Cross-language application program vulnerability mining method based on static analysis

Abstract

The invention discloses a cross-language application program vulnerability mining method based on static analysis, which adopts a nested cross-programming language pointer analysis method and a micro-service cross-programming language taint tracking method to effectively solve the limitation of processing nested cross-language control flow and micro-service cross-language data flow. A nested language semantic boundary is accurately positioned by constructing a nested byte code, and a data stream is completely tracked by utilizing an interface relay technology, so that the detection precision is improved. According to the method, part of multi-end data streams and complex control streams of cross-programming language applications can be uniformly processed, and the analysis process in a cross-programming language environment is simplified; by nesting cross-programming language control flow diagram construction and double-end / multi-end data flow diagram construction, a unified analysis framework is constructed, seamless cooperation of static analysis among different languages is achieved, the analysis cost is reduced, the analysis efficiency is improved, efficient and accurate vulnerability mining is achieved in a complex cross-programming language application program, and the method is suitable for application and popularization. And the reliability of cross-language vulnerability detection is improved.

Description

Technical Field

[0001] The present invention belongs to the field of Internet of Things security technology, and in particular relates to a cross-language application vulnerability mining method based on static analysis. Background Art

[0002] Cross-language applications leverage the characteristics of different programming languages to achieve efficient data exchange, function calls, and modular deployment to meet the needs of complex systems. They have been widely used in scenarios such as microservice architectures, nested systems, and collaborative computing of multi-language components. However, the complexity of designing, developing, and deploying cross-language applications also exposes them to more severe security threats and risks. Especially at the source code level, static analysis of cross-language applications is much more difficult than that of single-language applications. Existing static analysis methods and tools typically focus on a single language and lack analysis and understanding of cross-language call relationships, making it difficult to effectively capture security risks at language boundaries. With the increasing popularity of cross-language applications, how to overcome the analysis barriers caused by language isolation and achieve accurate vulnerability detection in cross-language applications has become an important research topic in the current software security field.

[0003] While existing static analysis methods can effectively detect security issues in single-language applications and have made some progress in control flow analysis and data flow analysis, when parsing nested cross-language applications, the execution logic of the main language calling the sub-language is highly dynamic. This makes it difficult for existing static analysis methods to accurately parse cross-language control flow and locate cross-language semantic boundaries, making vulnerabilities at language boundaries easily overlooked. When parsing microservice cross-language applications, multiple language instances exchange data via remote calls or message queues, making it difficult to maintain data flow integrity. This makes it difficult to statically discover vulnerabilities in microservice architectures. Therefore, syntax parsing, control flow modeling, and data flow tracing still face challenges such as unclear boundaries, information loss, and insufficient cross-end correlation. Summary of the Invention

[0004] To address the above-mentioned problems in the prior art, the present invention provides a cross-language application vulnerability mining method based on static analysis. The technical problem to be solved by the present invention is achieved through the following technical solutions:

[0005] The present invention provides a cross-language application vulnerability mining method based on static analysis, the method comprising:

[0006] Processing cross-programming language code using structural analysis, syntax analysis, and application dependency analysis to obtain corresponding cross-programming language feature categories; the cross-programming language feature categories include: nested cross-programming language applications and microservice cross-programming language applications;

[0007] Using a nested cross-language pointer analysis method based on control flow fusion, the cross-language code corresponding to the nested cross-language application is subjected to nested bytecode construction, cross-language bytecode translation, nested cross-language control flow graph construction, and pointer analysis to identify security vulnerabilities.

[0008] Using the microservice cross-programming language taint tracking method based on interface relay, we construct dual-end / multi-end data flow graphs and perform taint tracking on the cross-programming language codes corresponding to the microservice cross-programming language applications, and obtain vulnerabilities related to external malicious data.

[0009] The vulnerability accessibility and vulnerability hazard level of the security vulnerabilities and vulnerabilities related to external malicious data are verified to obtain the hazard level of each confirmed vulnerability.

[0010] In one embodiment of the present invention, cross-programming language code is processed using structural analysis, syntax analysis, and application dependency analysis to obtain corresponding cross-programming language feature categories, including:

[0011] Perform structural analysis on cross-programming language codes to obtain language features;

[0012] The language features are matched using syntax analysis. If the match is successful, the cross-programming language feature category corresponding to the cross-programming language code is obtained; if the match is unsuccessful, the language features are subjected to application dependency analysis using a preset feature dependency package to obtain the cross-programming language feature category corresponding to the cross-programming language code.

