Vulnerability detection method and device based on dynamic taint analysis and static trace analysis
By using dynamic taint analysis and static trace analysis methods in user equipment, the security vulnerabilities in user equipment are detected, and the problem of inaccurate vulnerability detection in the prior art is solved, thereby achieving higher vulnerability detection accuracy and user information security.
Patent Information
- Application Number
- CN202411704420.8
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-11-26
- Publication Date
- 2025-04-25
AI Technical Summary
The prior art is difficult to accurately detect security vulnerabilities in user equipment, resulting in malicious attackers being able to easily run malicious code on user equipment, causing security issues such as information leakage and device damage.
Vulnerability detection methods based on dynamic taint analysis and static trace analysis are adopted. By marking external input data as taint data, the propagation of taint variables is tracked during the program operation, attribute vectors and function call traces are generated, and dynamic and static analysis is used to detect security vulnerabilities.
It significantly improves the accuracy of security vulnerability detection, helps improve the security of user information, and comprehensively obtains vulnerability-related information through combining dynamic and static analysis.
Smart Images
Figure CN119885185A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to vulnerability detection, in particular, to a vulnerability detection method and device based on dynamic stain analysis and static trace analysis. Background Art
[0002] With the rapid development of the Internet, users' terminal devices are increasingly vulnerable to malicious network attacks, resulting in security issues such as user information leakage and device damage. The reason is that there are unknown security vulnerabilities in user devices, which allow malicious attackers to easily run malicious code on user devices. How to accurately detect security vulnerabilities is an urgent problem that the existing technology needs to solve. Summary of the invention
[0003] In order to solve at least one technical problem in the above-mentioned background technology, the present invention proposes a vulnerability detection method and device based on dynamic stain analysis and static trace analysis.
[0004] In order to achieve the above object, according to one aspect of the present invention, a vulnerability detection method based on dynamic taint analysis and static trace analysis is provided, the method comprising:
[0005] Mark external input data as tainted data, track the propagation of tainted variables in the program during program execution, generate attribute vectors for each tainted variable, record information about each function during program execution, and establish a function process linked list;
[0006] During the program running process, dynamic analysis is performed based on the function process linked list and the attribute vectors of each tainted variable to dynamically detect security vulnerabilities;
[0007] A function call trace and a return address trace are generated according to the function process linked list, and then after the program runs, a static analysis is performed according to the function call trace and the return address trace to perform static detection on security vulnerabilities.
[0008] Optionally, the dynamically analyzing the function process linked list and the attribute vectors of each tainted variable to dynamically detect security vulnerabilities includes:
[0009] Detect whether the characteristic attributes in the attribute vector of each tainted variable exceed the normal range. If so, determine the attribute vector as a risk variable;
[0010] Each of the function process linked lists is analyzed, and abnormal function calls are identified.
[0011] Optionally, the performing static analysis according to the function call trace and the return address trace to perform static detection on security vulnerabilities includes:
[0012] The function call trace and the return address trace are analyzed to determine whether the tainted variable propagates in violation of security rules. If so, the tainted variable is determined as a risk variable, wherein propagating in violation of security rules includes: the tainted variable propagates to an important memory area and the tainted variable calls a dangerous function.
[0013] Optionally, the step of establishing a function process linked list includes:
[0014] When a function starts executing, use a counter to record the total number of running functions;
[0015] Generate a node pointer for a new function and obtain the function's name, address, type, stack base address, and function execution order information;
[0016] Before adding the function to the linked list, determine whether the function is the first function executed by the program. If so, add it to the head of the linked list of the function process linked list. Otherwise, determine whether the function is the calling function of the running function. If so, add it to the head of the linked list of the function process linked list; otherwise, it means that the stack of the function has overwritten the stack of the previously running function, delete the overwritten function information in the function process linked list, and save the information of the function.
[0017] Optionally, generating a function call trace and a return address trace according to the function process linked list includes:
[0018] During the execution of the program, the function call instructions encountered are pushed into the call stack. When a new function call instruction is encountered, it is determined whether the new function call instruction is the next instruction after the return of an existing function call instruction in the call stack. If so, the call depth is adjusted. Otherwise, all elements from the new function call instruction to the top of the call stack are popped out of the stack, and the instruction offset and function call depth in the process of entering and exiting the stack are recorded to generate the function call trace.
[0019] Optionally, the generating a function call trace and a return address trace according to the function process linked list further includes:
[0020] Instruction offsets are sorted in the function call trace to generate the return address trace.
