A data stream analysis device and equipment

Abstract

This invention relates to the field of dynamic program analysis and provides a data flow analysis device and apparatus. The device includes: a data receiving module for acquiring instruction data and taint source information; a queue management module for storing instruction data into an instruction queue; an instruction decoding module for retrieving an instruction from the instruction queue as the current instruction, decoding the current instruction, and determining its code semantics; a taint calculation module for determining the taint propagation rules of the corresponding execution circuit, performing taint propagation calculations on the current instruction based on the execution circuit, and obtaining taint propagation data; a memory access interface for writing the taint propagation data into a memory-mapped taint record; and an exception output module for outputting taint source information at the location of the exception. This invention solves the problem that existing hardware-based taint propagation implementations only support single-source taint analysis and are inefficient, achieving high-performance multi-source dynamic taint propagation analysis based on a dedicated hardware module.

Description

Technical Field

[0001] This invention relates to the field of dynamic program analysis technology, and in particular to a data flow analysis device and equipment. Background Technology

[0002] Data flow analysis is a key technology in the field of dynamic program analysis, primarily used to trace the propagation path of data within a program, playing a crucial role, especially in security scenarios such as vulnerability discovery and malware detection. Traditional dynamic taint analysis techniques identify whether sensitive data (taint sources) affects critical operational nodes by marking them and tracking their flow during program execution. However, with increasing software complexity and diversified hardware architectures, existing technologies face significant challenges in high-performance and multi-source taint analysis.

[0003] Current mainstream dynamic taint analysis schemes are mainly divided into two categories: software-based and hardware-based. While software-based schemes offer greater versatility, they suffer from high instruction disassembly overhead and low taint propagation computation efficiency, making them unsuitable for scenarios with high real-time requirements. Hardware-based schemes, while improving computational speed, are limited by hardware resources; existing implementations only support single-source taint analysis and cannot distinguish between taint data from different sources, resulting in insufficient analysis accuracy. Furthermore, hardware schemes typically require compiler modifications or rely on specific CPU architectures, leading to poor versatility. Summary of the Invention

[0004] This invention provides a data stream analysis device and equipment, which solves the problem that the hardware-based taint propagation implementation in the prior art only supports single-source taint analysis and is inefficient, and realizes high-performance multi-source dynamic taint propagation analysis based on a dedicated hardware module.

[0005] This invention provides a data stream analysis device, comprising:

[0006] The data receiving module is used to acquire instruction data and taint source information;

[0007] The queue management module is used to store the instruction data into the instruction queue;

[0008] The instruction decoding module is used to retrieve an instruction from the instruction queue as the current instruction, decode the current instruction, and determine its code semantics;

[0009] The taint calculation module is used to determine the taint propagation rules of the corresponding execution circuit based on the code semantics; and to perform taint propagation calculation on the current instruction based on the execution circuit according to the taint propagation rules and the taint source information to obtain taint propagation data.

[0010] A memory access interface is used to write the taint propagation data into a memory-mapped taint record;

[0011] The exception output module is used to output the taint source information of the location where the exception occurred when all instructions in the instruction queue have been executed.

[0012] According to a data flow analysis apparatus provided by the present invention, the apparatus further includes: a shadow register group for temporarily storing the taint status of general-purpose registers.

[0013] According to a data stream analysis device provided by the present invention, the data receiving module includes a CPU pipeline mirror interface and a general-purpose peripheral interface; the CPU pipeline mirror interface is used to directly connect to the CPU instruction pipeline mirror interface in the mode where the data stream analysis device is used as a coprocessor; the general-purpose peripheral interface is used to receive instruction data through the general-purpose peripheral interface in the mode where the data stream analysis device is used as independent hardware.

[0014] The present invention also provides a data stream analysis method, comprising the following steps:

[0015] Acquire command data and taint source information;

[0016] Store the instruction data into the instruction queue;

[0017] Obtain an instruction from the instruction queue as the current instruction, decode the current instruction, and determine its code semantics;

[0018] The taint propagation rules of the corresponding execution circuit are determined based on the code semantics;

[0019] Based on the taint propagation rules and the taint source information, taint propagation calculations are performed on the current instruction using the execution circuit to obtain taint propagation data.

[0020] Write the taint propagation data into a memory-mapped taint record;

[0021] When all instructions in the instruction queue have been executed, the taint source information at the location where the exception occurred is output.

[0022] According to a data flow analysis method provided by the present invention, after storing the instruction data into an instruction queue, the method further includes: updating the queue counter.

[0023] According to a data flow analysis method provided by the present invention, when the instruction queue is full, instruction input is paused or the main central processing unit is paused until the instruction queue is processed.