[0013] In one embodiment of the present invention, the preset feature dependency package includes:

[0014] Provides feature dependency packages for nested cross-programming language functions and feature dependency packages for microservice cross-programming language functions.

[0015] In one embodiment of the present invention, a nested cross-programming language pointer analysis method based on control flow fusion is used to perform nested bytecode construction, cross-programming language bytecode translation, nested cross-programming language control flow graph construction, and pointer analysis on the cross-programming language code corresponding to the nested cross-programming language application to obtain security vulnerabilities, including:

[0016] Performing nested bytecode construction processing on the main code and the nested code in the cross-programming language code corresponding to the nested cross-programming language application to obtain the nested bytecode;

[0017] Obtain a translation strategy table based on the bytecodes corresponding to the main code and the nested code, and use the translation strategy table to perform cross-programming language bytecode translation on the nested bytecode to obtain the main language bytecode;

[0018] By analyzing the main language bytecode, cross-programming language call points and control flow paths are extracted to obtain an updated cross-programming language control flow graph; using the pointer analysis method, data flow is transferred to the cross-programming language call points and control flow paths in each updated cross-programming language control flow graph, and the variable pointing status on each node is checked to obtain security vulnerabilities.

[0019] In one embodiment of the present invention, a translation strategy table is obtained based on the bytecodes corresponding to the main code and the nested code, including:

[0020] The differences between the bytecodes corresponding to the main code and the nested code are analyzed, and a translation strategy table is obtained according to the differences; the differences include: execution mechanism, memory management and calling convention.

[0021] In one embodiment of the present invention, by analyzing the host language bytecode, cross-language call points and control flow paths are extracted to obtain an updated cross-language control flow graph. A pointer analysis method is used to perform data flow transfer on each cross-language call point and control flow path in the updated cross-language control flow graph, and the variable pointing status on each node is checked to obtain security vulnerabilities, including:

[0022] Analyze the main language bytecode obtained after translation, identify the fusion points of cross-programming language communication, extract the pointer flow for each fusion point, merge the pointer flows of each cross-programming language at each fusion point, and obtain an updated cross-programming language control flow graph; perform pointer analysis on each updated cross-programming language control flow graph, check and compare the status of the variables pointed to on each node according to each cross-programming language call and data transfer path, and obtain security vulnerabilities.

[0023] In one embodiment of the present invention, a microservice cross-programming language taint tracking method based on interface relay is used to construct a dual-end / multi-end data flow graph and perform taint tracking processing on the cross-programming language code corresponding to the microservice cross-programming language application, thereby obtaining vulnerabilities related to external malicious data, including:

[0024] Select a dual-end data flow graph construction or a multi-end data flow graph construction according to the number of languages supported by the microservice application to process the cross-programming language code corresponding to the microservice cross-programming language application to obtain a dual-end cross-programming language data flow graph or a multi-end cross-programming language data flow graph;

[0025] Taint tracking is used to process a two-end cross-programming language data flow graph or a multi-end cross-programming language data flow graph to obtain vulnerabilities related to external malicious data.

[0026] In one embodiment of the present invention, a dual-end data flow graph construction or a multi-end data flow graph construction is selected according to the number of languages supported by the microservice application to process the cross-programming language code, thereby obtaining a dual-end cross-programming language data flow graph or a multi-end cross-programming language data flow graph, including:

[0027] Determine the number of languages supported by the microservice application. If the number of languages is 2, use the two-end data flow graph to construct a cross-programming language code corresponding to the microservice cross-programming language application to obtain a two-end cross-programming language data flow graph.

[0028] If the number of languages is greater than 2, a multi-terminal data flow graph is used to construct and process the cross-programming language code corresponding to the microservice cross-programming language application to obtain a multi-terminal cross-programming language data flow graph.

[0029] In one embodiment of the present invention, the vulnerability accessibility and vulnerability hazard level verification is performed on the security vulnerability and the vulnerability related to external malicious data to obtain the hazard level of each confirmed vulnerability, including:

[0030] Perform vulnerability accessibility verification on the security vulnerabilities and vulnerabilities related to external malicious data, verify whether each of the security vulnerabilities and vulnerabilities related to external malicious data can be exploited by an attacker, and screen out confirmed vulnerabilities;

[0031] The confirmed vulnerabilities are scored using the Common Vulnerability Scoring System standard to obtain the hazard level of each confirmed vulnerability.

