Program analysis method and device, readable storage medium and electronic equipment

Abstract

The invention discloses a program analysis method and device, a readable storage medium and electronic equipment. A to-be-analyzed program is determined, an abstract syntax tree of the to-be-analyzed program is determined through a compiler corresponding to a programming language used by the to-be-analyzed program, nodes in the abstract syntax tree are standardized, and a standard syntax tree is determined. And determining each control flow edge and each data flow edge in the standard syntax tree through the standard syntax tree, adding each control flow edge and each data flow edge to the standard syntax tree, and determining the code attribute graph of the program to be analyzed. The abstract syntax tree is converted into the standard syntax tree, the abstract syntax trees of the programs to be analyzed in different programming languages are unified, and the code attribute graph is constructed based on the standard syntax tree, so that the method can be suitable for program analysis of the programs to be analyzed in various programming languages; different analysis algorithms do not need to be developed for different programming languages, the program analysis efficiency is improved, and the development cost is reduced.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a program analysis method, device, readable storage medium, and electronic device. Background Art

[0002] Program analysis is crucial for discovering syntax errors, security vulnerabilities, deep nesting and other program vulnerabilities in the program, and improving program security and program operation efficiency.

[0003] During the compilation process, the compiler parses the source code of the program and generates an abstract syntax tree (AST) that represents the syntax structure of the program. Based on the AST, it is further converted into executable machine code. The AST is a tree-structured intermediate representation of the program generated during the program compilation process. Each node of the AST represents a syntax component in the source code, such as a function declaration node, a control flow node, a statement node, an element node, etc. The edges of the AST represent the logical relationship between the syntax components. The tree structure of the AST clearly reflects the syntax hierarchy of the program. By analyzing the logical relationship, control flow, and data flow of the program based on the AST, a relatively intuitive analysis result can be obtained.

[0004] However, due to the differences in grammatical rules of different programming languages, different programming languages ​​generate different abstract syntax trees representing grammatical structures during the compilation process. When analyzing the logical relationships, control flows, and data flows of a program, the analysis algorithm used for one programming language is difficult to reuse in other types of programming languages. Therefore, in current program analysis, it is necessary to develop specific analysis algorithms for different programming languages, which reduces the efficiency of program analysis and increases the development cost during program analysis.

[0005] Therefore, this specification provides a program analysis method. Summary of the invention

[0006] This specification provides a program analysis method, device, readable storage medium and electronic device to partially solve the above-mentioned problems existing in the prior art.

[0007] This manual adopts the following technical solutions:

[0008] This specification provides a program analysis method, including:

[0009] Determine a program to be analyzed, and determine an abstract syntax tree of the program to be analyzed by using a compiler corresponding to a programming language used by the program to be analyzed;

[0010] Standardizing the nodes in the abstract syntax tree to determine a standard syntax tree;

[0011] Performing control flow analysis and data flow analysis on the program to be analyzed through the standard syntax tree, determining each control flow edge and each data flow edge in the standard syntax tree, adding each control flow edge and each data flow edge to the standard syntax tree, and determining a code attribute graph of the program to be analyzed;

[0012] In response to a user's query operation on the code property graph, a query result is returned, so that the user can analyze program vulnerabilities based on the query result.

[0013] Optionally, the nodes in the standard syntax tree are standard nodes, and the standard nodes include statement nodes representing program statement types;

[0014] Performing control flow analysis and data flow analysis on the program to be analyzed by using the standard syntax tree, determining each control flow edge and each data flow edge in the standard syntax tree, adding each control flow edge and each data flow edge to the standard syntax tree, and determining a code attribute graph of the program to be analyzed, specifically includes:

[0015] According to the standard syntax tree, control flow analysis is performed on the program to be analyzed to determine the control flow edges between the statement nodes in the standard syntax tree;

[0016] Adding each determined control flow edge to the standard syntax tree to determine an initial attribute graph;

[0017] According to the initial attribute graph, data flow analysis is performed on the program to be analyzed to determine the data flow edges between the statement nodes in the standard syntax tree;

[0018] The determined data flow edges are added to the initial attribute graph to obtain a code attribute graph.

[0019] Optionally, the standard nodes further include control flow nodes, and the control flow nodes are used to represent grammatical components that change the order of program execution;

[0020] According to the standard syntax tree, control flow analysis is performed on the program to be analyzed to determine the control flow edges between statement nodes in the standard syntax tree, specifically including:

[0021] The standard syntax tree is traversed in depth first, and the control flow edges between the statement nodes in the standard syntax tree are determined according to the traversal order of the standard nodes in the standard syntax tree and the control flow nodes included in the standard syntax tree.

[0022] Optionally, the child node of the control flow node is a statement node, and the control type of the control flow node is divided into judgment, loop and jump;

[0023] Performing a depth-first traversal on the standard syntax tree, and determining the control flow edges between the statement nodes in the standard syntax tree according to the traversal order of the standard nodes in the standard syntax tree and the control flow nodes included in the standard syntax tree, specifically includes:

[0024] Performing a depth-first traversal on the standard syntax tree, and determining, for each statement node traversed, whether the parent node of the statement node is a control flow node;

[0025] If yes, determine the control flow edge corresponding to the statement node according to the control type of the parent node of the statement node;

[0026] If not, determine the control flow edge between the statement node and the next statement node traversed.

[0027] Optionally, the child nodes of the statement node are element nodes representing components of program statements;

[0028] According to the initial attribute graph, data flow analysis is performed on the program to be analyzed to determine the data flow edges between the statement nodes in the standard syntax tree, specifically including:

[0029] Determining each execution path of the program to be analyzed according to each control flow edge in the initial attribute graph;

[0030] For each execution path, determine the element node on the execution path according to the descendant nodes of the statement node corresponding to the execution path;

[0031] Determine each variable contained in the element node on the execution path, and for each variable, determine the data flow path of the variable on the execution path according to the statement node corresponding to the parent node of the element node to which the variable belongs on the execution path;

[0032] According to the data flow paths of the variables on the execution paths, the data flow edges between the statement nodes corresponding to the element nodes to which the variables on the execution paths belong are determined.

