Static code analysis system and method based on taint analysis

Abstract

The invention relates to the technical field of network security, and particularly discloses a static code analysis system and method based on taint analysis, and the method comprises the steps: carrying out the marking of a taint data flow of a to-be-detected static code through employing a taint analysis technology; and carrying out embedded coding and context association analysis on each taint data stream by adopting a data processing technology based on deep learning to extract semantic feature representation of each taint data stream, and then carrying out time sequence association aggregation analysis on the taint data streams based on the time sequence and the propagation path of the taint data streams to obtain the semantic feature representation of each taint data stream. Therefore, the flow condition of the taint data can be understood more accurately, and the potential vulnerabilities in the static codes can be identified accurately. In this way, the accuracy and efficiency of static code analysis can be effectively improved, and the safety of a software system is further enhanced.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and more specifically, to a static code analysis system and method based on taint analysis. Background Art

[0002] As software systems become increasingly complex, code quality and security have become important concerns in software development and operation and maintenance. Static code analysis, as an effective means, can discover potential security vulnerabilities and quality issues during the code writing phase, thereby reducing the cost and risk of later repairs.

[0003] In recent years, taint analysis technology has been widely used due to its effectiveness in detecting data flow security vulnerabilities. For example, the invention patent with publication number CN113836532A discloses a PHP static code analysis method based on taint analysis, which first performs lexical analysis and syntax analysis on the static code to construct the corresponding abstract syntax tree (AST). Then, the abstract syntax tree is divided into different sub-functions, and the tainted data flow in each sub-function is marked using taint analysis technology. Finally, the existence of a security vulnerability is determined based on the properties of the convergence point parameters of the tainted data flow.

[0004] However, although the above method has achieved certain results in PHP static code analysis, it mainly focuses on the convergence point parameter properties of the tainted data flow when processing the tainted data flow, and lacks in-depth analysis of the deep semantic characteristics of the data flow and the temporal correlation of the data flow. This may lead to misjudgment or omission of security vulnerabilities when facing complex code logical structures, and its detection accuracy and efficiency still need to be improved.

[0005] Therefore, an optimized static code analysis method based on taint analysis is expected. Summary of the invention

[0006] In order to solve the above technical problems, the present application is proposed. The embodiment of the present application provides a static code analysis system and method based on taint analysis, which uses taint analysis technology to mark the tainted data stream of the static code to be detected, and uses data processing technology based on deep learning to embed coding and context association analysis on each tainted data stream to extract the semantic feature representation of each tainted data stream, and then, based on the time sequence and propagation path of the tainted data stream, perform temporal association aggregation analysis on it, so as to more accurately understand the flow of tainted data and realize accurate identification of potential vulnerabilities in static code. In this way, the accuracy and efficiency of static code analysis can be effectively improved, and the security of the software system can be further enhanced.

[0007] According to one aspect of the present application, a static code analysis method based on taint analysis is provided, which includes: Get the static code to be tested; Performing lexical analysis and grammatical analysis on the static code to be detected to obtain an abstract syntax tree corresponding to the static code to be detected; Splitting the abstract syntax tree into different sub-functions to obtain a set of sub-functions; Using the taint analysis technology to mark the tainted data flow of each sub-function in the set of sub-functions to obtain a time queue of the tainted data flow; Based on the time queue of the tainted data stream, it is determined whether the static code to be detected has a vulnerability.

[0008] In the above-mentioned static code analysis method based on taint analysis, based on the time queue of the taint data stream, it is determined whether the static code to be detected has a vulnerability, including: context-association encoding the time queue of the taint data stream to obtain a time queue of context taint data stream semantic encoding feature vectors; performing temporal dynamic propagation aggregation on the time queue of the context taint data stream semantic encoding feature vectors to obtain a data stream semantic temporal significant propagation aggregation feature vector; based on the data stream semantic temporal significant propagation aggregation feature vector, identifying whether the static code to be detected has a vulnerability.

[0009] In the above-mentioned static code analysis method based on taint analysis, the time queue of the context taint data stream semantic coding feature vector is subjected to temporal dynamic propagation aggregation, including: based on the feature association strength of each context taint data stream semantic coding feature vector in the time queue of the context taint data stream semantic coding feature vector relative to the current context taint data stream semantic coding feature vector, feature modulation is performed on the time queue of the context taint data stream semantic coding feature vector to obtain the time queue of the context taint data stream semantic coding feature vector after intensity modulation; and temporal association aggregation is performed on the time queue of the context taint data stream semantic coding feature vector after the intensity modulation to obtain the data stream semantic temporal significant propagation aggregation feature vector.

[0010] In the above-mentioned static code analysis method based on taint analysis, the time queue of the taint data stream is context-encoded to obtain a time queue of contextual taint data stream semantic coding feature vectors, including: using a taint data stream embedding coding matrix to embed code each taint data stream in the time queue of the taint data stream to obtain a time queue of taint data stream embedded coding vectors; inputting the time queue of the taint data stream embedded coding vectors into a data stream context encoder based on a converter structure to obtain a time queue of contextual taint data stream semantic coding feature vectors.

