A method and device for automatically mining protocol vulnerabilities based on an enhanced data flow graph

Abstract

The application provides a protocol vulnerability automatic mining method and device based on an enhanced data flow graph. The method comprises the following steps: determining an analysis range of source code, compiling the source code into an intermediate language file based on the analysis range; performing control flow analysis on the intermediate language file to obtain a total control flow graph; performing data flow analysis and perfecting on the intermediate language based on the total control flow graph to generate an enhanced data flow graph; determining an analysis target, obtaining a calling path of the analysis target based on the enhanced data flow graph; and performing potential risk judgment on the calling path of the analysis target, printing the path with potential vulnerability risks and warning a user. The application extracts protocol interaction semantic information in the source code through static analysis technology, and performs potential risk judgment on the interaction information, so that the vulnerability caused by the protocol interaction can be effectively identified, the dependence on manual analysis or test cases in the protocol vulnerability mining process is reduced, the analysis range of the protocol vulnerability is expanded, and the ability and efficiency of the protocol vulnerability mining are improved.

Description

Technical Field

[0001] The present application relates to the field of cyberspace security, and in particular to a method and device for automatically mining protocol vulnerabilities based on enhanced data flow graphs. Background Art

[0002] Protocols are the foundation of network communication and data exchange, playing a vital role in computer networks. However, with the continuous development of network technology and the evolving attack methods of attackers, protocol security faces increasingly severe challenges. Malicious attackers can exploit protocol vulnerabilities to conduct unauthorized access, denial of service, remote control, and other malicious activities. These attacks not only paralyze network systems but also lead to user privacy leaks and financial losses, posing a serious threat to cybersecurity. Therefore, exploring protocol vulnerabilities has become a key research direction in the field of cybersecurity.

[0003] Existing protocol vulnerability mining solutions have the following main flaws:

[0004] 1) Traditional protocol vulnerability discovery solutions rely on either expert manual analysis of protocol communication interaction logic or on fuzz testing to explore path execution results. With the former, vulnerability discovery rate and speed are completely limited by the individual capabilities of the experts, making it easy to miss potential vulnerabilities. With the latter, the coverage and effectiveness of test cases are limited, and building comprehensive test cases is challenging.

[0005] 2) Existing protocol vulnerability mining solutions usually analyze one or several specific protocols. However, modern network protocols are often very complex. The generation of a protocol vulnerability may involve interactions between multiple layers and multiple participants. Simply analyzing a certain protocol is obviously not enough.

[0006] 3) Protocol evolution and updates are an ongoing process, and attackers' attack methods are constantly improving. Therefore, the discovery and repair of protocol vulnerabilities must be continuous, and vulnerability discovery must be performed in real time. However, existing protocol vulnerability discovery solutions are time-consuming and prone to leaving opportunities for attackers to exploit. Summary of the Invention

[0007] The present application aims to solve one of the technical problems in the related art at least to a certain extent.

[0008] To this end, the first purpose of this application is to propose an automated protocol vulnerability mining method based on enhanced data flow graphs. For protocol vulnerabilities caused by semantic loss, static analysis technology is used to extract protocol interaction semantic information in the source code, and potential risks of the interaction information are judged, which can effectively identify vulnerabilities caused by protocol interactions.

[0009] A second object of the present application is to provide an enhanced data flow graph-based protocol vulnerability automatic mining device.

[0010] A third object of the present application is to provide an electronic device.

[0011] To achieve the above object, the first aspect of the present application provides an enhanced data flow graph-based protocol vulnerability automatic mining method, comprising:

[0012] determining an analysis range of source code, and compiling the source code into an intermediate language file based on the analysis range;

[0013] performing control flow analysis on the intermediate language file to obtain a total control flow graph;

[0014] performing data flow analysis and perfecting on the intermediate language based on the total control flow graph to generate an enhanced data flow graph;

[0015] determining an analysis target, and obtaining a call path of the analysis target based on the enhanced data flow graph;

[0016] performing potential risk judgment on the call path of the analysis target, printing a path with potential vulnerability risk and warning a user.

