Intelligent cause analysis method and device for conditional competitive vulnerabilities, equipment and medium

Abstract

The invention relates to the technical field of conditional competitive vulnerability cause analysis, and discloses an intelligent cause analysis method, device, equipment and medium for conditional competitive vulnerabilities, the method comprises: acquiring an environmental parameter set of an operating system when a conditional competitive vulnerability is triggered, the environmental parameter set comprising a plurality of environmental variables; environment variables in the environment parameter set are adjusted, the adjusted environment parameter set is replayed, and a plurality of trigger environment sequences of the replayed trigger condition competition vulnerabilities are obtained; and performing cause analysis based on the trigger environment sequence to obtain a cause relationship between each environment variable and the condition competition vulnerability. The method is not limited by whether a source code can be obtained or not, and is more universal and worthy of popularization.

Description

Technical Field

[0001] The present invention relates to the technical field of analysis of the causes of race condition vulnerabilities, and particularly to an intelligent method, device, equipment and medium for analyzing the causes of race condition vulnerabilities. Background Art

[0002] Race Condition vulnerabilities are a common type of concurrency defect. One of its core characteristics is that there are multiple threads or processes in the program accessing shared resources simultaneously, and the execution order of these access operations will affect the final result of the program. Since it often appears in the situation of competition across files and modules, it is more difficult to be discovered, the proof-of-concept code is more complex, and the cause of the vulnerability is also difficult to understand.

[0003] Race Condition vulnerabilities can be classified according to the root cause into: lack of synchronization mechanism, improper locking strategy, time window problem, logical error, and uncertain execution order. According to the characteristics, they can be classified into: read-write competition, write-write competition, check-then-execute competition, initialization competition, resource release competition, etc. Due to the diverse types and scenarios, and the characteristics of whether they can be triggered in different environments and the varying triggering probabilities, reliable analysis of the causes of conditional vulnerabilities can greatly help developers correctly understand and fix vulnerabilities. Currently, the analysis of the causes of race condition vulnerabilities adopts a static analysis method, mainly by obtaining the PoC (Proof of Concept) code of the computer system when the vulnerability appears, and analyzing the causes based on the source code. The PoC code is the source code, which is example code or script used to prove the existence of a certain vulnerability. It is usually used in security research, penetration testing and vulnerability verification to show how to exploit a specific security vulnerability. However, the acquisition of the source code is often restricted by many factors, and it is difficult to obtain the source code in some cases for further analysis. Summary of the Invention

[0004] In view of this, the present invention provides an intelligent method, device, equipment and medium for analyzing the causes of race condition vulnerabilities to solve the technical problem of the limitation of whether the source code can be obtained in the existing cause analysis.

[0005] In a first aspect, the present invention provides an intelligent method for analyzing the causes of race condition vulnerabilities, including: obtaining a set of environment parameters of the operating system when a race condition vulnerability is triggered, where the set of environment parameters includes several environment variables; adjusting the environment variables in the set of environment parameters, and replaying the adjusted set of environment parameters to obtain several trigger environment sequences that trigger the race condition vulnerability after replaying; performing cause analysis based on the trigger environment sequences to obtain the causal relationship between each environment variable and the cause of the race condition vulnerability.

[0006] The present invention obtains a set of environment parameters of an operating system when a triggering condition race vulnerability occurs, adjusts the environment variables in the set of environment parameters, and replays the adjusted set of environment parameters to obtain a number of triggering environment sequences that trigger the condition race vulnerability after replay. Based on the triggering environment sequences, a cause analysis is performed to obtain the causal relationship between each environment variable and the condition race vulnerability. Compared with the existing static analysis method, the present invention is not limited by whether the source code can be obtained, and has greater universality and promotion value.

[0007] In an alternative embodiment, adjusting the environment variables in the set of environment parameters and replaying the adjusted set of environment parameters to obtain a number of triggering environment sequences that trigger the condition race vulnerability after replay includes: adjusting the environment variables in the set of environment parameters by a reinforcement learning agent, where the reinforcement learning agent includes a state space, an action space, and a reward function. The state space includes the current environment sequence generated according to the set of environment parameters. The execution actions defined in the action space include adjustments to the current environment sequence. The reward function determines the reward value according to the feedback metrics after replaying the environment sequence after the execution action.

[0008] In this way, a reinforcement learning agent is introduced to adjust the environment variables. The reinforcement learning agent learns and makes decisions based on the state space, action space, and reward function, and can efficiently explore different environment variable adjustment strategies, quickly find the environment sequence that can trigger the condition race vulnerability, and improve the efficiency and accuracy of vulnerability mining.

[0009] In an alternative embodiment, the feedback metrics include whether the condition race vulnerability is successfully triggered, the time required for reproduction, the length of the environment sequence required for reproduction, and the resource utilization rate. Correspondingly, determining the reward value according to the feedback metrics corresponding to the environment sequence after the execution action includes: if the environment sequence after the execution action triggers the condition race vulnerability, the reward value is increased by a first preset value; for each unit time reduction in the time required to reproduce the condition race vulnerability, the reward value is increased by a second preset value; for each reduction in the length of the environment sequence required to reproduce the condition race vulnerability, the reward value is increased by a third preset value; if the resource utilization rate for reproducing the condition race vulnerability is greater than the set resource value, the reward value is decreased by a fourth preset value.

