A program analysis method and device, readable storage medium and electronic equipment

Abstract

The specification discloses a program analysis method and device, a readable storage medium and an electronic device. A program to be analyzed is determined, an abstract syntax tree of the program to be analyzed is determined through a compiler corresponding to a programming language used by the program to be analyzed, nodes in the abstract syntax tree are standardized, and a standard syntax tree is determined. Each control flow edge and each data flow edge in the standard syntax tree are determined, each control flow edge and each data flow edge are added to the standard syntax tree, and a code property graph of the program to be analyzed is determined. The abstract syntax trees of the programs to be analyzed in different programming languages are unified by converting the abstract syntax tree into the standard syntax tree, and the code property graph is constructed based on the standard syntax tree, so that the method can be applied to program analysis of programs to be analyzed in various programming languages, different analysis algorithms no longer need to be developed for different programming languages, the efficiency of program analysis is improved, and the development cost is reduced.

Description

TECHNICAL FIELD

[0001] The present specification relates to the technical field of computer technology, and in particular, to a program analysis method and device, a readable storage medium, and an electronic device. BACKGROUND

[0002] Program analysis is crucial for discovering program vulnerabilities such as syntax errors, security vulnerabilities, and deep nesting, and improving program security and program efficiency.

[0003] In the compilation process, after the compiler performs syntax analysis on the source code of a program, an abstract syntax tree (AST) representing the syntax structure of the program is generated, and the abstract syntax tree is further converted into executable machine code. The abstract syntax tree is a tree-structured program intermediate representation generated in the program compilation process. Each node of the abstract syntax tree represents a syntax component in the source code, such as a function declaration node, a control flow node, a statement node, and an element node. The edges of the abstract syntax tree represent the logical relationships between the syntax components. The tree structure of the abstract syntax tree clearly reflects the syntax hierarchy of the program. Based on the abstract syntax tree, the logical relationship, control flow, and data flow of the program can be analyzed to obtain a relatively intuitive analysis result.

[0004] However, due to differences in syntax rules of different programming languages, the abstract syntax trees representing the syntax structure generated in the compilation process of different programming languages are also different. When analyzing the logical relationship, control flow, and data flow of a program, the analysis algorithm for one programming language cannot be reused in other types of programming languages. Therefore, in the current program analysis, specific analysis algorithms need to be developed for different programming languages, which reduces the efficiency of program analysis and increases the development cost in the program analysis process.

[0005] Therefore, the present specification provides a program analysis method. SUMMARY

[0006] The present specification provides a program analysis method, device, readable storage medium, and electronic device to partially solve the above problems existing in the prior art.

[0007] The present specification adopts the following technical solutions:

[0008] The present specification provides a program analysis method, comprising:

[0009] determining an abstract syntax tree of a program to be analyzed by a compiler corresponding to a programming language used by the program to be analyzed;

[0010] standardizing the nodes in the abstract syntax tree to determine a standard syntax tree;

[0011] performing control flow analysis and data flow analysis on the program to be analyzed according to the standard syntax tree, determining control flow edges and data flow edges in the standard syntax tree, adding the control flow edges and the data flow edges to the standard syntax tree, and determining a code property graph of the program to be analyzed;

[0012] In response to a query operation of the user on the code property graph, a query result is returned to enable the user to analyze program vulnerabilities based on the query result.

[0013] Optionally, the nodes in the standard syntax tree are standard nodes, and the standard nodes include statement nodes representing types of program statements.

[0014] performing control flow analysis and data flow analysis on the program to be analyzed according to the standard syntax tree, determining control flow edges and data flow edges in the standard syntax tree, adding the control flow edges and the data flow edges to the standard syntax tree, and determining a code property graph of the program to be analyzed, and specifically comprising:

[0015] performing control flow analysis on the program to be analyzed according to the standard syntax tree, and determining control flow edges between the statement nodes in the standard syntax tree;

[0016] adding the determined control flow edges to the standard syntax tree to determine an initial property graph;

[0017] performing data flow analysis on the program to be analyzed according to the initial property graph, and determining data flow edges between the statement nodes in the standard syntax tree;

[0018] adding the determined data flow edges to the initial property graph to obtain a code property graph.

[0019] Optionally, the standard nodes further include control flow nodes for representing syntax components that change an execution order of the program.

[0020] performing control flow analysis on the program to be analyzed according to the standard syntax tree, and determining control flow edges between the statement nodes in the standard syntax tree, and specifically comprising:

[0021] performing depth-first traversal on the standard syntax tree, and determining the control flow edges between the statement nodes in the standard syntax tree according to a traversal order of the standard nodes in the standard syntax tree and control flow nodes included in the standard syntax tree.

[0022] Optionally, a child node of the control flow node is a statement node, and a control type of the control flow node is divided into judgment, loop, and jump.

[0023] performing a depth-first traversal on the standard syntax tree, determining control flow edges between statement nodes in the standard syntax tree according to an order of traversing each standard node in the standard syntax tree and control flow nodes contained in the standard syntax tree, specifically comprising:

[0024] performing a depth-first traversal on the standard syntax tree, and for each statement node traversed in turn, determining whether a parent node of the statement node is a control flow node;

[0025] if yes, determining a control flow edge corresponding to the statement node according to a control type of the parent node of the statement node;

[0026] if no, determining a control flow edge between the statement node and a next statement node traversed.

[0027] Optionally, the child nodes of the statement node are element nodes representing components of a program statement;

[0028] performing data flow analysis on the program to be analyzed according to the initial attribute graph, determining data flow edges between statement nodes in the standard syntax tree, specifically comprising:

[0029] determining each execution path of the program to be analyzed according to each control flow edge in the initial attribute graph;

[0030] for each execution path, determining element nodes on the execution path according to descendant nodes of a statement node corresponding to a parent node of the element nodes on the execution path;

[0031] determining each variable contained in the element nodes on the execution path, and for each variable, determining a data flow path of the variable on the execution path according to a statement node corresponding to a parent node of an element node to which the variable belongs on the execution path;

[0032] determining data flow edges between statement nodes corresponding to element nodes to which variables on each execution path belong according to the data flow paths of the variables on the execution path.