[0017] Optionally, the step of determining the analysis range of the source code and compiling the source code into an intermediate language file based on the analysis range comprises:

[0018] determining the analysis range of the source code as global analysis, including all source codes of a Linux kernel in the analysis range, and analyzing the Linux kernel as a project to obtain the intermediate language file;

[0019] determining the analysis range of the source code as local analysis, including a target file in the Linux kernel in the analysis range, separately compiling the target file and then uniformly linking to obtain the intermediate language file.

[0020] Optionally, the step of determining the analysis range of the source code as global analysis, including all source codes of a Linux kernel in the analysis range, and analyzing the Linux kernel as a project to obtain the intermediate language file comprises:

[0021] compiling the entire Linux kernel using a wllvm script under an llvm compiler project to obtain a compiled kernel image vmlinux file, wherein a Clang tool is specified as a compiler during kernel compilation, and llvm is specified as a compiler backend;

[0022] The compiled vmlinux file is extracted into an LLVM bytecode file using the extract-bc tool, and the LLVM bytecode file is used as the intermediate language file.

[0023] Optionally, determining the analysis scope of the source code as a local analysis, including target files in the Linux kernel in the analysis scope, and individually compiling and uniformly linking the target files to obtain the intermediate language file includes:

[0024] Compile each of the target files into an intermediate language sub-file using the Clang tool;

[0025] The llvm-link tool is used to link the multiple intermediate language sub-files together, and the merged result is used as the intermediate language file.

[0026] Optionally, performing control flow analysis on the intermediate language file to obtain a total control flow graph includes:

[0027] collecting target statements and next statements of jump statements within a function of the intermediate language file, where both the target statement and the next statement of the jump statement mark the beginning of a new basic block, determining transfer relationships between basic blocks based on the jump instructions and adding control flow edges to obtain a control flow graph within the function;

[0028] Traversing the control flow graph within the function to collect function call statements, determining the calling relationship between functions according to the function call statements, and constructing a function call graph;

[0029] The intra-function control flow graph and the function call graph are combined to obtain the overall control flow graph.

[0030] Optionally, performing data flow analysis and improvement on the intermediate language file based on the overall control flow graph to generate an enhanced data flow graph includes:

[0031] Invoke the data flow graph generation function of the open source static program analysis framework SVF tool to analyze and transform the intermediate language file, obtain the basic data pointing relationship graph PAG of the intermediate language file, and use the basic data pointing relationship graph PAG as the basic data flow graph. In the transformation process, pointer variables or abstract objects are set as nodes, and the relationships between pointer variables are transformed into edges.

[0032] Traversing each node in the basic data flow graph, obtaining a node instruction and a first node position corresponding to each node;

[0033] If the node instruction corresponding to the first node position is a jump statement, a second node position where the node instruction is located in the total control flow graph is obtained, all subsequent nodes after the second node position are traversed, and the node corresponding to the second node position and all subsequent nodes thereof are sequentially added to the back of the basic data flow graph at the first node position;

[0034] If the subsequent node of the second node position is a function call statement, a control dependence edge is added between the subsequent node corresponding to the second node position and the node representing the function in the basic data flow graph;

[0035] After the adding is completed, the enhanced data flow graph is obtained.

[0036] Optionally, the determining the analysis target and obtaining a call path of the analysis target based on the enhanced data flow graph comprises:

[0037] The key variables and the structure related to the vulnerability formation are determined, an alias analysis method is applied to determine aliases corresponding to the key variables and the structure, and the key variables, the structure and the aliases corresponding thereto are recorded in the memory by using a linked list;

[0038] The key variables, the structure or the aliases in the memory are traversed, and call paths of the key variables, the structure or the aliases in the enhanced data flow graph are traced back;

[0039] In the tracing back process, a code segment before a variable is assigned or after the variable is used is searched.

[0040] Optionally, the potential risk judgment on the call path of the analysis target, printing of a path with a potential vulnerability risk and warning of a user comprise:

[0041] Potential risk instructions are determined according to a risk measurement index, and all the risk instructions are recorded by using an Elist linked list;

[0042] The call path is traversed, and it is judged whether each instruction in the call path appears in the Elist linked list;

[0043] If at least one instruction in the call path appears in the Elist linked list, it is determined that the call path has a potential vulnerability risk, the call path is printed out, and a vulnerability warning is sent to the user.