[0011] In the above-mentioned static code analysis method based on taint analysis, based on the feature association strength of each context taint data stream semantic coding feature vector in the time queue of the context taint data stream semantic coding feature vector relative to the current context taint data stream semantic coding feature vector, the time queue of the context taint data stream semantic coding feature vector is feature modulated to obtain the time queue of the context taint data stream semantic coding feature vector after intensity modulation, including: extracting the current context taint data stream semantic coding feature vector from the time queue of the context taint data stream semantic coding feature vector; using the current context taint data stream semantic coding feature vector as a feature prompt gate, calculating the feature association strength prompt value of each context taint data stream semantic coding feature vector in the time queue of the context taint data stream semantic coding feature vector relative to the current context taint data stream semantic coding feature vector to obtain the time queue of the context taint data stream feature association strength prompt value; based on the time queue of the context taint data stream feature association strength prompt value, feature modulating the time queue of the context taint data stream semantic coding feature vector to obtain the time queue of the context taint data stream semantic coding feature vector after the intensity modulation.

[0012] In the above-mentioned static code analysis method based on taint analysis, the feature association strength prompt value of each context stain data stream semantic coding feature vector in the time queue of the context stain data stream semantic coding feature vector is calculated relative to the current context stain data stream semantic coding feature vector to obtain the time queue of the context stain data stream feature association strength prompt value, including: calculating the positional dot division vector between the context stain data stream semantic coding feature vector and the current context stain data stream semantic coding feature vector, and calculating the base-two logarithmic value of the absolute value of each eigenvalue in the dot division vector to obtain the context stain data stream feature association representation vector; calculating the dot product vector between the context stain data stream feature association representation vector and the context stain data stream semantic coding feature vector, and calculating the exponential function value with base e and the sum of the eigenvalues ​​of the dot product vector as the exponent to obtain the context stain data stream feature association strength prompt value.

[0013] In the above-mentioned static code analysis method based on taint analysis, based on the time queue of the context taint data stream feature association strength prompt value, the time queue of the context taint data stream semantic coding feature vector is feature modulated to obtain the time queue of the context taint data stream semantic coding feature vector after the intensity modulation, including: extracting the median of the time queue of the context taint data stream feature association strength prompt value as the feature association strength gate threshold; using the feature association strength gate threshold as the switching threshold of the gating unit, and inputting the time queue of the context taint data stream semantic coding feature vector and the time queue of the context taint data stream feature association strength prompt value into the gating unit to obtain the time queue of the context taint data stream semantic coding feature vector after the intensity modulation.

[0014] In the above-mentioned static code analysis method based on taint analysis, the feature association strength gate threshold is used as the switch threshold of the gating unit, and the time queue of the context taint data stream semantic coding feature vector and the time queue of the context taint data stream feature association strength prompt value are input into the gating unit to obtain the time queue of the context taint data stream semantic coding feature vector after intensity modulation, including: if the context taint data stream feature association strength prompt value is less than the feature association strength gate threshold, then the corresponding context taint data stream semantic coding feature vector is set to 0 to obtain the context taint data stream semantic coding feature vector after intensity modulation; if the context taint data stream feature association strength prompt value is greater than or equal to the feature association strength gate threshold, then it is divided by the feature association strength gate threshold as a weight coefficient and weighted modulated with the corresponding context taint data stream semantic coding feature vector to obtain the context taint data stream semantic coding feature vector after intensity modulation.

[0015] In the above-mentioned static code analysis method based on taint analysis, the time queue of the contextual taint data flow semantic encoding feature vector after intensity modulation is subjected to temporal correlation aggregation to obtain the data flow semantic temporal significant propagation aggregate feature vector, including: inputting the time queue of the contextual taint data flow semantic encoding feature vector after intensity modulation into a feature dynamic propagation module based on the forward LTSM model to obtain the data flow semantic temporal significant propagation aggregate feature vector.

[0016] In the above-mentioned static code analysis method based on taint analysis, based on the data flow semantic temporal significant propagation aggregate feature vector, it is identified whether the static code to be detected has a vulnerability, including: inputting the data flow semantic temporal significant propagation aggregate feature vector into a classifier-based vulnerability identifier to obtain an identification result, and the identification result is used to indicate whether the static code to be detected has a vulnerability.

[0017] According to another aspect of the present application, a static code analysis system based on taint analysis is provided, comprising: A tainted data context-associated encoding module, used for performing context-associated encoding on the time queue of the tainted data stream to obtain the time queue of the context tainted data stream semantic encoding feature vector; A temporal dynamic propagation aggregation module, used for performing temporal dynamic propagation aggregation on the time queue of the contextual stain data stream semantic encoding feature vector to obtain a data stream semantic temporal significant propagation aggregation feature vector; The vulnerability identification module is used to identify whether the static code to be detected has a vulnerability based on the data flow semantic time sequence significant propagation aggregation feature vector.

[0018] Compared with the prior art, the static code analysis system and method based on taint analysis provided by the present application uses taint analysis technology to mark the taint data stream of the static code to be detected, and uses data processing technology based on deep learning to embed coding and contextual association analysis on each taint data stream to extract the semantic feature representation of each taint data stream, and then, based on the time sequence and propagation path of the taint data stream, perform temporal association aggregation analysis on it, so as to more accurately understand the flow of taint data and realize accurate identification of potential vulnerabilities in static code. In this way, the accuracy and efficiency of static code analysis can be effectively improved, and the security of software systems can be further enhanced. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] By describing the embodiments of the present application in more detail in conjunction with the accompanying drawings, the above and other purposes, features and advantages of the present application will become more apparent. The accompanying drawings are used to provide a further understanding of the embodiments of the present application and constitute a part of the specification. Together with the embodiments of the present application, they are used to explain the present application and do not constitute a limitation of the present application. In the accompanying drawings, the same reference numerals generally represent the same components or steps.