[0021] In order to achieve the above object, according to another aspect of the present invention, a vulnerability detection device based on dynamic stain analysis and static trace analysis is provided, the device comprising:
[0022] The taint tracking and function process linked list establishment unit is used to mark external input data as tainted data, track the propagation of tainted variables in the program during program execution, generate an attribute vector for each tainted variable, record the information of each function during program execution, and establish a function process linked list;
[0023] A dynamic analysis unit, used to perform dynamic analysis according to the function process linked list and the attribute vectors of each tainted variable during program operation, and to dynamically detect security vulnerabilities;
[0024] The static analysis unit is used to generate a function call trace and a return address trace according to the function process linked list, and then after the program is finished running, static analysis is performed according to the function call trace and the return address trace to perform static detection on security vulnerabilities.
[0025] Optionally, the dynamic analysis unit includes:
[0026] The characteristic attribute analysis module is used to detect whether the characteristic attributes in the attribute vector of each tainted variable exceed the normal range. If so, the attribute vector is determined as a risk variable;
[0027] The function process linked list analysis module is used to analyze each of the function process linked lists and identify abnormal function calls.
[0028] Optionally, the static analysis unit includes:
[0029] The illegal propagation detection module is used to analyze the function call trace and the return address trace to determine whether the tainted variable is propagated in violation of the security rules. If so, the tainted variable is determined as a risk variable, wherein the propagation in violation of the security rules includes: the tainted variable is propagated to an important memory area and the tainted variable calls a dangerous function.
[0030] Optionally, the taint tracking and function process linked list establishment unit includes:
[0031] The function total number recording module is used to use a counter to record the total number of running functions when a function starts to execute;
[0032] The node pointer generation module is used to generate a node pointer of a new function and obtain the name, address, type, running stack base address and function running order information of the function;
[0033] The judgment module is used to judge whether the function is the first function executed by the program before adding the function to the linked list. If so, it is added to the linked list head of the function process linked list. Otherwise, it is judged whether the function is the calling function of the running function. If so, it is added to the linked list head of the function process linked list; otherwise, it means that the stack of the function has overwritten the stack of the previously running function, delete the overwritten function information in the function process linked list, and save the information of the function.
[0034] Optionally, the static analysis unit includes:
[0035] A function call trace generation module is used to push the function call instructions encountered during program execution into a call stack. When encountering a new function call instruction, it is determined whether the new function call instruction is the next instruction after the return of an existing function call instruction in the call stack. If so, the call depth is adjusted. Otherwise, all elements from the new function call instruction to the top of the call stack are popped out of the stack, and the instruction offset and function call depth in the process of pushing and pulling in and out of the stack are recorded to generate the function call trace.
[0036] Optionally, the static analysis unit further includes:
[0037] The return address trace generation module is used to sort the instruction offsets in the function call trace to generate the return address trace.
[0038] In order to achieve the above-mentioned purpose, according to another aspect of the present invention, a computer device is also provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, the steps of the vulnerability detection method based on dynamic taint analysis and static trace analysis are implemented.
[0039] In order to achieve the above-mentioned purpose, according to another aspect of the present invention, a computer-readable storage medium is further provided, on which a computer program / instruction is stored, and when the computer program / instruction is executed by a processor, the steps of the vulnerability detection method based on dynamic taint analysis and static trace analysis are implemented.
[0040] In order to achieve the above-mentioned purpose, according to another aspect of the present invention, a computer program product is also provided, including a computer program / instruction, which, when executed by a processor, implements the steps of the vulnerability detection method based on dynamic taint analysis and static trace analysis.
[0041] The beneficial effects of the present invention are:
[0042] During the program running process, the present invention performs dynamic analysis based on the function process linked list and the attribute vectors of each tainted variable to dynamically detect security vulnerabilities. After the program running ends, static analysis is performed based on the function call trace and the return address trace to statically detect security vulnerabilities. The present invention combines dynamic detection and static detection, which significantly improves the accuracy of security vulnerability detection and helps to improve the security of user information. BRIEF DESCRIPTION OF THE DRAWINGS
[0043] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the prior art descriptions. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work. In the drawings:
[0044] Figure 1 is a flow chart of a vulnerability detection method based on dynamic taint analysis and static trace analysis according to an embodiment of the present invention;
[0045] Figure 2 is a flow chart of establishing a function process linked list according to an embodiment of the present invention;
[0046] Figure 3 is an overall flow chart of the vulnerability detection method according to an embodiment of the present invention;
[0047] Figure 4 It is a schematic diagram of the stain propagation method according to an embodiment of the present invention;
[0048] Figure 5 is a schematic diagram of a function tracking method according to an embodiment of the present invention;
[0049] Figure 6 It is a schematic diagram of a method for generating function call and return address traces according to an embodiment of the present invention;
[0050] Figure 7 is a schematic diagram of the risk analysis process of an embodiment of the present invention;
[0051] Figure 8 It is a structural block diagram of a vulnerability detection device based on dynamic stain analysis and static trace analysis according to an embodiment of the present invention;
[0052] Fig. 9 It is a schematic diagram of a computer device according to an embodiment of the present invention. DETAILED DESCRIPTION
[0053] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.