[0044] To achieve the above purpose, a second aspect embodiment of the present application provides a protocol vulnerability automatic mining device based on an enhanced data flow graph, comprising:

[0045] an initialization module, configured to determine an analysis scope of the source code and compile the source code into an intermediate language file based on the analysis scope;

[0046] A control flow analysis module, configured to perform control flow analysis on the intermediate language file to obtain a total control flow graph;

[0047] A data flow analysis module, configured to perform data flow analysis and improvement on the intermediate language based on the overall control flow graph to generate an enhanced data flow graph;

[0048] A path tracing module is used to determine an analysis target and obtain a call path of the analysis target based on the enhanced data flow graph;

[0049] The security check module is used to judge the potential risks of the call path of the analysis target, print the path with potential vulnerability risks and warn the user.

[0050] To achieve the above-mentioned purpose, a third embodiment of the present application provides an electronic device, comprising: a processor, and a memory communicatively connected to the processor;

[0051] The memory stores computer-executable instructions;

[0052] The processor executes the computer-executable instructions stored in the memory to implement the method as described in any one of the first aspects above.

[0053] The technical solutions provided by the embodiments of this application bring at least the following beneficial effects:

[0054] For protocol vulnerabilities caused by semantic loss, static analysis technology is used to extract protocol interaction semantic information in the source code, and potential risk judgment is made on the interaction information, which can effectively identify vulnerabilities caused by protocol interaction. This solution does not rely on expert manual analysis or the completeness of test cases. In addition, this method is not limited to specific analysis of one or several protocols, but includes all protocol participants involved in the protocol communication process into the analysis scope, expanding the analysis scope of the protocol. In addition, this method uses automated methods to mine protocol vulnerabilities for different analysis targets, which can process a large amount of protocol code in a relatively short time and provide potential vulnerability risks, thereby improving the efficiency of vulnerability mining.

[0055] Additional aspects and advantages of the present application will be given in part in the description below, and in part will become apparent from the description below, or will be learned through practice of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0056] The above and / or additional aspects and advantages of the present application will become apparent and easily understood from the following description of the embodiments in conjunction with the accompanying drawings, in which:

[0057] Figure 1 This is a flowchart of a method for automatically mining protocol vulnerabilities based on an enhanced data flow graph according to an embodiment of the present application;

[0058] Figure 2 is a flowchart of a method for performing control flow analysis on an intermediate language file according to an embodiment of the present application;

[0059] Figure 3 This is a block diagram of an automated protocol vulnerability mining device based on an enhanced data flow graph according to an embodiment of the present application;

[0060] Figure 4 It is a block diagram of an electronic device. DETAILED DESCRIPTION

[0061] The following describes in detail embodiments of the present application. Examples of the embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are intended to be used to explain the present application, and should not be construed as limiting the present application.

[0062] The explanations of the terms used in this application are shown in Table 1.

[0063]

[0064] Table 1

[0065] The following describes, with reference to the accompanying drawings, a method and device for automatically mining protocol vulnerabilities based on enhanced data flow graphs according to an embodiment of the present application.

[0066] Figure 1 is a flow chart of a method for automatically mining protocol vulnerabilities based on an enhanced data flow graph according to an embodiment of the present application, such as Figure 1 As shown, the method includes the following steps:

[0067] Step 101 : determining an analysis scope of a source code, and compiling the source code into an intermediate language file based on the analysis scope.

[0068] It is understandable that the generation of modern protocol vulnerabilities is very complex, and the generation of a protocol vulnerability may involve interactions between multiple layers or participants.

[0069] Therefore, this application includes all protocol participants involved in the protocol communication process in the analysis scope in order to discover more complex vulnerabilities, such as those caused by data interaction between multiple protocols. In addition, an ideal vulnerability mining method should be cross-platform, scalable, and high-level abstract. This application compiles the source code into an intermediate language for analysis. The intermediate language is a common intermediate representation between different programming languages. This means that the same analysis tools and techniques can be used to process code on different platforms and different types of high-level languages, which has high scalability.

[0070] The solution disclosed in this application supports two analysis range options to meet different memory and speed requirements. It is understandable that different compilation methods will be different depending on the analysis range selected by the user. The following explanation is given using the example of mining protocol vulnerabilities in the Linux kernel.

[0071] As a possible implementation method, if the analysis scope of the source code is determined to be global analysis, all source codes of the Linux kernel are included in the analysis scope, and the Linux kernel is analyzed as a project to obtain the intermediate language file.