[0032] Beneficial effects of the present invention:

[0033] In the solution provided by the present invention, a nested cross-programming language pointer analysis method based on control flow fusion and a microservice cross-programming language taint tracking method based on interface relay are adopted, which effectively solves the limitations of existing methods in processing nested cross-language control flow and microservice cross-language data flow; by constructing nested bytecodes to accurately locate the semantic boundaries of nested languages, and using interface relay technology to fully track data flows, thereby overcoming the information loss and analysis blind spots in existing methods, and improving the detection accuracy of cross-language application vulnerabilities. The present invention can uniformly process multi-terminal data flows and complex control flows of some cross-programming language applications, simplify the analysis process in a cross-programming language environment, and is different from the limitations of existing methods in processing type conversion, memory management and exception handling differences between multiple languages. The present invention constructs a unified analysis framework by nesting cross-programming language control flow graph construction and dual-end / multi-end data flow graph construction, realizing seamless collaboration of static analysis between different languages, reducing analysis costs, improving analysis efficiency, and realizing efficient and accurate vulnerability mining in complex cross-programming language applications, thereby improving the reliability of cross-language vulnerability detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] Figure 1 A schematic diagram of the steps of a cross-language application vulnerability mining method based on static analysis provided by an embodiment of the present invention;

[0035] Figure 2 A schematic diagram illustrating the principle of a cross-language application vulnerability mining method based on static analysis provided by an embodiment of the present invention;

[0036] Figure 3 A schematic diagram illustrating the principle of nested bytecode construction in a cross-language application vulnerability mining method based on static analysis provided by an embodiment of the present invention;

[0037] Figure 4 A schematic diagram of the principle of translating nested bytecodes using a translation strategy table in a cross-language application vulnerability mining method based on static analysis provided by an embodiment of the present invention;

[0038] Figure 5 A schematic diagram of the principle of constructing a two-end data flow graph in a cross-language application vulnerability mining method based on static analysis provided by an embodiment of the present invention;

[0039] Figure 6 A schematic diagram of the principles of constructing a multi-terminal data flow graph in a cross-language application vulnerability mining method based on static analysis provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0040] The present invention will be further described in detail below with reference to specific examples, but the embodiments of the present invention are not limited thereto.

[0041] The embodiment of the present invention provides a cross-language application vulnerability mining method based on static analysis, such as Figure 1 As shown, this may include:

[0042] S1, uses structural and grammatical analysis and application dependency analysis to process cross-programming language codes to obtain corresponding cross-programming language feature categories; cross-programming language feature categories include: nested cross-programming language applications and microservice cross-programming language applications.

[0043] For S1, we use structure and syntax analysis and application dependency analysis to process the cross-programming language code to obtain the corresponding cross-programming language feature categories, which may include:

[0044] S11, perform structural analysis on cross-programming language codes to obtain language features.

[0045] Specifically, the cross-language code corresponding to nested cross-language applications typically involves direct calls and memory sharing between languages, such as passing data through pointers and structures. In contrast, the cross-language code corresponding to microservice cross-language applications defines interfaces and data formats through network protocols (such as HTTP and gRPC), with clearer service boundaries. Therefore, when conducting structural analysis, these characteristics can be used to identify corresponding language features.

[0046] S12, use grammatical analysis to match language features, if the match is successful, obtain the cross-programming language feature category corresponding to the cross-programming language code; if the match is unsuccessful, use the preset feature dependency package to perform application dependency analysis on the language features, and obtain the cross-programming language feature category corresponding to the cross-programming language code.

[0047] Specifically, when using grammatical analysis to match language features, a key function feature set is defined based on the language features. Pattern string matching is then performed on the code using this key function feature set to determine the cross-language feature category to which the cross-language code belongs. For categories that cannot be confirmed through structural and grammatical analysis, application dependency analysis can be used. When using application dependency analysis, pre-set feature dependency packages may include: feature dependency packages that provide nested cross-language functionality and feature dependency packages that provide microservice cross-language functionality. Applications using nested cross-language functionality should rely on feature dependency packages that provide nested cross-language functionality; applications using microservice cross-language functionality should rely on feature dependency packages that provide microservice cross-language functionality. Collect at least 10 dependency packages of each type, ensuring that there are no duplicate names in the two types of dependency packages. Feature string sets are constructed based on the dependency package names. String matching is performed between the dependency package names and the dependencies used by the application. When the dependencies used by the application belong to a certain set, the application can be classified into the cross-language application category represented by that set.

