A method and system for detecting cryptographic api combination misuse based on rule-based automated extraction

Abstract

The present application relates to a kind of cryptography API combination misuse detection method and system based on rule automatic extraction.The method includes: extracting cryptography API sequence from project source code based on data flow and control dependency analysis;Correct use mode is automatically extracted to cryptography API sequence by sequence pattern mining algorithm;Cryptography API combination misuse is detected based on correct use mode.The present application has more accurate detection effect, does not need to mark data set and manual participation, has more lightweight preparation and higher automation degree, while different actual projects can automatically extract correct cryptography API misuse detection rule, can meet the use demand of programming, testing and security analyst.

Description

Technical Field

[0001] This invention relates to the field of program analysis, and more particularly to a detection technology for the misuse of cryptographic API combinations in blockchain infrastructure, specifically a rule-based automated extraction technology for detecting the misuse of cryptographic API combinations. This technology can assist programmers, testers, and security analysts in understanding the correct patterns of cryptographic API combination usage, extracting the correct rules for cryptographic API combination usage, and identifying related security issues arising from the misuse of cryptographic API combinations in blockchain infrastructure. Background Technology

[0002] Blockchain infrastructure refers to the network service facilities consisting of public blockchain networks with broad access capabilities, public service capabilities, and flexible deployment, as well as cross-chain systems connecting these blockchains. It is a series of underlying infrastructures supporting blockchain technology, mainly involving the data layer, network layer, and consensus layer. Blockchain infrastructure ensures security through various cryptographic techniques. For example, cryptographic techniques are used to achieve secure key storage and protection, digital signatures, zero-knowledge proofs, and secure multi-party computation. However, the correct use of cryptographic techniques requires a deep understanding of their principles. Even experienced software developers may inadvertently introduce vulnerabilities due to a lack of cryptographic expertise. In recent years, the misuse of cryptographic algorithms and protocols caused by the misuse of cryptographic APIs in blockchain has increased significantly, leading to major security vulnerabilities. Based on the causes of misuse, the misuse of cryptographic APIs in blockchain infrastructure can be divided into two categories: misuse of a single cryptographic API and misuse of a combination of cryptographic APIs. Misuse of a combination of cryptographic APIs refers to the misuse caused by improper order of calls or the absence of a certain API in the sequence when multiple cryptographic APIs are combined to implement a cryptographic function. It could lead to serious security vulnerabilities, such as replay attacks, data breaches, and unauthorized access.

[0003] Currently, there is limited research on detecting misuse of cryptographic API combinations, making accurate detection in blockchain infrastructure difficult. Therefore, this invention focuses on research into detecting misuse of cryptographic API combinations.

[0004] Because the use of cryptographic APIs in blockchain is closely related to real-world scenarios, and the scenarios in which multiple APIs are used in combination are complex, it is impossible to achieve comprehensive detection through manual rule summarization. Furthermore, existing automated cryptographic API combination misuse detection technologies have issues with universality and accuracy. Representative technologies include: (1) Model training-based learning of correct patterns: Models are trained on labeled datasets using machine learning techniques and then applied to real-world projects for cryptographic API combination misuse detection. This method mainly faces the problem of insufficient universality. When it is necessary to analyze cryptographic API combination misuse in different scenarios, the dataset needs to be reconstructed, and the dataset cannot be guaranteed to be comprehensive enough. (2) Code change-based rule deduction method: Code changes related to cryptographic APIs are extracted from the repair code of the project source code, clustering algorithms are used to extract the commonalities of the code changes and derive detection rules, and then misuse detection is performed. However, this method is difficult to deduce cryptographic API combination methods that have not yet been misused from code changes, leading to accuracy issues. Summary of the Invention

[0005] To address the aforementioned problems, this invention provides a method and system for detecting misuse of cryptographic API combinations based on rule-based automated extraction.

[0006] The technical solution adopted in this invention is as follows:

[0007] A method for detecting misuse of cryptographic API combinations based on rule-based automated extraction includes the following steps:

[0008] Extracting cryptographic API sequences from the project source code based on data flow and control dependency analysis;

[0009] The correct usage patterns are automatically extracted from cryptographic API sequences using sequence pattern mining algorithms.

[0010] Detect misuse of cryptographic API combinations based on correct usage patterns.