[0033] Optionally, determining the data flow path of the variable on the execution path according to the statement node corresponding to the parent node of the element node to which the variable belongs on the execution path specifically includes:

[0034] According to the statement node corresponding to the parent node of the element node to which the variable belongs on the execution path, the statement node directly associated with the data flow of the variable is used;

[0035] In each element node corresponding to the statement node directly associated with the variable data flow, a variable having an operation relationship with the variable is determined as a related quantity of the variable;

[0036] The data flow path of the variable on the execution path is determined based on the statement node corresponding to the parent node of the element node to which the variable belongs on the execution path, and the statement node corresponding to the parent node of the element node to which the related quantity of the variable belongs on the execution path.

[0037] Optionally, performing control flow analysis and data flow analysis on the program to be analyzed through the standard syntax tree, determining each control flow edge and each data flow edge in the standard syntax tree, adding each control flow edge and each data flow edge to the standard syntax tree, and determining a code attribute graph of the program to be analyzed specifically includes:

[0038] Determining the static single assignment code of the program to be analyzed according to the standard syntax tree;

[0039] Performing control flow analysis and data flow analysis on the static single assignment code respectively to determine a control flow graph and a data flow graph of the program to be analyzed;

[0040] The control flow edges in the control flow graph and the data flow edges in the data flow graph are integrated with the edges in the standard syntax tree to determine a code attribute graph.

[0041] This specification provides a program analysis device, the device comprising:

[0042] An abstract syntax tree determination module determines a program to be analyzed, and determines an abstract syntax tree of the program to be analyzed by using a compiler corresponding to a programming language used by the program to be analyzed;

[0043] A standardization module, which standardizes the nodes in the abstract syntax tree to determine a standard syntax tree;

[0044] A code attribute graph determination module performs control flow analysis and data flow analysis on the program to be analyzed through the standard syntax tree, determines each control flow edge and each data flow edge in the standard syntax tree, adds each control flow edge and each data flow edge to the standard syntax tree, and determines a code attribute graph of the program to be analyzed;

[0045] The analysis module returns the query result in response to the user's query operation on the code property graph, so that the user can analyze the program vulnerability based on the query result.

[0046] The computer-readable storage medium provided in this specification stores a computer program, and when the computer program is executed by a processor, any of the above-mentioned program analysis methods is implemented.

[0047] The electronic device provided in this specification includes a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements any of the above-mentioned program analysis methods when executing the program.

[0048] At least one of the above technical solutions adopted in this specification can achieve the following beneficial effects:

[0049] In the program analysis method provided in this specification, a program to be analyzed is determined, and an abstract syntax tree of the program to be analyzed is determined by a compiler corresponding to the programming language used by the program to be analyzed, and the nodes in the abstract syntax tree are standardized to determine a standard syntax tree. Through the standard syntax tree, each control flow edge and each data flow edge in the standard syntax tree are determined, and each control flow edge and each data flow edge are added to the standard syntax tree to determine the code attribute graph of the program to be analyzed. In this method, the abstract syntax tree of the program to be analyzed in different programming languages ​​is unified by converting the abstract syntax tree into a standard syntax tree, and a code attribute graph is constructed based on the standard syntax tree. The code attribute graph contains the logical relationship between each grammatical component of the program to be analyzed, the execution order of each statement of the program to be analyzed, or the flow direction of data in the program to be analyzed, so that this method can be applied to the program analysis of the program to be analyzed in various programming languages. When performing program analysis by this method, it is no longer necessary to develop different analysis algorithms for different programming languages, which improves the efficiency of program analysis and reduces development costs. BRIEF DESCRIPTION OF THE DRAWINGS

[0050] The drawings described herein are used to provide a further understanding of this specification and constitute a part of this specification. The exemplary embodiments and descriptions of this specification are used to explain this specification and do not constitute an improper limitation on this specification.

[0051] In the figure:

[0052] Figure 1 A flowchart of the program analysis method provided in this specification;

[0053] Figure 2 A schematic diagram of a code attribute graph provided in an embodiment of this specification;

[0054] Figure 3 A schematic diagram of a program analysis provided in this manual;

[0055] Figure 4 A schematic diagram of a program analysis device provided in this specification;

[0056] Figure 5 The corresponding Figure 1 Schematic diagram of electronic equipment. DETAILED DESCRIPTION

[0057] In order to make the purpose, technical solutions and advantages of this specification more clear, the technical solutions of this specification will be clearly and completely described below in combination with the specific embodiments of this specification and the corresponding drawings. Obviously, the described embodiments are only part of the embodiments of this specification, not all of them. Based on the embodiments in this specification, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this specification.

[0058] The technical solutions provided by the embodiments of this specification are described in detail below in conjunction with the accompanying drawings.

[0059] Figure 1 The flowchart of the program analysis method provided in this specification specifically includes the following steps:

[0060] S100: Determine a program to be analyzed, and determine an abstract syntax tree of the program to be analyzed by using a compiler corresponding to a programming language used by the program to be analyzed.

[0061] All steps in the program analysis method provided in this specification can be implemented by any electronic device with computing functions, such as a terminal, a server, etc. For ease of description, the program analysis method provided in this specification is described below using only a server as the execution subject.

[0062] The program analysis method provided in this specification is compatible with various types of programming languages, so the program to be analyzed determined by the server can be a program in any programming language.