[0054] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.
[0055] It should be noted that the terms "including" and "having" and any variations thereof in the specification and claims of the present invention and the above-mentioned drawings are intended to cover non-exclusive inclusions. For example, a process, method, system, product or apparatus comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or apparatus.
[0056] It should be noted that, in the absence of conflict, the embodiments of the present invention and the features in the embodiments can be combined with each other. The present invention will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.
[0057] The present invention discloses a vulnerability detection method based on dynamic taint analysis and static trace analysis. In one embodiment of the present invention, the method includes: introducing external data and user-defined introduced data as tainted data as tainted sources, and constructing tainted variable attribute vectors; performing taint propagation based on different types of instructions; recording function information according to the program execution process, generating a function process linked list, and generating function call and return address traces according to the linked list content; analyzing the propagation process of tainted variables in the linked list and traces, determining whether they trigger vulnerabilities or violate propagation rules, and finding out the vulnerabilities in the program. In one embodiment of the present invention, the overall process of the method of the present invention can be as follows: Figure 3 As shown. Figure 3 As shown, the vulnerability detection method based on dynamic taint analysis and static trace analysis of the present invention specifically includes four parts: taint source introduction, taint propagation, function tracking and trace generation, and risk analysis. These four parts are introduced below respectively.
[0058] 1. Introduction of pollution sources
[0059] The introduction of tainted sources refers to the identification of tainted data. During the taint analysis process, external input data is marked as tainted data and its propagation in the program is tracked. The program obtains external input data through function calls and user-defined introductions. The type and address of tainted data are extracted by intercepting function calls, or special taint sources are added according to user or test requirements to construct taint markers and tainted variable attribute vectors.
[0060] The taint mark can indicate whether the bytes at each location in the memory are contaminated. The taint mark graph is represented as Sign(ad):
[0061]
[0062] Wherein, Sign(ad)=0 indicates that the byte at position ad is not polluted, and Sign(ad)=1 indicates that the byte at position ad is polluted.
[0063] In one embodiment of the present invention, the tainted variable attribute vector includes the address, size, tainted source address, tainted source length, and characteristic attributes required for different types of vulnerability analysis. The tainted variable attribute vector is represented as val k :
[0064] val k =[ad,size,scad,scl,spec]
[0065] Where val k Represents the attributes of the kth tainted variable; the attribute values ad, size, scad, scl, and spec correspond to address, size, pollution source address, pollution source length, and characteristic attributes respectively.
[0066] 2. Taint propagation
[0067] During the execution of the program, the pollution of the destination operand includes the following three situations: Sign(tar_ad) = Sign(sc_ad), Sign(tar_ad) | = Sign(sc_ad), and clearing the pollution of the destination operand. Among them, Sign(tar_ad) and Sign(sc_ad) respectively represent the pollution of the destination operand and the corresponding source operand. The pollution propagation method is as follows Figure 4 shown.
[0068] The type of instruction determines the possible source of pollution of the destination operand. Clearing the pollution of the destination operand will not cause new tainted variables to appear in the program. In other cases, it is necessary to determine whether the destination operand is polluted, that is, to perform the Sign(tar_ad)=0 judgment. If it is not 0, it means that the byte at the tar_ad position has been polluted, and it needs to be defined as a tainted variable, and the tainted variable attribute vector is established based on the relevant information.
[0069] 3. Function tracing and trace generation
[0070] Establish a function process linked list to track the execution of functions, and record the information of each function during the program running, including the function name, address, type, running stack base address and function running order. Function tracking methods are as follows Figure 5 shown.
[0071] Function process linked lists can be used to track and record function call information and stack information, providing basic information for vulnerability detection analysis and function trace generation. When a new function starts executing, a counter variable is used to record the total number of running functions; a node pointer for the function is generated, and the function name, address, type, running stack base address, and function running order information are obtained; before adding the function to the linked list, determine whether the function is the first function executed by the program, if so, add it to the head of the linked list; otherwise, determine whether the function is the calling function of the running function, if so, add it to the head of the linked list; otherwise, it means that the stack of the function has overwritten the stack of the previously running function, delete the overwritten function information in the linked list, and save the function information. Each time a new function is executed, the linked list is used to record the function information.
[0072] By generating a trace file based on the recorded contents of the function process linked list, the taint propagation process can be statically analyzed without executing the program to conduct risk analysis of security vulnerabilities. The trace file includes two parts: function call and return address traces. The trace generation method is as follows: Figure 6 shown.
