Vulnerability mining method and device, electronic equipment and storage medium

Abstract

The embodiment of the invention provides a vulnerability mining method and device, electronic equipment and a storage medium, and relates to the technical field of information security, the method comprises the following steps: obtaining an Array object corresponding to a target system and historical vulnerability data corresponding to the Array object, and obtaining object data corresponding to the Array object, the object data at least comprises object processing behaviors, function methods and object attributes; constructing an execution sample for performing vulnerability mining on the target system according to the historical vulnerability data, the object processing behavior, the function method and the object attribute; in response to the fact that the execution sample is input into the browser engine to be executed, if it is found that the object attribute corresponding to the Array object is abnormally changed in the execution process, the first target vulnerability corresponding to the abnormal change is determined, and therefore the target centrality in the vulnerability mining process is improved, the mining efficiency is improved, and meanwhile the vulnerability mining efficiency is improved. According to the method, vulnerability mining can be performed on the Array object in a centralized manner, and the mining efficiency is improved.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a vulnerability mining method, a vulnerability mining device, an electronic device and a computer-readable storage medium. Background Art

[0002] Vulnerability mining refers to the process of analyzing the code and configuration in software, systems, or networks to find security vulnerabilities or potential security weaknesses. Vulnerability mining aims to discover and exploit these vulnerabilities to help developers and security experts improve the security of the system. However, in the process of vulnerability mining, it is usually necessary to deeply analyze the internal working principles and code logic of the target system, which results in a long time consumption, increases the complexity of the vulnerability mining process, and cannot guarantee the exploitability of the discovered vulnerabilities. Summary of the invention

[0003] The embodiments of the present invention provide a vulnerability mining method, device, electronic device and computer-readable storage medium to solve or partially solve the problems of long time consumption, complicated process and low availability of mined vulnerabilities in the vulnerability mining process.

[0004] The embodiment of the present invention discloses a vulnerability mining method, which is applied to a browser engine and includes:

[0005] Obtaining an Array object corresponding to a target system and historical vulnerability data corresponding to the Array object, and obtaining object data corresponding to the Array object, wherein the object data includes at least object processing behavior, function methods, and object properties, and the Array object is an array object in the target system;

[0006] Constructing an execution sample for vulnerability mining of the target system according to the historical vulnerability data, the object processing behavior, the function method, and the object attribute;

[0007] In response to inputting the execution sample into the browser engine for execution, if it is found during the execution that an object property corresponding to the Array object has undergone an abnormal change, a first target vulnerability corresponding to the abnormal change is determined, and the first target vulnerability represents a type confusion vulnerability corresponding to the Array object.

[0008] The embodiment of the present invention also discloses a vulnerability mining device, which is applied to a browser engine and includes:

[0009] A data acquisition module, used to acquire an Array object corresponding to a target system and historical vulnerability data corresponding to the Array object, and acquire object data corresponding to the Array object, wherein the object data at least includes object processing behavior, function device and object attribute, and the Array object is an array object in the target system;

[0010] A sample construction module, used to construct an execution sample for vulnerability mining of the target system according to the historical vulnerability data, the object processing behavior, the function device and the object attribute;

[0011] The first vulnerability mining module is used to respond to the input of the execution sample into the browser engine for execution. If it is found that the object property corresponding to the Array object has undergone an abnormal change during the execution process, a first target vulnerability corresponding to the abnormal change is determined, and the first target vulnerability represents a type confusion vulnerability corresponding to the Array object.

[0012] The embodiment of the present invention further discloses an electronic device, comprising a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other via the communication bus;

[0013] The memory is used to store computer programs;

[0014] The processor is used to implement the method described in the embodiment of the present invention when executing the program stored in the memory.

[0015] The embodiment of the present invention further discloses a computer-readable storage medium having instructions stored thereon, which, when executed by one or more processors, enables the processors to execute the method described in the embodiment of the present invention.

[0016] The embodiments of the present invention include the following advantages:

[0017] In an embodiment of the present invention, it can be applied to a browser engine. In the process of mining vulnerabilities in a target system, the browser engine can obtain an Array object corresponding to the target system and historical vulnerability data corresponding to the Array object, and obtain object data corresponding to the Array object. The object data at least includes object processing behavior, function methods, and object properties. The Array object is an array object in the target system. Then, an execution sample for mining vulnerabilities in the target system is constructed according to the historical vulnerability data, object processing behavior, function methods, and object properties. Then, in response to inputting the execution sample into the browser engine for execution, if an abnormal change is found in the object property corresponding to the Array object during the execution process, the corresponding abnormal change is determined. The first target vulnerability represents the type confusion vulnerability corresponding to the Array object. The corresponding execution samples are constructed through historical vulnerability data, object processing behavior, function methods and object properties to describe the possible vulnerability characteristics, types and possible influencing factors of the target system, which improves the concentration of targets in the vulnerability mining process. While improving the mining efficiency, the vulnerability mining can be focused on the Array object to simplify the mining process. At the same time, the accuracy and comprehensiveness of the mining are expanded through rich data. Based on the constructed execution samples, the versatility and portability of vulnerability mining can be improved, thereby ensuring the availability of the mined target vulnerability, so as to optimize the target system based on the target vulnerability and ensure the security of system operation. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] Figure 1 It is a flowchart of the steps of a vulnerability mining method provided in an embodiment of the present invention;

[0019] Figure 2 is a schematic diagram of a data structure provided in an embodiment of the present invention;

[0020] Figure 3 is a schematic diagram of a vulnerability mining scenario provided in an embodiment of the present invention;

[0021] Figure 4 It is a structural block diagram of a vulnerability mining device provided in an embodiment of the present invention;

[0022] Figure 5 It is a block diagram of an electronic device provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0023] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the present invention is further described in detail below with reference to the accompanying drawings and specific embodiments.