[0024] According to a data stream analysis method provided by the present invention, after obtaining taint propagation data, the method further includes: synchronously writing the taint propagation data into a shadow register and a cache.

[0025] The present invention also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the data flow analysis method as described above.

[0026] The present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the data flow analysis method as described above.

[0027] The present invention also provides a computer program product, including a computer program that, when executed by a processor, implements the data flow analysis method as described above.

[0028] This invention provides a data flow analysis device and apparatus, which offers the following advantages: The collaborative operation of the data receiving module and the queue management module achieves efficient acquisition and buffering of instruction data, solving the problem of low instruction acquisition efficiency in traditional software solutions; the instruction decoding module directly parses instruction semantics using hardware circuitry, avoiding performance loss caused by software disassembly; the taint calculation module rapidly calculates multi-source taint propagation rules through hardware circuitry, not only supporting the differentiation of taint data from different sources but also significantly improving calculation speed; the memory access interface directly reads and writes taint records using memory mapping, reducing data exchange overhead; and the exception output module can quickly locate the source information of exception taints. Through the coordinated operation of its modules, the entire device achieves efficient and accurate multi-source dynamic taint analysis at the hardware level, overcoming the shortcomings of existing hardware implementations that only support single-source analysis and are inefficient, providing stronger technical support for program security analysis. Attached Figure Description

[0029] To more clearly illustrate the technical solutions in this invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0030] Figure 1 This is a schematic diagram of the data flow analysis device provided by the present invention.

[0031] Figure 2 This is a schematic diagram of the hardware implementation provided by the present invention.

[0032] Figure 3This is a schematic diagram of the hardware implementation provided by the present invention, which is accessed in the form of a coprocessor.

[0033] Figure 4 This is a schematic diagram of the hardware implementation provided by the present invention accessed in the form of independent hardware.

[0034] Figure 5 This is a flowchart illustrating the data flow analysis method provided by the present invention.

[0035] Figure 6 This is a data flow analysis logic flowchart based on a data flow analysis device provided by the present invention.

[0036] Figure 7 This is a schematic diagram of the structure of the electronic device provided by the present invention. Detailed Implementation

[0037] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without creative effort are within the scope of protection of this invention.

[0038] The English abbreviations and their English equivalents involved in this invention will be explained below.

[0039] A CFG (Control Flow Graph) is a graphical model used to represent all possible paths during the execution of a computer program, showing the control transfer relationships between basic program blocks.

[0040] DMA (Direct Memory Access) is a data transfer mechanism that allows specific hardware subsystems to read and write system memory directly, independently of the central processing unit, which can significantly improve data transfer efficiency.

[0041] FIFO (First In First Out) is a queue data structure that follows the rule that the data item that enters the queue first is processed first. It is often used in buffer and task scheduling scenarios.

[0042] IPI (Inter-Processor Interrupt) is an interrupt mechanism used for inter-core communication in multi-core processor systems, allowing one processor core to send an interrupt signal to other cores.

[0043] PCIe (Peripheral Component Interconnect Express) is a high-speed serial computer expansion bus standard used to connect motherboards to high-performance peripheral devices.

[0044] USB (Universal Serial Bus) is a widely used external bus standard used to regulate the connection and communication between computers and external devices.

[0045] Dcache (Data Cache) is a dedicated fast storage area in the processor used to temporarily store frequently accessed data, which can effectively reduce memory access latency.

[0046] opcode (Operation Code) is the part of a machine instruction that specifies the operation to be performed, and is used to instruct the processor to perform a specific operation or calculation.

[0047] addr (Address, address) is an identifier in computer architecture that refers to a specific data location in memory or a register.

[0048] Size (or size) in computer systems typically refers to the number of bytes occupied by a data block or storage area.

[0049] operand (Operand, operand) is the data or the identifier of the location of the data involved in the operation in the computer instruction. It can be an immediate value, a register, or a memory address.

[0050] The terminology involved in this invention will be explained below.

[0051] Data flow analysis: a technique used to collect information about the values ​​computed by a computer program at different points. A program's control flow graph (CFG) is used to determine which parts of the program a single assignment to a variable might propagate to.

[0052] Dynamic taint propagation analysis: a key technique for analyzing program robustness and vulnerability discovery. By marking sensitive or untrusted data, the flow of this tainted data during program execution can be observed, thereby determining whether the marked data affects critical nodes of the program.

[0053] Single-source dynamic taint propagation analysis: During program execution, external input data is marked with the same symbols, and its processing in the program is tracked. The data source is analyzed at the detection points specified by the analyst to determine whether the data processed at the monitoring points is related to the external input.