[0010] In this way, through these feedback metrics, the quality and effectiveness of the environment sequence after the execution action can be comprehensively evaluated, guiding the reinforcement learning agent to adjust in a direction that is more conducive to triggering vulnerabilities and is efficient and resource-optimized, further improving the accuracy and efficiency of the vulnerability mining and analysis process.

[0011] In an alternative embodiment, cause analysis is performed based on the trigger environment sequence to obtain the causal relationships between each environmental variable and the condition race vulnerability, including: performing data preprocessing on all the trigger environment sequences to obtain a dependency graph of the trigger environment sequences; performing necessity analysis and correlation analysis on each environmental variable based on the dependency graph to obtain the importance scores of each environmental variable; and verifying the causal relationships of each environmental variable from high to low according to the importance scores to obtain the causal relationships between each environmental variable and the condition race vulnerability.

[0012] In this method, the dependency graph intuitively shows the interaction between environmental variables and the influence path on vulnerability triggering. Necessity analysis and correlation analysis quantify the importance of environmental variables from different perspectives, and causal relationship verification further confirms the direct causal relationship between key environmental variables and vulnerabilities, making the cause analysis results more accurate and reliable, and providing a strong basis for subsequent vulnerability repair.

[0013] In an alternative embodiment, performing data preprocessing on all the trigger environment sequences to obtain a dependency graph of the trigger environment sequences includes: performing time series alignment on all the trigger environment sequences; extracting the key environmental variables and change points in the aligned trigger environment sequences; and constructing a dependency graph of the trigger environment sequences according to the key environmental variables and change points.

[0014] In this method, by constructing a dependency graph, the dynamic change relationships and mutual dependencies of environmental variables during vulnerability triggering can be clearly presented, providing a more accurate and valuable data basis for subsequent cause analysis, helping to more deeply understand the generation mechanism of condition race vulnerabilities, and improving the depth and breadth of cause analysis.

[0015] In an alternative embodiment, performing necessity analysis and correlation analysis on each environmental variable based on the dependency graph to obtain the importance scores of each environmental variable includes: statistically analyzing the inevitable relationships between each environmental variable and triggering the condition race vulnerability based on the dependency graph. If it appears in the specific value range of the environmental variable in all samples that successfully trigger the condition race vulnerability, the corresponding environmental variable is a necessary variable, and the importance score is increased by the necessity score value; calculating the correlation coefficient or information gain between each environmental variable and the success rate of triggering the condition race vulnerability based on the dependency graph, and increasing the importance score by the correlation score value according to the correlation coefficient or the information gain.

[0016] In this method, evaluating environmental variables from two dimensions of necessity and correlation and calculating importance scores can more comprehensively and objectively reflect the importance ranking of each environmental variable in the generation of condition race vulnerabilities.

[0017] In an alternative embodiment, the set of environmental parameters includes one or more environmental variables among CPU scheduling situation, network situation, process-thread interaction situation, user operation interaction, and memory situation.

[0018] In a second aspect, the present invention provides an intelligent cause analysis device for race condition vulnerabilities, including: an environmental variable acquisition module, configured to acquire a set of environmental parameters of an operating system when a race condition vulnerability is triggered, where the set of environmental parameters includes a number of environmental variables; an adjustment and replay module, configured to adjust the environmental variables in the set of environmental parameters and replay the adjusted set of environmental parameters to obtain a number of trigger environment sequences that trigger race condition vulnerabilities after replay; and a cause analysis module, configured to perform cause analysis based on the trigger environment sequences to obtain the causal relationship between each environmental variable and the race condition vulnerability.

[0019] In a third aspect, the present invention provides a computer device, including: a memory and a processor, which are communicatively connected to each other. The memory stores computer instructions, and the processor executes the computer instructions to execute the intelligent cause analysis method for race condition vulnerabilities according to the first aspect or any corresponding embodiment thereof.

[0020] In a fourth aspect, the present invention provides a computer-readable storage medium, on which computer instructions are stored, and the computer instructions are used to cause a computer to execute the intelligent cause analysis method for race condition vulnerabilities according to the first aspect or any corresponding embodiment thereof. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] In order to more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the following will briefly introduce the drawings required for use in the description of the specific embodiments or the prior art. Obviously, the drawings in the following description are some embodiments of the present invention. For those of ordinary skill in the art, other drawings can be obtained based on these drawings without creative efforts.

[0022] Figure 1 is a flowchart of an intelligent cause analysis method for a race condition vulnerability according to an embodiment of the present invention;

[0023] Figure 2 is a flowchart of another intelligent cause analysis method for a race condition vulnerability according to an embodiment of the present invention;

[0024] Figure 3 is a flowchart of the working process of an RL agent according to an embodiment of the present invention;

[0025] Figure 4 is a flowchart of the replay process according to an embodiment of the present invention;

[0026] Figure 5 It is a structural block diagram of an intelligent cause analysis device for the conditional race vulnerability of an embodiment of the present invention;

[0027] Figure 6 It is a schematic diagram of the hardware structure of a computer device according to an embodiment of the present invention. Specific embodiments

[0028] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are some, but not all, of the embodiments of the present invention. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative efforts shall fall within the protection scope of the present invention.