[0024] As an example, for the corresponding browser, it can use a high-performance JavaScript engine, which can be responsible for interpreting and executing JavaScript code in the web page. Among them, in the related technology, test samples are written by deeply analyzing the specific browser engine target module, and fuzz programs are written and dynamically tested through fuzz programs, and the generation process of test samples is continuously guided according to coverage feedback. At present, traditional browser engine vulnerability mining faces some challenges and problems, including but not limited to the following aspects:

[0025] Is the target selection reasonable? In the process of vulnerability mining, it is crucial to select the right target for analysis. Due to the complexity of browser engines and the diversity of vulnerabilities, miners need to carefully evaluate which parts may have security issues and focus on analysis. This requires a deep understanding of the internal working principles and code structure of the browser engine.

[0026] The target code logic is difficult to understand: The code base of the browser engine is large and complex, containing a large number of key components such as optimization, interpreters, and just-in-time compilers. The code logic of these components is often highly technically complex, and reading and understanding the code can be a challenging task. For vulnerability researchers, understanding the code logic is crucial to discovering potential vulnerabilities.

[0027] Optimization mechanisms make it extremely difficult to improve code coverage: Browser engines have powerful optimization mechanisms, including Just-In-Time Compilation and inline caching, which can significantly improve the execution efficiency of JavaScript code. However, these optimization mechanisms can also pose challenges to vulnerability mining, as they may lead to the diversity and complexity of code execution paths, thereby increasing the difficulty of code coverage.

[0028] The exploitability rate of crashes is extremely low: One of the goals of vulnerability mining is to find vulnerabilities that can be exploited to achieve attacks such as remote code execution or bypassing security mechanisms. However, browser engines have a high quality assurance in terms of security, so there are relatively few exploitable crash vulnerabilities. This makes it more difficult to find exploitable vulnerabilities, requiring the miners to have in-depth technical knowledge and innovative thinking.

[0029] High threshold and little accumulation: Browser engine vulnerability mining requires a deep understanding of the underlying operating system and programming language, as well as advanced debugging and reverse engineering skills. This makes vulnerability mining a technical field with a high threshold and requires long-term accumulation. Due to the relatively small number of mining personnel, related research and tool support are also relatively limited.

[0030] In this regard, in order to solve or partially solve the above-mentioned problems, in the process of vulnerability mining for the target system, the browser engine can obtain the Array object corresponding to the target system and the historical vulnerability data corresponding to the Array object, and obtain the object data corresponding to the Array object, the object data at least includes object processing behavior, function method and object attribute, the Array object is an array object in the target system, and then build an execution sample for vulnerability mining for the target system according to the historical vulnerability data, object processing behavior, function method and object attribute, and then respond to inputting the execution sample into the browser engine for execution, if it is found that the object attribute corresponding to the Array object has an abnormal change during the execution process, then determine the object attribute corresponding to the abnormal change. The first target vulnerability represents the type confusion vulnerability corresponding to the Array object. The corresponding execution samples are constructed through historical vulnerability data, object processing behavior, function methods and object properties to describe the possible vulnerability characteristics, types and possible influencing factors of the target system, which improves the concentration of targets in the vulnerability mining process. While improving the mining efficiency, the vulnerability mining can be focused on the Array object to simplify the mining process. At the same time, the accuracy and comprehensiveness of the mining are expanded through rich data. Based on the constructed execution samples, the versatility and portability of vulnerability mining can be improved, thereby ensuring the availability of the mined target vulnerability, so as to optimize the target system based on the target vulnerability and ensure the security of system operation.

[0031] In order to enable those skilled in the art to better understand the technical solutions in the embodiments of the present invention, some technical features involved in the embodiments of the present invention are explained and illustrated below:

[0032] Type Confusion: A type confusion vulnerability is a common software security vulnerability that usually occurs in strongly typed languages, such as C / C++. It occurs when an incorrect type is used in a program or an object reference is treated as an incorrect type.

[0033] JIT: JIT (Just-In-Time) is a compilation technology commonly used in dynamic language interpreters and virtual machines. The JIT compiler compiles source code or intermediate code into machine code in real time when the program is running to improve the execution efficiency of the program.

[0034] Reverse Engineering: Reverse Engineering refers to the process of analyzing and studying existing products or systems to understand their design, functions, and operating principles. Reverse engineering aims to reverse analyze existing technologies or products to obtain information about their internal mechanisms, algorithms, data structures, and design decisions.

[0035] POC (Proof of Concept) is an abbreviation for proof of concept or verification of concept. In the field of computer security, POC usually refers to a piece of code or demonstration that proves the existence of a security vulnerability or the feasibility of a function. POC can be a simple script, program or demonstration video that demonstrates how to exploit a security vulnerability or the implementation of a new security attack technology. Through POC, security researchers can show others actual security issues, prompting developers or manufacturers to take measures to fix vulnerabilities or strengthen security protection.

[0036] EXP (Exploit) refers to a program or code that is used to exploit security vulnerabilities in computer systems, applications, or services to perform illegal or unauthorized operations. EXP can be a specially written code that exploits known or unknown security vulnerabilities to perform malicious operations, such as obtaining system permissions, executing arbitrary code, bypassing security controls, etc. EXP is usually used by hackers or attackers to invade, attack, or control target systems.

[0037] Reference Figure 1 , shows a flowchart of a vulnerability mining method provided in an embodiment of the present invention, which is applied to a browser engine and may specifically include the following steps:

[0038] Step 101, obtaining an Array object corresponding to a target system and historical vulnerability data corresponding to the Array object, and obtaining object data corresponding to the Array object, wherein the object data at least includes object processing behavior, function methods, and object properties, and the Array object is an array object in the target system;

[0039] In the embodiment of the present invention, the target system may be an object for vulnerability mining. In the process of vulnerability mining for the target system, mining may be performed on specific objects of the target system, such as Array objects. In JavaScript, the Array object is a very important built-in object for processing and manipulating array data. An array is an ordered data collection that can store multiple values. Among them, the Array object provides many methods for operating and processing arrays.