[0072] As an example, the process of analyzing the Linux kernel as a project is implemented as follows:

[0073] Use the wllvm script under the llvm compiler project to compile the entire Linux kernel to obtain the compiled kernel image vmlinux file. During the kernel compilation process, specify the Clang tool as the compiler and llvm as the compiler backend; use the extract-bc tool to extract the compiled vmlinux file into an LLVM bytecode file, and use the LLVM bytecode file as the intermediate language file.

[0074] It is understandable that through global analysis, all communication interactions between kernel protocol stacks can be captured through source code analysis, thereby uncovering more types of protocol vulnerabilities, but this option requires more memory and computing resources.

[0075] As another possible implementation method, if the analysis scope of the source code is determined to be local analysis, the target files in the Linux kernel are included in the analysis scope, and the target files are compiled separately and then linked uniformly to obtain intermediate language files.

[0076] Among them, the target file is some specific file in the Linux kernel selected by the user, and this application does not make specific restrictions on this.

[0077] As an example, the process of compiling the target files separately and then linking them together is implemented as follows:

[0078] Clang tool is used to compile each target file into an intermediate language sub-file; the llvm-link tool is used to link multiple intermediate language sub-files together, and the merged result is taken as an intermediate language file for overall analysis.

[0079] It can be understood that, by means of local analysis, only the communication process of a specific module or protocol participant under the kernel protocol stack can be focused on, which requires less memory and computing resources.

[0080] In step 102, control flow analysis is performed on the intermediate language file to obtain a total control flow graph.

[0081] In the embodiment of the present application, based on step 101, the analysis range of the source code has been determined, and the final intermediate language file has been obtained, which provides the analysis basis for the present application. Since the flow and dependency of data are usually affected by the control flow structure, the present application will first construct a control flow graph according to the intermediate language file, which is used to represent the control flow transfer relationship in the program, and to prepare for the following data flow analysis.

[0082] As shown in FIG. 2, step 102 further includes the following steps: Figure 2

[0083] In step 201, the target statement of the jump statement and the next statement of the jump statement in the intermediate language file are collected, and the target statement of the jump statement and the next statement both mark the beginning of a new basic block. The transfer relationship between the basic blocks is determined according to the jump instruction, and a control flow edge is added to obtain an intra-function control flow graph.

[0084] It should be noted that the intra-function control flow graph is a graph structure representing the execution flow of the program in the function, and the nodes in the graph are instructions, and the edges represent the control flow.

[0085] As a possible implementation manner, the present application first collects the target statement of the jump statement and the next statement of the jump statement in the intermediate language file, which both mark the beginning of a new basic block, and then determines the transfer relationship between the basic blocks according to the jump instruction and adds a control flow edge to obtain an intra-function control flow graph.

[0086] It should be noted that each basic block only contains sequential statements, and the present application will traverse each basic block, and when a instruction is encountered, it will be individually specified as a node, and the next instruction will be taken as the next node, and a control flow edge will be connected between the two nodes, and finally an intra-function control flow graph is obtained.

[0087] As an example, the final intra-function control flow graph is represented as , wherein, ​is a node set , is a directed edge set, n is the number of nodes, and each node is an instruction.

[0088] Step 202, traverse the function internal control flow graph to collect function call statements, determine the call relationship between functions according to the function call statements, and build a function call graph.

[0089] Among them, the file name where the function is located, the function name, the function parameters and the function return value need to be recorded to form the function signature, so as to record which function calls which function, so as to draw the control flow edge.

[0090] As a possible implementation, a HashMap is used to record the mapping relationship between the function and the called function.

[0091] Step 203, compound the function internal control flow graph and the function call graph to obtain a total control flow graph.

[0092] In the embodiment of the application, the function internal control flow graph built in step 201 and the function call graph built in step 202 are compounded to generate a more comprehensive total control flow graph.

[0093] Among them, the total control flow graph contains the function call relationship of the entire intermediate language file and the control flow relationship between each instruction.

[0094] Step 103, based on the total control flow graph, data flow analysis and perfection of the intermediate language are performed to generate an enhanced data flow graph.

[0095] In the embodiment of the application, based on step 102, the total control flow graph has been generated for the intermediate language file, but only the control flow cannot let the application judge the call path of the key data. In order to obtain the call path of the key data, the application also needs to build a data flow graph.