[0033] Optionally, determining the data flow path of the variable on the execution path according to the statement node corresponding to the parent node of the element node to which the variable belongs on the execution path, specifically comprising:

[0034] taking the statement node corresponding to the parent node of the element node to which the variable belongs on the execution path as a statement node directly associated with data flow of the variable;

[0035] determining, among each element node corresponding to the statement node directly associated with data flow of the variable, a variable having an operation relationship with the variable as a related variable of the variable;

[0036] According to the statement node corresponding to the parent node of the element node to which the variable belongs on the execution path, and the statement node corresponding to the parent node of the element node to which the related quantity of the variable belongs on the execution path, a data flow path of the variable on the execution path is determined.

[0037] Optionally, the standard syntax tree is used to perform control flow analysis and data flow analysis on the program to be analyzed, to determine each control flow edge and each data flow edge in the standard syntax tree, and the each control flow edge and the each data flow edge are added to the standard syntax tree, so as to determine a code attribute graph of the program to be analyzed, and the code attribute graph specifically includes the following steps.

[0038] According to the standard syntax tree, a static single assignment code of the program to be analyzed is determined.

[0039] The static single assignment code is subjected to control flow analysis and data flow analysis respectively, to determine a control flow graph and a data flow graph of the program to be analyzed.

[0040] The control flow edges in the control flow graph and the data flow edges in the data flow graph are integrated with the edges in the standard syntax tree, to determine a code attribute graph.

[0041] The present specification provides a program analysis device, and the device comprises:

[0042] An abstract syntax tree determination module is configured to determine an abstract syntax tree of a program to be analyzed by using a compiler corresponding to a programming language used by the program to be analyzed.

[0043] A standardization module is configured to standardize nodes in the abstract syntax tree, to determine a standard syntax tree.

[0044] A code attribute graph determination module is configured to perform control flow analysis and data flow analysis on the program to be analyzed by using the standard syntax tree, to determine each control flow edge and each data flow edge in the standard syntax tree, and the each control flow edge and the each data flow edge are added to the standard syntax tree, so as to determine a code attribute graph of the program to be analyzed.

[0045] An analysis module is configured to return a query result in response to a query operation of a user on the code attribute graph, so that the user analyzes program vulnerabilities based on the query result.

[0046] The present specification provides a computer readable storage medium, and the storage medium stores a computer program, and the computer program is executed by a processor to implement any of the above program analysis methods.

[0047] The electronic device provided in the specification comprises a memory, a processor, and a computer program stored in the memory and executable on the processor, and the processor implements the program analysis method of any of the above when executing the program.

[0048] The above at least one technical solution adopted in the specification can achieve the following beneficial effects:

[0049] In the program analysis method provided in the specification, the program to be analyzed is determined, the abstract syntax tree of the program to be analyzed is determined through the compiler corresponding to the programming language used by the program to be analyzed, the nodes in the abstract syntax tree are standardized to determine the standard syntax tree. Through the standard syntax tree, each control flow edge and each data flow edge in the standard syntax tree are determined, each control flow edge and each data flow edge are added to the standard syntax tree, and the code property graph of the program to be analyzed is determined. In the method, the abstract syntax trees of the programs to be analyzed in different programming languages are unified by converting the abstract syntax tree into the standard syntax tree, and the code property graph is constructed based on the standard syntax tree. The code property graph contains the logical relationship between each syntax component of the program to be analyzed, the execution order of each statement of the program to be analyzed, or the flow direction of data in the program to be analyzed, so that the method can be applied to program analysis of programs to be analyzed in various programming languages. When the program analysis is performed by the method, different analysis algorithms do not need to be developed for different programming languages, the efficiency of program analysis is improved, and the development cost is reduced. BRIEF DESCRIPTION OF DRAWINGS

[0050] The drawings described herein are used to provide further understanding of the specification, constitute a part of the specification, the illustrative embodiments of the specification and the description thereof are used to explain the specification, and do not constitute an improper limitation on the specification. In the drawings

[0051] In the drawings:

[0052] Figure 1 The flowchart of the program analysis method provided in the specification is shown;

[0053] Figure 2 The schematic diagram of the code property graph provided in the embodiment of the specification is shown;

[0054] Figure 3 The program analysis principle provided in the specification is shown;

[0055] Figure 4 The schematic diagram of the program analysis device provided in the specification is shown;

[0056] Figure 5 The schematic diagram of the electronic device provided in the specification corresponding to Figure 1 is shown. DETAILED DESCRIPTION

[0057] For the purposes of the present description, the technical solutions and advantages, the technical solutions of the present description will be described in detail below with reference to specific embodiments of the present description and corresponding drawings. Obviously, the described embodiments are only a part of the embodiments of the present description, not all embodiments. Based on the embodiments in the present description, all other embodiments obtained by those of ordinary skill in the art without creative labor fall within the scope of protection of the present description.

[0058] The technical solutions provided by the embodiments of the present description will be described in detail below with reference to the drawings.

[0059] Figure 1 For the flowchart of the program analysis method provided in the present description, the specific steps include the following steps:

[0060] S100: Determine the program to be analyzed, and determine the abstract syntax tree of the program to be analyzed through the compiler corresponding to the programming language used by the program to be analyzed.

[0061] All steps in the program analysis method provided in the present description can be realized by any electronic device with computing function, such as terminal, server and the like. In order to facilitate description, the program analysis method provided in the present description will be described below by taking the server as the execution subject.

[0062] The program analysis method provided in the present description is compatible with various different types of programming languages, so the program to be analyzed determined by the server can be a program in any programming language.

[0063] After determining the program to be analyzed, the server performs syntax analysis on the source code of the program to be analyzed through the compiler corresponding to the programming language used by the program to be analyzed, and determines the abstract syntax tree of the program to be analyzed. The nodes of the abstract syntax tree represent the syntax components in the programming language used by the program to be analyzed. The edges between the nodes in the abstract syntax tree reflect the logical relationship between the syntax components represented by the nodes through the parent-child relationship between the nodes in the tree structure.