[0029] The reinforcement learning method is a method based on an agent learning how to take actions through interaction with the environment to maximize the accumulated rewards. It focuses on the decision-making process in an uncertain environment. With the excellent capabilities of artificial intelligence technology demonstrated in various fields, especially the advantageous characteristics of reinforcement learning in performing decision analysis in an uncertain environment, this solution introduces deep learning for intelligent root cause analysis of conditional race vulnerabilities to solve the limitations of manual analysis and empirical analysis.

[0030] According to an embodiment of the present invention, there is provided an embodiment of a method for intelligent cause analysis of conditional race vulnerabilities. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions, and although the logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in a different order than here.

[0031] In this embodiment, there is provided a method for intelligent cause analysis of conditional race vulnerabilities, which can be used in mobile terminals such as mobile phones, tablet computers, etc. As Figure 1 shown, the process includes the following steps:

[0032] Step S101, obtain a set of environment parameters of the operating system when a conditional race vulnerability is triggered, and the set of environment parameters includes several environment variables.

[0033] Specifically, race condition refers to a situation in a concurrently executed program where, due to the indeterminate order of access to shared resources, the behavior of the program depends on the execution timing. If the execution timing of the program does not meet expectations, it may lead to data inconsistency, abnormal states, or security vulnerabilities. A race condition vulnerability refers to a security issue where incorrect behavior or data corruption occurs in a program due to a race condition. The root cause of a vulnerability refers to the various factors that lead to security flaws in software, systems, or networks. Understanding these root causes helps developers and security experts identify and fix potential vulnerabilities.

[0034] Hook technology is a technique widely used in software development and system programming, mainly used to intercept and modify the behavior of a system or application. Through Hook, developers can insert custom code when a specific event occurs, thereby changing the execution flow of the program or obtaining specific information.

[0035] Apply Hook technology to obtain the key system calls of the operating system to monitor system calls and parameters, obtain environment variables, and thus construct a collection of environment parameters. Moreover, through Hook technology, various environment variables can be dynamically adjusted and controlled when a race condition vulnerability reappears on the operating system.

[0036] The set of environment parameters includes one or more environment variables such as CPU scheduling, network conditions, process - thread interaction, user operation interaction, and memory conditions. The collection of environment parameters includes the names and values of each environment variable except for the PoC code that triggers the race condition vulnerability. These environment variables can comprehensively consider and analyze various factors that may affect the occurrence of race condition vulnerabilities, making this analysis method highly generalizable and applicable, and can be widely used for analyzing race condition vulnerabilities in software systems of different types and scenarios.

[0037] Step S102: Adjust the environment variables in the set of environment parameters, and replay the adjusted set of environment parameters to obtain several trigger environment sequences that trigger race condition vulnerabilities after replay.

[0038] Specifically, the adjustment of environment variables includes the adjustment of the values and timings of each environment variable, and an associated environment sequence is obtained after adjustment. For example, adjust the thread priority, modify the memory allocation policy, adjust the network conditions, etc.

[0039] Replay the environment sequence multiple times within the operating system and monitor whether the operating system triggers a race condition vulnerability. If the operating system triggers a race condition vulnerability, then regard this environment sequence as a trigger environment sequence, record the time of the race condition vulnerability, and store the trigger environment sequence. Adjust the environment variables again, and perform replays in sequence, thereby obtaining multiple trigger environment sequences.

[0040] Step S103: Based on the obtained trigger environment sequences, conduct cause analysis to obtain the causal relationships between each environmental variable and the condition race vulnerability.

[0041] Specifically, analyze the obtained multiple trigger environment sequences to draw conclusions related to the causes, such as necessity and relevance. Here, necessity refers to whether the trigger of the vulnerability requires this environmental variable, and relevance refers to whether this environmental variable affects the trigger probability of the vulnerability. Through a large amount of reliable data and multi-dimensional analysis conclusions, the causes of condition race vulnerabilities can be analyzed fairly and quickly.

[0042] In the embodiment of the present invention, by obtaining the set of environmental parameters of the operating system when the condition race vulnerability is triggered, adjusting the environmental variables in the set of environmental parameters, and replaying the adjusted set of environmental parameters, several trigger environment sequences for triggering the condition race vulnerability after replay are obtained. Based on the trigger environment sequences, cause analysis is conducted to obtain the causal relationships between each environmental variable and the condition race vulnerability. Compared with the existing static analysis method, the present invention is not limited by whether the source code can be obtained, and has greater universality and promotion value.