[0048] By processing the cross-programming language code in step S1, the following can be obtained: Figure 2 The two feature categories shown are nested cross-programming language applications and microservice cross-programming language applications.

[0049] S2, using the nested cross-programming language pointer analysis method based on control flow fusion, performs nested bytecode construction, cross-programming language bytecode translation, nested cross-programming language control flow graph construction and pointer analysis on the cross-programming language code corresponding to the nested cross-programming language application, and obtains security vulnerabilities, such as Figure 2 As shown, this may include:

[0050] S21, performing nested bytecode construction processing on the main code and nested code in the cross-programming language code corresponding to the nested cross-programming language application to obtain a nested bytecode, such as Figure 3 As shown, this may include:

[0051] The main code and nested code in the cross-language code are compiled into independent bytecodes. Since the bytecode formats of different programming languages vary, the compiler generates bytecodes for the main code and nested code separately. Using nested bytecode construction technology, the bytecodes of the main code and nested code are parsed and the basic control structure is extracted to obtain the cross-language calling relationship. The bytecodes of the main code and the nested code are then integrated according to the cross-language calling relationship. That is, the bytecodes of the nested code are inserted into the corresponding positions of the bytecode of the main code according to the original logical order, constructing a unified nested control flow structure and obtaining the nested bytecode.

[0052] S22, obtaining a translation strategy table according to the bytecodes corresponding to the main code and the nested code, and performing a cross-programming language bytecode translation process on the nested bytecode using the translation strategy table to obtain the main language bytecode.

[0053] The translation strategy table obtained according to the bytecodes corresponding to the main code and the nested code in S22 may include:

[0054] Analyze the differences between the bytecodes corresponding to the main code and the nested code, and obtain a translation strategy table based on the differences; the differences include: execution mechanism, memory management and calling conventions.

[0055] After completing the independent compilation and fusion of bytecodes, we must also implement conversion between bytecodes of different languages. This begins by analyzing the differences in execution mechanisms, memory management, calling conventions, and other aspects of each language's bytecode. Based on these differences, we design a translation strategy table that records the conversion rules between different bytecode units for translation.

[0056] Use the translation strategy table to translate the nested bytecode to obtain the main language bytecode, such as Figure 4 Specifically, it may include:

[0057] During the transfer process, the bytecode of the nested code is located at the corresponding position of the main code bytecode according to the traversal of the control flow, and then converted into the target language (main language) bytecode according to the rules in the translation strategy table. Ultimately, seamless translation across programming language bytecodes is achieved.

[0058] S23, by analyzing the main language bytecode, extracting cross-programming language call points and control flow paths, and obtaining an updated cross-programming language control flow graph; using a pointer analysis method, performing data flow transfer on each cross-programming language call point and control flow path in the updated cross-programming language control flow graph, checking the variable pointing state on each node, and obtaining security vulnerabilities, which may include:

[0059] Analyze the translated bytecode, identify the fusion points of cross-programming language communication, extract the pointer stream for each fusion point, merge the pointer streams of each cross-programming language at each fusion point, and obtain an updated cross-programming language control flow graph; perform pointer analysis on each updated cross-programming language control flow graph, check and compare the status of the variables pointed to on each node according to each cross-programming language call and data transfer path, and obtain security vulnerabilities.

[0060] As you can understand, a control flow graph (CFG) needs to describe the call relationships, data transfer, and return jump logic between the main code and nested code. By analyzing the translated bytecode, we extract cross-language call points and control flow paths. When constructing a CFG, taking languages A and B as examples, we initialize the CFGs and corresponding bytecodes for languages A and B. We identify cross-language communication fusion points and extract pointer flows for each fusion point. At each fusion point, we merge the pointer flows from the two languages to generate a new CFG, updating the CFG. Pointer analysis is performed on each language's CFG to ensure that pointer analysis is feasible within a single language. Finally, the pointer flows from the two languages are merged to accurately represent each cross-language call and data transfer path. Pointer analysis methods are applied to ensure the correctness and completeness of data access and memory operations in the CFG across languages. Pointer analysis tracks the flow of data, such as pointers and references, and examines and compares the states of variables at each node in the CFG, thereby identifying potential security vulnerabilities such as memory leaks and buffer overflows.