[0020] Figure 1 It is a flowchart of sub-step S5 of the static code analysis method based on taint analysis according to an embodiment of the present application.

[0021] Figure 2 Schematic diagram of data flow of sub-step S5 of the static code analysis method based on taint analysis according to an embodiment of the present application.

[0022] Figure 3 It is a flowchart of sub-step S51 of the static code analysis method based on taint analysis according to an embodiment of the present application.

[0023] Figure 4 It is a flowchart of sub-step S52 of the static code analysis method based on taint analysis according to an embodiment of the present application.

[0024] Figure 5 This is a flowchart of sub-step S521 of the static code analysis method based on taint analysis according to an embodiment of the present application.

[0025] Figure 6 It is a block diagram of a static code analysis system based on taint analysis according to an embodiment of the present application. DETAILED DESCRIPTION

[0026] As shown in this application and claims, unless the context clearly indicates an exception, the words "a", "an", "an" and / or "the" do not refer to the singular and may also include the plural. Generally speaking, the terms "include" and "comprise" only indicate the inclusion of the steps and elements that have been clearly identified, and these steps and elements do not constitute an exclusive list. The method or device may also include other steps or elements.

[0027] Although the present application makes various references to certain modules in the system according to the embodiments of the present application, any number of different modules can be used and run on the user terminal and / or server. The modules are only illustrative, and different aspects of the system and method can use different modules.

[0028] Flowcharts are used in the present application to illustrate the operations performed by the system according to the embodiments of the present application. It should be understood that the preceding or following operations are not necessarily performed accurately in order. On the contrary, various steps may be processed in reverse order or simultaneously as required. Meanwhile, other operations may also be added to these processes, or a certain step or several steps of operations may be removed from these processes.

[0029] Below, the exemplary embodiments according to the present application will be described in detail with reference to the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all the embodiments of the present application, and it should be understood that the present application is not limited to the exemplary embodiments described here.

[0030] As mentioned in the background technology above, patent CN113836532A proposes a PHP static code analysis method based on taint analysis, which includes: S1, obtaining the static code to be detected; S2, performing lexical analysis and syntax analysis on the static code to be detected to obtain an abstract syntax tree corresponding to the static code to be detected; S3, dividing the abstract syntax tree into different sub-functions to obtain a set of sub-functions; S4, using taint analysis technology to mark the taint data stream of each sub-function in the set of sub-functions to obtain a time queue of the taint data stream; S5, based on the time queue of the taint data stream, determining whether the static code to be detected has a vulnerability.

[0031] As an important part of static code analysis, taint analysis technology can effectively track the propagation path of data flow in the program, thereby revealing potential security vulnerabilities. However, when processing tainted data flow, the above-mentioned PHP static code analysis method mainly determines whether there is a security vulnerability based on the nature of the convergence point parameters of the tainted data flow, and lacks in-depth analysis of the deep semantic features of the data flow and the temporal correlation of the data flow, which may lead to misjudgment or omission of security vulnerabilities when facing complex code logic structures.

[0032] In response to the above technical problems, this application proposes an optimized static code analysis method based on taint analysis, which uses taint analysis technology to mark the tainted data stream of the static code to be detected, and uses data processing technology based on deep learning to embed coding and contextual association analysis on each tainted data stream to extract the semantic feature representation of each tainted data stream, and then, based on the time sequence and propagation path of the tainted data stream, it performs temporal association aggregation analysis on it, so as to more accurately understand the flow of tainted data and realize accurate identification of potential vulnerabilities in static code. In this way, the accuracy and efficiency of static code analysis can be effectively improved, and the security of software systems can be further enhanced.

[0033] Figure 1 is a flowchart of sub-step S5 of the static code analysis method based on taint analysis according to an embodiment of the present application, Figure 2 FIG. 5 is a data flow diagram of sub-step S5 of the static code analysis method based on taint analysis according to an embodiment of the present application. Figure 1 and Figure 2 As shown, the step S5 includes the steps of: S51, context-association encoding the time queue of the tainted data stream to obtain the time queue of the context tainted data stream semantic encoding feature vector; S52, performing temporal dynamic propagation aggregation on the time queue of the context tainted data stream semantic encoding feature vector to obtain the data stream semantic temporal significant propagation aggregation feature vector; S53, identifying whether the static code to be detected has a vulnerability based on the data stream semantic temporal significant propagation aggregation feature vector.

[0034] In the above-mentioned static code analysis method based on taint analysis, the step S51 performs context-association encoding on the time queue of the taint data stream to obtain the time queue of the context taint data stream semantic encoding feature vector. Figure 3 FIG. 5 is a flowchart of sub-step S51 of the static code analysis method based on taint analysis according to an embodiment of the present application. Figure 3As shown, the step S51 includes the steps of: S511, using the taint data stream embedding coding matrix to embed code each taint data stream in the time queue of the taint data stream to obtain a time queue of taint data stream embedding coding vectors; S512, inputting the time queue of the taint data stream embedding coding vectors into a data stream context encoder based on a converter structure to obtain a time queue of the context taint data stream semantic coding feature vectors.