[0064] The nodes of the abstract syntax tree have various types, and each syntax component in the programming language used by the program to be analyzed has a corresponding type of node, such as function declaration node, control flow node, statement node, element node and the like. The control flow node is used to represent the syntax structure that changes the execution order of the program, and the statement node is used to represent the type of the program statement. The element node is used to represent the components of the statement, such as variable, operator, variable type declaration and the like.

[0065] In the abstract syntax tree, the child nodes of the control flow node are statement nodes. The descendant nodes of the statement node are element nodes. The depth of the sub-tree rooted at the statement node is related to the complexity of the program statement corresponding to the statement node. The descendant nodes of the statement node are all the nodes that can be reached by traversing deeper along the direction of the child nodes of the statement node. The descendant nodes of the statement node are composed of the child nodes of the statement node and the descendant nodes of the child nodes of the statement node.

[0066] Because in the compilation process of various programming languages, the compilers of various programming languages will first parse the program code into an abstract syntax tree and then further convert it into executable machine code, that is, the generation of an abstract syntax tree is a common process in the compilation process of various programming languages. Therefore, the abstract syntax tree can become the basis of the program analysis method compatible with various programming languages in this specification.

[0067] S102: Standardizing the nodes in the abstract syntax tree to determine a standard syntax tree.

[0068] In order to eliminate the differences of different programming languages from the abstract syntax tree, the server determines a standard syntax tree according to the standardization of the abstract syntax tree.

[0069] Specifically, the server maps the nodes of the abstract syntax tree to standard nodes according to a mapping rule to obtain a standard syntax tree. The mapping rule specifies the correspondence between the nodes of the abstract syntax trees of various programming languages and the standard nodes. The abstract syntax tree is used to reflect the syntax structure of a program. Due to the differences in the syntax rules of different programming languages, the nodes in the abstract syntax trees of different programming languages are different. For nodes of the same semantics that are included in at least two programming languages, the nodes of the same semantics corresponding to each programming language are mapped to the same standard node in the mapping rule. For a syntax component specific to a certain programming language, the node of the syntax component is specified to correspond to a standard node in the mapping rule.

[0070] For example, in Java, there is an import declaration syntax, and there is no pointer syntax, while in C++, there is a pointer syntax, but there is no import declaration syntax. Therefore, in the mapping rule, both the standard node corresponding to the import declaration syntax and the standard node corresponding to the pointer syntax are specified.

[0071] The specific form of the mapping rule is not limited in this specification, as long as the mapping rule specifies the standard nodes corresponding to the syntax components of various programming languages, and the abstract syntax trees of different programming languages can be standardized according to the mapping rule.

[0072] The server can identify the abstract syntax tree of the to-be-analyzed program in any programming language according to the mapping rule, determine the standard nodes of each node in the abstract syntax tree, and replace the standard nodes of each node in the abstract syntax tree with the nodes of the standard syntax tree, so as to unify the syntax structure of the abstract syntax tree of the to-be-analyzed program and obtain the standard syntax tree of the to-be-analyzed program.

[0073] The standard syntax tree is a standardized expression of the abstract syntax tree, and does not change the semantics of the abstract syntax tree, but only standardizes the names of the nodes contained in the abstract syntax tree. Therefore, the standard nodes in the standard syntax tree also contain various types of nodes such as function declaration nodes, control flow nodes, statement nodes, and element nodes in the abstract syntax tree.

[0074] In subsequent program analysis, the server only needs to determine an analysis algorithm applicable to the standard syntax tree, so as to implement program analysis tasks of programs in various programming languages and improve the efficiency of program analysis.

[0075] S104: Perform control flow analysis and data flow analysis on the to-be-analyzed program through the standard syntax tree, determine each control flow edge and each data flow edge in the standard syntax tree, add the control flow edges and the data flow edges to the standard syntax tree, and determine the code property graph of the to-be-analyzed program.

[0076] The code property graph (CPG) is a joint representation of the standard syntax tree, the control flow graph, and the data flow graph. In the code property graph, three types of edges corresponding to the standard syntax tree, the control flow graph, and the data flow graph are included, which are used to represent the logical relationship between the syntax components of the to-be-analyzed program, the execution order of the statements of the to-be-analyzed program, and the flow direction of the data in the to-be-analyzed program.

[0077] The server can construct the code property graph by adding the control flow edges in the control flow graph and the data flow edges in the data flow graph to the standard syntax tree. The control flow edges are used to represent the execution order of the program, and the data flow edges are used to represent the flow direction of the data in the program.

[0078] First, the server performs control flow analysis on the to-be-analyzed program according to the standard syntax tree, and determines the control flow edges between the statement nodes in the standard syntax tree. The control flow reflects the execution order of the program statements, so the control flow edges are the edges between the statement nodes.

[0079] In one or more embodiments of the present specification, the server performs a depth-first traversal on the standard syntax tree, determines the control flow edges between the statement nodes in the standard syntax tree according to the traversal order of the standard nodes in the standard syntax tree and the control flow nodes contained in the standard syntax tree.

[0080] In a standard syntax tree, control flow nodes are used to represent syntactic structures that change the execution order of a program. Generally, based on the different syntactic structures they correspond to, control flow nodes can be divided into three control types: conditional statements, loops, and jumps.

[0081] If a program does not have a syntax structure corresponding to a control flow node, the program statements are executed sequentially according to the order in which they are written. If a program has a syntax structure corresponding to a control flow node, the execution process becomes more diverse, with multiple execution paths.

[0082] A depth-first traversal of the standard syntax tree determines the program statements corresponding to each statement node in the traversal order, which represents the order of the program statements in sequential execution. The child nodes of a control flow node are the statement nodes corresponding to that control flow node. At the statement nodes corresponding to control flow nodes, the program's execution path will branch.

[0083] The server can determine control flow edges during traversal. That is, the server performs a depth-first traversal of the standard syntax tree, and for each statement node encountered, it determines whether the parent node of that statement node is a control flow node.

[0084] If so, then determine the control flow edge corresponding to the statement node based on the control type of the parent node of the statement node.