[0040] In the specific implementation, for the browser engine, the Array object and the String object have similar expressions, so type confusion vulnerabilities may occur. Both the String object and the Array object have a fixed data storage structure, which contains some meta information and data content. The representation of these objects in memory is continuous and adjacent. Type confusion can be caused by converting a variable that was originally a String object to an Array object, or converting a variable that was originally an Array object to a String object. Then modify the length of the Array object to make it larger than the actual allocated memory space. In this way, when operating on the variable, it is possible to read data at a memory location that should not be accessed out of bounds, thereby obtaining sensitive information by reading unexpected memory data out of bounds, or using this data to further launch other forms of attacks, such as address leakage, code execution, etc.

[0041] In view of the possible type confusion vulnerability between the above-mentioned Array object and String object, in the embodiment of the present invention, the target system is analyzed and all Array objects corresponding to the target system are determined, and then the object data corresponding to the Array object is obtained, and the object data at least includes object processing behavior, function methods and object properties. Among them, the object processing behavior is used to describe the basic operations and behaviors of the Array object; the function method includes all methods provided by the Array object and the functions corresponding to each function method; the object properties include the properties involved in the Array object and the functions corresponding to the properties.

[0042] For example, the data structure of an Array object can be represented as a Json object, which includes at least object processing behavior, function methods, and object properties. Object processing behavior may include:

[0043] Create an array: Create an array using an array literal or the Array constructor.

[0044] Accessing array elements: Accessing elements in an array by index.

[0045] Modify array elements: Modify elements in an array by index.

[0046] Traversing an array: Use methods such as forEach to traverse the elements in an array.

[0047] Concatenate arrays: Use the concat method to concatenate two or more arrays.

[0048] Splitting an array: Use the slice method to extract a portion of an array.

[0049] Sorting array: Use the sort method to sort the array.

[0050] Searching an array: Use indexOf and lastIndexOf methods to search for an element in an array.

[0051] For function methods, this can include:

[0052] push: Add one or more elements to the end of an array and return the new length.

[0053] pop: Removes the element at the end of the array and returns the element.

[0054] shift: Removes the element from the beginning of an array and returns that element.

[0055] unshift: Adds one or more elements to the beginning of an array and returns the new length.

[0056] concat: concatenates two or more arrays and returns a new array.

[0057] join: concatenates all elements of an array into a string and returns the string.

[0058] slice: Extract a portion of an array and return a new array.

[0059] splice: Adds or removes elements from an array and returns the removed elements.

[0060] forEach: Executes a provided function once for each element of an array.

[0061] map: Creates a new array with the results of calling a provided function on each element of the original array.

[0062] filter: Creates a new array containing all elements that pass a test implemented by the provided function.

[0063] reduce: Executes a reducer function for each element in an array, aggregating its results into a single return value.

[0064] indexOf: Returns the position of the first occurrence of a specified element in an array.

[0065] lastIndexOf: Returns the position of the last occurrence of the specified element in the array.

[0066] sort: Sorts an array and returns the sorted array.

[0067] reverse: Reverses the order of elements in an array.

[0068] For object properties, it can be length, etc., which means returning the length of the array, etc.

[0069] By obtaining the object processing behavior, function methods, and object properties corresponding to the Array object, you can understand how to create an Array object, how to read and modify elements in an array, how to delete and traverse an array, and other operations through the object processing behavior. Through the function method, you can deeply analyze the implementation details of the Array object to understand its internal complex logical operations and study the underlying data structure and algorithm of the Array object. Through the object properties, you can analyze the properties and corresponding functions corresponding to the Array object, so that when you are mining vulnerabilities in the target system, you can focus on the Array object of the target system.

[0070] In addition, historical vulnerability data may be corresponding vulnerability data obtained during the historical operation of the target system or during the historical mining process. By introducing historical vulnerability data, the complexity of influencing factors in the vulnerability mining process can be increased, thereby improving the comprehensiveness and accuracy of vulnerability mining.

[0071] Step 102, constructing an execution sample for vulnerability mining on the target system according to the historical vulnerability data, the object processing behavior, the function method and the object attribute;

[0072] In an embodiment of the present invention, after the object processing behavior, function method, and object attribute of the Array object are determined, an execution sample for performing vulnerability mining on the target system can be constructed based on historical vulnerability data, object processing behavior, function method, and object attribute, so as to perform vulnerability mining on the target system through the execution sample and determine the possible vulnerabilities in the target system. Moreover, by constructing the corresponding execution sample, the user does not need to deeply analyze the working principle and code logic of the target system, etc., which effectively reduces the time and workload of vulnerability mining. Moreover, the test samples generated by extracting, abstracting, and mutating influencing factors are closer to the real attack scenario, and can better simulate potential vulnerability situations, so that the vulnerabilities mined based on the test samples have high exploitability.

[0073] In some feasible implementations, historical vulnerability data, object processing behaviors, function methods, and object data may be combined and mutated to generate test samples for the target system, and then the test samples may be converted into execution samples for execution in the browser engine. In the process of converting the test samples, the test samples may be converted into JavaScript codes for execution in the browser engine, so that the converted JavaScript codes are executed in the browser engine.

[0074] In the specific implementation, different combined mutation strategies can be designed to combine and mutate historical vulnerability data, object processing behaviors, function methods, and object properties to generate corresponding test samples. For example, based on historical vulnerability data, a test sample that reproduces the vulnerability can be generated; the function method can be combined with the object property to generate a test sample that calls the function; based on the object processing behavior, a test sample that simulates the behavior can be generated; the parameters of the function method can be mutated to generate different test samples; and test samples for boundary conditions can be generated, such as null values, maximum values, minimum values, etc., so as to construct a situation that can cover possible vulnerabilities in the target system through combined mutation, and then test the behavior and boundary conditions of the Array object through the constructed test samples.