[0043] In some embodiments, step S102: Adjust the environmental variables in the set of environmental parameters, and replay the adjusted set of environmental parameters to obtain several trigger environment sequences for triggering the condition race vulnerability after replay, including:

[0044] Step S1021: Adjust the environmental variables in the set of environmental parameters through a reinforcement learning agent. The reinforcement learning agent includes a state space, an action space, and a reward function. The state space includes the current environment sequence generated according to the set of environmental parameters. The execution actions defined in the action space include the adjustment of the current environment sequence. The reward function determines the reward value according to the feedback index after the replay of the environment sequence after the execution action.

[0045] Step S1022: Replay the set of environmental parameters adjusted by the reinforcement learning agent to obtain several trigger environment sequences for triggering the condition race vulnerability after replay, and obtain the feedback index corresponding to the trigger environment sequence.

[0046] Specifically, the feedback index includes whether the condition race vulnerability is successfully triggered, the time required for reproduction, the length of the environment sequence required for reproduction, and the resource utilization rate.

[0047] Determine the reward value according to the feedback metrics corresponding to the environmental sequence after the execution of the action, including: if the environmental sequence after the execution of the action triggers a condition race vulnerability, the reward value is increased by a first preset value; for each unit time reduction in the time required to reproduce the condition race vulnerability, the reward value is increased by a second preset value; for each reduction in the environmental sequence length for reproducing the condition race vulnerability, a third preset value is increased; if the resource utilization rate for reproducing the condition race vulnerability is greater than the set resource value, the reward value is decreased by a fourth preset value.

[0048] Exemplarily, the first preset value is 50 points, the second preset value is 1 point, the third preset value is 2 points, and the fourth preset value is 5 points.

[0049] The reinforcement learning method is a method based on an agent learning how to take actions through interaction with the environment to maximize the cumulative reward. The reinforcement learning agent is an entity that can autonomously perceive the environment, make decisions, and take actions, with the goal of achieving a specific goal or task through interaction with the environment.

[0050] Determine the reward value based on the feedback metrics. Through these feedback metrics, the quality and effectiveness of the environmental sequence after the execution of the action can be comprehensively evaluated, guiding the reinforcement learning agent to adjust in a direction that is more conducive to triggering vulnerabilities and is efficient and resource-optimized, further improving the accuracy and efficiency of the vulnerability mining and analysis process.

[0051] In the embodiments of the present invention, the reinforcement learning agent is introduced to adjust the environmental variables. The reinforcement learning agent learns and makes decisions based on the state space, action space, and reward function, and can efficiently explore different environmental variable adjustment strategies, quickly find the environmental sequence that can trigger the condition race vulnerability, and improve the efficiency and accuracy of vulnerability mining.

[0052] At the same time, continuously optimizing and adjusting the strategy according to the feedback of the reward function helps to find the key vulnerability triggering conditions in the complex environmental parameter space, reducing the workload and time cost of manual debugging and experimentation.

[0053] In some embodiments, in step S103, perform a cause analysis based on the triggered environmental sequence to obtain the causal relationship between each environmental variable and the condition race vulnerability, including:

[0054] In step S1031, perform data preprocessing on all the triggered environmental sequences to obtain the dependency graph of the triggered environmental sequences.

[0055] The data preprocessing mainly performs time series alignment and data cleaning on the triggered environmental sequences that successfully trigger the condition race vulnerability. Specifically, the process of data preprocessing includes:

[0056] Perform time series alignment on all the trigger environment sequences. Performing time series alignment on the trigger environment sequences can eliminate the interference caused by time differences between different sequences, making the subsequent extraction of key environmental variables and change points more accurate.

[0057] Extract the key environmental variables and change points from the aligned trigger environment sequences. The key environmental variables are the environmental variables shared by multiple trigger environment sequences, and the change points are the values corresponding to the key environmental variables.

[0058] Construct a dependency graph of the trigger environment sequences based on the key environmental variables and change points. The dependency graph represents the causal relationship between the key environmental variables and their respective change points. By constructing the dependency graph, the dynamic change relationship and mutual dependence of environmental variables during the vulnerability trigger process can be clearly presented, providing a more accurate and valuable data basis for subsequent cause analysis, helping to more deeply understand the generation mechanism of the race condition vulnerability, and improving the depth and breadth of cause analysis.

[0059] Step S1032: Conduct a necessity analysis and a correlation analysis on each environmental variable based on the dependency graph to obtain the importance scores of each environmental variable.

[0060] Specifically, based on the dependency graph, count the inevitable relationship between each environmental variable and the triggering of the race condition vulnerability. If it appears in the specific value range of the environmental variable in all samples that successfully trigger the race condition vulnerability, the corresponding environmental variable is a necessary variable, and the necessity score is added to the importance score. Exemplarily, the necessity score is set to 5 points.

[0061] Calculate the correlation coefficient or information gain between each environmental variable and the success rate of triggering the race condition vulnerability based on the dependency graph, and add the correlation score to the importance score according to the correlation coefficient or the information gain. The range of the correlation coefficient is generally between 0 and 1, and the larger the value, the greater the correlation. Add the correlation score through the ranking of the correlation coefficient or information gain between the environmental variable and the success rate of triggering the race condition vulnerability. The correlation score can be set between 0 and 3 points. The larger the correlation coefficient or the higher the information gain ranking, the greater the correlation score.

