Vulnerability detection method and device

Abstract

The embodiment of the invention provides a vulnerability detection method and equipment, and is applied to the technical field of communication. The method is applied to detection equipment and comprises the steps that a to-be-detected code is obtained, and the to-be-detected code comprises a plurality of source code lines; based on the multiple source codes of the to-be-detected code, an index document is generated, the index document comprises multiple pieces of index information, the index information corresponds to the source code lines, and each piece of index information comprises an index path and code line information; performing vulnerability detection on the code line information in the index document based on a vulnerability rule, and determining target index information; and determining a target source code line based on the index path of the target index information. Based on the technical scheme, the complexity of performing vulnerability detection on the code line text is lower, and the scheme of the application is simpler; meanwhile, whether the corresponding to-be-detected codes have vulnerabilities or not can be determined only by detecting a single index document, the detection speed is higher, and the detection efficiency is higher.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to a vulnerability detection method and device. Background Art

[0002] After a security vulnerability in a software program is discovered, it is necessary to check whether there are duplicate or similar security vulnerabilities in related software programs. The current solution is usually to use static application security testing (SAST) tools such as Coverity, Fortify and Checkmarx to check the security vulnerabilities or defects of software programs.

[0003] In the existing inspection method, it is necessary to use the SAST tool to perform lexical, grammatical and semantic analysis on all source codes in the software program code repository, and then generate an abstract syntax tree (AST), which is then converted into an intermediate representation (IR), and finally a control flow graph (CFG) is generated. Finally, taint analysis is performed based on the CFG to identify security vulnerabilities in the software program code.

[0004] In the existing vulnerability detection scheme, steps such as semantic analysis, generation of abstract syntax tree and control flow graph are required. The processing process is complicated. At the same time, all source code is required to generate the control flow graph. The detection scheme is complicated and the detection efficiency is low. Summary of the invention

[0005] The embodiments of the present application provide a vulnerability detection method and device, which reduce the complexity of vulnerability detection and improve the efficiency of vulnerability detection.

[0006] In a first aspect, an embodiment of the present application provides a vulnerability detection method, the method comprising: obtaining a code to be detected, the code to be detected comprising multiple source code lines; generating an index document based on the multiple source codes of the code to be detected, the index document comprising multiple index information, the index information corresponding to the source code lines, each of the index information comprising an index path and code line information; performing vulnerability detection on the code line information in the index document based on vulnerability rules to determine target index information; determining the target source code line based on the index path of the target index information.

[0007] Based on the above technical solution, the detection device can generate an index document based on code lines according to the code to be detected, and then the detection device performs vulnerability detection on the code line information in the index document. Compared with the existing solution of generating a control flow graph, the vulnerability detection complexity of the code line information in the present application is lower, so the vulnerability detection method provided by the present application is simpler; at the same time, since the index document in the embodiment of the present application is based on code lines, the detection of vulnerabilities can be independent of each other. Compared with the existing solution that requires all codes to generate control flow graphs for vulnerability detection, the present application only needs to detect a single index document to determine whether the corresponding code to be detected has a vulnerability. Therefore, the vulnerability detection method provided by the present application has a faster detection speed and higher detection efficiency.

[0008] In addition, since the index document in the embodiment of the present application is based on code lines, the detection of vulnerabilities can be independent of each other. Therefore, when vulnerability detection needs to be performed again after the emergence of new code, the existing solution needs to regenerate the control flow graph for detection, while in the embodiment of the present application, only the index document needs to be updated, and there is no need to regenerate the index document corresponding to the above-mentioned code to be detected, which improves the detection speed and efficiency.

[0009] In a possible implementation, an index document is generated based on multiple source codes of the code to be detected, including: generating a corresponding index path according to a storage path of a source code line, the index path indicating the storage path of the source code line; generating corresponding code line information according to the source code line; determining index information corresponding to the source code line, the index information including the index path and code line information; and generating an index document according to multiple index information.

[0010] In this possible implementation, a method for generating an index document is specifically provided, which improves the feasibility of the embodiment of the present application.

[0011] In a possible implementation, the code line information includes code line text information, and the corresponding code line information is generated according to the source code line, including: filtering the source code line to obtain the code line text; performing word segmentation on the code line text to obtain multiple code mark tokens; converting the multiple code tokens to obtain code line text information, and the code line text information includes multiple code words and their synonym tokens.

[0012] In this possible implementation, a method for generating an index document is specifically provided, which improves the feasibility of the embodiment of the present application.

[0013] In a possible implementation, an index document is generated based on multiple source codes of the code to be detected, including: generating a first index document based on the multiple source codes of the code to be detected, where the code to be detected is an existing code; or generating a second index document based on the multiple source codes of the code to be detected, where the code to be detected is an incremental code.

[0014] In one possible implementation, before performing vulnerability detection on code line information in an index document based on vulnerability rules, the method also includes: performing keyword extraction on known vulnerability codes to obtain vulnerability keywords; and / or performing code line extraction on known vulnerability codes to obtain vulnerability code lines; creating vulnerability rules based on vulnerability keywords and / or vulnerability code lines, wherein the vulnerability rules include vulnerability keyword rules and vulnerability code line rules.

[0015] In this possible implementation, the detection device can create code vulnerability rules based on known vulnerability codes, which is not affected by the search rules of SAST tools or search engines, and can retrieve vulnerabilities faster and more accurately.

[0016] In one possible implementation, vulnerability detection is performed on the code line information in the index document based on vulnerability rules to determine target index information, including: vulnerability keyword detection and / or vulnerability code line detection is performed on the code line information in the index document based on vulnerability rules to determine the target index information, and a target source code line corresponding to the target index information has a vulnerability.