[0011] Furthermore, the data flow and control dependency analysis extracts a sequence of cryptographic APIs from the project source code, including:

[0012] During the preprocessing stage, cryptographic API information from the cryptographic standard library and third-party libraries is collected;

[0013] A function call graph is constructed for the entire project. Data flow and control dependencies between function nodes are analyzed for the collected cryptographic APIs. The cryptographic API sequence corresponding to each function is extracted to obtain a set of cryptographic API sequences.

[0014] Furthermore, the analysis of data flow and control dependencies between function nodes includes:

[0015] For the transmission of data streams, specify the parameter positions that need attention in the cryptographic API. Cryptographic APIs that transmit data streams at the specified parameter positions will be retained in the sequence, while APIs that do not involve the transmission of data streams at the specified positions will be deleted.

[0016] For control flow relationships, determine whether there is a control dependency between APIs before and after, retain the API sequence with control dependency, and filter out the rest of the APIs;

[0017] During data stream analysis, key parameter information of the cryptographic API is recorded into the API's schema.

[0018] Furthermore, the automatic extraction of correct usage patterns from cryptographic API sequences using a sequence pattern mining algorithm includes:

[0019] Clustering algorithms are used to classify cryptographic API sequences, grouping cryptographic API sequences with the same cryptographic function into one category;

[0020] In each type of cryptographic API sequence, a sequence pattern mining algorithm is used to extract frequent sequences as the correct usage patterns.

[0021] Furthermore, the sequence pattern mining algorithm mines frequent sequences that satisfy the minimum support from the set of cryptographic API sequences, thereby obtaining frequently occurring cryptographic API sequences; the minimum support represents the frequency of the cryptographic API sequence in the set of cryptographic API sequences.

[0022] Furthermore, the detection of misuse of cryptographic API combinations based on correct usage patterns includes:

[0023] Based on the extracted correct usage patterns, the misuse of cryptographic API combinations is detected in actual projects. If the usage pattern does not conform to the correct usage pattern, it is reported as a misuse.

[0024] Furthermore, the incorrect usage patterns include:

[0025] Violation of binding relationship, i.e., the project's cryptographic API sequence is missing any API in the correct usage pattern P;

[0026] Violation of temporal order, i.e., the order in which APIs appear in the project's cryptographic API sequence differs from the correct usage pattern P;

[0027] Violation frequency refers to the number of times an API appears in the project's cryptographic API sequence that differs from the correct usage pattern P.

[0028] A rule-based automated extraction system for detecting misuse of cryptographic API combinations, comprising:

[0029] The preprocessing module is used to collect cryptographic API information from the cryptographic standard library and third-party libraries;

[0030] The cryptographic API sequence extraction module is used to analyze the data flow and control dependencies between function nodes of the collected cryptographic APIs, extract the cryptographic API sequence corresponding to each function, and obtain a set of cryptographic API sequences.

[0031] The sequence classification module is used to classify cryptographic API sequences using clustering algorithms;

[0032] The correct usage pattern extraction module is used to automatically extract the correct usage patterns from cryptographic API sequences using a sequence pattern mining algorithm;

[0033] The vulnerability detection module is used to detect misuse of cryptographic API combinations based on correct usage patterns.

[0034] The beneficial effects of this invention are as follows:

[0035] This invention proposes an automated extraction technique for cryptographic API combination usage patterns in blockchain infrastructure. The technique first extracts cryptographic API sequences from the project's source code based on data flow and control dependency analysis. Then, it automatically extracts correct usage patterns using a sequence pattern mining algorithm. Finally, it detects misuse of cryptographic API combinations based on these correct usage patterns. Compared to similar techniques, this invention extracts cryptographic API sequences based on taint analysis of the source code, resulting in more accurate detection. It requires no labeled datasets or manual intervention, offering lighter preparation and a higher degree of automation. Furthermore, it can automatically extract correct cryptographic API misuse detection rules for different real-world projects, meeting the needs of programmers, testers, and security analysts. Attached Figure Description

[0036] Figure 1 This is a flowchart of the steps of the method of the present invention.

[0037] Figure 2 It is an extracted sequence of cryptographic APIs.

[0038] Figure 3 It is a partial sequence of one of the cryptographic API sequences after classification.

[0039] Figure 4 It is a frequent sequence extracted from a class of cryptographic API sequences.

[0040] Figure 5This is a code snippet of the ECDH algorithm from CVE-2023-49292.

[0041] Figure 6 It is the wrong API sequence and the correct API sequence. Detailed Implementation

[0042] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, the present invention will be further described in detail below with reference to specific embodiments and accompanying drawings.