[0061] When constructing an updated cross-language control flow graph, the algorithm parses the bytecodes of different languages into a unified control flow graph, addressing the lack of accurate control flow modeling in existing methods for nested cross-language applications. The algorithm initializes the control flow graphs for each language and generates the corresponding bytecodes. It then identifies cross-language boundaries as fusion points, merges the control flows of multiple languages at these fusion points, and updates the control flow graph. Pointer analysis is then verified on the control flow graphs of each language, and the pointer flows are subsequently merged. Based on this, pointer analysis methods are applied to identify vulnerabilities that arise during control flow transfers in nested cross-language applications.

[0062] By combining control flow graphs and pointer analysis, we ensure the accuracy and completeness of cross-language static analysis results. The specific algorithm for constructing nested cross-language control flow graphs is shown in Algorithm 1 below:

[0063]

[0064] As you can understand, for the cross-language code corresponding to nested cross-language applications, the present invention uses a nested cross-language pointer analysis method based on control flow fusion. This method can accurately identify the semantic boundaries of nested languages and, combined with bytecode translation strategies, achieve complete modeling of cross-language calls.

[0065] The nested cross-programming language pointer analysis method based on control flow fusion proposed in the embodiment of the present invention can handle the control flow incoherence between different programming languages and accurately parse the calling relationship between the main language and the sub-language. By constructing a cross-language control flow graph and combining it with the bytecode translation strategy, the calling relationship between different languages ​​is accurately mapped into a unified control flow graph, thereby accurately identifying potential vulnerabilities caused by cross-language call boundaries. It can effectively solve the problems of information loss and misjudgment that occur in traditional static analysis methods when dealing with nested cross-programming languages, and improve the accuracy and reliability of vulnerability analysis of nested cross-programming language applications.

[0066] S3 uses a microservice cross-programming language taint tracking method based on interface relay to construct a dual-end / multi-end data flow graph and perform taint tracking on the cross-programming language code corresponding to the microservice cross-programming language application. Vulnerabilities related to external malicious data are obtained, which may include:

[0067] S31, according to the number of languages supported by the microservice application, select a dual-end data flow graph construction or a multi-end data flow graph construction to process the cross-programming language code corresponding to the microservice cross-programming language application to obtain a dual-end cross-programming language data flow graph or a multi-end cross-programming language data flow graph.

[0068] For S31, this can include

[0069] Determine the number of languages supported by the microservice application. If the number of languages is 2, use the two-end data flow graph to construct a cross-programming language code corresponding to the microservice cross-programming language application to obtain a two-end cross-programming language data flow graph.

[0070] If the number of languages is greater than 2, a multi-terminal data flow graph is used to construct and process the cross-programming language code corresponding to the microservice cross-programming language application to obtain a multi-terminal cross-programming language data flow graph.

[0071] Specifically, in the process of obtaining a dual-end or multi-end cross-programming language data flow graph, a schematic diagram of the principle of constructing a dual-end data flow graph is shown as follows: Figure 5 As shown, the construction of a two-end data flow graph focuses on the processing of server-side and client-side data flows. It first locates the key input and output interfaces of each microservice. A termination node is inserted at the server-side output interface to ensure that the end of the data flow is clearly identified, thereby preventing the data flow from losing program state data at the end node. Simultaneously, the start node is reconstructed at the client-side input interface to ensure that external data flows can be accurately connected to the current analysis framework. This strategy enables seamless data flow from client to server and from server to client, breaking the common problem of discontinuous two-end data flows. A complete two-end cross-programming language data flow graph is constructed to ensure the analysis accuracy and consistency of cross-programming language data interactions. The data flow graph clearly reflects the data flow path between each microservice, supports tracking potential taint propagation paths during cross-coding language static analysis, and provides a foundation for subsequent taint analysis.

[0072] This two-end data flow graph construction technology addresses the lack of global analysis capabilities for microservice data flows across programming language applications by relaying two-end microservice data flows. It initializes the taint analysis environment on both ends of the microservice, identifies the taint source on both ends, and simultaneously propagates the taint. Through the interface relay, the taint flow status is continuously tracked and recorded. This allows for the discovery of vulnerabilities in microservices caused by incorrect communication data processing.