[0062] The embodiment of the present invention evaluates the environmental variables from two dimensions of necessity and correlation and calculates the importance scores, which can more comprehensively and objectively reflect the importance ranking of each environmental variable in the generation of the race condition vulnerability.

[0063] Step S1033: Verify the causal relationship of each environmental variable from high to low according to the importance scores to obtain the causal relationship between each environmental variable and the cause of the race condition vulnerability.

[0064] Specifically, intervention testing is performed on high-score variables to verify causal relationships, a model is constructed to reveal the causal chain between variables, and counterfactual analysis is used to evaluate the degree of influence of variables on triggering outcomes.

[0065] In this method, when analyzing based on the dependency graph, environmental variables are evaluated from two dimensions of necessity and relevance respectively, and importance scores are calculated. Necessity analysis ensures that key environmental variables that play a decisive role in triggering vulnerabilities are not overlooked. Relevance analysis further quantifies the degree of association between environmental variables and vulnerability triggering. Combining the scores from these two aspects can more comprehensively and objectively reflect the importance ranking of each environmental variable in the generation of race condition vulnerabilities, providing a more instructive reference basis for subsequent targeted causal relationship verification and vulnerability repair strategy formulation.

[0066] The "use-after-free" vulnerability in the Linux kernel refers to the situation where in a multi-threaded environment, a certain thread still accesses a memory object after it has been freed, resulting in undefined behavior or system crashes. The following, in combination with Figure 2 、 Figure 3 and Figure 4 takes the "use-after-free" vulnerability in the Linux kernel as an example to illustrate the specific implementation process of the intelligent cause analysis method for race condition vulnerabilities of this application.

[0067] Step 1: Environmental monitoring and data collection

[0068] Apply the Hook technique to perform Hook on key system calls (such as kmalloc, kfree, mutex_lock, mutex_unlock) to monitor their calls and parameters, so as to record the following environmental variables:

[0069] CPU scheduling situation: the scheduling time and status (running, waiting) of each thread;

[0070] Memory status: the life cycle of allocated and freed memory blocks and objects;

[0071] Thread status: information on thread activity, blocking, and status transitions;

[0072] User interaction: record the timestamps and types of relevant operations (such as creating and destroying threads).

[0073] Step 2: Define the reinforcement learning agent

[0074] Create an independent program as the agent, which is responsible for adjusting environmental variables to trigger vulnerabilities. It includes the following content:

[0075] Define the state space, including: the current CPU scheduling state, the current memory usage, and the current thread state.

[0076] Construct the action space, which defines the actions that the intelligent agent can perform, such as adjusting thread priorities and modifying memory allocation policies.

[0077] Step 3: Design the reward function

[0078] The reward mechanism adopted by the reward function includes: successfully triggering a conditional competition vulnerability +50 points; reducing the time required for reproduction by one unit +1 point; reducing the length of each action sequence by one +2 points; if the resource consumption is too high (e.g., CPU usage exceeds the threshold) -5 points.

[0079] Step 4 Vulnerability reproduction process

[0080] Initialization: Initialize the reinforcement learning intelligent agent in Step 2, initialize the monitoring module, deploy Hook points, and establish a set of baseline environmental parameters;

[0081] Exploration phase: The reinforcement learning intelligent agent randomly selects actions for exploration, collects initial state-action-reward data, and then constructs a reinforcement learning model;

[0082] Iterative optimization: Obtain the reward value and update the model.

[0083] Reproduction verification: When the reinforcement learning intelligent agent triggers a vulnerability, record the complete trigger chain, verify the consistency of the trigger conditions multiple times, and record the trigger environment sequence and various environmental variable parameters during the reproduction process.

[0084] Step 5: Conduct root cause analysis based on the reproduction data

[0085] Data processing: Preprocess the reproduction data, including time series alignment of successful trigger samples, extraction of key environmental variables and their change points, and construction of a dependency graph of the trigger sequence, etc.

[0086] Necessity analysis: Adopt the single-variable control method, keep other environmental variables unchanged, change the target environmental variable and observe whether the vulnerability can still be triggered; apply the binary search method to each environmental variable to determine its value critical point; count the inevitable relationship between the variable and the trigger result in multiple experiments; calculate the necessity score, if the specific value range of this environmental variable appears in 100% of the successful samples, then mark it as "necessary" (+5 points).

[0087] Correlation analysis: Calculate the correlation coefficient between each environmental variable and the trigger success rate, apply the gain algorithm to evaluate the contribution of each variable to the trigger result, and construct a decision tree model to determine the importance ranking of variables. Among them, the correlation scoring rules include:

[0088] Correlation coefficient > 0.7 or information gain ranking in the top 20%: Highly correlated (+3 points);

[0089] Correlation coefficient between 0.3 - 0.7 or information gain ranking 20% - 50%: Moderately correlated (+2 points);

[0090] Correlation coefficient between 0.1 - 0.3 or information gain with statistical significance: Lowly correlated (+1 point);

[0091] Correlation coefficient < 0.1 and information gain without statistical significance: Unrelated (0 points);

[0092] Causality verification: Conduct an intervention test on high - score variables to verify causality, build a model to reveal the causal chain between variables, and evaluate the impact degree of variables on triggering results through counterfactual analysis.