[0035] Specifically, the step S511 uses the tainted data stream embedding coding matrix to embed the tainted data streams in the time queue of the tainted data stream to obtain the time queue of the tainted data stream embedding coding vector. It should be understood that the time queue of the tainted data stream refers to a series of tainted data streams arranged in the relative order of the data streams during the execution of the program. For example, in a Web application, the data entered by the user (such as the data submitted by the form) is identified as the starting point of the tainted data. When this data is passed to a processing function on the server side, the first tainted data stream is formed; if the function passes the data to another function, then a new node will be added to the time queue of this tainted data stream. By analogy, until the data is finally used or output, the time queue of the tainted data stream formed in the whole process constitutes a complete data stream propagation path, which can be used to analyze whether there are security risks such as SQL injection and XSS. In the present application, considering that each tainted data stream usually has a different data structure and length, it is difficult to directly compare and analyze. Therefore, in order to standardize the data form, in the technical solution of the present application, a tainted data stream embedding coding matrix is ​​used to embed and code each tainted data stream in the time queue of the tainted data stream, so as to map discrete symbols or identifiers (such as variable names, function names, etc.) in the tainted data stream to a continuous feature space, standardized into a vector representation of a fixed length, and retain the semantic information of the original data stream, thereby generating a time queue of tainted data stream embedded coding vectors. In an embodiment of the present application, the tainted data stream embedding coding matrix is ​​generated by a pre-trained Word2Vec model.

[0036] Specifically, in step S512, the time queue of the tainted data stream embedded coding vector is input into the data stream context encoder based on the converter structure to obtain the time queue of the context tainted data stream semantic coding feature vector. It should be understood that since the program execution process usually involves the interaction of multiple functions and data structures, there is a certain context dependency between each tainted data stream. Therefore, in order to further consider the contextual relationship between the tainted data streams to improve the accuracy of code analysis, the present application introduces a data stream context encoder based on the converter structure to perform context association encoding on the time queue of the tainted data stream embedded coding vector. It should be known to those skilled in the art that Transformer, based on the self-attention mechanism, can effectively mine the long-distance dependencies in the sequence data and capture the context information of each tainted data stream node, thereby generating a time queue of the context tainted data stream semantic coding feature vector containing context information, so that the model can better understand the contextual background and environment of the tainted data stream when processing each tainted data stream, and improve the accuracy of the analysis.

[0037] In the above-mentioned static code analysis method based on taint analysis, the step S52 performs temporal dynamic propagation aggregation on the time queue of the contextual taint data flow semantic encoding feature vector to obtain a data flow semantic temporal significant propagation aggregation feature vector. Figure 4 FIG. 5 is a flowchart of sub-step S52 of the static code analysis method based on taint analysis according to an embodiment of the present application. Figure 4 As shown, the step S52 includes the steps of: S521, based on the feature association strength of each context taint data stream semantic coding feature vector in the time queue of the context taint data stream semantic coding feature vector relative to the current context taint data stream semantic coding feature vector, feature modulating the time queue of the context taint data stream semantic coding feature vector to obtain the time queue of the context taint data stream semantic coding feature vector after intensity modulation; S522, performing temporal association aggregation on the time queue of the context taint data stream semantic coding feature vector after intensity modulation to obtain the data stream semantic temporal significant propagation aggregated feature vector.

[0038] It should be understood that in order to further capture the temporal propagation path and dynamic changes of the tainted data stream and to achieve a global understanding of the tainted data stream, the present application further performs temporal correlation aggregation analysis on the time queue of the contextual tainted data stream semantic encoding feature vector. It is worth mentioning that, considering that the contextual information of the tainted data stream will continue to change during the propagation of the tainted data stream in the program. Therefore, in order to improve the time sensitivity of data analysis, the present application proposes a feature dynamic propagation aggregation method, which uses the contextual tainted data stream semantic encoding feature vector of the current node as the feature prompt gate, and dynamically adjusts the aggregation weight based on the feature correlation of the contextual tainted data stream semantic encoding feature vector of each historical time step relative to the current contextual tainted data stream semantic encoding feature vector, so as to adapt to the dynamic correlation changes of the tainted data stream during the execution of the program, and ensure real-time response to the latest state of the tainted data stream, thereby helping to more accurately identify potential security vulnerabilities based on the current state and context of the tainted data stream.

[0039] Figure 5 FIG. 5 is a flowchart of sub-step S521 of the static code analysis method based on taint analysis according to an embodiment of the present application. Figure 5 As shown, the step S521 includes the steps of: S5211, extracting the current context taint data stream semantic coding feature vector from the time queue of the context taint data stream semantic coding feature vector; S5212, using the current context taint data stream semantic coding feature vector as a feature prompt gate, calculating the feature association strength prompt value of each context taint data stream semantic coding feature vector in the time queue of the context taint data stream semantic coding feature vector relative to the current context taint data stream semantic coding feature vector to obtain a time queue of context taint data stream feature association strength prompt values; S5213, based on the time queue of the context taint data stream feature association strength prompt values, feature modulating the time queue of the context taint data stream semantic coding feature vector to obtain the time queue of the context taint data stream semantic coding feature vector after the intensity modulation.