[0073] In actual applications, microservice applications usually support more than two languages. If you analyze such cross-programming language applications, you should build a multi-terminal cross-programming language data flow graph. If you directly migrate the dual-terminal data flow graph construction method to the multi-terminal cross-programming language data flow graph construction, the number of mappings between languages will increase exponentially, resulting in an exponential decrease in construction efficiency. In order to solve the complexity and efficiency problems of multi-terminal data flow graph construction, a schematic diagram of the principle of multi-terminal data flow graph construction is designed, as shown in the figure. Figure 6 As shown, the multi-terminal data flow graph construction technology uses an intermediate language as a unified representation to convert the data flow between the server and client sides into an intermediate language representation. Through the unified representation of the intermediate language, the data flow mapping between different language environments can be simplified, avoiding the direct processing of the data flow interface of each language. The intermediate language provides an abstraction layer that enables data flow graphs across programming languages to be constructed in a unified framework, alleviating the problem that some different programming languages cannot be coupled with each other. At the same time, the interface relay technology is used to optimize the connection of multi-terminal data flows, integrating the input and output data flows of all endpoints to form a complete multi-terminal data flow graph, thereby effectively improving the efficiency of multi-terminal data flow graph construction and reducing the computational complexity of data flow paths between cross-programming language services, thereby realizing complete data flow analysis across multiple terminals and programming languages, ensuring that data interactions in the microservice architecture are fully and accurately tracked.

[0074] S32, using taint tracking to process a two-end cross-programming language data flow graph or a multi-end cross-programming language data flow graph to obtain vulnerabilities related to external malicious data.

[0075] As you can understand, after constructing a dual-end / multi-end data flow graph and gradually integrating the input-output relationships between microservices to form a cross-language data flow path, taint analysis technology is needed to track cross-language data flows. The goal of taint analysis is to track and identify possible sources of potentially malicious data flowing from external input points (such as external APIs) to backend services. To apply taint tracking technology, taking a dual-end microservice application as an example, it is necessary to initialize the taint analysis context for both ends of the microservice (hereinafter referred to as end C and end D) and their respective endpoint data interfaces. After identifying the taint sources in microservices end C and end D, taint propagation is performed on each end, tracing the taint flow through the interface relay and recording the taint flow. Key endpoints in the data flow (such as API calls) are marked, and taint information is relayed between microservices A and B. The trace path is propagated across the ends, and all potentially affected data flows starting from the traced end are marked. Using this path information, we can trace the propagation path of suspicious data in turn to determine whether it has passed through any potentially dangerous nodes or unfiltered interfaces in the system. We can also further discover whether there are any vulnerabilities related to external malicious data, such as information leakage or injection, in the interactions between cross-programming language services. The cross-programming language taint tracking algorithm for dual-end microservices is shown in Algorithm 2 below:

[0076]

[0077] For the cross-programming language code corresponding to the microservice cross-programming language application, the microservice cross-programming language taint tracking method based on interface relay proposed in the embodiment of the present invention can effectively track the data flow path between different language components, identify potential limitations in the cross-programming language environment, and realize comprehensive vulnerability mining of multi-language collaborative applications, providing efficient and accurate analysis means for the security protection of cross-programming language applications.

[0078] The interface-relay-based microservice cross-programming language taint tracking method proposed in an embodiment of the present invention can accurately track the data flow paths between different language components in a microservice architecture. This method uses interface relay technology to construct a cross-language data flow graph, thereby achieving global taint tracking between microservices. This method can effectively detect the state of data flow taints transmitted in microservice cross-programming language applications, achieving static analysis of the entire microservice application, overcoming the shortcomings of existing single-end analysis tools, and improving the accuracy of cross-language vulnerability detection in microservice architectures.

[0079] S4: Verify the vulnerability reachability and vulnerability severity level of security vulnerabilities and vulnerabilities related to external malicious data, and obtain the severity level of each confirmed vulnerability, which may include:

[0080] S41, performs vulnerability reachability verification on security vulnerabilities and vulnerabilities related to external malicious data, verifies whether each of the security vulnerabilities and vulnerabilities related to external malicious data can be exploited by attackers, and screens out confirmed vulnerabilities.

[0081] Specifically, for security vulnerabilities detected by static analysis and vulnerabilities related to external malicious data, it is necessary to verify whether they can be exploited by attackers. Therefore, vulnerability reachability should be verified. The core of this verification is to assess whether the path from external input to the vulnerability point is feasible. This path can include various data flows, control flows, and interface interactions that may exist in the system. By simulating different attack paths and input methods, security vulnerabilities and vulnerabilities related to external malicious data that can be accessed by attackers through these paths and triggered to execute malicious actions are screened as confirmed vulnerabilities.