[0073] During program execution, the function call instructions encountered are pushed into the call stack. When a new instruction is encountered, it is determined whether it is the next instruction after the return of the function call instruction in the stack. If so, the call depth is adjusted; otherwise, all elements from the instruction to the top of the stack are popped out. The instruction offset and function call depth in the stack popping process are recorded to generate a function call trace. In the function call trace, the instruction offsets are sorted to obtain the return address trace.
[0074] 4. Risk Analysis
[0075] According to the propagation of tainted variables during program operation, dynamic analysis and static analysis are combined to perform risk analysis and vulnerability detection to find possible security vulnerabilities in the program. Tainted variables are divided into security variables and risk variables according to whether they trigger vulnerabilities or violate security rules, so as to facilitate information collection. The risk analysis process of tainted variables is as follows: Figure 7 shown.
[0076] Dynamic analysis refers to the real-time analysis of the function process list during program execution. Based on different vulnerability types, it monitors whether the characteristic attributes in the tainted variable exceed the normal range. If it triggers a security vulnerability, it is necessary to stop the program, record the tainted variable attributes and vulnerability type that triggered the vulnerability, and add them to the risk variable.
[0077] Static analysis refers to analyzing the generated function call traces and return address traces after the program runs to determine the propagation process of the tainted variable and check whether it propagates in violation of security rules, including whether the tainted data propagates to important memory areas, whether dangerous functions are called, etc. If it propagates in violation of the rules, the tainted variable attributes and corresponding instruction addresses need to be recorded and added to the risk variables.
[0078] Figure 1 is a flow chart of a vulnerability detection method based on dynamic stain analysis and static trace analysis according to an embodiment of the present invention. Figure 1 As shown, in one embodiment of the present invention, the vulnerability detection method based on dynamic taint analysis and static trace analysis of the present invention includes steps S101 to S103.
[0079] Step S101, marking the external input data as tainted data, tracking the propagation of tainted variables in the program during program execution, generating an attribute vector for each tainted variable, and recording the information of each function during program execution to establish a function process linked list.
[0080] In one embodiment of the present invention, the present invention marks external input data as tainted data, and then initializes a data structure for storing tainted variables and their attributes. Create an empty function process linked list for recording function calls. The present invention intercepts function calls and uses a dynamic plugging tool to insert code into the program to intercept the call and return operations of each function. At the function entry, the information of the current function is recorded, including the name, address, type, stack base address, and the function running order. The present invention tracks tainted variables and updates its attribute vector every time the tainted variable is read, written or transferred to other locations. The attribute vector may include address, size, pollution source address, pollution source length, characteristic attributes, etc. The present invention can generate a propagation diagram of tainted data in the program based on the attribute vector of the tainted variable, and then can output the propagation path and attributes of each tainted variable, as well as output a complete function call trace to show the call relationship during the execution of the program. The present invention can also store taint analysis and function call information in a file or database for subsequent analysis.
[0081] Step S102, during the program running process, dynamic analysis is performed according to the function process linked list and the attribute vectors of each tainted variable to dynamically detect security vulnerabilities.
[0082] Step S103, generating a function call trace and a return address trace according to the function process linked list, and then after the program is finished running, performing static analysis according to the function call trace and the return address trace to perform static detection on security vulnerabilities.
[0083] According to the propagation of tainted variables during program operation, a combination of dynamic analysis and static analysis is used to perform risk analysis and vulnerability detection to find possible security vulnerabilities in the program, thereby improving the accuracy of vulnerability detection.
[0084] In one embodiment of the present invention, the above step S102 performs dynamic analysis based on the function process linked list and the attribute vectors of each tainted variable to dynamically detect security vulnerabilities, including:
[0085] Check whether the characteristic attributes in the attribute vector of each taint variable exceed the normal range. If so, the attribute vector is determined as a risk variable.
[0086] Dynamic analysis refers to the real-time analysis of the function process list during program execution. Based on different vulnerability types, it monitors whether the characteristic attributes in the tainted variable exceed the normal range. If it triggers a security vulnerability, it is necessary to stop the program, record the tainted variable attributes and vulnerability type that triggered the vulnerability, and add them to the risk variable.
[0087] In one embodiment of the present invention, the present invention predefines the normal range values (upper and lower limits) of characteristic attributes, such as numerical value size, data type, transmission path length, etc. During the program running process, it is checked in real time whether the characteristic attributes of the tainted variable exceed the normal range value. If it is detected that the attribute exceeds the normal range, the tainted variable is determined as a risk variable.
[0088] In one embodiment of the present invention, for a buffer overflow vulnerability, for a tainted variable, first obtain its attribute vector, including its address (addr), size (size), length information of the direct pollution source (len), and the stack base address (ebp) where it is located. Then, the maximum safe range available for the tainted variable is calculated based on the attribute vector: addr-ebp, and the actual range used is size, and the size is controlled by len. If the program runs normally and no overflow occurs when len>size+1, it means that the position is safe; otherwise, the position cannot be guaranteed to be safe, indicating that the position is risky, and the tainted variable is added to the risk variable set.