[0075] Furthermore, after the test case group is constructed, each test case can be translated and generated into JavaScript code to be executed on the browser engine, and then the JavaScript code can be passed to the browser engine for execution. During the execution process, the corresponding test environment and work can be used to ensure that the JavaScript code is executed in a controlled environment, and the corresponding execution results and log information can be collected based on the execution process.

[0076] Step 103, in response to inputting the execution sample into the browser engine for execution, if it is found during the execution that an object property corresponding to the Array object has undergone an abnormal change, a first target vulnerability corresponding to the abnormal change is determined, and the first target vulnerability represents a type confusion vulnerability corresponding to the Array object.

[0077] In an embodiment of the present invention, after inputting the execution sample into the browser engine for execution, the property changes of the Array object, especially the changes related to type confusion, can be recorded and observed. If it is found that the object property changes in the Array object during the execution process, the first target vulnerability corresponding to the abnormal change can be determined, that is, the type confusion vulnerability corresponding to the Array object is characterized by the first target vulnerability, so that the corresponding execution sample is constructed through historical vulnerability data, object processing behavior, function method and object property, and the possible vulnerability characteristics, types and possible influencing factors of the target system are described, thereby improving the concentration of the target in the vulnerability mining process, improving the mining efficiency, and allowing the vulnerability mining to focus on the Array object to mine, simplifying the mining process, and at the same time expanding the accuracy and comprehensiveness of the mining through rich data, and based on the constructed execution sample, the versatility and portability of the vulnerability mining can be improved, thereby ensuring the availability of the mined target vulnerability, so as to optimize the target system based on the target vulnerability and ensure the security of the system operation.

[0078] In some feasible implementations, an inline cache can be included in the browser engine. The inline cache can be used to accelerate JavaScript function's access to object properties. The inline cache can dynamically generate valid access codes for specific objects and properties based on the property access situation at runtime, so as to avoid dynamic search every time the property is accessed, thereby improving the efficiency of property access.

[0079] During the execution process, the browser engine can respond to inputting the execution sample into the browser engine for execution, obtain the execution count of the function method in the execution process, determine the target function method whose execution count reaches a preset threshold, then generate a corresponding valid access code for the target function method, and store the valid access code in the inline cache, the valid access code is used to access the target Array object to which the target function method belongs and the target object data of the target Array object, and then add a corresponding single-state tag to the target object data, the single-state tag is used to characterize that the target Array object has only one determined object type when running according to the target object data, and then respond to running the target Array object according to the target object data. If the object type of the target Array object changes during the running process, the first target vulnerability corresponding to the target Array object is determined, thereby using the characteristics of the inline cache to add a single-state tag characterizing a specific type to the Array object. If the type of the Array object changes during the execution process, it can be determined that the optimized code may have erroneous behavior, that is, the Array object has a type confusion vulnerability, thereby determining the vulnerability corresponding to the Array object.

[0080] Optionally, for the first target vulnerability, if the target Array object is modified to another object type or the target Array object is modified to another Array object during operation, the first target vulnerability corresponding to the target Array object is determined.

[0081] It should be noted that in the browser engine, inline caching is an optimization technology used to speed up JavaScript function access to object properties. Inline caching dynamically generates valid access codes for specific objects and properties based on the property access at runtime to avoid dynamic lookups every time a property is accessed.

[0082] When a function is executed a certain number of times, the browser engine will perform inline cache optimization on the properties of the object operated by the function. This means that the engine will generate efficient access code based on the execution of the function and store it in the inline cache. When the function is executed again, the engine will directly use the code in the inline cache without having to perform property lookup again.

[0083] During this optimization, the browser engine marks the accessed property as "MONOMORPHIC". This means that the property is considered monomorphic, i.e. it has only one determined type at runtime. By marking the property as MONOMORPHIC, the browser engine can generate more efficient access code without considering the case where the property may have multiple types.

[0084] This optimization can improve the performance of function execution, especially when accessing the same object properties repeatedly. Through inline caching and MONOMORPHIC marking, the browser engine can avoid repeated property lookups and type judgments, thereby speeding up code execution.

[0085] Type confusion vulnerabilities are usually introduced by the inline cache optimization feature of the browser engine. The essence of type confusion vulnerabilities is that at runtime, the browser engine makes assumptions about the type of the property and generates corresponding optimized code. However, if in the subsequent execution process, there is a situation that is inconsistent with the previously assumed property type, it will cause type confusion.

[0086] Specifically, during the execution of a function, the browser engine generates specific access codes based on the MONOMORPHIC tag of the property. These codes assume that the property has a specific type and are optimized accordingly. However, if in subsequent executions, the type of the property changes, for example, it is modified to a different type or a different object, then the previously generated assumptions no longer hold and the optimized code may behave incorrectly. This type confusion vulnerability can be exploited to bypass type checks, perform unauthorized operations, or tamper with data. For example, it is possible to modify the property type of an object so that it is mistaken for another object type, thereby bypassing access restrictions or executing malicious code.

[0087] It should be noted that the common obfuscation in browser engines is to confuse the type between string objects and array objects, and then modify the length of the array to achieve out-of-bounds reading of unexpected memory data. This exploit takes advantage of the similar internal representation of String objects and Array objects in the V8 engine. In the browser engine, both String objects and Array objects have a fixed data storage structure, which contains some meta information and data content. The representation of these objects in memory is continuous and adjacent. Then, by converting a variable that was originally a String object to an Array object, or converting a variable that was originally an Array object to a String object, type confusion can be caused. Then modify the length of the Array object to make it larger than the actual allocated memory space. In this way, when operating the variable, data at a memory location that should not be accessed can be read out of bounds, so that sensitive information can be obtained by reading unexpected memory data out of bounds, or the data can be used to further launch other forms of attacks, such as address leakage and code execution.