[0043] This invention proposes an automated extraction technique for cryptographic API combination usage patterns in blockchain infrastructure. The technique first extracts cryptographic API sequences from the project source code based on data flow and control dependency analysis. Then, it automatically extracts correct usage patterns using a sequence pattern mining algorithm. Finally, it detects misuse of cryptographic API combinations based on the correct usage patterns. The basic process is as follows: Figure 1 As shown, the steps include: 1) Preprocessing stage: Collecting cryptographic API information from the cryptographic standard library and third-party libraries, specifically including API function names and the types and positions of input parameters. The collected cryptographic APIs will serve as targets for subsequent sequence analysis and extraction. 2) Cryptographic API sequence extraction: Constructing a function call graph for the entire project, using the cryptographic APIs collected in the previous step as targets, analyzing the data flow and control dependencies between function nodes to extract the cryptographic API sequence corresponding to each function, resulting in a set of cryptographic API sequences. 3) Sequence classification: For the extracted set of cryptographic API sequences, using a clustering algorithm to classify the sequences, grouping sequences with the same cryptographic function into one category. The purpose of classification is to extract the correct API sequence for each category of cryptographic function, preventing some functions from being overlooked due to insufficient usage. 4) Extraction of correct usage patterns: In each category of sequences, using a sequence pattern mining algorithm to extract frequent sequences as correct usage patterns, which will be used as the basis for vulnerability detection in step 5. 5) Vulnerability Detection: Based on the extracted sequence correct usage pattern, detect the misuse of cryptographic API combinations in actual projects. If it does not conform to the correct pattern, it is reported as a misuse.

[0044] The detailed steps of the above-mentioned method are as follows:

[0045] 1. Preprocessing stage

[0046] Since blockchain infrastructure is primarily developed using the Go programming language, this study first collected the cryptographic APIs from Go's standard library `crypto` and the community-developed supplementary library `golang.org / x / crypto`. Simultaneously, other commonly used third-party cryptographic libraries in blockchains were also collected. This invention collected 22 third-party cryptographic libraries from open-source blockchain infrastructure projects on GitHub, blockchain-related papers, and official documentation websites for various infrastructures. From these libraries, cryptographic APIs of interest were selected and added to the target cryptographic API set to be tested.

[0047] 2. Cryptographic API Sequence Extraction

[0048] This step extracts the sequence of cryptographic API calls within each function, including the cryptographic APIs themselves and the key parameters within each API, recording them as a combination usage pattern for a cryptographic API, i.e., P = {API1: param1; API2: param2; ...}. The key parameters are used for data flow and control dependency analysis.

[0049] First, this invention constructs a function call graph for the entire project, analyzing the data flow and control flow dependencies of function nodes within the graph. For data flow transmission, the cryptographic APIs specify the parameter positions of interest. Cryptographic APIs that transmit data at the specified parameter positions are retained in the sequence, while APIs not involved in data flow transmission at the specified positions are deleted. For control flow relationships, it is necessary to determine whether there are control dependencies between preceding and following APIs. Cryptographic API sequences with control dependencies are retained, while the rest are filtered out. Simultaneously, during data flow analysis, key parameter information of the cryptographic APIs is recorded in the API's schema for easier analysis. Finally, through the analysis of each function, a set of cryptographic API sequences for the entire project is obtained. Figure 2 It is an extracted sequence of cryptographic APIs.

[0050] 3. Sequence Classification

[0051] This step categorizes the extracted set of cryptographic API sequences. This invention uses similarity measurement algorithms, such as edit distance and cosine similarity, to describe the similarity between two sequences, and then uses clustering algorithms, such as agglomerative hierarchical clustering and K-means, to classify the cryptographic API sequences.

[0052] To determine the number of clusters, this invention uses clustering evaluation metrics, such as silhouette coefficient and Davies-Bouldin Index, to assess the clustering effect. Since cryptographic APIs exhibit diversity at the implementation level, involving different levels of cryptographic libraries, and currently lack a standard classification method, this invention determines the number of clusters by combining clustering evaluation metrics with experiments. Following this method, this invention divides the cryptographic API sequences into 20 categories, resulting in a set of 20 cryptographic API sequences. Figure 3 It is a partial sequence of one of the cryptographic API sequences after classification.

[0053] 4. Correctly use pattern extraction

[0054] This step extracts the correct usage patterns from the cryptographic API sequence set categorized in the previous step. Based on the characteristics of cryptographic sequence extraction and efficiency requirements, sequence pattern mining algorithms are used to extract frequent sequences for each category of cryptographic API sequences, such as the PrefixSpan algorithm, Apriori-based algorithm, and SPADE algorithm. Sequence pattern mining algorithms can extract frequent sequences that meet the minimum support requirement from the sequence dataset, thus obtaining frequently occurring cryptographic API sequences. Minimum support represents the frequency of the sequence's occurrence in the cryptographic API sequence set.