[0085] Specifically, the server determines the control type of the control flow node based on its parent node. When the parent node's control type is a conditional statement, the execution relationships between the child nodes of this control flow node are mutually exclusive, and each child node corresponds to one execution path. If the statement is executed, the server will not execute the statements corresponding to the other child nodes of this control flow node, and the server will determine the control flow edge between this statement node and the next statement node that is not a child node of this control flow node.

[0086] When the control type of the parent node of this statement node is loop, it means that the execution of the program statement corresponding to this statement node is either executed or not executed. Generally, the program statement is executed if the loop condition is met, and not executed if the loop condition is not met, regardless of the number of loop iterations. Therefore, the control flow edges between this statement node and the next statement node traversed, as well as the control flow edges between the previous statement node and the next statement node traversed, are considered.

[0087] When the control type of the parent node of the statement node is jump, the server determines the element node representing the jump target of the statement node in the child nodes of the statement node, i.e., the element nodes representing the components of the statement, and determines the statement node corresponding to the jump target according to the element node representing the jump target of the statement node, so as to determine the control flow edge between the statement node and the statement node corresponding to the jump target of the statement node.

[0088] Secondly, the server adds the determined control flow edges to the standard syntax tree to determine an initial attribute graph. According to the initial attribute graph, the server performs data flow analysis on the program to be analyzed to determine data flow edges between the statement nodes in the standard syntax tree. The data flow reflects the flow of data between the program statements, so the data flow edges are also edges between the statement nodes.

[0089] In one or more embodiments of the present specification, the server determines each execution path of the program to be analyzed according to the control flow edges in the initial attribute graph. For each execution path, the server determines the element nodes on the execution path according to the descendant nodes of the statement nodes corresponding to the execution path. The descendant nodes of the statement nodes represent the components of the program statements corresponding to the statement nodes, and the descendant nodes of the statement nodes include standard nodes representing variables, standard nodes representing operators, and the like.

[0090] The server determines each variable included in the element nodes on the execution path according to the element nodes corresponding to the statement nodes on the execution path. In each program statement, the variable represents data information, and the transmission path of the variable between the program statements constitutes the data flow.

[0091] Therefore, for each variable, the server determines the data flow path of the variable on the execution path according to the statement nodes corresponding to the parent nodes of the element nodes to which the variable belongs on the execution path. According to the data flow paths of the variables on each execution path, the server determines the data flow edges between the statement nodes corresponding to the element nodes to which the variables belong on the execution path.

[0092] Specifically, the server connects the statement nodes corresponding to each data flow path according to the direction of each data flow path, i.e., obtains each data flow edge.

[0093] Finally, the server adds the determined data flow edges to the initial attribute graph to obtain a code attribute graph. Therefore, in the code attribute graph, both the edges in the standard syntax tree and the control flow edges and the data flow edges are added, and the server can analyze the program logic, execution order, or data flow of the program to be analyzed according to the code attribute graph.

[0094] Figure 2 A schematic diagram of a code attribute graph provided in an embodiment of the present specification is shown in FIG. 1.Figure 2 As shown, the rectangular nodes represent different statement nodes, and the circular nodes represent element nodes, the element nodes corresponding to the same rectangular node are used to represent the specific syntax components of the statement represented by the rectangular node. The solid arrows represent the edges of the standard syntax tree, the long dashed arrows represent the control flow edges, and the short dashed arrows represent the data flow edges. In Figure 2 In the example shown, according to the control flow edges, two program execution paths can be determined, which are the statement node 1→statement node 2→statement node 3 and the statement node 1→statement node 3. The variable x is contained in the element nodes corresponding to the statement node 1 and the statement node 3, and thus according to the direction of the control flow edges, the data flow edges from the statement node 1 to the statement node 3 can be determined.

[0095] It should be noted that the method of performing control flow analysis or data flow analysis can be various, i.e., the method of determining the control flow edges or the data flow edges can be various, and is not limited to the method provided in the above embodiment. For example, the server can also determine the control flow edges by using a node merging algorithm, a static single assignment (SSA) conversion, etc., and determine the data flow edges by using symbolic execution, reachability definition analysis, etc.

[0096] S106: In response to the user's query operation on the code property graph, return the query result, so that the user analyzes the program vulnerability based on the query result.

[0097] The code property graph determined by the server in the above steps can be stored in a database. The user can determine the queried nodes or edges according to the actual program analysis requirements. The server returns the query result in response to the user's query operation, so that the user analyzes the program vulnerability based on the query result.

[0098] For example, in some application scenarios, the user can perform program syntax error detection according to the edges of the standard syntax tree in the code property graph. The user queries whether the case statement is not ended with a break statement according to the standard nodes in the code property graph. Alternatively, the user queries the nested loops in the program to be analyzed according to the control flow edges in the code property graph, and the user optimizes the program to be analyzed according to the query result provided by the server to improve the execution speed of the program, etc.

[0099] Because the code attribute graph in the present specification is generated based on the standard syntax tree which standardizes the abstract syntax trees of different types of programming languages, the code attribute graph in the present specification is also applicable to various different programming languages, and thus, when querying the code attribute graph, different query statements need not be written for different programming languages for the same query operation, thereby reducing the workload of the user during program analysis. For example, in existing program analysis, if the user needs to query a nested loop in a program, specific query statements need to be written for different programming languages, and by applying the present method, the user only needs to write one query statement for the operation of querying the nested loop.

[0100] Figure 3 A program analysis schematic diagram is provided in the present specification. As shown in Figure 3 , the program to be analyzed can be a program in any programming language, and the abstract syntax tree of the program to be analyzed is different for different programming languages. However, after the standard syntax tree is determined, the abstract syntax trees of different types of programming languages have a unified expression, and then, based on the standard syntax tree, the data flow edges and the control flow edges are determined to obtain the code attribute graph. The user performs a query operation on the code attribute graph through a query statement to perform program analysis.