[0017] In a possible implementation, the code vulnerability rule is a multi-level rule, and the code vulnerability rule includes a code vulnerability parent rule and a code vulnerability sub-rule, and the code vulnerability sub-rule is a rule created based on the code vulnerability parent rule.

[0018] In this possible implementation, the detection device can create code vulnerability rules based on vulnerability keywords and / or vulnerability code lines, and specifically provides a method for creating code vulnerability rules, which effectively improves the accuracy of vulnerability detection.

[0019] In one possible implementation, vulnerability keyword detection and / or vulnerability code line detection are performed on the code line information in the index document based on vulnerability rules to determine the target index information, including: performing vulnerability detection on the code line information according to the code vulnerability parent rule to obtain a first detection result; performing vulnerability detection on the first detection result according to the code vulnerability sub-rule to determine the target index information, and a vulnerability exists in the target source code line corresponding to the target index information.

[0020] In this possible implementation, the code vulnerability rule may be a multi-level rule, and detection may be performed again through the code vulnerability sub-rule based on the detection of the code vulnerability parent rule, thereby improving the accuracy of vulnerability detection through multi-level rule detection.

[0021] In one possible implementation, after creating vulnerability rules based on vulnerability keywords and / or vulnerability code lines, the method also includes: detecting sample code according to the vulnerability rules to obtain sample code detection results; when the number of code vulnerabilities in the sample detection results does not exceed a threshold, determining that the code vulnerability rules have passed the test; when the number of code vulnerabilities in the sample detection results exceeds a threshold, determining that the code vulnerability rules have failed the test.

[0022] In this possible implementation, a method for testing code vulnerability rules is specifically provided, which determines that the number of code vulnerabilities in the sample detection results detected by the code vulnerability rules cannot exceed a threshold, ensuring that the code vulnerability rules used meet the detection effect requirements and improving the accuracy and efficiency of vulnerability detection.

[0023] In a second aspect, an embodiment of the present application provides a detection device, including: a processor and a memory. The processor is coupled to the memory; the memory is used to store computer instructions, which are loaded and executed by the processor to enable the satellite base station to implement any one of the methods provided in the first aspect.

[0024] In a third aspect, an embodiment of the present application provides a chip, comprising: a processor and an interface circuit; the interface circuit is used to receive code instructions and transmit them to the processor; the processor is used to run the code instructions to execute any one of the methods provided in the first aspect.

[0025] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, in which at least one computer program instruction is stored. The computer program instruction is loaded and executed by a processor to implement any one of the methods provided in the first aspect above.

[0026] In a fifth aspect, an embodiment of the present application provides a computer program product, including computer execution instructions, which, when executed on a computer, enable the computer to execute any one of the methods provided in the first aspect.

[0027] The possible implementation methods of the second to fifth aspects have effects similar to those of the first aspect and the possible designs of the first aspect, and will not be repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] Figure 1 A schematic diagram of a vulnerability detection method provided in an embodiment of the present application;

[0029] Figure 2 A schematic diagram of the software structure of a detection device provided in an embodiment of the present application;

[0030] Figure 3 A flowchart of another vulnerability detection method provided in an embodiment of the present application;

[0031] Figure 4 A flowchart of a method for creating code vulnerability rules provided in an embodiment of the present application;

[0032] Figure 5 A schematic diagram of a scenario of a method for creating code vulnerability rules provided in an embodiment of the present application;

[0033] Figure 6 A schematic diagram of a scenario in which a detection device obtains a code to be detected provided in an embodiment of the present application;

[0034] Figure 7 A schematic diagram of a source code processing scenario provided in an embodiment of the present application;

[0035] Figure 8 A schematic diagram of an index document provided in an embodiment of the present application;

[0036] Fig. 9 A schematic diagram of a scenario in which an index library stores index documents provided in an embodiment of the present application;

[0037] Fig.10 A schematic diagram of a scenario of a vulnerability detection method provided in an embodiment of the present application;

[0038] Fig.11 A schematic diagram of the structure of another detection device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0039] The technical solutions in the embodiments of the present application are described below in conjunction with the accompanying drawings.

[0040] In the description of this application, unless otherwise specified, " / " indicates that the objects associated with each other are in an "or" relationship, for example, A / B can represent A or B; "and / or" in this application is merely a description of the association relationship between associated objects, indicating that three relationships may exist, for example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone, where A and B can be singular or plural.

[0041] In the description of this application, unless otherwise specified, "plurality" means two or more than two. "At least one of the following" or similar expressions refers to any combination of these items, including any combination of single items or plural items. For example, at least one of a, b, or c can mean: a, b, c, ab, ac, bc, or abc, where a, b, and c can be single or multiple.

[0042] In addition, in order to clearly describe the technical solutions of the embodiments of the present application, in the embodiments of the present application, words such as "first" and "second" are used to distinguish the same items or similar items with substantially the same functions and effects. Those skilled in the art can understand that words such as "first" and "second" do not limit the quantity and execution order, and words such as "first" and "second" do not necessarily limit the difference.

[0043] In the embodiments of the present application, words such as "exemplary" or "for example" are used to indicate examples, illustrations or descriptions. Any embodiment or design described as "exemplary" or "for example" in the embodiments of the present application should not be interpreted as being more preferred or more advantageous than other embodiments or designs. Specifically, the use of words such as "exemplary" or "for example" is intended to present related concepts in a concrete way for easy understanding.

[0044] It is understood that the "embodiment" mentioned throughout the specification means that the specific features, structures or characteristics related to the embodiment are included in at least one embodiment of the present application. Therefore, the various embodiments in the entire specification do not necessarily refer to the same embodiment. In addition, these specific features, structures or characteristics can be combined in one or more embodiments in any suitable manner. It is understood that in various embodiments of the present application, the size of the sequence number of each process does not mean the order of execution, and the execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiment of the present application.