[0082] S42, scoring the confirmed vulnerabilities using the Common Vulnerability Scoring System standard to obtain a hazard level of each confirmed vulnerability.

[0083] After confirming that a vulnerability is accessible and has been identified, the severity level of the confirmed vulnerability needs to be further assessed. Confirmed vulnerabilities are scored according to the Common Vulnerability Scoring System 3.3 (CVSS 3.3) standard, taking into account factors such as the vulnerability's access complexity, scope of impact, and the conditions under which the vulnerability can be exploited by an attacker. This scoring accurately determines the potential risk of the vulnerability to the system, assesses the actual threat level of the confirmed vulnerability to system security, and derives the severity level of each confirmed vulnerability. The severity level of the confirmed vulnerability can then be used as a basis for vulnerability prioritization, providing data support for vulnerability remediation and response decisions.

[0084] Compared with the existing cross-programming language static analysis method based on intermediate representation conversion, the cross-language application vulnerability mining method based on static analysis proposed in the embodiment of the present invention adopts a nested cross-programming language pointer analysis method based on control flow fusion and a microservice cross-programming language taint tracking method based on interface relay, which effectively solves the limitations of the existing method in processing nested cross-language control flow and microservice cross-language data flow; by constructing nested bytecodes to accurately locate the semantic boundaries of nested languages, and using interface relay technology to fully track data flows, thereby overcoming the information loss and analysis blind spots in the existing methods, and improving the detection accuracy of cross-language application vulnerabilities. The present invention can uniformly process multi-terminal data flows and complex control flows of some cross-programming language applications, simplify the analysis process in a cross-programming language environment, and is different from the limitations of existing methods in processing type conversion, memory management and exception handling differences between multiple languages. The present invention constructs a unified analysis framework by nesting cross-programming language control flow graph construction and dual-end / multi-end data flow graph construction, realizes seamless collaboration of static analysis between different languages, reduces analysis cost, improves analysis efficiency, realizes efficient and accurate vulnerability mining in complex cross-programming language applications, and improves the reliability of cross-language vulnerability detection.

[0085] It should be noted that, in the description of the present invention, it should be understood that the terms "first" and "second" are used for descriptive purposes only and should not be understood to indicate or imply relative importance or implicitly specify the number of the technical features indicated. Therefore, a feature defined as "first" or "second" may explicitly or implicitly include one or more of the features. In the description of the present invention, "plurality" means two or more, unless otherwise specifically defined.

[0086] The above description is only a preferred embodiment of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of the present invention are included in the scope of protection of the present invention.

Claims

1. A cross-language application vulnerability mining method based on static analysis, characterized in that: include: Use structural analysis, syntax analysis, and application dependency analysis to process cross-programming language codes and obtain corresponding cross-programming language feature categories; The cross-programming language feature categories include: nested cross-programming language applications and microservice cross-programming language applications; Using a nested cross-language pointer analysis method based on control flow fusion, the cross-language code corresponding to the nested cross-language application is subjected to nested bytecode construction, cross-language bytecode translation, nested cross-language control flow graph construction, and pointer analysis to identify security vulnerabilities. Using the microservice cross-programming language taint tracking method based on interface relay, we construct dual-end / multi-end data flow graphs and perform taint tracking on the cross-programming language codes corresponding to the microservice cross-programming language applications, and obtain vulnerabilities related to external malicious data. The vulnerability accessibility and vulnerability hazard level of the security vulnerabilities and vulnerabilities related to external malicious data are verified to obtain the hazard level of each confirmed vulnerability.

2. A cross-language application vulnerability mining method based on static analysis according to claim 1, characterized in that: The cross-programming language code is processed using structural analysis, syntax analysis, and application dependency analysis to obtain corresponding cross-programming language feature categories, including: Perform structural analysis on cross-programming language codes to obtain language features; The language features are matched using syntax analysis. If the match is successful, the cross-programming language feature category corresponding to the cross-programming language code is obtained; if the match is unsuccessful, the language features are subjected to application dependency analysis using a preset feature dependency package to obtain the cross-programming language feature category corresponding to the cross-programming language code.

3. A cross-language application vulnerability mining method based on static analysis according to claim 1, characterized in that: The preset feature dependency package includes: Provides feature dependency packages for nested cross-programming language functions and feature dependency packages for microservice cross-programming language functions.