[0093] The intelligent cause analysis method for conditional race vulnerabilities in the embodiments of the present invention has the following advantages:

[0094] The present invention obtains a set of environment parameters of the operating system when a conditional race vulnerability is triggered, and replays the adjusted set of environment parameters to obtain several trigger environment sequences for triggering the conditional race vulnerability after replay. Based on the trigger environment sequences, the cause - effect relationship is obtained through cause analysis. The present invention adopts dynamic analysis, can monitor and analyze programs during operation, is not restricted by whether the source code is available, has stronger applicability than traditional static analysis methods, can perform intelligent cause analysis of conditional race vulnerabilities for more software systems, and has more universality and promotional value.

[0095] Introducing reinforcement learning to automatically explore the reproduction environment, can automatically adjust environment variables and replay, obtain multiple successful trigger condition sequences, avoid the cumbersome and uncertainty of manual one - by - one attempts. The reinforcement learning agent automatically learns and optimizes the strategy of adjusting environment variables through mechanisms such as state space, action space, and reward function, realizes intelligent triggering, makes the cause analysis process more intelligent, and improves the accuracy and efficiency of analysis.

[0096] The test method for reproducing according to the recovery key conditions of a single type of conditional race vulnerability requires analysts to understand both business code and security vulnerability knowledge at the same time. Compared with the analysis conditions of probabilistic reproduction based on a single sample in a specific environment, the present invention analyzes the time series of successful trigger samples and the corresponding set of environment variables recorded by the trigger program, including necessity and correlation analysis, and then draws conclusions related to the cause, which has important significance for fairly and quickly analyzing the cause.

[0097] The embodiments of the present invention also provide an intelligent cause analysis device for conditional race vulnerabilities, as Figure 5 shown, including:

[0098] An environment variable acquisition module 501 is configured to acquire a set of environment parameters of an operating system when a trigger condition race vulnerability occurs. The set of environment parameters includes a number of environment variables.

[0099] An adjustment and replay module 502 is configured to adjust the environment variables in the set of environment parameters and replay the adjusted set of environment parameters to obtain a number of trigger environment sequences for triggering a condition race vulnerability after replay.

[0100] A cause analysis module 503 is configured to perform cause analysis based on the trigger environment sequences to obtain the causal relationship between each environment variable and the condition race vulnerability.

[0101] Further, the adjustment and replay module 502 includes:

[0102] An agent module is configured to adjust the environment variables in the set of environment parameters through a reinforcement learning agent. The reinforcement learning agent includes a state space, an action space, and a reward function. The state space includes a current environment sequence generated according to the set of environment parameters. The execution actions defined in the action space include adjustments to the current environment sequence. The reward function determines a reward value based on a feedback metric after replaying the environment sequence after the execution action.

[0103] A replay module is configured to replay the set of environment parameters adjusted by the reinforcement learning agent to obtain a number of trigger environment sequences for triggering a condition race vulnerability after replay and acquire the feedback metrics corresponding to the trigger environment sequences.

[0104] Further, the feedback metrics include whether a condition race vulnerability is successfully triggered, the time required for reproduction, the length of the environment sequence required for reproduction, and the resource utilization rate. Correspondingly, the agent module is further configured to:

[0105] If the environment sequence after the execution action triggers a condition race vulnerability, the reward value is increased by a first preset value. For each unit time reduction in the time required to reproduce the condition race vulnerability, the reward value is increased by a second preset value. For each reduction in the length of the environment sequence required to reproduce the condition race vulnerability by one, a third preset value is increased. If the resource utilization rate for reproducing the condition race vulnerability is greater than a set resource value, the reward value is decreased by a fourth preset value.

[0106] Further, the cause analysis module 503 includes:

[0107] A preprocessing module is configured to perform data preprocessing on all the trigger environment sequences to obtain a dependency graph of the trigger environment sequences.

[0108] A necessity and correlation analysis module is configured to perform necessity analysis and correlation analysis on each environment variable based on the dependency graph to obtain the importance scores of each environment variable.

[0109] A causality verification module, configured to verify the causality of each environmental variable from high to low according to the importance score, so as to obtain the causal relationship between each environmental variable and the cause of the conditional race vulnerability.

[0110] Further, the preprocessing module includes:

[0111] A sequence alignment module, configured to perform time series alignment on all the trigger environment sequences;

[0112] A key point extraction module, configured to extract key environmental variables and change points in the aligned trigger environment sequences;

[0113] A dependency graph construction module, configured to construct a dependency graph of the trigger environment sequences according to the key environmental variables and change points.

[0114] Further, the importance and correlation analysis module includes:

[0115] A necessity analysis module, configured to statistically analyze the inevitable relationship between each environmental variable and the trigger of the conditional race vulnerability based on the dependency graph. If it appears in the specific value range of the environmental variable in all samples that successfully trigger the conditional race vulnerability, the corresponding environmental variable is a necessary variable, and the importance score is increased by the necessity score;

[0116] A correlation analysis module, configured to calculate the correlation coefficient or information gain between each environmental variable and the success rate of triggering the conditional race vulnerability based on the dependency graph, and increase the correlation score for the importance score according to the correlation coefficient or the information gain.