[0063] After determining the program to be analyzed, the server performs syntax analysis on the source code of the program to be analyzed through the compiler corresponding to the programming language used by the program to be analyzed, and determines the abstract syntax tree of the program to be analyzed. The nodes of the abstract syntax tree represent the various syntax components in the programming language used by the program to be analyzed. The edges between the nodes in the abstract syntax tree reflect the logical relationship between the syntax components represented by each node through the parent-child relationship between the nodes in the tree structure.

[0064] There are many types of nodes in the abstract syntax tree. Each grammatical component in the programming language used in the program to be analyzed has a corresponding type of node, such as function declaration node, control flow node, statement node, element node, etc. Control flow nodes are used to represent grammatical structures that change the order of program execution, and statement nodes are used to represent the type of program statements. Element nodes are used to represent statement components, such as variables, operators, variable type declarations, etc.

[0065] In the abstract syntax tree, the child nodes of the control flow node are statement nodes. The descendant nodes of the statement node are element nodes. The depth of the subtree with the statement node as the root node is related to the complexity of the program statement corresponding to the statement node. The descendant nodes of a statement node are all the nodes that can be reached by traversing deeper along the child nodes of the statement node. The descendant nodes of a statement node are composed of the child nodes of the statement node and the descendant nodes of the child nodes of the statement node.

[0066] Because in the compilation process of various programming languages, the compilers of various programming languages ​​will first parse the program code into an abstract syntax tree, and then further convert it into executable machine code, that is, the generation of an abstract syntax tree is a common process in the compilation process of various programming languages. Therefore, the abstract syntax tree can become the basis of the program analysis method compatible with various programming languages ​​in this specification.

[0067] S102: Standardize the nodes in the abstract syntax tree to determine a standard syntax tree.

[0068] In order to eliminate the differences in abstract syntax trees among different programming languages, the server determines a standard syntax tree by standardizing the abstract syntax tree.

[0069] Specifically, the server maps the nodes of the abstract syntax tree to standard nodes according to the mapping rules to obtain a standard syntax tree. The mapping rules specify the correspondence between the nodes of the abstract syntax tree of each programming language and the standard nodes. The abstract syntax tree is used to reflect the grammatical structure of the program. Due to the differences in the grammatical rules of different programming languages, the nodes in the abstract syntax trees of different programming languages ​​are different. For nodes with the same semantics of grammatical components contained in at least two programming languages, the semantically identical nodes corresponding to each programming language are mapped to the same standard node in the mapping rules. For grammatical components unique to a certain programming language, the standard nodes corresponding to the nodes of the grammatical component are specified in the mapping rules.

[0070] For example, in Java, there is import declaration syntax but no pointer syntax, while in C++, there is pointer syntax but no import declaration syntax. In the mapping rules, both standard nodes corresponding to the import declaration syntax and standard nodes corresponding to the pointer syntax are specified.

[0071] The specific form of the mapping rules is not limited in this specification. As long as the mapping rules specify standard nodes corresponding to the grammatical components of various programming languages, the abstract syntax trees of different programming languages ​​can be standardized according to the mapping rules.

[0072] The server can identify the abstract syntax tree of the program to be analyzed in any programming language according to the mapping rules, determine the standard node of each node in the abstract syntax tree, and replace each node with the standard node of the abstract syntax tree, unify the syntax structure of the abstract syntax tree of the program to be analyzed, and obtain the standard syntax tree of the program to be analyzed.

[0073] The standard syntax tree is a standardized expression of the abstract syntax tree. It does not change the semantics of the abstract syntax tree, but only standardizes the names of the nodes contained in the abstract syntax tree. The standard nodes of the standard syntax tree also include various types of nodes in the abstract syntax tree, such as function declaration nodes, control flow nodes, statement nodes, element nodes, etc.

[0074] In the subsequent program analysis, the server only needs to determine an analysis algorithm applicable to the standard syntax tree to implement program analysis tasks for programs in various programming languages, thereby improving the efficiency of program analysis.

[0075] S104: Perform control flow analysis and data flow analysis on the program to be analyzed through the standard syntax tree, determine each control flow edge and each data flow edge in the standard syntax tree, add each control flow edge and each data flow edge to the standard syntax tree, and determine the code attribute graph of the program to be analyzed.

[0076] The Code Property Graph (CPG) is a joint representation of the standard syntax tree, control flow graph, and data flow graph. The code property graph contains three types of edges corresponding to the standard syntax tree, control flow graph, and data flow graph, which are used to represent the logical relationship between the grammatical components of the program to be analyzed, the execution order of each statement in the program to be analyzed, and the flow direction of data in the program to be analyzed.

[0077] The server can construct a code attribute graph by adding control flow edges in the control flow graph and data flow edges in the data flow graph to the standard syntax tree. The control flow edges are used to represent the execution order of the program, and the data flow edges are used to represent the flow direction of data in the program.

[0078] First, the server performs control flow analysis on the program to be analyzed based on the standard syntax tree and determines the control flow edges between the statement nodes in the standard syntax tree. The control flow reflects the execution order of program statements, so the control flow edges are the edges between statement nodes.

[0079] In one or more embodiments of the present specification, the server performs a depth-first traversal on the standard syntax tree, and determines the control flow edges between the statement nodes in the standard syntax tree according to the traversal order of the standard nodes in the standard syntax tree and the control flow nodes included in the standard syntax tree.

[0080] The control flow nodes in the standard syntax tree are used to represent the grammatical structure that changes the order of program execution. Usually, according to the different grammatical structures corresponding to the control flow nodes, the control flow nodes can be divided into three control types: judgment, loop and jump.