[0088] For example, refer to Figure 2 , showing a schematic diagram of a data structure provided in an embodiment of the present invention, for an Array object, the array length is 3, and after type confusion, the variable originally an Array object can be converted into a String object, and then the Array length is modified to n. For the n-3 part, data at a memory location that should not be accessed can be read out of bounds, thereby realizing reading unexpected memory data out of bounds, such as reading binary data stored in the backing_store (underlying storage area) corresponding to the ArrayBuffer (such as read permission R / W, etc.), object attributes stored in the Object, etc., thereby causing abnormal data reading due to memory leaks (leek).

[0089] In one example code, it is demonstrated how to exploit the type confusion vulnerability to modify other data:

[0090]

[0091]

[0092] In the above code example, first, a class named C is defined at the beginning of the code, which contains a method m. Inside the m method, super.prototype is accessed, which returns C._proto_.prototype.

[0093] Next, a function named f is defined.

[0094] Then, by setting C.prototype._proto_ to the f function, the prototype chain of the C class is modified to point to the f function.

[0095] In the following code, an instance c of class C is created, and some attributes x0, x1, x2, x3, and x4 are added to the c object.

[0096] The next key part is that type confusion is triggered at f.prototype.

[0097] For functions that are executed a certain number of times, the browser engine will perform inline cache optimization on the properties of the objects operated by the function and mark the properties as MONOMORPHIC. This part of the code will cause the properties of f.prototype to become MEGAMORPHIC, which is related to the confusion path triggered by the code. This type confusion can lead to type assumption errors.

[0098] Finally, the type confusion vulnerability is triggered when the cm() method is called.

[0099] Through the above process, we can effectively discover vulnerabilities related to type confusion in the target system, so as to deal with the vulnerabilities involved in the Array object and improve the stability and security of the target system operation.

[0100] In addition, when the browser engine is executing the execution sample, in addition to vulnerability mining of the Array object, it can also detect whether there are vulnerabilities in the browser engine itself. If the state of the browser engine changes during the execution process (such as abnormal exit, running freeze, etc.), the second target vulnerability corresponding to the browser engine is determined. The second target vulnerability represents the running vulnerability of the browser engine itself, thereby enriching the types of vulnerability mining and improving the comprehensiveness of vulnerability mining.

[0101] Optionally, after the corresponding target vulnerability is mined through the above process, a demonstration script and an execution script for the target vulnerability mined from the target system can be obtained, and then the demonstration script can be executed to output the demonstration process corresponding to the target vulnerability, and / or the execution script can be executed to output the vulnerability behavior corresponding to the target vulnerability, so that the mined vulnerability can be reproduced by obtaining the corresponding demonstration script and execution script, so that the user can view and analyze the specific causes of the vulnerability, and then the vulnerability can be repaired in a targeted manner to ensure the security and stability of the system operation.

[0102] It should be noted that the embodiments of the present invention include but are not limited to the above examples. It is understandable that those skilled in the art can also make settings according to actual needs under the guidance of the ideas of the embodiments of the present invention, and the present invention is not limited to this.

[0103] In an embodiment of the present invention, it can be applied to a browser engine. In the process of mining vulnerabilities in a target system, the browser engine can obtain an Array object corresponding to the target system and historical vulnerability data corresponding to the Array object, and obtain object data corresponding to the Array object. The object data at least includes object processing behavior, function methods, and object properties. The Array object is an array object in the target system. Then, an execution sample for mining vulnerabilities in the target system is constructed according to the historical vulnerability data, object processing behavior, function methods, and object properties. Then, in response to inputting the execution sample into the browser engine for execution, if an abnormal change is found in the object property corresponding to the Array object during the execution process, the corresponding abnormal change is determined. The first target vulnerability represents the type confusion vulnerability corresponding to the Array object. The corresponding execution samples are constructed through historical vulnerability data, object processing behavior, function methods and object properties to describe the possible vulnerability characteristics, types and possible influencing factors of the target system, which improves the concentration of targets in the vulnerability mining process. While improving the mining efficiency, the vulnerability mining can be focused on the Array object to simplify the mining process. At the same time, the accuracy and comprehensiveness of the mining are expanded through rich data. Based on the constructed execution samples, the versatility and portability of vulnerability mining can be improved, thereby ensuring the availability of the mined target vulnerability, so as to optimize the target system based on the target vulnerability and ensure the security of system operation.

[0104] In order to enable those skilled in the art to better understand the technical solutions in the embodiments of the present invention, the following examples are used for exemplary description:

[0105] Reference Figure 3, showing a schematic diagram of the vulnerability mining scenario provided in an embodiment of the present invention, a corresponding vulnerability mining model can be constructed for the corresponding prior knowledge, wherein the prior knowledge can be knowledge, beliefs or assumptions that already exist before the user obtains new information, that is, the vulnerability model is constructed by acquiring existing data. In a specific implementation, a corresponding vulnerability mining model can be constructed for the Array object in the target system, by acquiring the corresponding object processing behaviors, loop traversal, complex logic, object methods, etc. corresponding to the "add, delete, modify and query" of the Array object, and combining historical vulnerabilities, JS syntax libraries and other related data, a corresponding vulnerability mining model is constructed, through which various test samples can be abstracted and combined and mutated to cover various possible situations. These test samples can cover different inputs and scenarios to test the behavior and boundary conditions of the Array object.

[0106] After the test samples are generated, each test sample can be translated and the actual executed JavaScrip code can be generated. In this step, the abstract test sample is converted into the actual executable JavaScript code. Specifically, according to the operations and influencing factors in the test sample, the corresponding JavaScript code is written, and then the JavaScript code is executed in the corresponding browser engine. Among them, the execution process can include recording the crash vulnerability and outputting the corresponding POC (Proof of Concept) code; outputting the corresponding EXP (Exploit) code for the length change during the execution process; and outputting the corresponding exception record for the property change process.