[0089] In one embodiment of the present invention, the above step S102 of dynamically analyzing the function process linked list and the attribute vectors of each tainted variable to dynamically detect security vulnerabilities also includes:
[0090] Each of the function process linked lists is analyzed, and abnormal function calls are identified.
[0091] In one embodiment of the present invention, the present invention can track the calling order, address, name, etc. of each function by analyzing each function process linked list, and then can identify abnormal calling mode or unauthorized calling sequence through the calling order and stack base address. In addition, the present invention can also check whether the stack base address changes abnormally during the function call to identify the stack overflow risk, and determine whether there is unauthorized base address modification by identifying the stack base address during function call and return. The present invention can also set specific monitoring conditions for specific types of functions (such as system calls, file operations, etc.), and check whether these functions are accompanied by abnormal use of tainted variables when called in a specific context to identify risks.
[0092] In one embodiment of the present invention, the above step S103 performs static analysis based on the function call trace and the return address trace to perform static detection on security vulnerabilities, including:
[0093] The function call trace and the return address trace are analyzed to determine whether the tainted variable propagates in violation of security rules. If so, the tainted variable is determined as a risk variable, wherein propagating in violation of security rules includes: the tainted variable propagates to an important memory area and the tainted variable calls a dangerous function.
[0094] Static analysis refers to analyzing the generated function call traces and return address traces after the program runs to determine the propagation process of the tainted variables and check whether it propagates in violation of security rules, including whether the tainted data propagates to important memory areas and whether dangerous functions are called. If it propagates in violation of the rules, the tainted variable attributes and corresponding instruction addresses need to be recorded and added to the risk variables. Since static analysis does not run the program, it is necessary to analyze the taint propagation process based on the trace file, and judge based on the instructions called, instruction location, function boundaries, return addresses, etc. to determine whether the tainted data propagates in violation of the rules.
[0095] like Figure 2 As shown, in one embodiment of the present invention, the process of establishing a function process linked list includes steps S201 to S203.
[0096] Step S201, when a function starts to execute, a counter is used to record the total number of functions in operation.
[0097] Step S202, generate a node pointer of the new function, and obtain the name, address, type, execution stack base address and function execution order information of the function.
[0098] Step S203, before adding the function to the linked list, determine whether the function is the first function executed by the program. If so, add it to the head of the linked list of the function process linked list. Otherwise, determine whether the function is the calling function of the running function. If so, add it to the head of the linked list of the function process linked list; otherwise, it means that the stack of the function has overwritten the stack of the previously running function, delete the overwritten function information in the function process linked list, and save the information of the function.
[0099] In the present invention, each time a new function is executed, the function information is recorded using a function process linked list.
[0100] In one embodiment of the present invention, the step S103 of generating a function call trace and a return address trace according to the function process linked list includes:
[0101] During the execution of the program, the function call instructions encountered are pushed into the call stack. When a new function call instruction is encountered, it is determined whether the new function call instruction is the next instruction after the return of an existing function call instruction in the call stack. If so, the call depth is adjusted. Otherwise, all elements from the new function call instruction to the top of the call stack are popped out of the stack, and the instruction offset and function call depth in the process of entering and exiting the stack are recorded to generate the function call trace.
[0102] The instruction offset is used to calculate the offset portion of the address, thereby determining the location of the instruction in memory.
[0103] The function call depth means that each time a function call instruction is encountered, it is pushed into the function call stack and the function call depth is increased by 1.
[0104] For each thread, a function call stack is maintained. Next, each instruction is compared to determine whether it is the next instruction of the function call instruction; if so, it is considered to be the return address of the function call instruction, and the function call depth is adjusted. If the return address matches the top element in the function call stack, the function call depth is reduced by 1; otherwise, the distance from it to the top of the stack is subtracted, and all elements from it to the top of the stack are popped out of the stack. The offset of the function call instruction and its return instruction in the Trace file, the function call depth, and the thread number are all recorded in the function call trace file.
[0105] In one embodiment of the present invention, the step S103 of generating a function call trace and a return address trace according to the function process linked list further includes:
[0106] Instruction offsets are sorted in the function call trace to generate the return address trace.
[0107] The main function of the return address trace is to reversely find the address of the function call instruction based on the return address. After the function call trace file is generated, the function call trace file is read, the offset of the return instruction in the trace file is used as a keyword to sort, and then written into the return address trace.