[0045] It can be understood that some optional features in the embodiments of the present application may be implemented independently in certain scenarios without relying on other features, such as the solution on which they are currently based, to solve corresponding technical problems and achieve corresponding effects, or may be combined with other features according to needs in certain scenarios. Accordingly, the devices provided in the embodiments of the present application may also realize these features or functions accordingly, which will not be elaborated here.

[0046] In this application, unless otherwise specified, the same or similar parts between the various embodiments can refer to each other. In this application, if there is no special description or logical conflict between the various embodiments, the terms and / or descriptions between different embodiments are consistent and can be referenced to each other, and different embodiments can be combined to form new embodiments according to their inherent logical relationships. The following implementation methods of this application do not constitute a limitation on the scope of protection of this application.

[0047] like Figure 1As shown, an embodiment of the present application provides a vulnerability detection method, the method comprising: obtaining a code to be detected, the code to be detected includes multiple source code lines; based on the multiple source codes of the code to be detected, generating an index document, the index document includes multiple index information, the index information corresponds to the source code line, each index information includes an index path and code line information; based on the vulnerability rule, the code line information in the index document is subjected to vulnerability detection to determine the target index information; based on the index path of the target index information, the target source code line is determined. Based on the above technical solution, the detection device can generate an index document based on code lines according to the code to be detected, and then the detection device compares the known vulnerability code with the code line text in the index document to perform vulnerability detection, so the vulnerability detection method provided by the embodiment of the present application has a faster detection speed and higher detection efficiency.

[0048] On the other hand, since the index documents in the embodiments of the present application are based on code lines, the detection of vulnerabilities can be independent of each other. Therefore, when vulnerability detection needs to be performed again after the emergence of new code, the existing solution needs to regenerate the control flow graph for detection, while in the embodiments of the present application, only the index documents need to be updated, and some index documents do not need to be regenerated, which improves the detection speed and efficiency.

[0049] The detection device in the embodiments of the present application may be a computing service device with data processing, network communication and program running functions, such as a server, a tablet computer, a personal computer, a mobile phone, etc., or an electronic device that can realize the above functions and can execute the vulnerability detection method provided in the embodiments of the present application.

[0050] like Figure 2 As shown, the vulnerability detection method provided in the embodiment of the present application can be applied to a detection device 200, and the detection device 200 may include:

[0051] The code management unit 201 is responsible for establishing the association between the product and the code warehouse information, supporting the docking of the code warehouse, and managing the docked warehouse. When the code warehouse is first connected, it actively pulls the full code to create an index, and when the code changes subsequently, it pulls the incremental code based on the webhook WebHook to update the index file.

[0052] In the embodiment of the present application, WebHook is a message push mechanism triggered by an event. It allows one application to send real-time data to another application. In simple terms, when a specific event occurs in a source application, the source application automatically sends a hypertext transfer protocol (HTTP) request to a pre-configured target uniform resource locator (URL), and this request contains data related to the event.

[0053] The rule management unit 202 is responsible for managing all vulnerability rules and supports adding, deleting and modifying vulnerability rules. The source code or patch file needs to be subjected to vulnerability technical analysis and feature extraction. Based on the analysis results, keywords (such as hard-coded strings, dangerous functions, weak encryption algorithms, etc.) and code lines can be selected to generate multi-level rules. After the rules pass the preliminary verification test, the rules are finally archived and stored. If the rule test fails, further optimization and improvement are required.

[0054] The scanning engine unit 203 is used to support parsing multi-level vulnerability rules and converting them into query languages ​​of the above open source engines based on full-text detection engines such as elasticsearch and solr and keyword detection engines such as Yara.

[0055] The task management unit 204 is used to connect to the code management unit, automatically execute the index creation task for the connected code warehouse, receive the scanning rules issued by the user, schedule the scanning engine to perform the troubleshooting task, and transmit the troubleshooting results to the report processing unit.

[0056] The report processing unit 205 is used to visualize the task results and present them to the user.

[0057] It is understandable that in the embodiments of the present application, the execution subject may execute some or all of the steps in the embodiments of the present application, and these steps or operations are only examples. The embodiments of the present application may also execute other operations or variations of various operations. In addition, the various steps may be executed in different orders presented in the embodiments of the present application, and it is possible that not all operations in the embodiments of the present application need to be executed.

[0058] It should be noted that the message names between the devices or the names of the parameters in the messages in the following embodiments of the present application are only examples, and other names may be used in the specific implementation, and the embodiments of the present application do not specifically limit this.

[0059] Combine the following Figures 3 to 5 The technical solution of the present application is described in detail with specific method embodiments. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described in detail in some embodiments.

[0060] For example, Figure 3 A schematic diagram of a vulnerability detection method provided in an embodiment of the present application. Figure 3 As shown, the vulnerability detection method may specifically include the following steps:

[0061] 301. Create code vulnerability rules.

[0062] The detection device creates corresponding code vulnerability rules based on known code vulnerability information.

[0063] In an embodiment of the present application, after knowing a code vulnerability, in order to detect whether the same vulnerability exists in other program codes, the detection device needs to create corresponding code vulnerability rules based on the relevant information of the code vulnerability. The code vulnerability rules can be used to detect whether other codes have the vulnerability.

[0064] Specifically, Figure 4 A flowchart of a method for creating code vulnerability rules provided in an embodiment of the present application is shown below. Figure 5 As shown, the code vulnerability rule creation method may include:

[0065] 401. Identify vulnerable code in source code.

[0066] After the detection device determines that there is a vulnerability in a piece of source code, it needs to perform vulnerability technical analysis on the source code to determine the vulnerability code that causes the vulnerability. The vulnerability code can be used to determine the vulnerability rule.