[0055] The basis for considering frequent sequences as correct usage patterns is that, in most cases, the code developed by developers is correct. Previous extensive research based on API usage pattern extraction has shown that patterns appearing more frequently in code are more reliable.

[0056] Since the number of sequences varies across different cryptographic API sequence set categories, setting a uniform minimum support level could lead to either no sequences being mined or a very large number of frequent sequences being mined. Therefore, this invention uses the absolute value of the occurrence count to classify frequent sequences. We record the frequency of each sequence and consider sequences that occur at least 10 times in the sequence set as frequent sequences, i.e., the correct usage pattern for extraction. Figure 4 It is a frequent sequence extracted from a class of cryptographic API sequences.

[0057] 5. Vulnerability Detection

[0058] In this step, based on the previously extracted cryptographic API combination usage patterns, misuse of cryptographic API combinations in the project is detected. Based on the extracted correct cryptographic API combination usage pattern P = {API1:param1; API2:param2; ...}, where API1, API2... represent cryptographic APIs contained in frequent sequences, and param1, param2... represent key parameters in each cryptographic API, a cryptographic API sequence is considered misused if it meets any of the following three conditions.

[0059] The sequence does not conform to the pattern P = {API1:param1; API2:param2; ...}, such as if any API is missing or the APIs are in the wrong order. Specifically:

[0060] a. The binding relationship is violated if the sequence is missing any one of API1, API2, or API3;

[0061] b. Violation of temporal order: If the sequence contains API1, API2, and API3, but the order in which these APIs appear is different from P;

[0062] c. Violation of frequency of occurrence: If the sequence contains API1, API2, and API3 in the same order as P, but in a subsequence that starts with API1 and ends with API3, the frequency of occurrence of API1, API2, and API3 is different from that of P.

[0063] The following is an example of misuse detection:

[0064] Taking CVE-2023-49292 (https: / / cve.mitre.org / cgi-bin / cvename.cgi?name=2023-49292) as an example, Figure 5This is the repaired code snippet. `secp256k1` is a commonly used elliptic curve parameter, and elliptic curve integrated encryption can be implemented based on `secp256k1`. ECDH (Elliptic Curve Diffie-Hellman) is a key exchange protocol based on elliptic curve cryptography, used to establish a shared key between two or more parties. This key can be used to encrypt and decrypt data, or to verify the integrity and authenticity of messages. The ECDH algorithm sequentially calls cryptographic APIs such as `IsOnCurve()`, `ScalarMult()`, and `Params()`. The `IsOnCurve()` function in the `secp256k1` library is used to check the legitimacy of the public key. However, in CVE-2023-49292, this crucial function is missing, allowing attackers to recover any private key they interact with by calling the `ECDH()` function.

[0065] In step 2, the cryptographic API sequence corresponding to this function is extracted, namely crypto / elliptic.IsOnCurve, crypto / elliptic.ScalarMult, and crypto / elliptic.Params, as follows: Figure 6 As shown in (b). In step 3, a set of all cryptographic API sequences for the project is extracted, and in step 4, they are categorized, with the most frequent API sequences extracted in this category being as follows: Figure 6 As shown in (c). In step 5, an erroneous API sequence detected in this category is as follows: Figure 6 As shown in (d).

[0066] Another embodiment of the present invention provides a cryptographic API combination misuse detection system based on rule-based automated extraction, comprising:

[0067] The preprocessing module is used to collect cryptographic API information from the cryptographic standard library and third-party libraries;

[0068] The cryptographic API sequence extraction module is used to analyze the data flow and control dependencies between function nodes of the collected cryptographic APIs, extract the cryptographic API sequence corresponding to each function, and obtain a set of cryptographic API sequences.

[0069] The sequence classification module is used to classify cryptographic API sequences using clustering algorithms;

[0070] The correct usage pattern extraction module is used to automatically extract the correct usage patterns from cryptographic API sequences using a sequence pattern mining algorithm;

[0071] The vulnerability detection module is used to detect misuse of cryptographic API combinations based on correct usage patterns.

[0072] The above division of modules is merely illustrative. In practical applications, the functions described above can be assigned to different functional modules as needed to complete all or part of the functions described in the aforementioned method. The specific working process of each module can be found in the corresponding process in the aforementioned method embodiments, and will not be repeated here.

