nested variable, decomposing the variable pointed to by the pointer into multiple sub-variables, and using the multiple sub-variables as multiple target variables; (62) Obtaining scope information of the target variable based on the global variable information table; (63) If the target variable of the current predecessor node is a local scope variable, then in the current function, determine the target statement when the target variable is on the right side of the assignment statement; Obtain the line number of the target statement and the variable name on the left side of the target statement, and store them in an alias set; (64) If the target variable of the current predecessor node is a global scope variable, the target function that uses the target variable is retrieved from the global variable information table; In each objective function, determine the objective statement when the objective variable is on the right side of the assignment statement; The line number where the target is located and the variable name on the left side of the target statement are obtained and stored in an alias set.

7. The static system-wide taint source analysis method according to claim 1, characterized in that: The method for determining the end node is: (71) Determine whether the code statement of the predecessor node is a definition statement; If yes, the predecessor node is the terminal node; otherwise, execute step (72); (72) Determine whether the code statement of the predecessor node is an assignment statement; If yes, identify the type of each data on the right side of the assignment operator according to the data source; (73) The predecessor node is a terminal node only when all the data on the right side of the assignment operator of the code statement are of the terminal type; the terminal type includes the input value and the initialization value.

8. The static system-wide taint source analysis method according to claim 2, characterized in that: The analysis of the predecessor nodes includes the analysis of the predecessor nodes within the process and the analysis of the predecessor nodes between the processes; The intra-process predecessor node analysis is to determine the intra-process predecessor node through all the starting nodes connected by the edges pointing to the current node in the control flow graph; In the global propagation path, when the code statement of the predecessor node involves a function call or a global variable, an inter-procedural predecessor node analysis is performed based on the function call graph and the global variable information table.

9. The static system-wide taint source analysis method according to claim 8, characterized in that: The output pollution source node set includes: PN n (T) ∪PN n (NT) =PN n PN0=F(tp) PN1=F(PN0 (NT) ) PN n =F(PN n-1 (NT) ) Source=PN0 (T) ∪PN1 (T) U…∪PN n (T) Among them, PN n represents the pollution source node obtained from the analysis of the nth predecessor node, where PN n (T) Indicates the end node in the nth analysis result, PN n (NT) Represents the non-terminal node in the nth analysis result; tp represents the tainted node containing tainted data, F represents the method of calculating the intra-process and inter-process predecessor nodes in the propagation path, and Source represents the set of pollution source nodes.

10. A static system-wide taint source analysis system, characterized in that: include: A static modeling module, used for performing static program modeling on source code files containing tainted data to obtain a static representation of the source code; A propagation path calculation module extracts the propagation rules of the control flow based on the static representation of the source code, and starts from the current tainted node, and obtains at least one global propagation path based on the propagation rules of the control flow by searching the nodes in a reverse direction and searching the directed edges in a forward direction; A predecessor node analysis module, used for iteratively analyzing the variable introduction in the predecessor node code statement of the tainted node in the global propagation path to determine the pollution source node; An alias acquisition module, used to execute an alias acquisition algorithm when it is determined that the code statement of the predecessor node contains a pointer type assignment; The taint source output module is used to terminate the taint source analysis on the propagation path when the predecessor node is determined to be the terminal node; traverse all propagation paths of the taint node and output the taint source node set.

Images