[0081] If there is no grammatical structure corresponding to a control flow node in a program, the program statements contained in the program will be executed in sequence according to the order in which the statements are written. If there is a grammatical structure corresponding to a control flow node in a program, the execution process of the program will become diversified and multiple execution paths will appear.

[0082] Perform a depth-first traversal of the standard syntax tree, and determine the program statements corresponding to each statement node in the traversal order, which is the order of each program statement in the sequential execution case. The child nodes of the control flow node are the statement nodes corresponding to the control flow node. At the statement nodes corresponding to the control flow node, the execution path of the program will branch.

[0083] The server can determine the control flow edge while traversing. That is, the server performs a depth-first traversal on the standard syntax tree, and for each statement node traversed, determines whether the parent node of the statement node is a control flow node.

[0084] If so, the control flow edge corresponding to the statement node is determined according to the control type of the parent node of the statement node.

[0085] Specifically, the server determines the control type of the control flow node according to the control flow node corresponding to the parent node of the statement node. When the control type of the parent node of the statement node is judgment, the execution relationship between the statement nodes corresponding to the child nodes of the control flow node is mutually exclusive, and each child node of the control flow node corresponds to an execution path. If the program statement is executed, the server will not execute the program statements corresponding to other child nodes of the control flow node, and the server determines the control flow edge between the statement node and the next traversed statement node that is not a child node of the control flow node.

[0086] When the control type of the parent node of the statement node is loop, it means that the execution status of the program statement corresponding to the statement node is either executed or not executed. Generally, the program statement is executed if the loop condition is met, and not executed if the loop condition is not met, regardless of the number of loops. Therefore, the server controls the control flow edge between the statement node and the next statement node traversed, as well as the control flow edge between the previous statement node of the statement node and the next statement node traversed.

[0087] When the control type of the parent node of the statement node is jump, the server determines the element node representing the jump target of the statement node among the child nodes of the statement node, that is, the element nodes representing the constituent components of the statement, and determines the statement node corresponding to the jump target based on the element node representing the jump target of the statement node, thereby determining the control flow edge between the statement node and the statement node corresponding to the jump target of the statement node.

[0088] Secondly, the server adds the determined control flow edges to the standard syntax tree to determine the initial attribute graph. Based on the initial attribute graph, the server performs data flow analysis on the program to be analyzed to determine the data flow edges between the statement nodes in the standard syntax tree. The data flow reflects the flow of data between the statements of the program, so the data flow edges are also the edges between the statement nodes.

[0089] In one or more embodiments of the present specification, the server determines each execution path of the program to be analyzed according to each control flow edge in the initial attribute graph. For each execution path, the element node on the execution path is determined according to the descendant nodes of the statement node corresponding to the execution path. The descendant nodes of the statement node represent the components of the program statement corresponding to the statement node, and the descendant nodes of the statement node include standard nodes representing variables, standard nodes representing operators, and the like.

[0090] The server determines the variables contained in the element nodes on the execution path according to the element nodes corresponding to the statement nodes on the execution path. In each program statement, the variable represents the data information, and the transmission path of the variable between the program statements constitutes the data flow.

[0091] Therefore, for each variable, the server determines the data flow path of the variable on the execution path according to the statement node corresponding to the parent node of the element node to which the variable belongs on the execution path. According to the data flow path of the variable on each execution path, the data flow edges between the statement nodes corresponding to the element nodes to which the variable belongs on each execution path are determined.

[0092] Specifically, the server connects the statement nodes corresponding to each data flow path according to the direction of each data flow path, thereby obtaining each data flow edge.

[0093] Finally, the server adds the determined data flow edges to the initial attribute graph to obtain the code attribute graph. Therefore, the code attribute graph contains not only the edges in the standard syntax tree, but also the control flow edges and data flow edges. The server can analyze the program logic, execution order or data flow of the program to be analyzed based on the code attribute graph.

[0094] Figure 2 A schematic diagram of a code attribute diagram provided in an embodiment of this specification is shown in FIG. Figure 2 As shown in the figure, the rectangular nodes marked with numbers represent different statement nodes, and the circular nodes represent element nodes. The element nodes corresponding to the same rectangular node are used to represent the specific grammatical components of the statement represented by the rectangular node. The solid arrows represent the edges of the standard syntax tree, the long dashed arrows represent the control flow edges, and the short dashed arrows represent the data flow edges. Figure 2 In the example, two program execution paths can be determined based on the control flow edge: statement node 1 → statement node 2 → statement node 3, and statement node 1 → statement node 3. The element nodes corresponding to statement node 1 and statement node 3 both contain variable x. According to the direction of the control flow edge, the data flow edge from statement node 1 to statement node 3 can be determined.

[0095] It should be noted that there are many methods for performing control flow analysis or data flow analysis, that is, there are many methods for determining control flow edges or data flow edges, which are not limited to the methods provided in the above embodiments. For example, the server can also determine control flow edges through methods such as node merging algorithm and static single assignment (SSA) conversion, and determine data flow edges through methods such as symbolic execution and reachable definition analysis.

[0096] S106: In response to the user's query operation on the code property graph, the query result is returned, so that the user can analyze program vulnerabilities based on the query result.

[0097] The code property graph determined by the server in the above steps can be stored in the database. The user can determine the query node or edge according to the actual program analysis requirements. The server responds to the user's query operation and returns the query result so that the user can analyze the program vulnerability based on the query result.

[0098] For example, in some application scenarios, users can detect program syntax errors based on the edges of the standard syntax tree in the code attribute graph. Users can query whether a case statement does not end with a break statement based on the standard nodes in the code attribute graph. Alternatively, users can query nested loops in the program to be analyzed based on the control flow edges in the code attribute graph. Users can optimize the program to be analyzed based on the query results given by the server to improve the execution speed of the program, and so on.