[0054] Multi-source dynamic taint propagation analysis: During program execution, data from multiple external inputs are labeled with different symbols to track their processing within the program. The data sources are analyzed at the detection points specified by the analysts to determine which data sources are related to the data processed at the monitoring points.

[0055] Extended hardware refers to additional hardware modules or structures introduced into a standard computing system to support specific application needs or enhance system capabilities. These extensions are typically not part of the processor or platform's basic configuration, but are characterized by customization and specialization, and are widely used in high-performance computing, embedded systems, security protection, and other fields.

[0056] Coprocessor: An auxiliary processor is a type of processor developed and used to assist the central processing unit (CPU) in performing tasks that it cannot perform or that are inefficient or ineffective.

[0057] Dynamic data flow analysis technology plays a crucial role in program security analysis and vulnerability detection. Its core principle is to achieve security monitoring by marking taint sources and tracing data propagation paths. Currently, this technology is mainly implemented in software and hardware, but both have significant limitations.

[0058] In terms of software implementation, the program execution process is mainly monitored through instrumentation tools or virtual machines. Although this method is highly versatile, it suffers from serious performance bottlenecks: First, the instruction disassembly process consumes a large amount of computing resources; second, instruction recognition and function dispatch require complex logical judgments; and finally, the set operations in the taint propagation process introduce extremely high time and space complexity, making it difficult for the software solution to meet the application scenarios with high real-time requirements.

[0059] Hardware implementations typically employ coprocessors or CPU extension modules to accelerate analysis and improve efficiency. However, existing hardware solutions suffer from two key drawbacks: first, limited by hardware resources, current implementations only support single-source taint analysis; that is, when marking taint sources, they can only distinguish whether the data is contaminated, but cannot identify taint data from different sources or locations. Second, during taint backtracking, they can only determine whether the data is contaminated, but cannot precisely pinpoint the exact offset location of the taint source. This lack of precision severely restricts the application value of hardware solutions in complex security analysis.

[0060] Ideally, taint propagation analysis should possess multi-source differentiation capabilities. This means assigning independent identifiers to data from different sources during the labeling phase, maintaining this differentiation throughout propagation, and ultimately accurately outputting the location information of taint sources affecting specific instructions. However, the industry currently lacks hardware implementations that can simultaneously meet high performance and high accuracy requirements, a technological gap that urgently needs to be filled. Especially in security applications requiring real-time monitoring and precise source tracing, developing hardware acceleration solutions that support multi-source analysis has become an urgent industry need.

[0061] Based on this, the technical problem that the present invention aims to solve is as follows:

[0062] 1. How to achieve fast reading and writing of large-scale taint status records.

[0063] 2. How to achieve data exchange and timing synchronization between the data flow analysis hardware and the main CPU.

[0064] 3. How to quickly calculate stain labels.

[0065] 4. How to solve the problem of asynchronous processing speeds between the main CPU and dedicated hardware.

[0066] 5. How to achieve data input and output between the main CPU and dedicated hardware, and acquire data without affecting the operation of the main CPU.

[0067] 6. How to implement input and output between the operating system and dedicated hardware.

[0068] 7. How to implement both standalone hardware and coprocessor access methods.

[0069] To address the aforementioned problems, this invention provides a hardware implementation scheme for high-performance data flow analysis. This scheme implements a complete set of dedicated hardware for data flow analysis. This hardware can exist as a standalone taint propagation computing device, or it can be connected to the main CPU as a coprocessor for parallel computing. The device's analytical capabilities are versatile, enabling taint propagation calculations for instruction sets of architectures such as x86, MIPS, and ARM, but not limited to x86, MIPS, and ARM.

[0070] The following is combined with Figures 1-7 The embodiments of the present invention are described in detail.

[0071] Figure 1 A schematic diagram of a data stream analysis device provided by the present invention includes:

[0072] Data receiving module 110 is used to acquire instruction data and taint source information;

[0073] The queue management module 120 is used to store the instruction data into the instruction queue;

[0074] The instruction decoding module 130 is used to retrieve an instruction from the instruction queue as the current instruction, decode the current instruction, and determine its code semantics;

[0075] The taint calculation module 140 is used to determine the taint propagation rules of the corresponding execution circuit based on the code semantics; and to perform taint propagation calculation on the current instruction based on the execution circuit according to the taint propagation rules and the taint source information to obtain taint propagation data.

[0076] Memory access interface 150 is used to write the taint propagation data into a memory-mapped taint record;

[0077] The exception output module 160 is used to output the taint source information of the location where the exception occurred when all instructions in the instruction queue have been executed.

[0078] According to a data flow analysis apparatus provided by the present invention, the apparatus further includes a shadow register group for temporarily storing the taint status of general-purpose registers.