[0108] It can be seen from the above embodiments that the advantages of the vulnerability detection method based on dynamic stain analysis and static trace analysis of the present invention are:
[0109] 1) According to different vulnerability types, the present invention adds parameters related to the corresponding vulnerabilities in the characteristic attributes of the tainted variables. During the program running process and trace analysis process, specific types of security vulnerabilities can be detected according to the characteristic attributes. For example, for stack overflow vulnerabilities, the additional information includes the stack bottom address of the function stack where the local variable is located;
[0110] 2) The present invention uses the function process linked list generated by instruction tracing to establish function call and return address traces, and performs offline analysis on the traces, which can reduce the analysis of instructions unrelated to tainted variables and improve the efficiency of vulnerability detection;
[0111] 3) The present invention combines dynamic analysis and static analysis to clarify the propagation path of tainted variables and more comprehensively obtain information such as tainted variables, vulnerability types, instruction addresses, etc. related to vulnerabilities.
[0112] It should be noted that the steps shown in the flowcharts of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and that, although a logical order is shown in the flowcharts, in some cases, the steps shown or described can be executed in an order different from that shown here.
[0113] Based on the same inventive concept, an embodiment of the present invention also provides a vulnerability detection device based on dynamic taint analysis and static trace analysis, which can be used to implement the vulnerability detection method based on dynamic taint analysis and static trace analysis described in the above embodiment, as described in the following embodiment. Since the principle of solving the problem by the vulnerability detection device based on dynamic taint analysis and static trace analysis is similar to that of the vulnerability detection method based on dynamic taint analysis and static trace analysis, the embodiment of the vulnerability detection device based on dynamic taint analysis and static trace analysis can refer to the embodiment of the vulnerability detection method based on dynamic taint analysis and static trace analysis, and the repeated parts will not be repeated. As used below, the term "unit" or "module" can be a combination of software and / or hardware that implements a predetermined function. Although the device described in the following embodiment is preferably implemented in software, the implementation of hardware, or a combination of software and hardware, is also possible and conceived.
[0114] Figure 8 is a structural block diagram of a vulnerability detection device based on dynamic stain analysis and static trace analysis according to an embodiment of the present invention. Figure 8 As shown, in one embodiment of the present invention, the vulnerability detection device based on dynamic stain analysis and static trace analysis of the present invention includes:
[0115] The taint tracking and function process linked list establishment unit 1 is used to mark external input data as tainted data, track the propagation of tainted variables in the program during program execution, generate an attribute vector for each tainted variable, record information of each function during program execution, and establish a function process linked list;
[0116] Dynamic analysis unit 2, used for dynamically analyzing the function process linked list and the attribute vectors of each tainted variable during program operation, and dynamically detecting security vulnerabilities;
[0117] The static analysis unit 3 is used to generate a function call trace and a return address trace according to the function process linked list, and then after the program is finished running, perform static analysis according to the function call trace and the return address trace to perform static detection on security vulnerabilities.
[0118] In one embodiment of the present invention, the dynamic analysis unit 2 includes:
[0119] The characteristic attribute analysis module is used to detect whether the characteristic attributes in the attribute vector of each tainted variable exceed the normal range. If so, the attribute vector is determined as a risk variable;
[0120] The function process linked list analysis module is used to analyze each of the function process linked lists and identify abnormal function calls.
[0121] In one embodiment of the present invention, the static analysis unit 3 includes:
[0122] The illegal propagation detection module is used to analyze the function call trace and the return address trace to determine whether the tainted variable is propagated in violation of the security rules. If so, the tainted variable is determined as a risk variable, wherein the propagation in violation of the security rules includes: the tainted variable is propagated to an important memory area and the tainted variable calls a dangerous function.
[0123] In one embodiment of the present invention, the taint tracking and function process linked list establishment unit 1 includes:
[0124] The function total number recording module is used to use a counter to record the total number of running functions when a function starts to execute;
[0125] The node pointer generation module is used to generate a node pointer of a new function and obtain the name, address, type, running stack base address and function running order information of the function;
[0126] The judgment module is used to judge whether the function is the first function executed by the program before adding the function to the linked list. If so, it is added to the linked list head of the function process linked list. Otherwise, it is judged whether the function is the calling function of the running function. If so, it is added to the linked list head of the function process linked list; otherwise, it means that the stack of the function has overwritten the stack of the previously running function, delete the overwritten function information in the function process linked list, and save the information of the function.
[0127] In one embodiment of the present invention, the static analysis unit 3 includes:
[0128] A function call trace generation module is used to push the function call instructions encountered during program execution into a call stack. When encountering a new function call instruction, it is determined whether the new function call instruction is the next instruction after the return of an existing function call instruction in the call stack. If so, the call depth is adjusted. Otherwise, all elements from the new function call instruction to the top of the call stack are popped out of the stack, and the instruction offset and function call depth in the process of pushing and pulling in and out of the stack are recorded to generate the function call trace.