[0107] Execute all test codes by calling the browser engine. In this step, the browser engine is called and the generated test code is passed to the engine for execution. Use appropriate test environment and tools to ensure that the test code is executed in a controlled environment and collect relevant execution results and log information.

[0108] Record and observe changes in Array properties and the state of the browser engine. During the execution of the test code, record and observe changes in the properties of the Array object, especially those related to type confusion. If an unexpected change in the Array property is found during execution, this indicates a type confusion vulnerability. In addition, the state of the browser engine is also observed, especially abnormal exits. If the engine exits abnormally, this may indicate that the vulnerability discovered is in the browser engine itself, and it is likely to be exploited.

[0109] Through this process, possible type confusion vulnerabilities and vulnerabilities of the browser engine itself can be discovered and mined, thereby helping developers fix these security issues and improving the security of browsers and engines. In addition, this process avoids most of the technical difficulties in the traditional vulnerability mining process, making the mining target and mining process simpler and clearer, and the mining results are more in line with expectations.

[0110] It should be noted that, for the sake of simplicity, the method embodiments are described as a series of action combinations, but those skilled in the art should be aware that the embodiments of the present invention are not limited by the order of the actions described, because according to the embodiments of the present invention, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions involved are not necessarily required by the embodiments of the present invention.

[0111] Reference Figure 4 , shows a structural block diagram of a vulnerability mining device provided in an embodiment of the present invention, which is applied to a browser engine and may specifically include the following modules:

[0112] The data acquisition module 401 is used to acquire an Array object corresponding to the target system and historical vulnerability data corresponding to the Array object, and acquire object data corresponding to the Array object, wherein the object data at least includes object processing behavior, function device and object attribute, and the Array object is an array object in the target system;

[0113] A sample construction module 402, used to construct an execution sample for vulnerability mining of the target system according to the historical vulnerability data, the object processing behavior, the function device and the object attribute;

[0114] The first vulnerability mining module 403 is used to respond to the input of the execution sample into the browser engine for execution. If it is found that the object property corresponding to the Array object has undergone an abnormal change during the execution process, a first target vulnerability corresponding to the abnormal change is determined, and the first target vulnerability represents a type confusion vulnerability corresponding to the Array object.

[0115] Some possible implementations also include:

[0116] The second vulnerability mining module is used to determine a second target vulnerability corresponding to the browser engine if the state of the browser engine changes during execution, and the second target vulnerability represents an operation vulnerability of the browser engine itself.

[0117] In some feasible implementations, the sample construction module 402 is specifically used to:

[0118] Performing combined mutation on the historical vulnerability data, the object processing behavior, the function device and the object data to generate a test sample for the target system;

[0119] The test sample is converted into an execution sample for execution in the browser engine.

[0120] In some feasible implementations, the sample construction module 402 is specifically used to:

[0121] The test sample is converted into JavaScript code for execution in the browser engine.

[0122] In some feasible implementations, the browser engine includes at least an inline cache, and the first vulnerability mining module 403 is specifically used to:

[0123] In response to inputting the execution sample into the browser engine for execution, obtaining the execution count of the function device in the execution process, and determining a target function device whose execution count reaches a preset threshold;

[0124] Generate a corresponding valid access code for the target function device, and store the valid access code in the inline cache, wherein the valid access code is used to access the target Array object to which the target function device belongs and the target object data of the target Array object;

[0125] Add a corresponding single state mark to the target object data, wherein the single state mark is used to indicate that the target Array object has only one determined object type when running according to the target object data;

[0126] In response to running the target Array object according to the target object data, if the object type of the target Array object changes during the running process, a first target vulnerability corresponding to the target Array object is determined.

[0127] In some feasible implementations, the first vulnerability mining module 403 is specifically used to:

[0128] If the target Array object is modified into another object type or the target Array object is modified into another Array object during the running process, a first target vulnerability corresponding to the target Array object is determined.

[0129] Some possible implementations also include:

[0130] A script acquisition module, used to acquire a demonstration script and an execution script for a target vulnerability mined from the target system;

[0131] A first script execution module, used to execute the demonstration script and output the demonstration process corresponding to the target vulnerability;

[0132] The second script execution module is used to execute the execution script and output the vulnerability behavior corresponding to the target vulnerability.

[0133] As for the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0134] In addition, an embodiment of the present invention further provides an electronic device, including: a processor, a memory, and a computer program stored in the memory and executable on the processor. When the computer program is executed by the processor, each process of the above-mentioned vulnerability mining method embodiment is implemented, and the same technical effect can be achieved. To avoid repetition, it will not be described here.

[0135] The embodiment of the present invention further provides a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, each process of the above-mentioned vulnerability mining method embodiment is implemented, and the same technical effect can be achieved. To avoid repetition, it is not repeated here. The computer-readable storage medium is, for example, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0136] Figure 5 A schematic diagram of the hardware structure of an electronic device for implementing various embodiments of the present invention.

[0137] The electronic device 500 includes but is not limited to: a radio frequency unit 501, a network module 502, an audio output unit 503, an input unit 504, a sensor 505, a display unit 506, a user input unit 507, an interface unit 508, a memory 509, a processor 510, and a power supply 511. Those skilled in the art will appreciate that the electronic device structure involved in the embodiments of the present invention does not constitute a limitation on the electronic device, and the electronic device may include more or fewer components than shown in the figure, or combine certain components, or arrange components differently. In the embodiments of the present invention, the electronic device includes but is not limited to a mobile phone, a tablet computer, a laptop computer, a PDA, a vehicle-mounted terminal, a wearable device, and a pedometer.