[0117] Further, the environmental parameter set includes one or more environmental variables such as CPU scheduling situation, network situation, process - thread interaction situation, user operation interaction, and memory situation.

[0118] The embodiment of the present invention also provides a structural schematic diagram of a computer device, as Figure 6As shown, the computer device includes: one or more processors 10, a memory 20, and interfaces for connecting various components, including a high-speed interface and a low-speed interface. Each component communicates with each other using different buses and can be installed on a common motherboard or in other ways as needed. The processor can process instructions executed within the computer device, including instructions stored in the memory or on the memory to display graphical information of the GUI on an external input / output device (such as a display device coupled to the interface). In some alternative embodiments, if needed, multiple processors and / or multiple buses can be used together with multiple memories and multiple memories. Similarly, multiple computer devices can be connected, and each device provides part of the necessary operations (such as a server array, a set of blade servers, or a multi-processor system). In [the figure], a processor 10 is taken as an example.

[0119] The processor 10 can be a central processing unit, a network processor, or a combination thereof. Among them, the processor 10 can further include a hardware chip. The above hardware chip can be an application-specific integrated circuit, a programmable logic device, or a combination thereof. The above programmable logic device can be a complex programmable logic device, a field-programmable gate array, a generic array logic, or any combination thereof.

[0120] Among them, the memory 20 stores instructions executable by at least one processor 10, so that at least one processor 10 executes the method shown in the above embodiments.

[0121] The memory 20 can include a program storage area and a data storage area. Among them, the program storage area can store an operating system and application programs required for at least one function; the data storage area can store data created according to the use of the computer device, etc. In addition, the memory 20 can include a high-speed random access memory, and can also include a non-transitory memory, such as at least one disk storage device, a flash memory device, or other non-transitory solid-state storage devices. In some alternative embodiments, the memory 20 can optionally include a memory remotely set relative to the processor 10, and these remote memories can be connected to the computer device through a network. Examples of the above network include but are not limited to the Internet, an enterprise intranet, a local area network, a mobile communication network, and combinations thereof.

[0122] The memory 20 can include a volatile memory, such as a random access memory; the memory can also include a non-volatile memory, such as a flash memory, a hard disk, or a solid-state drive; the memory 20 can also include a combination of the above types of memories.

[0123] The computer device further includes an input device 30 and an output device 40. The processor 10, the memory 20, the input device 30, and the output device 40 can be connected through a bus or other means,Figure 6 Figure 6 Take the bus connection as an example.

[0124] The input device 30 can receive input digital or character information, and generate key signal inputs related to the user settings and function controls of the computer device, such as a touch screen, a keypad, a mouse, a trackpad, a touchpad, a pointing stick, one or more mouse buttons, a trackball, a joystick, etc. The output device 40 may include a display device, an auxiliary lighting device (e.g., an LED), and a haptic feedback device (e.g., a vibration motor), etc. The above display device includes, but is not limited to, a liquid crystal display, a light emitting diode, a display, and a plasma display. In some alternative embodiments, the display device may be a touch screen.

[0125] The embodiments of the present invention also provide a computer-readable storage medium. The method according to the embodiments of the present invention can be implemented in hardware, firmware, or be implemented as computer code that can be recorded on a storage medium, or be implemented by downloading through a network the original computer code stored in a remote storage medium or a non-transitory machine-readable storage medium and to be stored in a local storage medium, so that the method described herein can be stored as such software processing on a storage medium using a general-purpose computer, a dedicated processor, or programmable or dedicated hardware. Among them, the storage medium can be a magnetic disk, an optical disk, a read-only memory, a random access memory, a flash memory, a hard disk, or a solid-state drive, etc.; further, the storage medium can also include a combination of the above types of memories. It can be understood that a computer, a processor, a microprocessor controller, or programmable hardware includes a storage component that can store or receive software or computer code, and when the software or computer code is accessed and executed by the computer, the processor, or the hardware, the methods shown in the above embodiments are implemented.

[0126] A part of the present invention can be applied as a computer program product, such as computer program instructions, which when executed by a computer, can call or provide the methods and / or technical solutions according to the present invention through the operation of the computer. Those skilled in the art should be able to understand that the forms of existence of computer program instructions in a computer-readable medium include, but are not limited to, source files, executable files, installation package files, etc. Correspondingly, the ways in which computer program instructions are executed by a computer include, but are not limited to: the computer directly executes the instruction, or the computer compiles the instruction and then executes the corresponding compiled program, or the computer reads and executes the instruction, or the computer reads and installs the instruction and then executes the corresponding installed program. Herein, the computer-readable medium can be any available computer-readable storage medium or communication medium accessible by the computer.

[0127] Although embodiments of the present invention have been described in conjunction with the accompanying drawings, those skilled in the art can make various modifications and variations without departing from the spirit and scope of the present invention, and such modifications and variations all fall within the scope protected by the present invention.