[0067] For example, if there is a vulnerability in the following source code, a technical analysis is required before detection to determine the key vulnerability code.

[0068]

[0069]

[0070] Among them, the code "ucHostNameLength = (UCHAR)StrLen((CHAR*)stDraCfg.stBaseInfo.szDraHostName)" indicates to obtain the length of the host name "stDraCfg.stBaseInfo.szDraHostName" and assign it to "ucHostNameLength".

[0071] The code “(VOID)MemCpy((CHAR*)pcDraName,(CHAR*)stDraCfg.stBaseInfo.szDraHostName,ucHostNameLength+1)” indicates copying the host name to the specified memory area.

[0072] Since the StrLen() function performs a memory copy operation without checking the length after obtaining the host name length, there is a buffer overflow vulnerability, which leads to a program denial of service. Therefore, it can be determined that the above two lines of code are vulnerable codes.

[0073] In the embodiments of the present application, for the technical analysis of source code vulnerabilities, the determination of vulnerability codes can be done manually or by a detection device, which is not specifically limited here.

[0074] 402. Determine vulnerability keywords and / or vulnerability code lines according to the vulnerability code.

[0075] The detection device extracts features from the vulnerability code to obtain vulnerability keywords and / or vulnerability code lines.

[0076] like Figure 5 As shown, Figure 5 A scenario diagram of a vulnerability detection method code vulnerability rule creation method provided in an embodiment of the present application. Specifically, after determining the vulnerability code, the detection device can determine the keyword that causes the vulnerability through keyword scanning. For example, if a code has a vulnerability due to calling a dangerous function, the detection device can scan the function name through the keyword and then determine that the function name is the vulnerability keyword.

[0077] Specifically, Figure 5 As shown, after determining the vulnerability code, the detection device can scan the code lines to determine the vulnerability code lines that cause the vulnerability. For example, since the StrLen() function does not perform length judgment after obtaining the host name length, it performs a memory copy operation, which causes a buffer overflow vulnerability, resulting in a program denial of service. In the code, the code "ucHostNameLength = (UCHAR)StrLen((CHAR*)stDraCfg.stBaseInfo.szDraHostName)" indicates obtaining the length of the host name "stDraCfg.stBaseInfo.szDraHostName" and assigning it to "ucHostNameLength" and the code "(VOID)MemCpy((CHAR*)pcDraName,(CHAR*)stDraCfg.stBaseInfo.szDraHostName,ucHostNameLength+1)" is the vulnerability code line.

[0078] In the embodiment of the present application, for the analysis and scanning of the vulnerability code, the method of extracting keywords can be used, which is more suitable for the scenario of simple vulnerability features, such as the use of dangerous functions, weak encryption algorithms and hard-coded strings. The method of extracting code lines can also be used in most scenarios, but feature extraction is somewhat difficult, especially for the scenario where the defective code is distributed in multiple files.

[0079] To sum up, in the embodiments of the present application, the analysis and scanning of vulnerability codes can be performed by extracting keywords, extracting code lines, or both extracting keywords and extracting code lines; it can also be implemented by other methods, which are not limited here.

[0080] 403. Create code vulnerability rules based on vulnerability keywords and / or vulnerability code lines.

[0081] The detection device creates corresponding code vulnerability rules according to vulnerability keywords and / or vulnerability code lines. The code vulnerability rules can be used to detect whether other codes have the same vulnerability.

[0082] The code vulnerability rules in the embodiment of the present application may include the following multiple vulnerability rules:

[0083] 1. Vulnerability keyword rules.

[0084] Vulnerability keyword rules identify potential security risks based on specific words or functions that may appear in the code. These keywords are often associated with known dangerous operations or functions that are easily exploited.

[0085] For example, in the code involving file operations, functions such as "fopen()" and "write()" are key. If the parameters of these functions (such as file names) are controlled by user input and are not fully validated, it may lead to file write vulnerabilities. For example, the code file = fopen (GET ['filename'], 'w') may allow attackers to write or overwrite important files on the server by constructing malicious file names. The corresponding rules can be strict whitelist verification of the file names entered by the user to ensure that only legal file names can be used in file operation functions.

[0086] 2. Vulnerability code line rule.

[0087] Vulnerable code line rules focus more on analyzing the specific syntax structure and operations of the code to determine whether each line of code may introduce security risks. This may involve checking multiple aspects such as operators, function calls, and variable usage in the code line.

[0088] 3. Parameter validation rules.

[0089] When calling a function, the parameters passed into the function need to be strictly verified.

[0090] For example, in many programming languages, there are functions for reading files. If the validity of the file path parameter is not checked, it may lead to a file reading vulnerability.

[0091] For example, for mathematical functions, such as functions that calculate square roots (such as the sqrt() function in C), if a negative number is passed as an argument (within the real number range), it may cause a program exception. Therefore, when calling these functions, the range of the argument needs to be verified to ensure that it meets the domain requirements of the function.

[0092] 4. Return value check rules.

[0093] Many function calls return a value that may contain important information or indicate the status of the function's execution. After calling a function, the return value should be checked.

[0094] In addition, there may be other types of vulnerability rules, which are not specifically limited here.

[0095] In the embodiment of the present application, the detection device can generate corresponding vulnerability keyword rules according to vulnerability keywords, can also create corresponding vulnerability code line rules according to vulnerability code lines, and can also create corresponding code vulnerability rules according to vulnerability keywords and vulnerability code lines. That is, for a vulnerability code, there are corresponding vulnerability keywords and corresponding vulnerability code lines at the same time, the detection device can create corresponding code vulnerability rules according to vulnerability keywords and vulnerability code lines respectively, or can create corresponding code vulnerability rules according to vulnerability keywords and vulnerability code lines, which are not limited here.