[0096] As a possible implementation, the application calls the data flow graph generation function of the open source static program analysis framework SVF tool to analyze and transform the intermediate language file, obtain the basic data pointing relationship graph PAG of the intermediate language file, and take the basic data pointing relationship graph PAG as the basic data flow graph.

[0097] It should be noted that in the transformation process, the pointer variable or abstract object is set as a node, the relationship between the pointer variables is transformed into an edge, and the basic data flow graph is flow-insensitive and context-insensitive. In addition, the basic data flow graph generated in the above steps only contains data dependency relationships between variables, and the cause of the missing semantic vulnerability in the protocol is that the improper or incorrect processing of the program causes the program to meet certain conditional statements, therefore, the data flow graph must also contain part of the control flow information.

[0098] As an example, the data flow graph contains the contents of the basic block after the intermediate language br instruction. In this way, when tracing the call path of a variable, if it is used to determine the control flow, the present application can also traverse the contents of the different branch basic blocks caused by the variable, so as to determine which instructions the program has performed due to the different values of the variable, and to determine whether the processing manner of the program is appropriate.

[0099] Therefore, as a possible implementation manner, each node in the basic data flow graph is traversed to obtain the node instruction corresponding to each node and the first node position a. If the node instruction corresponding to the first node position a is a jump statement, the second node position b where the node instruction is located in the total control flow graph is obtained, all subsequent nodes after the second node position b are traversed, and the node corresponding to the second node position b and all subsequent nodes thereof are sequentially added behind the node position of the first node position a in the basic data flow graph; if the subsequent node of the second node position is a function call statement, a control dependency edge is added between the subsequent node corresponding to the second node position and the node representing the function in the basic data flow graph.

[0100] After the above operation is performed on all nodes meeting the requirements, the enhanced data flow graph is obtained.

[0101] In step 104, the analysis target is determined, and the call path of the analysis target is obtained based on the enhanced data flow graph.

[0102] In the embodiment of the present application, based on step 103, the basic graph data structure has been obtained, and then the user needs to determine his own analysis target, and then trace the call path of the target on the current data flow graph. The purpose of this step is to let the user select a part of the program for analysis according to the known situation of the vulnerability, and it is not necessary to analyze all variables or instructions in the program.

[0103] Firstly, the user needs to determine the analysis target, that is, the user needs to determine the analysis starting point of the program, that is, to determine the key variables and structures related to the formation of the vulnerability, and then to determine the alias of the key variables and structures by applying the alias analysis method. The key variables, structures and their corresponding aliases are recorded in the memory by using a linked list, and the memory is named as Glist.

[0104] It can be understood that there are various alias analysis methods, and the present application does not make specific limitations thereto.

[0105] It should be noted that the above method makes the mined vulnerability type more targeted. In the subsequent analysis process, the user traverses the key variables, structures and aliases in Glist, and traces the call path of the key variables, structures or aliases on the existing data flow graph.

[0106] In addition, the present application designs a variable call path tracing algorithm based on deep traversal to search the code segment before or after the variable is assigned or used in the tracing process. For these two cases, it is specifically related to starting from the current node, recursively traversing its neighbor nodes, and adding unvisited neighbor nodes to the queue. If the current node and the nodes in the queue are repeated, it means that the current path traversal ends.

[0107] Step 105, judging the potential risk of the call path of the analysis target, printing the path with potential vulnerability risk and warning the user.

[0108] It can be understood that in the above step 104, the key variables and their call paths in the kernel have been obtained, and then the call path needs to be verified to filter out the paths that may indeed cause potential vulnerabilities, and print the path and warn the user.

[0109] Firstly, the user needs to determine the risk measurement index to determine the potential risk instruction, and use the Elist linked list to record all the risk instructions, and the risk instructions are related to the vulnerability type.

[0110] It can be understood that if the path contains these risk instructions, it is considered that the path has potential vulnerability risk.

[0111] Then, traverse the call path, for each instruction in the call path, judge whether the instruction appears in the Elist linked list, if at least one instruction in the call path appears in the Elist linked list, it is determined that the call path has potential vulnerability risk, and the call path needs to be printed and the vulnerability warning is sent to the user.