Claims

1. An intelligent cause analysis method for conditional competition vulnerabilities, characterized in that Including: Obtain a set of environment parameters of the operating system when a trigger condition competition vulnerability occurs, where the set of environment parameters includes several environment variables; Adjust the environment variables in the set of environment parameters, and replay the adjusted set of environment parameters to obtain several trigger environment sequences for triggering the condition competition vulnerability after replay; Based on the trigger environment sequences, conduct a cause analysis to obtain the causal relationship between each environment variable and the condition competition vulnerability.

2. The intelligent cause analysis method for conditional competition vulnerabilities according to claim 1, characterized in that Adjust the environment variables in the set of environment parameters, and replay the adjusted set of environment parameters to obtain several trigger environment sequences for triggering the condition competition vulnerability after replay, including: Adjust the environment variables in the set of environment parameters through a reinforcement learning agent, where the reinforcement learning agent includes a state space, an action space, and a reward function. The state space includes the current environment sequence generated according to the set of environment parameters. The execution actions defined in the action space include the adjustment of the current environment sequence. The reward function determines the reward value according to the feedback metrics after the replay of the environment sequence after the execution of the action; Replay the set of environment parameters adjusted by the reinforcement learning agent to obtain several trigger environment sequences for triggering the condition competition vulnerability after replay, and obtain the feedback metrics corresponding to the trigger environment sequences.

3. The intelligent cause analysis method for conditional competition vulnerabilities according to claim 2, characterized in that, The feedback metrics include whether the condition competition vulnerability is successfully triggered, the time required for reproduction, the length of the environment sequence required for reproduction, and the resource utilization rate; Correspondingly, determining the reward value according to the feedback metrics corresponding to the environment sequence after the execution of the action includes: If the environment sequence after the execution of the action triggers the condition competition vulnerability, the reward value is increased by a first preset value. For each unit time reduction in the time required to reproduce the condition competition vulnerability, the reward value is increased by a second preset value. For each reduction in the length of the environment sequence for reproducing the condition competition vulnerability, a third preset value is increased. If the resource utilization rate for reproducing the condition competition vulnerability is greater than the set resource value, the reward value is decreased by a fourth preset value.

4. The intelligent cause analysis method for conditional competition vulnerabilities according to claim 1, characterized in that Based on the trigger environment sequences, conduct a cause analysis to obtain the causal relationship between each environment variable and the condition competition vulnerability, including: Perform data preprocessing on all the trigger environment sequences to obtain a dependency graph of the trigger environment sequences; Based on the dependency graph, conduct a necessity analysis and a correlation analysis on each environment variable to obtain the importance scores of each environment variable; According to the importance scores, conduct a causal relationship verification on each environment variable from high to low to obtain the causal relationship between each environment variable and the condition competition vulnerability.

5. The intelligent cause analysis method for conditional competition vulnerabilities according to claim 4, characterized in that Perform data preprocessing on all the trigger environment sequences to obtain a dependency graph of the trigger environment sequences, including: Perform time series alignment on all the trigger environment sequences; Extract the key environment variables and change points in the aligned trigger environment sequences; Construct a dependency graph of the trigger environment sequences according to the key environment variables and change points.

6. The intelligent cause analysis method for conditional competition vulnerabilities according to claim 5, characterized in that Based on the dependency graph, conduct a necessity analysis and a correlation analysis on each environment variable to obtain the importance scores of each environment variable, including: Statistically analyze the inevitable relationship between each environmental variable and the triggering condition competition vulnerability based on the dependency graph. If it appears in the specific value range of the environmental variable among all samples where the condition competition vulnerability is successfully triggered, the corresponding environmental variable is a necessary variable, and the importance score is increased by the necessity score value. Calculate the correlation coefficient or information gain between each environmental variable and the success rate of the triggering condition competition vulnerability based on the dependency graph, and increase the relevance score value for the importance score according to the correlation coefficient or the information gain.

7. The intelligent cause analysis method for conditional competition vulnerabilities according to claim 1, wherein The environmental parameter set includes one or more environmental variables such as CPU scheduling situation, network situation, process-thread interaction situation, user operation interaction, and memory situation.

8. An intelligent cause analysis device for conditional race vulnerabilities, characterized in that, It includes: An environmental variable acquisition module for acquiring the environmental parameter set of the operating system when the condition competition vulnerability is triggered, where the environmental parameter set includes several environmental variables; An adjustment and replay module for adjusting the environmental variables in the environmental parameter set and replaying the adjusted environmental parameter set to obtain several triggering environment sequences for triggering the condition competition vulnerability after replay; A cause analysis module for performing cause analysis based on the triggering environment sequence to obtain the cause relationship between each environmental variable and the condition competition vulnerability.

9. A computer device, characterized in that, It includes: A memory and a processor, which are communicatively connected to each other. The memory stores computer instructions, and the processor executes the computer instructions to execute the intelligent cause analysis method for the condition competition vulnerability according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, Computer instructions are stored on the computer-readable storage medium, and the computer instructions are used to cause the computer to execute the intelligent cause analysis method for the condition competition vulnerability according to any one of claims 1 to 7.

Images