[0073] Another embodiment of the present invention provides a computer device (computer, server, smartphone, etc.) including a memory and a processor, the memory storing a computer program configured to be executed by the processor, the computer program including instructions for performing the steps of the method of the present invention.

[0074] Another embodiment of the present invention provides a computer-readable storage medium (such as ROM / RAM, disk, optical disk) storing a computer program that, when executed by a computer, implements the various steps of the method of the present invention.

[0075] The specific embodiments of the present invention disclosed above are intended to help understand the content of the present invention and to implement it accordingly. Those skilled in the art will understand that various substitutions, changes, and modifications are possible without departing from the spirit and scope of the present invention. The present invention should not be limited to the content disclosed in the embodiments of this specification; the scope of protection of the present invention is defined by the claims.

Claims

1. A method for detecting misuse of cryptographic API combinations based on rule-based automated extraction for blockchain infrastructure, characterized in that, Includes the following steps: Extracting cryptographic API sequences from the project source code based on data flow and control dependency analysis; The correct usage patterns are automatically extracted from cryptographic API sequences using sequence pattern mining algorithms. Detect misuse of cryptographic API combinations based on correct usage patterns; The automatic extraction of correct usage patterns from cryptographic API sequences using a sequence pattern mining algorithm includes: Clustering algorithms are used to classify cryptographic API sequences, grouping cryptographic API sequences with the same cryptographic function into one category; within each category of cryptographic API sequences, a sequence pattern mining algorithm is used to extract frequent sequences as the correct usage patterns. The sequence pattern mining algorithm extracts frequent sequences that meet the minimum support from the set of cryptographic API sequences, thereby obtaining frequently occurring cryptographic API sequences; the minimum support represents the frequency of the cryptographic API sequence in the set of cryptographic API sequences. The detection of misuse of cryptographic API combinations based on correct usage patterns includes: detecting misuse of cryptographic API combinations in actual projects based on the extracted correct usage patterns; if the correct usage patterns are not met, it is reported as a misuse. The incorrect usage patterns include: Violation of binding relationship, i.e., the project's cryptographic API sequence is missing any API in the correct usage pattern P; Violation of temporal order, i.e., the order in which APIs appear in the project's cryptographic API sequence differs from the correct usage pattern P; Violation frequency refers to the number of times an API appears in the project's cryptographic API sequence that differs from the correct usage pattern P.

2. The method according to claim 1, characterized in that, The data flow and control dependency analysis extracts a sequence of cryptographic APIs from the project source code, including: During the preprocessing stage, cryptographic API information from the cryptographic standard library and third-party libraries is collected; A function call graph is constructed for the entire project. Data flow and control dependencies between function nodes are analyzed for the collected cryptographic APIs. The cryptographic API sequence corresponding to each function is extracted to obtain a set of cryptographic API sequences.

3. The method according to claim 2, characterized in that, The analysis of data flow and control dependencies between function nodes includes: For the transmission of data streams, specify the parameter positions that need attention in the cryptographic API. Cryptographic APIs that transmit data streams at the specified parameter positions will be retained in the sequence, while APIs that do not involve the transmission of data streams at the specified positions will be deleted. For control flow relationships, determine whether there is a control dependency between APIs before and after, retain the API sequence with control dependency, and filter out the rest of the APIs; During data stream analysis, key parameter information of the cryptographic API is recorded into the API's schema.

4. A rule-based automated extraction cryptographic API combination misuse detection system for blockchain infrastructure, employing the method described in any one of claims 1 to 3, characterized in that, include: The preprocessing module is used to collect cryptographic API information from the cryptographic standard library and third-party libraries; The cryptographic API sequence extraction module is used to analyze the data flow and control dependencies between function nodes of the collected cryptographic APIs, extract the cryptographic API sequence corresponding to each function, and obtain a set of cryptographic API sequences. The sequence classification module is used to classify cryptographic API sequences using clustering algorithms; The correct usage pattern extraction module is used to automatically extract the correct usage patterns from cryptographic API sequences using a sequence pattern mining algorithm; The vulnerability detection module is used to detect misuse of cryptographic API combinations based on correct usage patterns.

5. A computer device, characterized in that, It includes a memory and a processor, the memory storing a computer program configured to be executed by the processor, the computer program including instructions for performing the method of any one of claims 1 to 3.

6. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program, which, when executed by a computer, implements the method according to any one of claims 1 to 3.

Images