[0040] More specifically, the step S5212 further includes: calculating the positional dotted division vector between the contextual taint data stream semantic coding feature vector and the current contextual taint data stream semantic coding feature vector, and calculating the base-two logarithmic value of the absolute value of each eigenvalue in the dotted division vector to obtain the contextual taint data stream feature association representation vector; calculating the dot product vector between the contextual taint data stream feature association representation vector and the contextual taint data stream semantic coding feature vector, and calculating an exponential function value with base e and the sum of the eigenvalues ​​of the dot product vector as the exponent to obtain the contextual taint data stream feature association strength prompt value.

[0041] More specifically, the step S5213 further includes: extracting the median of the time queue of the context taint data stream feature association strength prompt value as the feature association strength gate threshold; using the feature association strength gate threshold as the switching threshold of the gating unit, and inputting the time queue of the context taint data stream semantic encoding feature vector and the time queue of the context taint data stream feature association strength prompt value into the gating unit to obtain the time queue of the context taint data stream semantic encoding feature vector after intensity modulation. In a specific example of the present application, the feature association strength gate threshold is used as the switching threshold of the gating unit, and the time queue of the context taint data stream semantic coding feature vector and the time queue of the context taint data stream feature association strength prompt value are input into the gating unit to obtain the time queue of the context taint data stream semantic coding feature vector after intensity modulation, further including: if the context taint data stream feature association strength prompt value is less than the feature association strength gate threshold, then the corresponding context taint data stream semantic coding feature vector is set to 0 to obtain the context taint data stream semantic coding feature vector after intensity modulation; if the context taint data stream feature association strength prompt value is greater than or equal to the feature association strength gate threshold, then the context taint data stream feature association strength prompt value is divided by the feature association strength gate threshold as a weight coefficient and weighted modulated with the corresponding context taint data stream semantic coding feature vector to obtain the context taint data stream semantic coding feature vector after intensity modulation.

[0042] That is, first, extract the current context taint data stream semantic encoding feature vector from the time queue of the context taint data stream semantic encoding feature vector as the benchmark for feature propagation and update, and use this as the focus to construct the perspective of attention for the temporal propagation of the taint data stream. Then, use the current context taint data stream semantic encoding feature vector as the feature prompt gate, and calculate the feature association strength prompt value between other context taint data stream semantic encoding feature vectors and the current context taint data stream semantic encoding feature vector to evaluate the relative importance of other taint data stream semantic features, identify the context information that has a greater impact on the current taint data stream, and assign a higher weight to subsequent feature propagation. Subsequently, in order to avoid the degradation of model performance due to a few extreme cases, further extract the median from the feature association strength prompt value sequence obtained above as the threshold switch, perform feature intensity modulation on the time queue of the context taint data stream semantic encoding feature vector, and filter out feature representations that are weakly associated with the current context taint data stream semantic encoding feature vector based on the gating mechanism, while paying more attention to the context information closely related to the current taint data stream.

[0043] Specifically, the step S522 further includes: inputting the time queue of the semantic encoding feature vector of the contextual taint data stream after the intensity modulation into the feature dynamic propagation module based on the forward LTSM model to obtain the data stream semantic time series significant propagation aggregation feature vector. That is, the forward LSTM model is used to perform time series association aggregation on the semantic encoding feature vector of the contextual taint data stream after the feature intensity modulation, and by capturing the feature accumulation effect of the taint data stream at each time step, a global semantic encoding feature vector of the taint data stream is generated, so as to reflect the global dynamic changes of the taint data stream during the program execution process, so as to more comprehensively understand the propagation path of the taint data stream and improve the ability to identify potential vulnerabilities in the code. It should be known to those skilled in the art that the forward LSTM model is a special type of recurrent neural network (RNN), which can fully capture and memorize the long-term dependencies in the time series data based on the gating mechanism, thereby effectively mining the contextual relationship between the features of each taint data stream, and providing useful information support for subsequent data processing.

[0044] Accordingly, the step S52 includes: processing the time queue of the contextual stain data stream semantic encoding feature vector using the following feature dynamic propagation aggregation formula to obtain the data stream semantic temporal significant propagation aggregation feature vector, wherein the feature dynamic propagation aggregation formula is:

[0045] in, A time queue representing the semantic encoding feature vector of the contextual taint data stream, , , and Respectively represent the first, second, and third in the time queue of the semantic encoding feature vector of the contextual stain data stream and the current contextual taint data stream semantic encoding feature vector, is the number of semantically encoded feature vectors of the contextual taint data stream, and Respectively represent the The first feature vector of the semantic encoding of the contextual taint data stream The feature value of the position and the semantic encoding feature vector of the current context stain data stream The eigenvalues ​​of the positions, represents the logarithmic function with base 2, represents the natural exponential function, represents the characteristic scale of the semantic encoding feature vector of the contextual taint data stream, , , and Respectively represent the first, second, and and contextual taint data stream feature association strength prompt values, where =1, It means taking the median, represents the feature association strength gate threshold, represents the gate control unit, represents the temporal queue of semantically encoded feature vectors of the contextual taint data stream after intensity modulation, , , and Respectively represent the first, second, and third in the time queue of the semantic coding feature vector of the contextual stain data stream after the intensity modulation and The semantic encoding feature vector of the contextual taint data stream after intensity modulation, represents the forward LSTM model, The aggregate feature vector representing the significant propagation of the semantic temporal sequence of the data stream.