[0138] It should be understood that in the embodiment of the present invention, the radio frequency unit 501 can be used for receiving and sending signals during information transmission or communication. Specifically, after receiving downlink data from the base station, it is sent to the processor 510 for processing; in addition, uplink data is sent to the base station. Generally, the radio frequency unit 501 includes but is not limited to an antenna, at least one amplifier, a transceiver, a coupler, a low noise amplifier, a duplexer, etc. In addition, the radio frequency unit 501 can also communicate with the network and other devices through a wireless communication system.

[0139] The electronic device provides users with wireless broadband Internet access through the network module 502, such as helping users to send and receive emails, browse web pages, and access streaming media.

[0140] The audio output unit 503 can convert the audio data received by the RF unit 501 or the network module 502 or stored in the memory 509 into an audio signal and output it as sound. Moreover, the audio output unit 503 can also provide audio output related to a specific function performed by the electronic device 500 (for example, a call signal reception sound, a message reception sound, etc.). The audio output unit 503 includes a speaker, a buzzer, a receiver, etc.

[0141] The input unit 504 is used to receive audio or video signals. The input unit 504 may include a graphics processor (GPU) 5041 and a microphone 5042. The graphics processor 5041 processes the image data of a static picture or video obtained by an image capture device (such as a camera) in a video capture mode or an image capture mode. The processed image frame can be displayed on the display unit 506. The image frame processed by the graphics processor 5041 can be stored in the memory 509 (or other storage medium) or sent via the radio frequency unit 501 or the network module 502. The microphone 5042 can receive sound and can process such sound into audio data. The processed audio data can be converted into a format output that can be sent to a mobile communication base station via the radio frequency unit 501 in the case of a telephone call mode.

[0142] The electronic device 500 also includes at least one sensor 505, such as a light sensor, a motion sensor, and other sensors. Specifically, the light sensor includes an ambient light sensor and a proximity sensor, wherein the ambient light sensor can adjust the brightness of the display panel 5061 according to the brightness of the ambient light, and the proximity sensor can turn off the display panel 5061 and / or the backlight when the electronic device 500 is moved to the ear. As a type of motion sensor, the accelerometer sensor can detect the magnitude of acceleration in each direction (generally three axes), and can detect the magnitude and direction of gravity when stationary, which can be used to identify the posture of the electronic device (such as horizontal and vertical screen switching, related games, magnetometer posture calibration), vibration recognition related functions (such as pedometer, tapping), etc.; the sensor 505 can also include a fingerprint sensor, a pressure sensor, an iris sensor, a molecular sensor, a gyroscope, a barometer, a hygrometer, a thermometer, an infrared sensor, etc., which will not be repeated here.

[0143] The display unit 506 is used to display information input by the user or information provided to the user. The display unit 506 may include a display panel 5061, which may be configured in the form of a liquid crystal display (LCD), an organic light-emitting diode (OLED), or the like.

[0144] The user input unit 507 can be used to receive input digital or character information, and to generate key signal input related to user settings and function control of the electronic device. Specifically, the user input unit 507 includes a touch panel 5071 and other input devices 5072. The touch panel 5071, also known as a touch screen, can collect the user's touch operation on or near it (such as the user's operation on the touch panel 5071 or near the touch panel 5071 using any suitable object or accessory such as a finger, stylus, etc.). The touch panel 5071 may include two parts: a touch detection device and a touch controller. Among them, the touch detection device detects the user's touch orientation, detects the signal brought by the touch operation, and transmits the signal to the touch controller; the touch controller receives the touch information from the touch detection device, converts it into the contact point coordinates, and then sends it to the processor 510, receives the command sent by the processor 510 and executes it. In addition, the touch panel 5071 can be implemented using multiple types such as resistive, capacitive, infrared and surface acoustic waves. In addition to the touch panel 5071, the user input unit 507 may also include other input devices 5072. Specifically, other input devices 5072 may include but are not limited to a physical keyboard, function keys (such as volume control keys, switch keys, etc.), a trackball, a mouse, and a joystick, which are not described in detail here.

[0145] Further, the touch panel 5071 may be covered on the display panel 5061. When the touch panel 5071 detects a touch operation on or near it, it is transmitted to the processor 510 to determine the type of the touch event, and then the processor 510 provides a corresponding visual output on the display panel 5061 according to the type of the touch event. It can be understood that in one embodiment, the touch panel 5071 and the display panel 5061 are used as two independent components to implement the input and output functions of the electronic device, but in some embodiments, the touch panel 5071 and the display panel 5061 can be integrated to implement the input and output functions of the electronic device, which is not limited here.

[0146] The interface unit 508 is an interface for connecting an external device to the electronic device 500. For example, the external device may include a wired or wireless headset port, an external power supply (or battery charger) port, a wired or wireless data port, a memory card port, a port for connecting a device with an identification module, an audio input / output (I / O) port, a video I / O port, a headphone port, etc. The interface unit 508 may be used to receive input (e.g., data information, power, etc.) from an external device and transmit the received input to one or more elements within the electronic device 500 or may be used to transmit data between the electronic device 500 and an external device.

[0147] The memory 509 can be used to store software programs and various data. The memory 509 can mainly include a program storage area and a data storage area, wherein the program storage area can store an operating system, an application required for at least one function (such as a sound playback function, an image playback function, etc.), etc.; the data storage area can store data created according to the use of the mobile phone (such as audio data, a phone book, etc.), etc. In addition, the memory 509 can include a high-speed random access memory, and can also include a non-volatile memory, such as at least one disk storage device, a flash memory device, or other volatile solid-state storage devices.

[0148] The processor 510 is the control center of the electronic device. It uses various interfaces and lines to connect various parts of the entire electronic device. By running or executing software programs and / or modules stored in the memory 509 and calling data stored in the memory 509, it performs various functions of the electronic device and processes data, thereby monitoring the electronic device as a whole. The processor 510 may include one or more processing units; preferably, the processor 510 may integrate an application processor and a modem processor, wherein the application processor mainly processes the operating system, user interface, and application programs, and the modem processor mainly processes wireless communications. It is understandable that the above-mentioned modem processor may not be integrated into the processor 510.