[0112] As another possible implementation, if you want to improve the path recognition accuracy, you can use symbolic execution to filter the potential vulnerability path, and the present application does not make specific description, only describes a scheme to improve the path recognition accuracy.

[0113] The embodiment of the present application targets protocol vulnerabilities caused by semantic loss. It extracts protocol interaction semantic information in the source code through static analysis technology and makes potential risk judgments on the interaction information, thereby effectively identifying vulnerabilities caused by protocol interaction. The solution does not rely on manual analysis by experts or the completeness of test cases. In addition, the method is not limited to specific analysis of one or several protocols, but includes all protocol participants involved in the protocol communication process into the analysis scope, thereby expanding the analysis scope of the protocol. In addition, the method adopts an automated method to mine protocol vulnerabilities for different analysis targets, and can process a large amount of protocol code in a relatively short period of time and provide potential vulnerability risks, thereby improving the efficiency of vulnerability mining.

[0114] Figure 3 1 is a block diagram of an automated protocol vulnerability mining device 10 based on an enhanced data flow graph according to an embodiment of the present application, comprising:

[0115] Initialization module 100, used to determine the analysis scope of the source code and compile the source code into an intermediate language file based on the analysis scope;

[0116] A control flow analysis module 200 is used to perform control flow analysis on the intermediate language file to obtain a total control flow graph;

[0117] The data flow analysis module 300 is used to perform data flow analysis and improvement on the intermediate language based on the overall control flow graph to generate an enhanced data flow graph;

[0118] The path tracing module 400 is used to determine the analysis target and obtain the call path of the analysis target based on the enhanced data flow graph;

[0119] The security check module 500 is used to determine potential risks of the call path of the analysis target, print the path with potential vulnerability risks and warn the user.

[0120] Regarding the apparatus in the above embodiment, the specific manner in which each module performs operations has been described in detail in the embodiment of the method, and will not be elaborated here.

[0121] Figure 4A schematic block diagram of an example electronic device 700 that can be used to implement an embodiment of the present application is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital assistants, cellular phones, smart phones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present application described and / or claimed herein.

[0122] like Figure 4 As shown, device 700 includes a computing unit 701, which can perform various appropriate actions and processes according to a computer program stored in a read-only memory (ROM) 702 or a computer program loaded from a storage unit 708 into a random access memory (RAM) 703. RAM 703 may also store various programs and data required for the operation of device 700. Computing unit 701, ROM 702, and RAM 703 are connected to each other via a bus 704. An input / output (I / O) interface 705 is also connected to bus 704.

[0123] Various components in device 700 are connected to I / O interface 705, including an input unit 706, such as a keyboard, mouse, etc.; an output unit 707, such as various types of displays, speakers, etc.; a storage unit 708, such as a magnetic disk, optical disk, etc.; and a communication unit 709, such as a network card, modem, wireless communication transceiver, etc. The communication unit 709 allows device 700 to exchange information / data with other devices via a computer network such as the Internet and / or various telecommunication networks.

[0124] The computing unit 701 can be any general-purpose and / or specialized processing component with processing and computing capabilities. Some examples of the computing unit 701 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various specialized artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. The computing unit 701 performs the various methods and processes described above, such as the voice command response method. For example, in some embodiments, the voice command response method may be implemented as a computer software program tangibly embodied in a machine-readable medium, such as the storage unit 708. In some embodiments, part or all of the computer program may be loaded and / or installed onto the device 700 via the ROM 702 and / or the communication unit 709. When the computer program is loaded into the RAM 703 and executed by the computing unit 701, one or more steps of the voice command response method described above may be performed. Alternatively, in other embodiments, the computing unit 701 may be configured to perform the voice command response method in any other suitable manner (e.g., via firmware).

[0125] Various embodiments of the systems and techniques described above can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), system-on-chip systems (SOCs), programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments can include being implemented in one or more computer programs that are executable and / or interpreted on a programmable system that includes at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0126] The program code for implementing the methods of the present application can be written in any combination of one or more programming languages. Such program code can be provided to a processor or controller of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the program code is executed by the processor or controller, the functions / operations specified in the flow charts and / or block diagrams are implemented. The program code can be executed entirely on the machine, partially on the machine, as a stand-alone software package, partially on the machine and partially on a remote machine, or entirely on a remote machine or server.