4. A cross-language application vulnerability mining method based on static analysis according to claim 1, characterized in that: The nested cross-programming language pointer analysis method based on control flow fusion is used to perform nested bytecode construction, cross-programming language bytecode translation, nested cross-programming language control flow graph construction, and pointer analysis on the cross-programming language code corresponding to the nested cross-programming language application, thereby obtaining security vulnerabilities, including: Performing nested bytecode construction processing on the main code and the nested code in the cross-programming language code corresponding to the nested cross-programming language application to obtain the nested bytecode; Obtain a translation strategy table based on the bytecodes corresponding to the main code and the nested code, and use the translation strategy table to perform cross-programming language bytecode translation on the nested bytecode to obtain the main language bytecode; By analyzing the main language bytecode, cross-programming language call points and control flow paths are extracted to obtain an updated cross-programming language control flow graph; using the pointer analysis method, data flow is transferred to the cross-programming language call points and control flow paths in each updated cross-programming language control flow graph, and the variable pointing status on each node is checked to obtain security vulnerabilities.

5. A cross-language application vulnerability mining method based on static analysis according to claim 4, characterized in that: The translation strategy table is obtained according to the bytecodes corresponding to the main code and the nested code, including: The differences between the bytecodes corresponding to the main code and the nested code are analyzed, and a translation strategy table is obtained according to the differences; the differences include: execution mechanism, memory management and calling convention.

6. A cross-language application vulnerability mining method based on static analysis according to claim 4, characterized in that: The method extracts cross-language call points and control flow paths by analyzing the main language bytecode to obtain an updated cross-language control flow graph; utilizes a pointer analysis method to perform data flow transfer on the cross-language call points and control flow paths in each updated cross-language control flow graph, checks the variable pointing status on each node, and obtains security vulnerabilities, including: Analyze the main language bytecode obtained after translation, identify the fusion points of cross-programming language communication, extract the pointer flow for each fusion point, merge the pointer flows of each cross-programming language at each fusion point, and obtain an updated cross-programming language control flow graph; perform pointer analysis on each updated cross-programming language control flow graph, check and compare the status of the variables pointed to on each node according to each cross-programming language call and data transfer path, and obtain security vulnerabilities.

7. The cross-language application vulnerability mining method based on static analysis according to claim 1, characterized in that: The interface relay-based microservice cross-programming language taint tracking method constructs a dual-end / multi-end data flow graph and performs taint tracking on the cross-programming language code corresponding to the microservice cross-programming language application, and obtains vulnerabilities related to external malicious data, including: Select a dual-end data flow graph construction or a multi-end data flow graph construction according to the number of languages supported by the microservice application to process the cross-programming language code corresponding to the microservice cross-programming language application to obtain a dual-end cross-programming language data flow graph or a multi-end cross-programming language data flow graph; Taint tracking is used to process a two-end cross-programming language data flow graph or a multi-end cross-programming language data flow graph to obtain vulnerabilities related to external malicious data.

8. A cross-language application vulnerability mining method based on static analysis according to claim 7, characterized in that: The method of selecting a dual-end data flow graph construction or a multi-end data flow graph construction according to the number of languages supported by the microservice application to process the cross-programming language code to obtain a dual-end cross-programming language data flow graph or a multi-end cross-programming language data flow graph includes: Determine the number of languages supported by the microservice application. If the number of languages is 2, use the two-end data flow graph to construct a cross-programming language code corresponding to the microservice cross-programming language application to obtain a two-end cross-programming language data flow graph. If the number of languages is greater than 2, a multi-terminal data flow graph is used to construct and process the cross-programming language code corresponding to the microservice cross-programming language application to obtain a multi-terminal cross-programming language data flow graph.

9. The cross-language application vulnerability mining method based on static analysis according to claim 1, characterized in that: Verify the vulnerability accessibility and vulnerability severity level of the security vulnerabilities and vulnerabilities related to external malicious data, and obtain the severity level of each confirmed vulnerability, including: Perform vulnerability accessibility verification on the security vulnerabilities and vulnerabilities related to external malicious data, verify whether each of the security vulnerabilities and vulnerabilities related to external malicious data can be exploited by an attacker, and screen out confirmed vulnerabilities; The confirmed vulnerabilities are scored using the Common Vulnerability Scoring System standard to obtain the hazard level of each confirmed vulnerability.

Images