[0101] Based on the above Figure 1 , the abstract syntax tree of the program to be analyzed in different programming languages is unified by converting the abstract syntax tree into the standard syntax tree, and the code attribute graph is constructed based on the standard syntax tree. The code attribute graph has the control flow edges and the data flow edges in addition to the standard syntax tree, that is, the code attribute graph can represent the logical relationship between the syntax components of the program to be analyzed, the execution order of the statements of the program to be analyzed, or the flow direction of the data in the program to be analyzed, so that the present method can be applied to program analysis of programs to be analyzed in various programming languages. When program analysis is performed by the present method, different analysis algorithms need not be developed for different programming languages, thereby improving the efficiency of program analysis and reducing the development cost.

[0102] In step S104, the server can first perform a depth-first traversal on the standard syntax tree, and then determine the control flow edges after the traversal is completed.

[0103] In one or more embodiments of the present specification, after the traversal is completed, the server determines the node sequences composed of the statement nodes traversed in the traversal order, and determines the control flow edges between adjacent statement nodes in the node sequences.

[0104] Then, the server determines, for each statement node in the node sequence, whether a parent node of the statement node is a control flow node. If yes, the server deletes the control flow edge corresponding to the statement node determined previously, and re-determines the control flow edge corresponding to the statement node according to a control type of the parent node of the statement node. If no, the server does not change the control flow edge corresponding to the statement node.

[0105] In step S104, when determining the data flow edge, the server determines a data flow path of the variable on the execution path according to the statement node corresponding to the parent node of the element node to which the variable belongs on the execution path. That is, in the above embodiment, the determined data flow path is composed of the program statements containing the same variable.

[0106] However, with the execution of each program statement, the variable can be assigned to another variable or participate in an operation corresponding to the another variable, and in this process, the data information contained in the variable is transferred to the another variable. When the program statement containing the another variable is executed subsequently, the data information contained in the variable still flows. Therefore, in order to determine a more accurate data flow path, in one or more embodiments of the present specification, the server can also determine the data flow path according to the transfer of the data information contained in the same variable.

[0107] Specifically, the server determines, as the statement node directly associated with the data flow of the variable, the statement node corresponding to the parent node of the element node to which the variable belongs on the execution path. The data flow path determined by the statement node directly associated with the data flow of the variable is the data flow path determined in step S104.

[0108] Then, the server determines, in each element node corresponding to the statement node directly associated with the data flow of the variable, the variable having an operation relationship with the variable as the related variable of the variable. In the execution process of the program statement, the data information contained in the variable will be transferred to the related variable of the variable.

[0109] Finally, the server determines the data flow path of the variable on the execution path according to the statement node corresponding to the parent node of the element node to which the variable belongs on the execution path, and the statement node corresponding to the parent node of the element node to which the related variable of the variable belongs on the execution path.

[0110] In this way, the data flow path determined in the embodiment is composed of the statement node corresponding to the same variable and the statement node corresponding to the related variable of the same variable, and the data flow path more accurately determines the flow of data information. Based on the code property graph determined in the embodiment, more accurate program analysis can be performed.

[0111] In step S104, the control flow edges in the control flow graph are first added to the standard syntax tree, and an initial attribute graph is determined. Then, the data flow edges are added based on the initial attribute graph to determine the code attribute graph. In one or more embodiments of the present disclosure, the server can also determine the code attribute graph in the following manner.

[0112] The server first converts the standard syntax tree into a static single assignment code. Then, based on the static single assignment code of the program to be analyzed, the server determines the control flow graph and the data flow graph of the program to be analyzed, respectively.

[0113] Then, the server integrates the control flow edges in the control flow graph and the data flow edges in the data flow graph with the edges in the standard syntax tree to determine the code attribute graph.

[0114] In the static single assignment code, the program to be analyzed is divided into basic blocks (BBs), and each basic block contains one or more program statements. In the control flow graph and the data flow graph determined based on the static single assignment code, the basic blocks are used as nodes, the statements in the basic blocks are executed in sequence, the control flow edges in the control flow graph represent the execution order of the program between the basic blocks, and the data flow edges in the data flow graph represent the data flow direction between the basic blocks.

[0115] Therefore, in the control flow graph or the data flow graph, one node represents one or more program statements, but in the statement nodes of the standard syntax tree, only one program statement is represented.

[0116] Therefore, the server traverses the standard syntax tree, the control flow graph, and the data flow graph to determine the standard nodes connected by the edges in the standard syntax tree, the nodes connected by the control flow edges in the control flow graph, and the nodes connected by the data flow edges in the data flow graph.

[0117] Secondly, for each control flow edge, the server determines the first flow-out basic block and the first flow-in basic block of the control flow edge based on the two nodes connected by the control flow edge in the control flow graph, and determines the program statements contained in the first flow-out basic block and the first flow-in basic block, respectively.

[0118] In the standard syntax tree, the server determines the statement nodes corresponding to the program statements in the first flow-out basic block in sequence as the flow-out nodes according to the order of the program statements in the first flow-out basic block, and determines the statement nodes corresponding to the program statements in the first flow-in basic block in sequence as the flow-in nodes according to the order of the program statements in the first flow-in basic block.

[0119] The server determines the data flow edges between the adjacent outflow nodes corresponding to the first outflow basic block, and determines the data flow edges between the adjacent inflow nodes corresponding to the first inflow basic block. Meanwhile, the server determines the control flow edge between the last outflow node corresponding to the first outflow basic block and the first inflow node corresponding to the first inflow basic block.

[0120] For each data flow edge, the server determines the second outflow basic block and the second inflow basic block of the data flow edge according to the two nodes connected by the data flow edge in the data flow graph, and determines the program statements contained in the second outflow basic block and the second inflow basic block respectively.

[0121] In the standard syntax tree, the server determines the statement nodes corresponding to the program statements contained in the second outflow basic block in sequence according to the order of the program statements in the second outflow basic block, as the outflow nodes, and determines the statement nodes corresponding to the program statements in the second inflow basic block in sequence, as the inflow nodes.

[0122] For each inflow node corresponding to the second outflow basic block, the server determines whether there is data flow between the program statements corresponding to the inflow node and the outflow node in sequence according to the determination order of the outflow nodes. If yes, the server determines the data flow edge between the inflow node and the outflow node, and stops the determination process between the inflow node and the next outflow node. If no, the server performs the determination process between the inflow node and the next outflow node corresponding to the second outflow basic block.