[0096] Specifically, Figure 5 As shown, after obtaining the vulnerability keyword, the detection device can generate a corresponding vulnerability keyword rule based on the vulnerability keyword, and the vulnerability keyword rule can be used to find the same vulnerability keyword in the code to be detected. For example, the vulnerability keyword is a function name, and the function is a dangerous function. The detection device can create a corresponding vulnerability keyword rule based on this. The vulnerability keyword rule can be to find the dangerous function name in the code to be detected, and the code line with the dangerous function name is the code line with the vulnerability. For example, the rule can be "from{index}wherecode.snippet contains("function name")", indicating to query the code snippet containing the function name in a specific index.

[0097] Specifically, Figure 5As shown, after obtaining the vulnerable code line, the detection device can create a corresponding vulnerable code line rule based on the vulnerable code line, and the vulnerable code line rule can be used to find similar vulnerable code lines in the code to be detected. For example, in the vulnerable code line in step 402 above, since the StrLen() function does not perform a length judgment after obtaining the host name length, a memory copy operation is performed, resulting in a buffer overflow vulnerability, which leads to program denial of service. It can be understood that the vulnerability mainly includes the two steps of obtaining the length and memory copying, so the code snippet including these two steps is more likely to be a vulnerable code snippet, so a rule can be created to find the code snippet including "StrLen" and "MemCpy", and whether to perform a length judgment after obtaining the host name length.

[0098] For example, the detection device can create a corresponding vulnerability code line rule based on this, and the vulnerability code line rule is: "from {index} where code.snippet contains ("StrLen") and code.snippet contains ("MemCpy")"

[0099] The code vulnerability rule indicates to search in the index for code snippets containing both the strings "StrLen" and "MemCpy" in the code snippet, and obtain the first detection result after searching.

[0100] “from{index}where code.file in(first test result)and code.function in(first test result)

[0101] and code.snippet regex(“\\(\w+)\s+=\s+StrLen*”)

[0102] and code.snippet regex("\(VOID\)MemCpy\(\(CHAR\s+\*\)\w+,\s+\(CHAR\s+\*\)\w+(\.\w+)+,\s+\w+\s+\+\s\d\)""

[0103] In the above rule, the first two conditions in the where statement "code.file in (first test result) and code.function in (first test result)" limit the query scope, and the third query condition code.snippet regex("\\(\w+)\s+=\s+StrLen*") is a regular match, which means using regular expressions to fuzzily match code lines in the form of "ucHostNameLength=(UCHAR)StrLen". The fourth query condition code.snippetregex("\(VOID\)MemCpy\(\(CHAR\s+\*\)\w+,\s+\(CHAR\s+\*\)\w+(\.\w+)+,\s+\w+\s+\+\s\d\)" means using regular expressions to fuzzily match code lines in the form of "(VOID)MemCpy((CHAR*)pcDraName,(CHAR*)stDraCfg.stBaseInfo.szDraHostName,ucHostNameLength+1)").

[0104] Thus, the code fragment that does not perform length judgment after obtaining the host name length is detected in the first detection result to obtain the final detection result.

[0105] In a possible implementation, the code vulnerability rules in the embodiments of the present application may be multi-level rules, for example, may include code vulnerability parent rules and code vulnerability sub-rules, where the code vulnerability sub-rules are code vulnerability rules created based on the code vulnerability parent rules.

[0106] The detection device can perform vulnerability detection on the code line text according to the code vulnerability parent rule to obtain a first detection result; then perform vulnerability detection on the first detection result according to the code vulnerability sub-rule to obtain a final second detection result (i.e., target index information). The second detection result includes the code line text with vulnerabilities and the corresponding target index information.

[0107] For example, in the above code vulnerability rule "from{index}where code.snippet contains("StrLen")andcode.snippet contains("MemCpy")", the two strings "StrLen" and "MemCpy" are searched. However, it is possible that the code snippet includes these two strings, but there is not necessarily a code vulnerability. Therefore, we need to use the above code vulnerability rule as the code vulnerability parent rule, create further code vulnerability rules as code vulnerability sub-rules, and after obtaining the first detection result by detecting according to the code vulnerability parent rule, detect according to the first detection result of the code vulnerability sub-rule to obtain the second detection result.

[0108] Therefore, you can create the following rule:

[0109] Parent rule:

[0110] "from{index}where code.snippet contains("StrLen")and code.snippetcontains("MemCpy")" sub-rule:

[0111] “from{index}where code.file in(first test result)and code.function in(first test result)

[0112] and code.snippet regex(“\\(\w+)\s+=\s+StrLen*”)

[0113] and code.snippet regex("\(VOID\)MemCpy\(\(CHAR\s+\*\)\w+,\s+\(CHAR\s+\*\)\w+(\.\w+)+,\s+\w+\s+\+\s\d\)""

[0114] In the generation of sub-rules, the detection device can modify the function name, variable name and parameter name in the rule to detect vulnerabilities as much as possible and reduce the possibility of undetected vulnerabilities. The broader the rule setting, the higher the false alarm rate may be.

[0115] 404. Test code vulnerability rules.

[0116] After the detection device creates a code vulnerability rule, in order to ensure the efficiency and effectiveness of the code vulnerability rule, the code vulnerability rule process needs to be tested. After ensuring that the code vulnerability rule passes the test, the code vulnerability rule can be used.

[0117] In one possible implementation, if too many code vulnerabilities are detected through the code vulnerability rule scan and exceed the expected number, it means that the code vulnerability rule may not be set reasonably and needs to be optimized. For example, the detection device can detect the sample code according to the code vulnerability rule to obtain the detection result of the sample code. When the number of code vulnerabilities in the sample detection result does not exceed the preset threshold value, such as 500, the detection device can determine that the code vulnerability rule has passed the test. When the number of code vulnerabilities in the sample detection result exceeds the threshold value, it means that the setting of the code vulnerability rule is not reasonable, and the detection result may include a large number of results that do not actually have vulnerabilities, which need further optimization. The detection device can determine that the code vulnerability rule has not passed the test.