[0129] In one embodiment of the present invention, the static analysis unit 3 further includes:
[0130] The return address trace generation module is used to sort the instruction offsets in the function call trace to generate the return address trace.
[0131] In order to achieve the above object, according to another aspect of the present application, a computer device is also provided. Fig. 9 As shown, the computer device includes a memory, a processor, a communication interface and a communication bus. A computer program that can be executed on the processor is stored in the memory. When the processor executes the computer program, the steps in the above-mentioned embodiment method are implemented.
[0132] The processor may be a central processing unit (CPU). The processor may also be other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, or a combination of the above chips.
[0133] The memory, as a non-transitory computer-readable storage medium, can be used to store non-transitory software programs, non-transitory computer executable programs and units, such as the corresponding program units in the above method embodiments of the present invention. The processor executes various functional applications of the processor and works data processing by running the non-transitory software programs, instructions and modules stored in the memory, that is, implementing the method in the above method embodiments.
[0134] The memory may include a program storage area and a data storage area, wherein the program storage area may store an operating system, an application required for at least one function; the data storage area may store data created by the processor, etc. In addition, the memory may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one disk storage device, a flash memory device, or other non-volatile solid-state storage device. In some embodiments, the memory may optionally include a memory remotely arranged relative to the processor, and these remote memories may be connected to the processor via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.
[0135] The one or more units are stored in the memory, and when executed by the processor, the method in the above embodiment is performed.
[0136] The specific details of the above-mentioned computer device can be understood by referring to the corresponding related descriptions and effects in the above-mentioned embodiments, and will not be repeated here.
[0137] In order to achieve the above purpose, according to another aspect of the present application, a computer-readable storage medium is also provided, wherein the computer-readable storage medium stores a computer program, and the computer program implements the steps in the vulnerability detection method based on dynamic taint analysis and static trace analysis when executed in a computer processor. Those skilled in the art can understand that the implementation of all or part of the process in the above embodiment method can be completed by instructing the relevant hardware through a computer program, and the program can be stored in a computer-readable storage medium, and the program can include the process of the embodiment of each method as described above when executed. Among them, the storage medium can be a disk, an optical disk, a read-only memory (ROM), a random access memory (RAM), a flash memory (FlashMemory), a hard disk (Hard Disk Drive, abbreviated: HDD) or a solid-state drive (SSD), etc.; the storage medium can also include a combination of the above types of memory.
[0138] In order to achieve the above-mentioned purpose, according to another aspect of the present application, a computer program product is also provided, including a computer program / instruction, which, when executed by a processor, implements the steps of the above-mentioned vulnerability detection method based on dynamic taint analysis and static trace analysis.
[0139] Obviously, those skilled in the art should understand that the above modules or steps of the present invention can be implemented by a general computing device, they can be concentrated on a single computing device, or distributed on a network composed of multiple computing devices, and optionally, they can be implemented by a program code executable by a computing device, so that they can be stored in a storage device and executed by the computing device, or they can be made into individual integrated circuit modules, or multiple modules or steps therein can be made into a single integrated circuit module for implementation. Thus, the present invention is not limited to any specific combination of hardware and software.
[0140] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.
Claims
1. A vulnerability detection method based on dynamic taint analysis and static trace analysis, characterized in that: include: Mark external input data as tainted data, track the propagation of tainted variables in the program during program execution, generate attribute vectors for each tainted variable, record information about each function during program execution, and establish a function process linked list; During the program running process, dynamic analysis is performed based on the function process linked list and the attribute vectors of each tainted variable to dynamically detect security vulnerabilities; A function call trace and a return address trace are generated according to the function process linked list, and then after the program runs, a static analysis is performed according to the function call trace and the return address trace to perform static detection on security vulnerabilities.
2. The vulnerability detection method based on dynamic stain analysis and static trace analysis according to claim 1 is characterized in that: The method of dynamically analyzing the function process linked list and the attribute vectors of each tainted variable to dynamically detect security vulnerabilities includes: Detect whether the characteristic attributes in the attribute vector of each tainted variable exceed the normal range. If so, determine the attribute vector as a risk variable; Each of the function process linked lists is analyzed, and abnormal function calls are identified.
3. The vulnerability detection method based on dynamic stain analysis and static trace analysis according to claim 1 is characterized in that: The static analysis is performed according to the function call trace and the return address trace to perform static detection on security vulnerabilities, including: The function call trace and the return address trace are analyzed to determine whether the tainted variable propagates in violation of security rules. If so, the tainted variable is determined as a risk variable, wherein propagating in violation of security rules includes: the tainted variable propagates to an important memory area and the tainted variable calls a dangerous function.