[0123] When the second outflow basic block contains multiple program statements, the server determines whether there is data flow between the inflow nodes corresponding to the second outflow basic block. If yes, the server determines the data flow edge between the outflow nodes corresponding to the two program statements with data flow among the inflow nodes corresponding to the second outflow basic block.

[0124] The data flow mentioned in this embodiment has the same meaning as the data flow mentioned when determining the data flow edge in the above embodiment. The data flow can be determined according to the name of the variable, or can be determined according to the transmission of the data information contained in the same variable.

[0125] In this embodiment, the execution order of the determination process of the control flow edge and the data flow edge is not limited. The server can first determine the control flow edge, or first determine the data flow edge, or simultaneously determine the control flow edge and the data flow edge.

[0126] The server adds the determined control flow edges and data flow edges to the standard syntax tree, and obtains the code property graph.

[0127] The program analysis method provided in one or more embodiments of the present specification is based on the same idea, and the present specification also provides a corresponding program analysis device, such as Figure 4 as shown.

[0128] Figure 4 The schematic diagram of the program analysis device provided in the present specification specifically includes:

[0129] The abstract syntax tree determination module 200 is configured to standardize the nodes in the abstract syntax tree and determine a standard syntax tree.

[0130] The standardization module 202 is configured to determine the standard nodes corresponding to each original node in the abstract syntax tree according to a preset mapping rule, replace each original node with the standard node corresponding to the original node in the abstract syntax tree, and obtain the standard syntax tree of the program to be analyzed, wherein the mapping rule defines the correspondence between the original nodes and the standard nodes of the abstract syntax tree of each programming language.

[0131] The code attribute graph determination module 204 is configured to perform control flow analysis and data flow analysis on the program to be analyzed through the standard syntax tree, determine each control flow edge and each data flow edge in the standard syntax tree, add each control flow edge and each data flow edge to the standard syntax tree, and determine the code attribute graph of the program to be analyzed.

[0132] The analysis module 206 is configured to return a query result in response to a query operation of a user on the code attribute graph, so that the user analyzes program vulnerabilities based on the query result.

[0133] Optionally, the nodes in the standard syntax tree are standard nodes, the standard nodes include statement nodes representing the types of program statements, the code attribute graph determination module 204 is specifically configured to perform control flow analysis on the program to be analyzed according to the standard syntax tree, determine the control flow edges between each statement node in the standard syntax tree, add each determined control flow edge to the standard syntax tree, determine an initial attribute graph, perform data flow analysis on the program to be analyzed according to the initial attribute graph, determine the data flow edges between each statement node in the standard syntax tree, add each determined data flow edge to the initial attribute graph, and obtain the code attribute graph.

[0134] Optionally, the standard nodes further include control flow nodes, the control flow nodes are used to represent syntax components that change the execution order of a program, and the code attribute graph determination module 204 is specifically configured to perform depth-first traversal on the standard syntax tree, determine the control flow edges between each statement node in the standard syntax tree according to the traversal order of each standard node in the standard syntax tree and the control flow nodes included in the standard syntax tree.

[0135] Optionally, the sub-node of the statement node is an element node representing a component of a program statement, and the code property graph determining module 204 is specifically configured to determine each execution path of the program to be analyzed according to each control flow edge in the initial property graph, determine, for each execution path, an element node on the execution path according to a descendant node of a statement node corresponding to a parent node of the element node, determine each variable contained in the element node on the execution path, determine, for each variable, a data flow path of the variable on the execution path according to a statement node corresponding to a parent node of an element node to which the variable belongs on the execution path, and determine a data flow edge between statement nodes corresponding to the element nodes to which the variables on each execution path belong according to the data flow paths of the variables on the execution paths.

[0136] Optionally, the sub-node of the statement node is an element node representing a component of a program statement, and the code property graph determining module 204 is specifically configured to determine each execution path of the program to be analyzed according to each control flow edge in the initial property graph, determine, for each execution path, an element node on the execution path according to a descendant node of a statement node corresponding to a parent node of the element node, determine each variable contained in the element node on the execution path, determine, for each variable, a data flow path of the variable on the execution path according to a statement node corresponding to a parent node of an element node to which the variable belongs on the execution path, and determine a data flow edge between statement nodes corresponding to the element nodes to which the variables on each execution path belong according to the data flow paths of the variables on the execution paths.

[0137] Optionally, the code property graph determining module 204 is specifically configured to determine, as a statement node directly associated with data flow of the variable, a statement node corresponding to a parent node of an element node to which the variable belongs on the execution path, determine, as a related variable of the variable, a variable existing in an operation relationship with the variable in each element node corresponding to the statement node directly associated with the data flow of the variable, determine, as a related variable of the variable, a statement node corresponding to a parent node of an element node to which the variable belongs on the execution path, and determine a data flow path of the variable on the execution path according to the statement node corresponding to the parent node of the element node to which the variable belongs on the execution path and a statement node corresponding to a parent node of an element node to which the related variable of the variable belongs on the execution path.

[0138] Optionally, the code property graph determining module 204 is specifically configured to determine a static single assignment code of the program to be analyzed according to the standard syntax tree, perform control flow analysis and data flow analysis on the static single assignment code respectively, determine a control flow graph and a data flow graph of the program to be analyzed, integrate control flow edges in the control flow graph and data flow edges in the data flow graph with edges in the standard syntax tree, and determine a code property graph.

[0139] The specification also provides a computer readable storage medium storing a computer program, the computer program being used to execute the above Figure 1 program analysis method.

[0140] The specification also provides Figure 5 The schematic structural diagram of the electronic device is shown. As Figure 5 As described above, at the hardware level, the electronic device includes a processor, an internal bus, a network interface, a memory, and a non-volatile memory, and of course can also include other hardware required by the business. The processor reads the corresponding computer program from the non-volatile memory into the memory and then runs to implement the above Figure 1 The program analysis method described above. Of course, in addition to the software implementation, the specification does not exclude other implementation manners, such as logic devices or a combination of software and hardware, and the like, that is, the execution subject of the following processing flow is not limited to each logic unit, but can also be hardware or a logic device.