[0099] Because the code attribute graph in this specification is generated based on the standard syntax tree, which standardizes the abstract syntax trees of different types of programming languages, the code attribute graph in this specification is also applicable to various programming languages. When querying the code attribute graph, for the same query operation, there is no need to write different query statements according to different programming languages, which reduces the workload of users in program analysis. For example, in the existing program analysis, if the user needs to query the nested loops in the program, it is necessary to write specific query statements for different programming languages. However, using this method, the user only needs to write a query statement for the operation of querying the nested loops.

[0100] Figure 3 This is a program analysis schematic diagram provided in this manual. Figure 3 As shown in the figure, the program to be analyzed may be a program in any programming language. The abstract syntax trees obtained are different for different programming languages. However, after the standard syntax tree is determined, the abstract syntax trees of different types of programming languages ​​have a unified expression. Based on the standard syntax tree, the data flow edges and control flow edges are determined to obtain the code attribute graph. Users perform query operations on the code attribute graph through query statements to perform program analysis.

[0101] Based on the above Figure 1 The program analysis method shown converts the abstract syntax tree into a standard syntax tree, unifies the abstract syntax trees of the programs to be analyzed in different programming languages, and constructs a code attribute graph based on the standard syntax tree. The code attribute graph has control flow edges and data flow edges added to the standard syntax tree, that is, the code attribute graph can simultaneously characterize the logical relationship between the various grammatical components of the program to be analyzed, the execution order of each statement of the program to be analyzed, or the flow direction of data in the program to be analyzed, so that the method can be applied to program analysis of programs to be analyzed in various programming languages. When performing program analysis using the method, it is no longer necessary to develop different analysis algorithms for different programming languages, which improves the efficiency of program analysis and reduces development costs.

[0102] In the above step S104, the server may also first perform a depth-first traversal on the standard syntax tree, and then determine the control flow edges after the traversal is completed.

[0103] In one or more embodiments of the present specification, after the traversal is completed, the server determines the node sequence composed of the traversed statement nodes according to the traversal order, and determines the control flow edges between adjacent statement nodes in each node sequence.

[0104] Then, for each statement node in the node sequence, the server determines whether the parent node of the statement node is a control flow node. If so, the previously determined control flow edge corresponding to the statement node is deleted, and the control flow edge corresponding to the statement node is re-determined according to the control type of the parent node of the statement node. If not, the control flow edge corresponding to the statement node is not changed.

[0105] In the above step S104, when determining the data flow edge, the server determines the data flow path of the variable on the execution path according to the statement node corresponding to the parent node of the element node to which the variable belongs on the execution path. That is, in the above embodiment, the determined data flow path is composed of program statements containing the same variable.

[0106] However, at any time when each program statement is executed, a variable may be assigned to another variable, or participate in the operation corresponding to another variable. In this process, the data information contained in the variable is passed to the other variable. Then, when the subsequent program statement containing the other variable is executed, the flow of the data information contained in the variable still occurs. Therefore, in order to determine a more accurate data flow path, in one or more embodiments of this specification, the server can also determine the data flow path based on the transfer of data information contained in the same variable.

[0107] Specifically, the server uses the statement node corresponding to the parent node of the element node to which the variable belongs on the execution path as the statement node directly associated with the variable data flow. The data flow path determined by the statement node directly associated with the variable data flow is the data flow path determined in step S104.

[0108] Then, the server determines the variable that has an operation relationship with the variable in each element node corresponding to the statement node directly associated with the variable data flow as the relevant quantity of the variable. During the execution of the program statement, the data information contained in the variable will be passed to the relevant quantity of the variable.

[0109] Finally, the server determines the data flow path of the variable on the execution path based on the statement node corresponding to the parent node of the element node to which the variable belongs on the execution path, and the statement node corresponding to the parent node of the element node to which the related quantity of the variable belongs on the execution path.

[0110] In this way, a data flow path determined by this embodiment is composed of statement nodes corresponding to the same variable and statement nodes corresponding to related variables of the same variable, and the data flow path more accurately determines the flow of data information. Based on the code attribute graph determined by this embodiment, more accurate program analysis can be performed.

[0111] In the above step S104, a method is provided in which a control flow edge in a control flow graph is first added to the standard syntax tree to determine an initial attribute graph, and then a data flow edge is added based on the initial attribute graph to determine a code attribute graph. In one or more embodiments of the present specification, the server may also determine a code attribute graph according to the following method.

[0112] The server first converts the standard syntax tree into a static single assignment code, and then determines the control flow graph and data flow graph of the program to be analyzed based on the static single assignment code of the program to be analyzed.

[0113] Then, the server integrates the control flow edges in the control flow graph and the data flow edges in the data flow graph with the edges in the standard syntax tree to determine a code attribute graph.

[0114] In static single assignment code, the program to be analyzed is divided into basic blocks (Basic Black, BB), each of which contains one or more program statements. In the control flow graph and data flow graph determined by static single assignment code, basic blocks are used as nodes, and the statements inside the basic blocks are executed sequentially. The control flow edges in the control flow graph indicate the execution order of the program between basic blocks, and the data flow edges in the data flow graph indicate the data flow direction between basic blocks.

[0115] In this embodiment, a node in a control flow graph or a data flow graph represents one or more program statements, but a statement node in a standard syntax tree represents only one program statement.

[0116] Therefore, the server traverses the standard syntax tree, control flow graph and data flow graph respectively to determine the standard nodes connected by each edge in the standard syntax tree, the nodes connected by each control flow edge in the control flow graph and the nodes connected by each data flow edge in the data flow graph.

[0117] Secondly, for each control flow edge, the server determines the first outflow basic block and the first inflow basic block of the control flow edge according to the two nodes connected by the control flow edge in the control flow graph, and respectively determines the program statements contained in the first outflow basic block and the first inflow basic block.