[0046] In the above-mentioned static code analysis method based on taint analysis, the step S53, based on the data flow semantic time sequence significant propagation aggregate feature vector, identifies whether the static code to be detected has a vulnerability. In a specific example of the present application, the step S53 further includes: inputting the data flow semantic time sequence significant propagation aggregate feature vector into a vulnerability identifier based on a classifier to obtain an identification result, and the identification result is used to indicate whether the static code to be detected has a vulnerability. A person of ordinary skill in the art should know that the classifier is trained based on a large number of annotated code samples, and adjusts its internal parameters through back propagation and optimization algorithms (such as Adam, SGD, etc.) to minimize the difference between the predicted results and the actual annotations, so as to effectively learn the correlation and correspondence between code features and vulnerabilities. In practical applications, the decision rules learned during the training process are used to accurately classify the input data flow semantic time sequence significant propagation aggregate feature vector to obtain the vulnerability identification result of the static code to be detected, thereby realizing real-time monitoring and early warning of potential risks in the static code to be detected, so as to prompt relevant personnel to take corresponding risk control measures.

[0047] In particular, the present application takes into account that when each contextual taint data stream semantic coding feature vector in the time queue of the contextual taint data stream semantic coding feature vector respectively represents the contextual semantic association coding features of the embedded coding representation of each taint data stream in the time queue of the taint data stream, when performing feature dynamic propagation with the current node as the feature prompt gate, the temporal contextual semantic embedding feature representation of the taint data stream corresponding to each predetermined time point and the prompt sparsity of the temporal contextual semantic embedding feature of the taint data stream relative to the current temporal node will lead to the lack of dynamic propagation between time domains, that is, the full time domain dynamic propagation representation of the data stream semantic temporal significant propagation aggregation feature vector has the propagation aggregation richness based on the local time domain semantic embedding coding representation, resulting in repetition of unstructured probability mapping, affecting the accuracy of the classification results.

[0048] In a preferred embodiment, the data stream semantic temporal significant propagation aggregate feature vector is input into a classifier-based vulnerability identifier to obtain an identification result, including: Determine the number of zero eigenvalues ​​in the data stream semantic temporal significant propagation aggregate eigenvector and zero eigenvalue , and the zero eigenvalue and the number of zero eigenvalues Multiply and divide them respectively to obtain the first data stream semantic timing significant propagation aggregate field weight value The second data stream semantic timing significantly propagates the aggregate field weight value ; Calculate the square root of the sum of squares of all eigenvalues ​​of the data stream semantic temporal significant propagation aggregate eigenvector to obtain the data stream semantic temporal significant propagation aggregate full mode weight ,in, Each eigenvalue of the aggregated eigenvector representing the data stream semantic timing significant propagation, Indicates the significant propagation of the data stream semantic timing aggregated full-mode weights; With the zero characteristic factor value Each eigenvalue of the aggregated eigenvector is calculated as an exponentially significant propagation of the data stream semantic timing The power function , and multiply it by the first data stream semantic timing significant propagation aggregation field weight value To obtain the semantic timing of the first data stream, the aggregate intermediate value is significantly propagated ; Calculate each eigenvalue of the data stream semantic time series significant propagation aggregate eigenvector The second data stream semantic timing significantly propagates the aggregate field weight value and the data flow semantic timing significantly propagates the aggregated full-mode weights The product of the second data flow semantic timing significantly propagates the aggregate intermediate value ; The first data stream semantic timing significantly propagates the aggregated intermediate values The second data flow semantics significantly propagates the aggregate intermediate values ​​in timing The weighted difference The composition of the optimized data stream semantic sequence significantly propagates the aggregate feature vector, where and represents different weight hyperparameters; The optimized data stream semantic timing significant propagation aggregate feature vector is passed through a classifier-based vulnerability identifier to obtain the identification result.

[0049] Based on the vector field fitting law of high-dimensional manifold, the isolated zeros and their differentiable factors in the data stream semantic temporal significant propagation aggregate feature vector are used as the differentiable dimensions of the high-dimensional manifold, so as to fix the normal direction pointing to the center of the feature distribution near the local coordinates represented by the eigenvalues ​​of the data stream semantic temporal significant propagation aggregate feature vector, thereby avoiding invalid repetition in the probability mapping process caused by the unstructured characteristics of the distribution of the data stream semantic temporal significant propagation aggregate feature vector with interactive response richness through effective alignment of the feature distribution pattern of the data stream semantic temporal significant propagation aggregate feature vector to the probability density differentiable field, thereby improving the accuracy of the recognition results obtained by the classifier-based vulnerability identifier.

[0050] In summary, the static code analysis method based on taint analysis based on the embodiment of the present application is explained, which uses taint analysis technology to mark the taint data stream of the static code to be detected, and uses data processing technology based on deep learning to embed coding and context association analysis on each taint data stream to extract the semantic feature representation of each taint data stream, and then, based on the time sequence and propagation path of the taint data stream, it performs time series association aggregation analysis on it, so as to more accurately understand the flow of taint data and realize accurate identification of potential vulnerabilities in static code. In this way, the accuracy and efficiency of static code analysis can be effectively improved, and the security of software systems can be further enhanced.