[0127] In the context of this application, a machine-readable medium can be a tangible medium that contains or stores a program for use by or in connection with an instruction execution system, apparatus, or device. The machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium can include but is not limited to an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any suitable combination of the foregoing. More specific examples of the machine-readable storage medium would include a linearly-programmed electronic circuit, a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or Flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0128] To provide for interaction with a user, the systems and techniques described here can be implemented on a computer having a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user and a keyboard and a pointing device (e.g., a mouse or a trackball) by which the user can provide input to the computer. Other kinds of devices can be used to provide for interaction with a user as well; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form, including acoustic, speech, or tactile input.

[0129] The systems and techniques described here can be implemented in a computing system that includes a back end component (e.g., as a data server), or that includes a middleware component (e.g., an application server), or that includes a front end component (e.g., a user computer having a graphical user interface or a Web browser through which a user can interact with an implementation of the systems and techniques described here), or any combination of such back end, middleware, or front end components. The components of the system can be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include a local area network (LAN), a wide area network (WAN), the Internet, and a blockchain network.

[0130] A computer system may include a client and a server. The client and server are generally remote from each other and typically interact via a communication network. This client-server relationship arises through computer programs running on the respective computers, establishing a client-server relationship. The server may be a cloud server, also known as a cloud computing server or cloud host. This server is a host product within the cloud computing service ecosystem that addresses the management difficulties and limited scalability of traditional physical servers and VPS services ("Virtual Private Servers" or "VPS"). The server may also be a server in a distributed system or a server integrated with blockchain.

[0131] It should be understood that the various forms of the processes shown above can be used to reorder, add, or delete steps. For example, the steps described in this application can be performed in parallel, sequentially, or in a different order, as long as the desired results of the technical solution of this application can be achieved. This is not limited herein.

[0132] The above specific embodiments do not constitute a limitation on the scope of protection of this application. Those skilled in the art will appreciate that various modifications, combinations, sub-combinations, and substitutions may be made based on design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this application shall be included within the scope of protection of this application.

Claims

1. A protocol vulnerability automated mining method based on enhanced data flow graph, characterized in that: include: Determining an analysis scope of the source code, and compiling the source code into an intermediate language file based on the analysis scope; Determining the analysis scope of the source code to be a global analysis, including all source codes of the Linux kernel in the analysis scope, analyzing the Linux kernel as a project, and obtaining the intermediate language file; Determining the analysis scope of the source code as local analysis, including the target files in the Linux kernel in the analysis scope, compiling the target files separately and then linking them uniformly to obtain the intermediate language file; Performing control flow analysis on the intermediate language file to obtain a total control flow graph, including: calling the data flow graph generation function of the open source static program analysis framework SVF tool to analyze and convert the intermediate language file, obtaining a basic data pointing relationship graph PAG of the intermediate language file, and using the basic data pointing relationship graph PAG as a basic data flow graph, wherein, during the conversion process, pointer variables or abstract objects are set as nodes, and the relationship between pointer variables is converted into edges; traversing each node in the basic data flow graph to obtain a node instruction and a first node position corresponding to each node; if the node instruction corresponding to the first node position is a jump statement, obtaining a second node position of the node instruction in the total control flow graph, traversing all subsequent nodes after the second node position, and sequentially adding the node corresponding to the second node position and all subsequent nodes thereof to the node position after the first node position in the basic data flow graph; if the subsequent node of the second node position is a function call statement, adding a control dependency edge between the subsequent node corresponding to the second node position and the corresponding node representing the function in the basic data flow graph; after the addition is completed, obtaining the enhanced data flow graph; Based on the overall control flow graph, performing data flow analysis and improvement on the intermediate language to generate an enhanced data flow graph; Determine an analysis target, and obtain a call path of the analysis target based on the enhanced data flow graph; Perform potential risk assessment on the call path of the analysis target, print the path with potential vulnerability risk and warn the user; Determining the analysis scope of the source code as a global analysis, including all source codes of the Linux kernel in the analysis scope, analyzing the Linux kernel as a project, and obtaining the intermediate language file includes: using the wllvm script under the llvm compiler project to compile the entire Linux kernel to obtain a compiled kernel image vmlinux file, wherein the Clang tool is specified as the compiler and llvm is used as the compiler backend during the kernel compilation process; using the extract-bc tool to extract the compiled vmlinux file into an LLVM bytecode file, and using the LLVM bytecode file as the intermediate language file; The step of determining the analysis scope of the source code as a local analysis, incorporating target files in the Linux kernel into the analysis scope, and individually compiling the target files and then uniformly linking them to obtain the intermediate language file comprises: using the Clang tool to compile each target file into an intermediate language sub-file; and using the llvm-link tool to link multiple intermediate language sub-files together, and using the merged result as the intermediate language file.