[0118] In an embodiment of the present application, the detection device tests the code vulnerability rules, which can be determined by testing whether the number of code vulnerabilities detected by the code vulnerability rules meets expectations; it can also be determined by other methods, such as testing whether all vulnerabilities can be detected by the code vulnerability rules, or whether the time for detecting vulnerabilities by the code vulnerability rules exceeds expectations, etc., which are not limited here.

[0119] In the embodiment of the present application, when the code vulnerability rule passes the test, the detection device can store and archive the code vulnerability rule for use in subsequent detection of the code to be detected.

[0120] In summary, the detection device can create corresponding code vulnerability rules according to the relevant information of the code vulnerability, and then detect the code to be detected according to the code vulnerability rules.

[0121] 302. Obtain the code to be detected.

[0122] After the creation of the code vulnerability rule is completed, the detection device can obtain the code to be detected, which includes multiple source code lines, and generate a corresponding detection task to perform vulnerability detection on the code to be detected.

[0123] In the embodiment of the present application, the detection device can be associated with the code warehouse of the program product to detect and manage the connected code warehouse. For example, for a newly connected code warehouse, the detection device can actively pull the full code; when the code warehouse is subsequently updated, the detection device can pull the incremental code according to the webhook and detect the incremental code.

[0124] Specific as Figure 6 As shown, Figure 6Schematic diagram of a scenario in which a detection device provided in an embodiment of the present application obtains the code to be detected. The detection device 601 is connected to the code hosting platform 602, and the detection device 601 can detect and manage the code warehouse in the code hosting platform 602 that has been connected. The code warehouse of the code hosting platform 602 may include the source code of product 1, product 2, and product 3 in the application product 603. There are two main ways for the detection device to obtain the code to be detected:

[0125] A. Webhook push.

[0126] When the source code is the under-development version code 604, the code hosting platform 602 can push the updated source code to the detection device through the webhook. Correspondingly, the detection device can pull the updated source code according to the webhook to obtain the code to be detected.

[0127] B. Actively pull.

[0128] When the source code is a historical version code 605 and vulnerability detection needs to be performed on the historical version code 605, the detection device can actively obtain the historical version code 605, thereby obtaining the code to be detected.

[0129] 303. Generate an index document according to the code to be detected.

[0130] After obtaining the code to be detected, in order to quickly and efficiently detect the code to be detected, the detection device can generate an index document based on multiple source codes of the code to be detected. The index document includes multiple index information, and the index information corresponds to the source code line. Each index information includes an index path and code line information.

[0131] Specifically, a corresponding index path is generated according to a storage path of a source code line, the index path indicates a storage path of the source code line; corresponding code line information is generated according to the source code line; index information corresponding to the source code line is determined, the index information includes the index path and code line information; and an index document is generated according to a plurality of index information.

[0132] In the embodiment of the present application, the index document may be an index document based on the code lines of the code to be detected.

[0133] In the embodiment of the present application, the detection device can generate corresponding index documents according to multiple source codes of the code to be detected.

[0134] In a possible implementation, the code to be detected is an existing code, and the detection device can generate a corresponding first index document according to the existing code.

[0135] In another possible implementation, the code to be detected is an incremental code, and the detection device can generate a corresponding second index document based on the incremental code. It is understandable that after the code to be detected is updated, the corresponding index document also needs to be updated. Therefore, after the code to be detected is updated, the detection device can generate a corresponding second index document based on the updated code to be detected.

[0136] In one possible implementation, Figure 7 As shown, Figure 7 A schematic diagram of a source code processing scenario provided by an embodiment of the present application. The detection device can first filter the source code lines of the code to be detected to obtain code text, such as removing HTML tags, comment lines, import statements, blank lines and other information from the original code text.

[0137] The detection device then performs word segmentation processing on the code text to obtain multiple code mark tokens. Specifically, the detection device can segment the code text information into multiple code tokens according to the word segmentation rule, for example, the word segmentation rule can be segmentation according to spaces.

[0138] Then, the detection device converts the multiple code tokens to obtain code line text information in the index document, and the code line text information may include multiple code words and their synonymous tokens.

[0139] For example, for the code to be detected “Process process=Runtime.getRuntime().exec(osCommand+data)”, after filtering, word segmentation and conversion, the code line text information “Process processRuntime.getRuntime exec osCommand data)” can be obtained.

[0140] In an embodiment of the present application, the index document includes code text information and code-related information of the code to be detected. The code text information includes the code path, method name, code line number and code line text of the code to be detected. The code-related information includes the product name, version number, warehouse address and branch information of the code to be detected.

[0141] For example, for the code to be detected "Process process = Runtime.getRuntime().exec(osCommand+data)", the corresponding index document format can be as follows:

[0142] {

[0143] "product":"A", / / Product name is A

[0144] "version":"24.0.0","repo_url":"https: / / git.gitlab.com / SecurityToolsLab / Demo / BackendService.git", / / The version number is 24.0.0

[0145] "branch":"master", / / Branch is master

[0146] "file_path":"ReportAnalysiService / src / main / java / com / seclab / reportanalysiservice / utils / VirusHttpUtils.java", / / file path

[0147] "language":"Java", / / language type is Java

[0148] "method":"runCmd", / / The method name is runCmd

[0149] "line":78, / / line number is 78

[0150] "snippet":"Process process=Runtime.getRuntime().exec(osCommand+data);"

[0151] / / Code behavior Process process = Runtime.getRuntime().exec(osCommand+data)

[0152] }

[0153] For example Figure 8 As shown, the index document includes the index documents of the two codes to be detected, "Process process = Runtime.getRuntime().exec(osCommand+data)" and "int result = (int)(data*data)". The index document of each code to be detected contains the product name, version number, warehouse address, file path, method name, line number and code line text.