4. The vulnerability detection method based on dynamic taint analysis and static trace analysis according to claim 1 is characterized in that: The step of establishing a function process linked list comprises: When a function starts executing, use a counter to record the total number of running functions; Generate a node pointer for a new function and obtain the function's name, address, type, stack base address, and function execution order information; Before adding the function to the linked list, determine whether the function is the first function executed by the program. If so, add it to the head of the linked list of the function process linked list. Otherwise, determine whether the function is the calling function of the running function. If so, add it to the head of the linked list of the function process linked list; otherwise, it means that the stack of the function has overwritten the stack of the previously running function, delete the overwritten function information in the function process linked list, and save the information of the function.
5. The vulnerability detection method based on dynamic stain analysis and static trace analysis according to claim 1 is characterized in that: The generating of function call traces and return address traces according to the function process linked list comprises: During the execution of the program, the function call instructions encountered are pushed into the call stack. When a new function call instruction is encountered, it is determined whether the new function call instruction is the next instruction after the return of an existing function call instruction in the call stack. If so, the call depth is adjusted. Otherwise, all elements from the new function call instruction to the top of the call stack are popped out of the stack, and the instruction offset and function call depth in the process of entering and exiting the stack are recorded to generate the function call trace.
6. The vulnerability detection method based on dynamic stain analysis and static trace analysis according to claim 5 is characterized in that: The generating of function call traces and return address traces according to the function process linked list also includes: Instruction offsets are sorted in the function call trace to generate the return address trace.
7. A vulnerability detection device based on dynamic stain analysis and static trace analysis, characterized in that: include: The taint tracking and function process linked list establishment unit is used to mark external input data as tainted data, track the propagation of tainted variables in the program during program execution, generate an attribute vector for each tainted variable, record the information of each function during program execution, and establish a function process linked list; A dynamic analysis unit, used to perform dynamic analysis according to the function process linked list and the attribute vectors of each tainted variable during program operation, and to dynamically detect security vulnerabilities; The static analysis unit is used to generate a function call trace and a return address trace according to the function process linked list, and then after the program is finished running, static analysis is performed according to the function call trace and the return address trace to perform static detection on security vulnerabilities.
8. The vulnerability detection device based on dynamic stain analysis and static trace analysis according to claim 7, characterized in that: The dynamic analysis unit comprises: The characteristic attribute analysis module is used to detect whether the characteristic attributes in the attribute vector of each tainted variable exceed the normal range. If so, the attribute vector is determined as a risk variable; The function process linked list analysis module is used to analyze each of the function process linked lists and identify abnormal function calls.
9. The vulnerability detection device based on dynamic stain analysis and static trace analysis according to claim 7, characterized in that: The static analysis unit comprises: The illegal propagation detection module is used to analyze the function call trace and the return address trace to determine whether the tainted variable is propagated in violation of the security rules. If so, the tainted variable is determined as a risk variable, wherein the propagation in violation of the security rules includes: the tainted variable is propagated to an important memory area and the tainted variable calls a dangerous function.
10. The vulnerability detection device based on dynamic stain analysis and static trace analysis according to claim 7, characterized in that: The taint tracking and function process linked list establishment unit includes: The function total number recording module is used to use a counter to record the total number of running functions when a function starts to execute; The node pointer generation module is used to generate a node pointer of a new function and obtain the name, address, type, running stack base address and function running order information of the function; The judgment module is used to judge whether the function is the first function executed by the program before adding the function to the linked list. If so, it is added to the linked list head of the function process linked list. Otherwise, it is judged whether the function is the calling function of the running function. If so, it is added to the linked list head of the function process linked list; otherwise, it means that the stack of the function has overwritten the stack of the previously running function, delete the overwritten function information in the function process linked list, and save the information of the function.
11. The vulnerability detection device based on dynamic stain analysis and static trace analysis according to claim 7, characterized in that: The static analysis unit comprises: A function call trace generation module is used to push the function call instructions encountered during program execution into a call stack. When encountering a new function call instruction, it is determined whether the new function call instruction is the next instruction after the return of an existing function call instruction in the call stack. If so, the call depth is adjusted. Otherwise, all elements from the new function call instruction to the top of the call stack are popped out of the stack, and the instruction offset and function call depth in the process of pushing and pulling in and out of the stack are recorded to generate the function call trace.
12. The vulnerability detection device based on dynamic stain analysis and static trace analysis according to claim 11, characterized in that: The static analysis unit further includes: The return address trace generation module is used to sort the instruction offsets in the function call trace to generate the return address trace.
13. A computer device comprising a memory, a processor and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 6 are implemented.
14. A computer-readable storage medium having a computer program / instruction stored thereon, characterized in that: When the computer program / instructions are executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.
15. A computer program product comprising a computer program / instructions, characterized in that When the computer program / instructions are executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.