[0149] The electronic device 500 may also include a power supply 511 (such as a battery) for supplying power to each component. Preferably, the power supply 511 may be logically connected to the processor 510 through a power management system, thereby implementing functions such as charging, discharging, and power consumption management through the power management system.

[0150] In addition, the electronic device 500 includes some functional modules not shown, which will not be described in detail here.

[0151] It should be noted that, in this article, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the sentence "comprises a ..." does not exclude the existence of other identical elements in the process, method, article or device including the element.

[0152] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present invention, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, a magnetic disk, or an optical disk), and includes a number of instructions for enabling a terminal (which can be a mobile phone, a computer, a server, an air conditioner, or a network device, etc.) to execute the methods described in each embodiment of the present invention.

[0153] The embodiments of the present invention are described above in conjunction with the accompanying drawings, but the present invention is not limited to the above-mentioned specific implementation modes, which are merely illustrative rather than restrictive. Under the guidance of the present invention, ordinary technicians in this field can also make many forms without departing from the scope of protection of the present invention and the claims, all of which are within the protection of the present invention.

[0154] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed in the embodiments of the present invention can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.

[0155] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0156] In the embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0157] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0158] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0159] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, server, or network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: various media that can store program codes, such as USB flash drives, mobile hard disks, ROM, RAM, magnetic disks, or optical disks.

[0160] The above is only a specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any person skilled in the art can easily think of changes or substitutions within the technical scope disclosed by the present invention, which should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention should be based on the protection scope of the claims.

Claims

1. A vulnerability mining method, characterized in that: Applicable to browser engines, including: Obtaining an Array object corresponding to a target system and historical vulnerability data corresponding to the Array object, and obtaining object data corresponding to the Array object, wherein the object data includes at least object processing behavior, function methods, and object properties, and the Array object is an array object in the target system; Constructing an execution sample for vulnerability mining of the target system according to the historical vulnerability data, the object processing behavior, the function method, and the object attribute; In response to inputting the execution sample into the browser engine for execution, if it is found during the execution that an object property corresponding to the Array object has undergone an abnormal change, a first target vulnerability corresponding to the abnormal change is determined, and the first target vulnerability represents a type confusion vulnerability corresponding to the Array object.

2. The method according to claim 1, characterized in that Also includes: If the state of the browser engine changes during the execution process, a second target vulnerability corresponding to the browser engine is determined, where the second target vulnerability represents an operation vulnerability of the browser engine itself.

3. The method according to claim 1 or 2, characterized in that: The step of constructing an execution sample for performing vulnerability mining on the target system according to the historical vulnerability data, the object processing behavior, the function method, and the object attribute includes: Performing combined mutation on the historical vulnerability data, the object processing behavior, the function method and the object data to generate a test sample for the target system; The test sample is converted into an execution sample for execution in the browser engine.

4. The method according to claim 3, characterized in that The converting the test sample into an execution sample for execution in the browser engine includes: The test sample is converted into JavaScript code for execution in the browser engine.

5. The method according to claim 1, characterized in that The browser engine at least includes an inline cache, and in response to inputting the execution sample into the browser engine for execution, if it is found during the execution that an object property corresponding to the Array object has undergone an abnormal change, determining a first target vulnerability corresponding to the abnormal change includes: In response to inputting the execution sample into the browser engine for execution, obtaining the number of executions of the function method in the execution process, and determining a target function method whose number of executions reaches a preset threshold; Generate a corresponding valid access code for the target function method, and store the valid access code in the inline cache, wherein the valid access code is used to access the target Array object to which the target function method belongs and the target object data of the target Array object; Add a corresponding single state mark to the target object data, wherein the single state mark is used to indicate that the target Array object has only one determined object type when running according to the target object data; In response to running the target Array object according to the target object data, if the object type of the target Array object changes during the running process, a first target vulnerability corresponding to the target Array object is determined.

6. The method according to claim 5, characterized in that If the object type of the target Array object changes during the running process, determining a first target vulnerability corresponding to the target Array object includes: If the target Array object is modified into another object type or the target Array object is modified into another Array object during the running process, a first target vulnerability corresponding to the target Array object is determined.

7. The method according to claim 1, characterized in that Also includes: Obtaining a demonstration script and an execution script for a target vulnerability mined from the target system; Execute the demonstration script and output the demonstration process corresponding to the target vulnerability; And / or, executing the execution script to output the vulnerability behavior corresponding to the target vulnerability.

8. A device for excavating a vulnerability, characterized in that: Applicable to browser engines, including: A data acquisition module, used to acquire an Array object corresponding to a target system and historical vulnerability data corresponding to the Array object, and acquire object data corresponding to the Array object, wherein the object data at least includes object processing behavior, function device and object attribute, and the Array object is an array object in the target system; A sample construction module, used to construct an execution sample for vulnerability mining of the target system according to the historical vulnerability data, the object processing behavior, the function device and the object attribute; The first vulnerability mining module is used to respond to the input of the execution sample into the browser engine for execution. If it is found that the object property corresponding to the Array object has undergone an abnormal change during the execution process, a first target vulnerability corresponding to the abnormal change is determined, and the first target vulnerability represents a type confusion vulnerability corresponding to the Array object.

9. An electronic device, characterized in that: It includes a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other through the communication bus; The memory is used to store computer programs; The processor is used to implement the method according to any one of claims 1 to 7 when executing the program stored in the memory.

10. A computer-readable storage medium having instructions stored thereon, which, when executed by one or more processors, cause the processors to perform the method according to any one of claims 1 to 7.

Images