[0118] In the standard syntax tree, the server determines the statement nodes corresponding to the program statements contained in the first outgoing basic block in sequence as the outgoing nodes according to the order of the program statements in the first outgoing basic block, and determines the statement nodes corresponding to the first ingoing basic block in sequence as the ingoing nodes according to the order of the program statements in the first ingoing basic block.

[0119] The server determines the data flow edges between adjacent outflow nodes corresponding to the first outflow basic block, determines the data flow edges between adjacent inflow nodes corresponding to the first inflow basic block, and simultaneously determines the control flow edges between the last outflow node corresponding to the first outflow basic block and the first inflow node corresponding to the first inflow basic block.

[0120] For each data flow edge, according to the two nodes connected by the data flow edge in the data flow graph, the second outflow basic block and the second inflow basic block of the data flow edge are determined, and the program statements contained in the second outflow basic block and the second inflow basic block are determined respectively.

[0121] In the standard syntax tree, according to the order of each program statement in the second outgoing basic block, the statement nodes corresponding to the program statements contained in the second outgoing basic block are determined in sequence as the outgoing nodes, and according to the order of each program statement in the second incoming basic block, the statement nodes corresponding to the second incoming basic block are determined in sequence as the incoming nodes.

[0122] The server determines, for each inflow node corresponding to the second outflow basic block, whether there is a flow of data information between the inflow node and the program statement corresponding to the outflow node in accordance with the determination order of each outflow node. If so, the server determines the data flow edge between the inflow node and the outflow node, and stops the determination process between the inflow node and the next outflow node. If not, the server performs the determination process between the inflow node and the next outflow node corresponding to the second outflow basic block.

[0123] When the second outflow basic block contains multiple program statements, determine whether there is data information flow between the inflow nodes corresponding to the second outflow basic block. If so, in the inflow nodes corresponding to the second outflow basic block, determine the data flow edge between the outflow nodes corresponding to the two program statements where data information flow exists.

[0124] The flow of data information mentioned in this embodiment has the same meaning as the flow of data information mentioned when determining the data flow edge in the above embodiment, and can be determined based on the name of the variable or based on the transmission of data information contained in the same variable.

[0125] In this embodiment, there is no restriction on the execution order of the above-mentioned determination process of the control flow edge and the data flow edge. The server may determine the control flow edge first, or may determine the data flow edge first, or may determine the control flow edge and the data flow edge at the same time.

[0126] The server adds the determined control flow edges and data flow edges to the standard syntax tree to obtain a code property graph.

[0127] The above is a program analysis method provided in one or more embodiments of this specification. Based on the same idea, this specification also provides a corresponding program analysis device, such as Figure 4 shown.

[0128] Figure 4 This is a schematic diagram of the program analysis device provided in this specification, which specifically includes:

[0129] An abstract syntax tree determination module 200 is used to standardize the nodes in the abstract syntax tree to determine a standard syntax tree;

[0130] A standardization module 202 is used to determine the standard node corresponding to each original node in the abstract syntax tree according to a preset mapping rule, and replace each original node with the standard node corresponding to each original node in the abstract syntax tree to obtain a standard syntax tree of the program to be analyzed, wherein the mapping rule specifies the correspondence between the original node and the standard node of the abstract syntax tree of each programming language;

[0131] A code attribute graph determination module 204 is used to perform control flow analysis and data flow analysis on the program to be analyzed through the standard syntax tree, determine each control flow edge and each data flow edge in the standard syntax tree, add each control flow edge and each data flow edge to the standard syntax tree, and determine a code attribute graph of the program to be analyzed;

[0132] The analysis module 206 is used to return the query result in response to the user's query operation on the code property graph, so that the user can analyze the program vulnerability based on the query result.

[0133] Optionally, the nodes in the standard syntax tree are standard nodes, and the standard nodes include statement nodes that represent program statement types. The code attribute graph determination module 204 is specifically used to perform control flow analysis on the program to be analyzed according to the standard syntax tree, determine the control flow edges between the statement nodes in the standard syntax tree, add the determined control flow edges to the standard syntax tree, determine an initial attribute graph, perform data flow analysis on the program to be analyzed according to the initial attribute graph, determine the data flow edges between the statement nodes in the standard syntax tree, add the determined data flow edges to the initial attribute graph, and obtain a code attribute graph.

[0134] Optionally, the standard node also includes a control flow node, and the control flow node is used to represent the grammatical components that change the order of program execution. The code attribute graph determination module 204 is specifically used to perform a depth-first traversal on the standard syntax tree, and determine the control flow edges between each statement node in the standard syntax tree according to the traversal order of each standard node in the standard syntax tree and the control flow nodes included in the standard syntax tree.

[0135] Optionally, the child node of the control flow node is a statement node, and the control type of the control flow node is divided into judgment, loop and jump. The code attribute graph determination module 204 is specifically used to perform a depth-first traversal on the standard syntax tree, and for each traversed statement node, determine whether the parent node of the statement node is a control flow node. If so, determine the control flow edge corresponding to the statement node according to the control type of the parent node of the statement node. If not, determine the control flow edge between the statement node and the next traversed statement node.

[0136] Optionally, the child nodes of the statement node are element nodes that represent components of program statements. The code attribute graph determination module 204 is specifically used to determine the execution paths of the program to be analyzed based on the control flow edges in the initial attribute graph, and for each execution path, determine the element nodes on the execution path based on the descendant nodes of the statement node corresponding to the execution path, determine the variables contained in the element nodes on the execution path, and for each variable, determine the data flow path of the variable on the execution path based on the statement node corresponding to the parent node of the element node to which the variable belongs on the execution path, and determine the data flow edges between the statement nodes corresponding to the element nodes to which the variables on the execution paths belong based on the data flow paths of the variables on the execution paths.