2. The method according to claim 1, characterized in that The control flow analysis of the intermediate language file is performed to obtain a total control flow graph, including: collecting target statements and next statements of jump statements within a function of the intermediate language file, where both the target statement and the next statement of the jump statement mark the beginning of a new basic block, determining transfer relationships between basic blocks based on the jump instructions and adding control flow edges to obtain a control flow graph within the function; Traversing the control flow graph within the function to collect function call statements, determining the calling relationship between functions according to the function call statements, and constructing a function call graph; The intra-function control flow graph and the function call graph are combined to obtain the overall control flow graph.

3. The method according to claim 1, characterized in that The determining of the analysis target and obtaining the calling path of the analysis target based on the enhanced data flow graph includes: Determine key variables and structures related to the vulnerability, apply an alias analysis method to determine aliases corresponding to the key variables and the structures, and record the key variables, the structures, and their corresponding aliases in a memory using a linked list; Traversing the key variable, the structure or the alias in the memory, and tracing back the calling path of the key variable, the structure or the alias in the enhanced data flow graph; In the tracing process, the code segments before the variable is assigned or after it is used are searched.

4. The method according to claim 1, wherein The step of determining potential risks of the call path of the analysis target, printing the path with potential vulnerability risks and warning the user includes: Determine potential risk instructions based on risk measurement indicators and use the Elist linked list to record all of the risk instructions; Traverse the call path and determine whether each instruction in the call path appears in the Elist linked list; If at least one instruction in the call path appears in the Elist linked list, it is determined that the call path has a potential vulnerability risk, the call path is printed out and a vulnerability warning is sent to the user.

5. A protocol vulnerability automatic mining device based on enhanced data flow graph, characterized in that: include: An initialization module, configured to determine an analysis scope of the source code and compile the source code into an intermediate language file based on the analysis scope; Determining the analysis scope of the source code to be a global analysis, including all source codes of the Linux kernel in the analysis scope, analyzing the Linux kernel as a project, and obtaining the intermediate language file; Determining the analysis scope of the source code as local analysis, including the target files in the Linux kernel in the analysis scope, compiling the target files separately and then linking them uniformly to obtain the intermediate language file; A control flow analysis module is used to perform control flow analysis on the intermediate language file to obtain an overall control flow graph, including: calling the data flow graph generation function of the open source static program analysis framework SVF tool to analyze and convert the intermediate language file, obtain the basic data pointing relationship graph PAG of the intermediate language file, and use the basic data pointing relationship graph PAG as the basic data flow graph, wherein, during the conversion process, pointer variables or abstract objects are set as nodes, and the relationship between pointer variables is converted into edges; traversing each node in the basic data flow graph to obtain the node instruction and the first node position corresponding to each node; if the node instruction corresponding to the first node position is a jump statement, obtaining the second node position of the node instruction in the overall control flow graph, traversing all subsequent nodes after the second node position, and sequentially adding the node corresponding to the second node position and all subsequent nodes thereof to the node position after the first node position in the basic data flow graph; if the subsequent node of the second node position is a function call statement, adding a control dependency edge between the subsequent node corresponding to the second node position and the corresponding node representing the function in the basic data flow graph; after the addition is completed, the enhanced data flow graph is obtained; A data flow analysis module, configured to perform data flow analysis and improvement on the intermediate language based on the overall control flow graph to generate an enhanced data flow graph; A path tracing module is used to determine an analysis target and obtain a call path of the analysis target based on the enhanced data flow graph; The security check module is used to judge the potential risks of the call path of the analysis target, print the path with potential vulnerability risks and warn the user.

6. An electronic device, characterized in that: include: a processor, and a memory communicatively connected to the processor; The memory stores computer-executable instructions; The processor executes the computer-executable instructions stored in the memory to implement the method according to any one of claims 1 to 4.

Images