[0051] Furthermore, a static code analysis system based on taint analysis is also provided.

[0052] Figure 6 FIG. 1 is a block diagram of a static code analysis system based on taint analysis according to an embodiment of the present application. Figure 6As shown, according to the static code analysis system 100 based on taint analysis according to the embodiment of the present application, it includes: a taint data context association encoding module 110, which is used to perform context association encoding on the time queue of the taint data stream to obtain the time queue of the context taint data stream semantic encoding feature vector; a timing dynamic propagation aggregation module 120, which is used to perform timing dynamic propagation aggregation on the time queue of the context taint data stream semantic encoding feature vector to obtain a data stream semantic timing significant propagation aggregation feature vector; a vulnerability identification module 130, which is used to identify whether the static code to be detected has a vulnerability based on the data stream semantic timing significant propagation aggregation feature vector.

[0053] Here, those skilled in the art can understand that the specific operations of each module in the above-mentioned static code analysis system based on taint analysis have been referred to above. Figures 1 to 5 The description of the static code analysis method based on taint analysis has been introduced in detail, and therefore, its repeated description will be omitted.

[0054] The basic principle of the present invention is described above in conjunction with specific embodiments. However, it should be pointed out that the advantages, strengths, effects, etc. mentioned in the present invention are only examples and not limitations, and it cannot be considered that these advantages, strengths, effects, etc. must be possessed by each embodiment of the present invention. In addition, the specific details of the above embodiments are only for the purpose of illustration and facilitation of understanding, rather than limitation, and the above details do not limit the present invention to being implemented by adopting the above specific details.

[0055] In the above embodiments, the description of each embodiment has its own emphasis. For the parts that are not described or recorded in detail in a certain embodiment, please refer to the relevant description of other embodiments. In the several embodiments provided by the present invention, it should be understood that the disclosed system and method can be implemented in other ways. For example, the system embodiment described above is only schematic. For example, the unit division is only a logical function division, and there may be other division methods in actual implementation. The units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the scheme of this embodiment.

[0056] It will be apparent to those skilled in the art that the invention is not limited to the details of the exemplary embodiments described above and that the invention can be implemented in other specific forms without departing from the spirit or essential features of the invention. Therefore, the embodiments should be considered exemplary and non-limiting in all respects, and the scope of the invention is defined by the appended claims rather than the foregoing description, and it is intended that all variations falling within the meaning and scope of the equivalent elements of the claims be included in the invention. Any reference to a figure in a claim should not be considered as limiting the claim to which it relates.

[0057] In addition, it is obvious that the word "comprising" does not exclude other units or steps, and the singular does not exclude the plural. The multiple units stated in the system claims can also be implemented by one unit through software or hardware.

[0058] Finally, it should be noted that the above description has been given for the purpose of illustration and description. In addition, the above embodiments are only used to illustrate the technical solution of the present invention and are not intended to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, it should be understood by those skilled in the art that the technical solution of the present invention can be modified or replaced by equivalents without departing from the spirit and scope of the technical solution of the present invention.

Claims

1. A static code analysis method based on taint analysis, comprising: Get the static code to be tested; Performing lexical analysis and grammatical analysis on the static code to be detected to obtain an abstract syntax tree corresponding to the static code to be detected; Splitting the abstract syntax tree into different sub-functions to obtain a set of sub-functions; Using a taint analysis technology to mark each sub-function in the set of sub-functions with a taint data stream to obtain a time queue of the taint data stream; determining whether the static code to be detected has a vulnerability based on the time queue of the taint data stream, wherein determining whether the static code to be detected has a vulnerability based on the time queue of the taint data stream comprises: Performing context-associative coding on the time queue of the tainted data stream to obtain a time queue of a contextual tainted data stream semantic coding feature vector; Performing temporal dynamic propagation aggregation on the time queue of the contextual stain data stream semantic encoding feature vector to obtain a data stream semantic temporal significant propagation aggregation feature vector; Based on the data flow semantic time sequence significant propagation aggregation feature vector, identifying whether the static code to be detected has a vulnerability; Among them, the time queue of the context taint data stream semantic coding feature vectors is subjected to temporal dynamic propagation aggregation, including: based on the feature association strength of each context taint data stream semantic coding feature vector in the time queue of the context taint data stream semantic coding feature vector relative to the current context taint data stream semantic coding feature vector, feature modulation is performed on the time queue of the context taint data stream semantic coding feature vectors to obtain the time queue of the context taint data stream semantic coding feature vectors after intensity modulation; and temporal association aggregation is performed on the time queue of the context taint data stream semantic coding feature vectors after the intensity modulation to obtain the data stream semantic temporal significant propagation aggregation feature vector.

2. The static code analysis method based on taint analysis according to claim 1, characterized in that: Performing context-associative encoding on the time queue of the tainted data stream to obtain a time queue of a contextual tainted data stream semantic encoding feature vector includes: Using a tainted data stream embedding coding matrix, embedding coding is performed on each tainted data stream in the time queue of the tainted data stream to obtain a time queue of tainted data stream embedding coding vectors; The time queue of the tainted data stream embedding coding vector is input into a data stream context encoder based on a converter structure to obtain the time queue of the context tainted data stream semantic coding feature vector.