[0141] In the 1990s, it was quite obvious to distinguish whether an improvement in a technology was in hardware (e.g., improvement in circuit structures of diodes, transistors, switches, etc.) or in software (improvement in method flow). However, as technology has evolved, many improvements in method flow today can be considered as direct improvements in hardware circuit structures. Designers almost always obtain the corresponding hardware circuit structures by programming the improved method flow into hardware circuits. Therefore, it cannot be said that an improvement in a method flow cannot be implemented by hardware entity modules. For example, a programmable logic device (PLD) (e.g., a field programmable gate array (FPGA)) is an integrated circuit whose logic function is determined by user programming of the device. A digital system is "integrated" on a PLD by the designer programming it, rather than by asking a chip manufacturer to design and fabricate a custom integrated circuit chip. Moreover, instead of manually fabricating integrated circuit chips, this programming is now mostly implemented by "logic compiler" software, which is similar to software compilers used in program development, and the original code to be compiled is written in a specific programming language, which is called a hardware description language (HDL), and there are many such languages, such as ABEL (Advanced Boolean Expression Language), AHDL (Altera Hardware Description Language), Confluence, CUPL (Cornell University Programming Language), HDCal, JHDL (Java Hardware Description Language), Lava, Lola, MyHDL, PALASM, RHDL (Ruby Hardware Description Language), etc., and the most commonly used are VHDL (Very-High-Speed Integrated Circuit Hardware Description Language) and Verilog. Those skilled in the art should be aware that, as long as the method flow is logically programmed in the above-mentioned hardware description languages and programmed into an integrated circuit, a hardware circuit implementing the logical method flow can be easily obtained.

[0142] The controller can be implemented in any suitable way, for example, the controller can take the form of a microprocessor or processor and a computer readable medium storing computer readable program code, such as software or firmware, executable by the (micro)processor, logic gates, switches, an application specific integrated circuit (ASIC), a programmable logic controller and an embedded microcontroller, examples of which include but are not limited to the following microcontrollers: ARC 625D, Atmel AT91SAM, Microchip PIC18F26K20 and Silicone Labs C8051F320, the memory controller can also be implemented as part of the control logic of the memory. Those skilled in the art will also know that, in addition to being implemented in pure computer readable program code, the controller can equally well be implemented to perform the same functions using logic gates, switches, an application specific integrated circuit, a programmable logic controller and an embedded microcontroller, etc. by means of a logical programming of the method steps. The controller can thus be considered as a hardware component, and the means comprised therein for performing the various functions can be considered as structures within the hardware component. Alternatively, the means for performing the various functions can even be considered as both a software module implementing the method and a structure within the hardware component.

[0143] The systems, apparatuses, modules or units illustrated by the above embodiments can be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer. Specifically, the computer can be a personal computer, a laptop computer, a cellular phone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or a combination of any of these devices.

[0144] For the sake of description, the above apparatuses are described in various units by functions respectively. Of course, the functions of each unit can be implemented in the same or multiple software and / or hardware in implementing the present specification.

[0145] Those skilled in the art will understand that the embodiments of the present application can be provided as a method, a system or a computer program product. Therefore, the present application can take the form of a complete hardware embodiment, a complete software embodiment or an embodiment combining software and hardware aspects. Moreover, the present application can take the form of a computer program product implemented on one or more computer usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) containing computer usable program code.

[0146] The computer program instructions can also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer-implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart block or blocks. Figure 1 one or more flowcharts and / or blocks in the flowcharts and / or combination thereof. Figure 1 one or more flowcharts and / or blocks in the flowcharts and / or combination thereof.

[0147] The computer program instructions can also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer-implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart block or blocks. Figure 1 one or more flowcharts and / or blocks in the flowcharts and / or combination thereof. Figure 1 one or more flowcharts and / or blocks in the flowcharts and / or combination thereof.

[0148] The computer program instructions can also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer-implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart block or blocks. Figure 1 one or more flowcharts and / or blocks in the flowcharts and / or combination thereof. ​ one or more flowcharts and / or blocks in the flowcharts and / or combination thereof.

[0149] In one typical configuration, the computing device includes one or more processors (CPUs), input / output interfaces, network interfaces, and memory.

[0150] The memory can include non-persistent memory and / or volatile memory, such as random access memory (RAM) and / or cache memory, non-volatile memory, such as read-only memory (ROM), EPROM, and / or flash memory. The memory is an example of computer-readable media.

[0151] Computer-readable media includes permanent and non-permanent, movable and non-movable media that can be implemented by any method or technology to store information. The information can be computer-readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic cassette, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other non-transmission medium that can be used to store information accessible to a computing device. According to the definition herein, computer-readable media does not include transitory media such as modulated data signals and carriers.

[0152] It should also be noted that the terms "comprising", "comprising" or any other variant thereof are intended to cover non-exclusive inclusion, so that a process, method, article or apparatus that includes a list of elements not only includes those elements, but also includes other elements not explicitly listed or inherent to such process, method, article or apparatus. Without more limitations, the element defined by the statement "comprising a" does not exclude the presence of additional identical elements in the process, method, article or apparatus that includes the element.

[0153] Those skilled in the art will appreciate that embodiments of the present specification can be provided as methods, systems or computer program products. Therefore, the present specification can take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment combining software and hardware aspects. Moreover, the present specification can take the form of a computer program product implemented on one or more computer-usable storage media (including, but not limited to, magnetic disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0154] The present specification can be described in the general context of computer-executable instructions, such as program modules, executed by computers. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform particular tasks or implement particular abstract data types. The present specification can also be practiced in distributed computing environments where tasks are performed by remote processing devices connected through a communication network. In a distributed computing environment, program modules can be located in both local and remote computer storage media, including storage devices.

[0155] The various embodiments described in this specification are described using a numbering of embodiments approach: these are each individually integrated contributions pertaining to different but related aspects of the description. Each of the various embodiments can stand on its own, and each can be combined with the subject matter of other embodiments to produce further embodiments. Where appropriate, therefore, the contents of the specification can be regarded as being incorporated by reference, including the description, drawings, claims, abstract and the like.