[0137] Optionally, the code attribute graph determination module 204 is specifically used to determine, based on the statement node corresponding to the parent node of the element node to which the variable belongs on the execution path, as the statement node directly associated with the data flow of the variable, a variable that has an operational relationship with the variable in each element node corresponding to the statement node directly associated with the data flow of the variable, as the relevant quantity of the variable, and determine the data flow path of the variable on the execution path based on the statement node corresponding to the parent node of the element node to which the variable belongs on the execution path, and the statement node corresponding to the parent node of the element node to which the relevant quantity of the variable belongs on the execution path.

[0138] Optionally, the code attribute graph determination module 204 is specifically used to determine the static single assignment code of the program to be analyzed based on the standard syntax tree, perform control flow analysis and data flow analysis on the static single assignment code respectively, determine the control flow graph and data flow graph of the program to be analyzed, integrate the control flow edges in the control flow graph and the data flow edges in the data flow graph with the edges in the standard syntax tree, and determine the code attribute graph.

[0139] This specification also provides a computer-readable storage medium, which stores a computer program, which can be used to execute the above Figure 1 Provides program analysis methods.

[0140] This manual also provides Figure 5 The schematic structure diagram of the electronic device shown in FIG. Figure 5 As mentioned above, at the hardware level, the electronic device includes a processor, an internal bus, a network interface, a memory, and a non-volatile memory, and may also include other hardware required for the business. The processor reads the corresponding computer program from the non-volatile memory into the memory and then runs it to achieve the above Figure 1 Of course, in addition to the software implementation, this specification does not exclude other implementations, such as logic devices or a combination of software and hardware, etc., that is, the execution subject of the following processing flow is not limited to each logic unit, but can also be hardware or logic devices.

[0141] In the 1990s, improvements to a technology could be clearly distinguished as hardware improvements (for example, improvements to the circuit structure of diodes, transistors, switches, etc.) or software improvements (improvements to the method flow). However, with the development of technology, many improvements to the method flow today can be regarded as direct improvements to the hardware circuit structure. Designers almost always obtain the corresponding hardware circuit structure by programming the improved method flow into the hardware circuit. Therefore, it cannot be said that an improvement in a method flow cannot be implemented using a hardware entity module. For example, a programmable logic device (PLD) (such as a field programmable gate array (FPGA)) is such an integrated circuit whose logical function is determined by the user's programming of the device. Designers can "integrate" a digital system on a PLD by programming it themselves, without having to ask a chip manufacturer to design and produce a dedicated integrated circuit chip. Moreover, nowadays, instead of manually making integrated circuit chips, this kind of programming is mostly implemented by "logic compiler" software, which is similar to the software compiler used when developing and writing programs, and the original code before compilation must also be written in a specific programming language, which is called hardware description language (HDL). There is not only one HDL, but many kinds, such as ABEL (Advanced Boolean Expression Language), AHDL (Altera Hardware Description Language), Confluence, CUPL (Cornell University Programming Language), HDCal, JHDL (Java Hardware Description Language), Lava, Lola, MyHDL, PALASM, RHDL (Ruby Hardware Description Language), etc. The most commonly used ones are VHDL (Very-High-Speed ​​Integrated Circuit Hardware Description Language) and Verilog. Those skilled in the art should also know that it is only necessary to program the method flow slightly in the above-mentioned hardware description languages ​​and program it into the integrated circuit, and then it is easy to obtain the hardware circuit that implements the logic method flow.

[0142] The controller can be implemented in any appropriate manner, for example, the controller can take the form of a microprocessor or processor and a computer-readable medium storing a computer-readable program code (such as software or firmware) that can be executed by the (micro)processor, a logic gate, a switch, an application-specific integrated circuit (ASIC), a programmable logic controller, and an embedded microcontroller. Examples of controllers include, but are not limited to, the following microcontrollers: ARC 625D, Atmel AT91SAM, Microchip PIC18F26K20, and Silicone Labs C8051F320. The memory controller can also be implemented as part of the control logic of the memory. Those skilled in the art also know that in addition to implementing the controller in a purely computer-readable program code manner, the controller can be implemented in the form of a logic gate, a switch, an application-specific integrated circuit, a programmable logic controller, and an embedded microcontroller by logically programming the method steps. Therefore, this controller can be considered as a hardware component, and the devices included therein for implementing various functions can also be regarded as structures within the hardware component. Or even, the devices for implementing various functions can be regarded as both software modules for implementing the method and structures within the hardware component.

[0143] The systems, devices, modules or units described in the above embodiments may be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer. Specifically, the computer may be, for example, a personal computer, a laptop computer, a cellular phone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or a combination of any of these devices.

[0144] For the convenience of description, the above device is described in various units according to their functions. Of course, when implementing this specification, the functions of each unit can be implemented in the same or multiple software and / or hardware.

[0145] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0146] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0147] These computer program instructions may also be stored in a computer readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0148] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process in the computer or other programmable device. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0149] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0150] The memory may include non-permanent storage in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0151] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0152] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0153] Those skilled in the art will appreciate that the embodiments of this specification may be provided as methods, systems or computer program products. Therefore, this specification may take the form of a complete hardware embodiment, a complete software embodiment or an embodiment combining software and hardware. Moreover, this specification may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0154] This specification may be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform specific tasks or implement specific abstract data types. This specification may also be practiced in distributed computing environments where tasks are performed by remote processing devices connected through a communication network. In a distributed computing environment, program modules may be located in local and remote computer storage media, including storage devices.

[0155] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0156] The above description is only an embodiment of the present specification and is not intended to limit the present specification. For those skilled in the art, the present specification may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present specification shall be included in the scope of the claims of the present specification.