3. The static code analysis method based on taint analysis according to claim 2, characterized in that: Based on the feature association strength of each context taint data stream semantic coding feature vector in the time queue of the context taint data stream semantic coding feature vector relative to the current context taint data stream semantic coding feature vector, feature modulating the time queue of the context taint data stream semantic coding feature vector to obtain a time queue of the context taint data stream semantic coding feature vector after intensity modulation, including: Extracting the current context taint data stream semantic encoding feature vector from the time queue of the context taint data stream semantic encoding feature vector; Taking the current context taint data stream semantic coding feature vector as a feature prompt gate, calculating the feature association strength prompt value of each context taint data stream semantic coding feature vector in the time queue of the context taint data stream semantic coding feature vector relative to the current context taint data stream semantic coding feature vector to obtain a time queue of context taint data stream feature association strength prompt values; Based on the time queue of the contextual stain data stream feature association strength prompt value, feature modulation is performed on the time queue of the contextual stain data stream semantic encoding feature vector to obtain the time queue of the contextual stain data stream semantic encoding feature vector after the strength modulation.

4. The static code analysis method based on taint analysis according to claim 3 is characterized in that: Calculating the feature association strength prompt value of each context taint data stream semantic encoding feature vector in the time queue of the context taint data stream semantic encoding feature vector relative to the current context taint data stream semantic encoding feature vector to obtain the time queue of the context taint data stream feature association strength prompt value, including: Calculate the positional dot-wise division vector between the contextual stain data stream semantic coding feature vector and the current contextual stain data stream semantic coding feature vector, and calculate the base-two logarithm of the absolute value of each eigenvalue in the dot-wise division vector to obtain a contextual stain data stream feature association representation vector; Calculate the dot product vector between the contextual stain data stream feature association representation vector and the contextual stain data stream semantic encoding feature vector, and calculate the exponential function value with e as the base and the sum of the eigenvalues ​​of the dot product vector as the exponent to obtain the contextual stain data stream feature association strength prompt value.

5. The static code analysis method based on taint analysis according to claim 4, characterized in that: Based on the time queue of the contextual stain data stream feature association strength prompt value, feature modulating the time queue of the contextual stain data stream semantic encoding feature vector to obtain the time queue of the contextual stain data stream semantic encoding feature vector after the intensity modulation, including: Extracting the median of the time queue of the contextual stain data stream feature association strength prompt value as the feature association strength gate threshold; The feature association strength gate threshold is used as the switching threshold of the gating unit, and the time queue of the contextual taint data stream semantic encoding feature vector and the time queue of the contextual taint data stream feature association strength prompt value are input into the gating unit to obtain the time queue of the contextual taint data stream semantic encoding feature vector after intensity modulation.

6. The static code analysis method based on taint analysis according to claim 5, characterized in that: The method uses the feature association strength gate threshold as the switch threshold of the gating unit, inputs the time queue of the contextual stain data stream semantic coding feature vector and the time queue of the contextual stain data stream feature association strength prompt value into the gating unit to obtain the time queue of the contextual stain data stream semantic coding feature vector after the intensity modulation, including: If the contextual stain data stream feature association strength prompt value is less than the feature association strength gate threshold, the corresponding contextual stain data stream semantic coding feature vector is set to 0 to obtain the contextual stain data stream semantic coding feature vector after intensity modulation; If the contextual taint data stream feature association strength prompt value is greater than or equal to the feature association strength gate threshold, then it is divided by the feature association strength gate threshold and used as a weight coefficient to perform weighted modulation with the corresponding contextual taint data stream semantic coding feature vector to obtain the contextual taint data stream semantic coding feature vector after intensity modulation.

7. The static code analysis method based on taint analysis according to claim 6, characterized in that: Performing temporal association aggregation on the time queue of the semantic coding feature vector of the intensity modulated contextual stain data stream to obtain the data stream semantic temporal significant propagation aggregate feature vector, including: The time queue of the semantic encoding feature vector of the intensity-modulated contextual stain data stream is input into a feature dynamic propagation module based on a forward LTSM model to obtain the data stream semantic temporal significant propagation aggregate feature vector.

8. The static code analysis method based on taint analysis according to claim 7, characterized in that: Based on the data flow semantic time sequence significant propagation aggregate feature vector, identifying whether the static code to be detected has a vulnerability, including: The data stream semantic temporal significant propagation aggregate feature vector is input into a classifier-based vulnerability identifier to obtain an identification result, and the identification result is used to indicate whether the static code to be detected has a vulnerability.

9. A static code analysis system based on taint analysis, characterized in that: include: A tainted data context-associated encoding module, used for performing context-associated encoding on the time queue of the tainted data stream to obtain the time queue of the context tainted data stream semantic encoding feature vector; A temporal dynamic propagation aggregation module, used for performing temporal dynamic propagation aggregation on the time queue of the contextual stain data stream semantic encoding feature vector to obtain a data stream semantic temporal significant propagation aggregation feature vector; The vulnerability identification module is used to identify whether the static code to be detected has a vulnerability based on the data flow semantic time sequence significant propagation aggregation feature vector.

Images