[0156] The above only describes the embodiments of the specification and is not intended to limit the specification. The specification can have various modifications and changes for those skilled in the art. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the specification shall be included in the scope of claims of the specification.

Claims

1. A program analysis method, comprising: The program to be analyzed is identified, and the abstract syntax tree of the program is determined by the compiler corresponding to the programming language used by the program to be analyzed. The nodes in the abstract syntax tree are standardized to determine the standard syntax tree; Using the standard syntax tree, control flow analysis and data flow analysis are performed on the program to be analyzed to determine each control flow edge and each data flow edge in the standard syntax tree. These control flow edges and data flow edges are then added to the standard syntax tree to determine the code attribute graph of the program to be analyzed. The nodes in the standard syntax tree are standard nodes, and each standard node contains statement nodes representing the type of program statements. Based on the standard syntax tree, control flow analysis is performed on the program to be analyzed to determine the control flow edges between each statement node in the standard syntax tree. These determined control flow edges are then added to the standard syntax tree to determine the initial attribute graph. Based on the initial attribute graph, data flow analysis is performed on the program to be analyzed to determine the data flow edges between each statement node in the standard syntax tree. These determined data flow edges are then added to the initial attribute graph to obtain the code attribute graph. In response to a user's query operation on the code attribute graph, the query results are returned so that the user can analyze program vulnerabilities based on the query results.

2. The method as described in claim 1, wherein the standard node further comprises a control flow node, the control flow node being used to characterize syntactic components that change the execution order of the program; Based on the standard syntax tree, control flow analysis is performed on the program to be analyzed to determine the control flow edges between statement nodes in the standard syntax tree, specifically including: A depth-first traversal is performed on the standard syntax tree, and the control flow edges between statement nodes in the standard syntax tree are determined based on the traversal order of each standard node in the standard syntax tree and the control flow nodes contained in the standard syntax tree.

3. The method as described in claim 2, wherein the child nodes of the control flow node are statement nodes, and the control types of the control flow node are divided into judgment, loop, and jump; A depth-first traversal is performed on the standard syntax tree (SLT). Based on the traversal order of the standard nodes in the SLT and the control flow nodes contained in the SLT, the control flow edges between the statement nodes in the SLT are determined, specifically including: A depth-first traversal is performed on the standard syntax tree, and for each statement node encountered, it is determined whether the parent node of the statement node is a control flow node. If so, determine the control flow edge corresponding to the statement node based on the control type of the parent node of the statement node; If not, determine the control flow edge between the current statement node and the next statement node traversed.

4. The method as described in claim 1, wherein the child nodes of the statement node are element nodes that characterize the constituent components of the program statement; Based on the initial attribute graph, data flow analysis is performed on the program to be analyzed to determine the data flow edges between statement nodes in the standard syntax tree, specifically including: Based on the control flow edges in the initial attribute graph, determine the execution paths of the program to be analyzed; For each execution path, determine the element nodes on that execution path based on the descendant nodes of the statement node corresponding to that execution path; Identify the variables contained in the element nodes on the execution path. For each variable, determine the data flow path of the variable on the execution path based on the statement node corresponding to the parent node of the element node to which the variable belongs. Based on the data flow path of the variables on each execution path, determine the data flow edges between the statement nodes corresponding to the element nodes to which the variables belong on each execution path.

5. The method as described in claim 4, wherein the data flow path of the variable on the execution path is determined based on the statement node corresponding to the parent node of the element node to which the variable belongs on the execution path, specifically including: The statement node corresponding to the parent node of the element node to which the variable belongs on the execution path is taken as the statement node directly associated with the data flow of the variable. In each element node corresponding to the statement node directly associated with the data flow of the variable, determine the variables that have a computational relationship with the variable, and use them as the relevant quantities of the variable; Based on the statement node corresponding to the parent node of the element node to which the variable belongs on the execution path, and the statement node corresponding to the parent node of the element node to which the related quantity of the variable belongs on the execution path, determine the data flow path of the variable on the execution path.

6. The method as described in claim 1, wherein control flow analysis and data flow analysis are performed on the program to be analyzed using the standard syntax tree, each control flow edge and each data flow edge in the standard syntax tree is determined, and each control flow edge and each data flow edge is added to the standard syntax tree to determine the code attribute graph of the program to be analyzed, specifically including: Based on the standard syntax tree, determine the static single assignment code of the program to be analyzed; Control flow analysis and data flow analysis are performed on the static single assignment code respectively to determine the control flow graph and data flow graph of the program to be analyzed. The control flow edges in the control flow graph and the data flow edges in the data flow graph are integrated with the edges in the standard syntax tree to determine the code attribute graph.

7. A program analysis apparatus, the apparatus comprising: The abstract syntax tree determination module determines the program to be analyzed and determines the abstract syntax tree of the program to be analyzed by using the compiler corresponding to the programming language used by the program to be analyzed. The standardization module standardizes the nodes in the abstract syntax tree to determine the standard syntax tree; The code attribute graph determination module performs control flow analysis and data flow analysis on the program to be analyzed using the standard syntax tree (SLT), determines each control flow edge and each data flow edge in the SLT, and adds each control flow edge and each data flow edge to the SLT to determine the code attribute graph of the program to be analyzed. The nodes in the SLT are standard nodes, and each standard node contains statement nodes representing the type of program statements. Based on the SLT, control flow analysis is performed on the program to be analyzed to determine the control flow edges between each statement node in the SLT. The determined control flow edges are added to the SLT to determine the initial attribute graph. Based on the initial attribute graph, data flow analysis is performed on the program to be analyzed to determine the data flow edges between each statement node in the SLT. The determined data flow edges are added to the initial attribute graph to obtain the code attribute graph. The analysis module, in response to a user's query operation on the code attribute graph, returns query results so that the user can analyze program vulnerabilities based on the query results.

8. A computer-readable storage medium storing a computer program that, when executed by a processor, implements the method described in any one of claims 1 to 6.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the method described in any one of claims 1 to 6.

Images