[0154] In the present application embodiment, Fig. 9 As shown, Fig. 9A schematic diagram of a scenario in which an index library stores index documents provided in an embodiment of the present application. After the detection device generates the corresponding index document according to the code to be detected, it can be stored separately according to the source code language type of the code to be detected. For example, for the code to be detected in different development languages, the detection device can store the index documents corresponding to the code to be detected in different development languages ​​into the corresponding index library, for example, the index document corresponding to the detection code of the C language is stored in the corresponding C language index library; the index document corresponding to the detection code of the Java language is stored in the corresponding Java language index library; the index document corresponding to the detection code of the Python language is stored in the corresponding Python language index library; the index document corresponding to the detection code of the JavaScript language is stored in the corresponding JavaScript language index library; the index document corresponding to the detection code of the Go language is stored in the corresponding Go language index library.

[0155] In the embodiment of the present application, the detection device independently stores and retrieves index documents of different development languages, which can improve the retrieval efficiency and reduce the storage space by using the grammatical similarity between the same languages.

[0156] 304. Perform vulnerability detection on the code line information in the index document based on the vulnerability rule to determine the target index information.

[0157] like Fig.10 As shown, the detection device detects the index document corresponding to the code to be detected according to the preset code vulnerability rules to determine the target index information.

[0158] In the embodiment of the present application, the detection device can detect index documents through detection engines such as full-text detection engine elasticsearch, solr and keyword detection engine Yara. These detection engines support parsing multi-level vulnerability rules and converting them into query language (query language, QL) of open source engines.

[0159] In an embodiment of the present application, after determining that there is a vulnerability in the code to be detected, the detection device can locate the storage location of the code to be detected based on the code path, method name, code line number, product name, version number, warehouse address, branch information and other information of the code to be detected in the index document. The detection device can quickly locate the vulnerability location through the above information, thereby improving the efficiency of vulnerability location.

[0160] In a possible implementation, the code vulnerability rules in the embodiments of the present application may be multi-level rules, for example, may include code vulnerability parent rules and code vulnerability sub-rules, where the code vulnerability sub-rules are code vulnerability rules created based on the code vulnerability parent rules.

[0161] The detection device can perform vulnerability detection on the code line text according to the code vulnerability parent rule to obtain a first detection result; then perform vulnerability detection on the first detection result according to the code vulnerability sub-rule to obtain a second detection result (i.e., the final detection result), and the second detection result includes target index information.

[0162] 305. Determine a target source code line based on an index path of the target index information.

[0163] After determining the target index information, the detection device determines the corresponding target source code line according to the index path of the target index information. The target source code line is the code line where the vulnerability exists, and the target source code line is the detection result.

[0164] In the embodiment of the present application, after the detection device detects the index document according to the code vulnerability rule and obtains the detection result, the detection result can be displayed to the user through the display device.

[0165] Fig.11 This is a schematic diagram of the structure of a detection device provided in an embodiment of the present application. Fig.11 As shown, the detection device 1100 includes one or more (including two) processors 1101 , a communication line 1102 and a communication interface 1103 . Optionally, the detection device 1100 also includes a memory 1104 .

[0166] In some implementations, the memory 1104 stores the following elements: executable modules or data structures, or a subset thereof, or an extended set thereof.

[0167] The method described in the above embodiment of the present application can be applied to the processor 1101, or implemented by the processor 1101. The processor 1101 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method can be completed by an integrated logic circuit of hardware in the processor 1101 or an instruction in the form of software. The above-mentioned processor 1101 can be a general-purpose processor (for example, a microprocessor or a conventional processor), a digital signal processor, an application specific integrated circuit (ASIC), a field-programmable gate array (FPGA) or other programmable logic devices, discrete gates, transistor logic devices or discrete hardware components. The processor 1101 can implement or execute the disclosed methods, steps and logic block diagrams in the embodiments of the present application.

[0168] The steps of the method disclosed in the embodiment of the present application can be directly embodied as being executed by a hardware decoding processor, or being executed by a combination of hardware and software modules in the decoding processor. Among them, the software module can be located in a mature storage medium in the field such as a random access memory, a read-only memory, a programmable read-only memory, or an electrically erasable programmable read only memory (EEPROM). The storage medium is located in the memory 1104, and the processor 1101 reads the information in the memory 1104 and completes the steps of the above method in combination with its hardware.

[0169] The processor 1101 , the memory 1104 , and the communication interface 1103 may communicate with each other via the communication line 1102 .

[0170] In the above embodiments, the instructions stored in the memory for execution by the processor may be implemented in the form of a computer program product, wherein the computer program product may be pre-written in the memory, or may be downloaded and installed in the memory in the form of software.

[0171] The embodiment of the present application also provides a computer program product, which includes one or more computer instructions. When the computer program instructions are loaded and executed on the computer, the process or function performed by the satellite base station or detection device in the embodiment of the present application is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network or other programmable device. The computer instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions can be transmitted from a website satellite constellation, a computer, a server or a data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (digital subscriber line, DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) mode to another website satellite constellation, computer, server or data center. The computer-readable storage medium can be any available medium that a computer can store or a data storage device such as a server, a data center, etc. that includes one or more available media integrated. For example, the available medium can include a magnetic medium (e.g., a floppy disk, a hard disk or a tape), an optical medium (e.g., a digital versatile disc (digital versatile disc, DVD)), or a semiconductor medium (e.g., a solid state disk (solid state disk, SSD)), etc.