Claims

1. A program analysis method, comprising: Determine a program to be analyzed, and determine an abstract syntax tree of the program to be analyzed by using a compiler corresponding to a programming language used by the program to be analyzed; Standardizing the nodes in the abstract syntax tree to determine a standard syntax tree; Performing control flow analysis and data flow analysis on the program to be analyzed through the standard syntax tree, determining each control flow edge and each data flow edge in the standard syntax tree, adding each control flow edge and each data flow edge to the standard syntax tree, and determining a code attribute graph of the program to be analyzed; In response to a user's query operation on the code property graph, a query result is returned, so that the user can analyze program vulnerabilities based on the query result.

2. The method according to claim 1, wherein the nodes in the standard syntax tree are standard nodes, and the standard nodes include statement nodes representing program statement types; Performing control flow analysis and data flow analysis on the program to be analyzed by using the standard syntax tree, determining each control flow edge and each data flow edge in the standard syntax tree, adding each control flow edge and each data flow edge to the standard syntax tree, and determining a code attribute graph of the program to be analyzed, specifically includes: According to the standard syntax tree, control flow analysis is performed on the program to be analyzed to determine the control flow edges between the statement nodes in the standard syntax tree; Adding each determined control flow edge to the standard syntax tree to determine an initial attribute graph; According to the initial attribute graph, data flow analysis is performed on the program to be analyzed to determine the data flow edges between the statement nodes in the standard syntax tree; The determined data flow edges are added to the initial attribute graph to obtain a code attribute graph.

3. The method according to claim 2, wherein the standard nodes further include control flow nodes, the control flow nodes being used to represent grammatical components that change the order of execution of a program sequence; According to the standard syntax tree, control flow analysis is performed on the program to be analyzed to determine the control flow edges between statement nodes in the standard syntax tree, specifically including: The standard syntax tree is traversed in depth first, and the control flow edges between the statement nodes in the standard syntax tree are determined according to the traversal order of the standard nodes in the standard syntax tree and the control flow nodes included in the standard syntax tree.

4. The method according to claim 3, wherein the child nodes of the control flow node are statement nodes, and the control types of the control flow node are judgment, loop and jump; Performing a depth-first traversal on the standard syntax tree, and determining the control flow edges between the statement nodes in the standard syntax tree according to the traversal order of the standard nodes in the standard syntax tree and the control flow nodes included in the standard syntax tree, specifically includes: Performing a depth-first traversal on the standard syntax tree, and determining, for each statement node traversed, whether the parent node of the statement node is a control flow node; If yes, determine the control flow edge corresponding to the statement node according to the control type of the parent node of the statement node; If not, determine the control flow edge between the statement node and the next statement node traversed.

5. The method according to claim 2, wherein the child nodes of the statement node are element nodes representing components of the program statement; According to the initial attribute graph, data flow analysis is performed on the program to be analyzed to determine the data flow edges between the statement nodes in the standard syntax tree, specifically including: Determining each execution path of the program to be analyzed according to each control flow edge in the initial attribute graph; For each execution path, determine the element node on the execution path according to the descendant nodes of the statement node corresponding to the execution path; Determine each variable contained in the element node on the execution path, and for each variable, determine the data flow path of the variable on the execution path according to the statement node corresponding to the parent node of the element node to which the variable belongs on the execution path; According to the data flow paths of the variables on the execution paths, the data flow edges between the statement nodes corresponding to the element nodes to which the variables on the execution paths belong are determined.

6. The method according to claim 5, determining the data flow path of the variable on the execution path according to the statement node corresponding to the parent node of the element node to which the variable belongs on the execution path, specifically comprises: According to the statement node corresponding to the parent node of the element node to which the variable belongs on the execution path, the statement node directly associated with the data flow of the variable is used; In each element node corresponding to the statement node directly associated with the variable data flow, a variable having an operation relationship with the variable is determined as a related quantity of the variable; The data flow path of the variable on the execution path is determined based on the statement node corresponding to the parent node of the element node to which the variable belongs on the execution path, and the statement node corresponding to the parent node of the element node to which the related quantity of the variable belongs on the execution path.

7. The method according to claim 1, performing control flow analysis and data flow analysis on the program to be analyzed through the standard syntax tree, determining each control flow edge and each data flow edge in the standard syntax tree, adding each control flow edge and each data flow edge to the standard syntax tree, and determining a code attribute graph of the program to be analyzed, specifically comprising: Determining the static single assignment code of the program to be analyzed according to the standard syntax tree; Performing control flow analysis and data flow analysis on the static single assignment code respectively to determine a control flow graph and a data flow graph of the program to be analyzed; The control flow edges in the control flow graph and the data flow edges in the data flow graph are integrated with the edges in the standard syntax tree to determine a code attribute graph.

8. A program analysis device, comprising: An abstract syntax tree determination module determines a program to be analyzed, and determines an abstract syntax tree of the program to be analyzed by using a compiler corresponding to a programming language used by the program to be analyzed; A standardization module, which standardizes the nodes in the abstract syntax tree to determine a standard syntax tree; A code attribute graph determination module performs control flow analysis and data flow analysis on the program to be analyzed through the standard syntax tree, determines each control flow edge and each data flow edge in the standard syntax tree, adds each control flow edge and each data flow edge to the standard syntax tree, and determines a code attribute graph of the program to be analyzed; The analysis module returns the query result in response to the user's query operation on the code property graph, so that the user can analyze the program vulnerability based on the query result.

9. A computer-readable storage medium, wherein the storage medium stores a computer program, and when the computer program is executed by a processor, the method according to any one of claims 1 to 7 is implemented.

10. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the method according to any one of claims 1 to 7 when executing the program.

Images