[0172] An embodiment of the present application provides a detection device, which includes a processor and a memory, the memory is used to store a computer program, and the processor is used to execute the computer program to perform the above-mentioned vulnerability detection method.

[0173] The embodiment of the present application also provides a computer-readable storage medium. The computer-readable storage medium stores a computer program or instruction. When the computer program or instruction is executed by the processor, the method executed by the above-mentioned base station or detection device is implemented. The method described in the above embodiment can be implemented in whole or in part by software, hardware, firmware, or any combination thereof. If implemented in software, the function can be stored as one or more instructions or codes on a computer-readable medium or transmitted on a computer-readable medium. Computer-readable media may include computer storage media and communication media, and may also include any medium that can transfer a computer program from one place to another. The storage medium may be any target medium that can be accessed by a computer.

[0174] As a possible design, the computer-readable medium may include a compact disc read-only memory (CD-ROM), RAM, ROM, EEPROM or other optical disc storage; the computer-readable medium may include a magnetic disk storage or other magnetic disk storage device. Moreover, any connecting line may also be appropriately referred to as a computer-readable medium. For example, if the software is transmitted from a website, server or other remote source using a coaxial cable, fiber optic cable, twisted pair, DSL or wireless technology (such as infrared, radio and microwave), the coaxial cable, fiber optic cable, twisted pair, DSL or wireless technology such as infrared, radio and microwave are included in the definition of the medium. Disks and optical discs as used herein include compact discs (CDs), laser discs, optical discs, DVDs, floppy disks and Blu-ray discs, where disks generally reproduce data magnetically, while optical discs reproduce data optically using lasers. Combinations of the above should also be included in the scope of computer-readable media.

[0175] The embodiments of the present application are described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processing unit of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processing unit of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0176] The above specific implementation methods further illustrate the purpose, technical solutions and beneficial effects of the present application in detail. It should be understood that the above are only specific implementation methods of the present application and are not used to limit the protection scope of the present application. Any modifications, equivalent substitutions, improvements, etc. made on the basis of the technical solutions of the present application should be included in the protection scope of the present application.

Claims

1. A vulnerability detection method, characterized in that: The method comprises: Obtaining a code to be detected, wherein the code to be detected includes a plurality of source code lines; Generate an index document based on multiple source codes of the code to be detected, wherein the index document includes multiple index information, the index information corresponds to the source code line, and each of the index information includes an index path and code line information; Perform vulnerability detection on the code line information in the index document based on vulnerability rules to determine target index information; Based on the index path of the target index information, a target source code line is determined.

2. The method according to claim 1, characterized in that The step of generating an index document based on the plurality of source codes of the code to be detected comprises: generating a corresponding index path according to the storage path of the source code line, wherein the index path indicates the storage path of the source code line; Generate corresponding code line information according to the source code line; Determine index information corresponding to the source code line, the index information including the index path and the code line information; The index document is generated according to the plurality of index information.

3. The method according to claim 2, characterized in that The code line information includes code line text information, and the generating corresponding code line information according to the source code line includes: Filtering the source code lines to obtain code line texts; Performing word segmentation processing on the code line text to obtain multiple code mark tokens; The multiple code tokens are converted to obtain the code line text information, where the code line text information includes multiple code words and their synonymous tokens.

4. The method according to claim 3, characterized in that The step of generating an index document based on the plurality of source codes of the code to be detected comprises: Generate a first index document based on multiple source codes of the code to be detected, where the code to be detected is an existing code; or A second index document is generated based on a plurality of source codes of the code to be detected, where the code to be detected is an incremental code.

5. The method according to any one of claims 1 to 4, characterized in that Before performing vulnerability detection on the code line information in the index document based on the vulnerability rule, the method further includes: Extract keywords from known vulnerability codes to obtain vulnerability keywords; and / or Extract code lines from known vulnerable codes to obtain vulnerable code lines; A vulnerability rule is created according to the vulnerability keyword and / or the vulnerability code line, wherein the vulnerability rule includes a vulnerability keyword rule and a vulnerability code line rule.

6. The method according to claim 5, characterized in that The step of performing vulnerability detection on the code line information in the index document based on the vulnerability rule to determine the target index information includes: Based on the vulnerability rule, vulnerability keyword detection and / or vulnerability code line detection are performed on the code line information in the index document to determine the target index information, and the target source code line corresponding to the target index information has a vulnerability.

7. The method according to claim 6, characterized in that The code vulnerability rule is a multi-level rule, and the code vulnerability rule includes a code vulnerability parent rule and a code vulnerability sub-rule, and the code vulnerability sub-rule is a rule created based on the code vulnerability parent rule.

8. The method according to claim 7, characterized in that The step of performing vulnerability keyword detection and / or vulnerability code line detection on the code line information in the index document based on the vulnerability rule to determine the target index information includes: Perform vulnerability detection on the code line information according to the code vulnerability parent rule to obtain a first detection result; Vulnerability detection is performed on the first detection result according to the code vulnerability sub-rule to obtain determined target index information, and a target source code line corresponding to the target index information has a vulnerability.

9. The method according to claim 8, characterized in that After creating vulnerability rules according to the vulnerability keywords and / or vulnerability code lines, the method further includes: Detect the sample code according to the vulnerability rules to obtain the sample code detection result; When the number of code vulnerabilities in the sample detection result does not exceed a threshold, determining that the code vulnerability rule passes the test; When the number of code vulnerabilities in the sample detection result exceeds a threshold, it is determined that the code vulnerability rule fails the test.

10. A detection device, characterized in that: The system comprises a memory and a processor, wherein the memory is used to store a computer program, and the processor is used to call the computer program to execute the vulnerability detection method according to any one of claims 1 to 9.

Images