[0079] According to a data stream analysis device provided by the present invention, the data receiving module 110 includes a CPU pipeline mirror interface and a general peripheral interface; the CPU pipeline mirror interface is used to directly connect to the CPU instruction pipeline mirror interface in the mode where the data stream analysis device is a coprocessor; the general peripheral interface is used to receive instruction data through the general peripheral interface in the mode where the data stream analysis device is independent hardware.

[0080] Specifically, Figure 2 The diagram shown is a schematic of the hardware implementation of this solution, which includes the following parts:

[0081] 1. Data Receiving Module. As the system's data entry point, it is responsible for receiving instruction data streams from the CPU pipeline or external devices in real time, ensuring the integrity and timeliness of the analyzed data.

[0082] 2. The queue management module includes a queue full signal notification interface. When the instruction buffer reaches its capacity threshold, this module will send a pause signal to the main CPU or input device through a hardware interrupt mechanism, effectively solving the problem of data processing speed mismatch.

[0083] 3. High-efficiency memory access interface, supporting dual-mode memory management, which can dynamically allocate taint recording areas in the host system memory space, and also access dedicated memory devices, providing a flexible storage solution for large-scale taint data analysis.

[0084] 4. A multi-level caching system, consisting of a tainted record cache and a shadow register, where the cache is responsible for caching recently accessed tainted data in memory, while the shadow register synchronizes the tainted status of general-purpose registers in real time, significantly improving data access efficiency.

[0085] 5. The taint calculation module adopts a parallel pipeline architecture and realizes fast calculation of wide-byte taint data based on preset propagation rules, supporting accurate differentiation and propagation of multi-source taints.

[0086] 6. Anomaly output module, which integrates a rule matching circuit, can monitor abnormal patterns in the process of taint propagation in real time and output alarm information through a dedicated interface.

[0087] 7. The taint calculation result query module provides instruction-level taint status query function and supports real-time acquisition of taint analysis results after instruction execution.

[0088] The hardware architecture of this invention supports two flexible deployment modes: it can be connected as a coprocessor to the CPU to perform parallel computing during CPU operation; or it can be used as independent hardware, accessing the hardware interface through the operating system to realize dynamic taint propagation computing.

[0089] like Figure 3 The diagram illustrates a coprocessor-based approach implemented through deep coupling with the CPU pipeline: it directly accesses the instruction decoding stage to obtain complete execution context information, including opcode, memory address, data size, and operands. A hardware-level synchronization mechanism is employed; when the instruction queue is full, main CPU execution is paused via inter-processor communication protocol, automatically resuming execution after data processing is complete, ensuring the accuracy of the timing analysis.

[0090] like Figure 4 The diagram illustrates a standardized external access solution via standalone hardware: it supports connection to host systems through high-speed interfaces such as PCIe and USB. It can receive binary instruction streams or dynamic taint data, making it suitable for offline analysis and cross-platform applications. Memory-mapped I / O and DMA technologies are employed for efficient data transfer, minimizing the impact on host performance. Input data includes instruction data and dynamic taint propagation data.

[0091] This invention systematically showcases the various technical advantages of the hardware architecture through a modular functional description approach, fully presenting the overall technical characteristics of the solution. The dual-mode deployment design supports both deep integration as a coprocessor into the CPU pipeline and flexible deployment as independent hardware, fully demonstrating the solution's high adaptability to different application scenarios. In terms of technical description, precise technical terminology is used to describe the interaction mechanisms and working principles of each functional module, enhancing the rigor and professionalism of the solution and making the internal data flow and control logic clearer and easier to understand. Particularly noteworthy are the key optimizations in the solution's multi-level caching system, parallel computing architecture, and efficient memory management mechanism, which significantly improve the overall system performance. These targeted optimizations demonstrate outstanding practical value and technical advantages in real-world applications.

[0092] The data flow analysis method provided by the present invention is described below. The data flow analysis method described below and the data flow analysis device described above can be referred to in correspondence.

[0093] Figure 5 This is a flowchart illustrating the data flow analysis method provided by the present invention, as shown below. Figure 5 As shown, the method includes the following steps:

[0094] S510: Obtain instruction data and taint source information.

[0095] Specifically, this is achieved through a multi-source data acquisition interface, which supports two operating modes: in coprocessor mode, it directly monitors the CPU instruction pipeline to obtain complete execution context information, including opcodes and operands, in real time; in independent hardware mode, it receives preprocessed instruction streams through a high-speed peripheral interface. Simultaneously, the taint source information acquisition module collects labeled data, including the address range of tainted memory regions, data length, and multi-level tags.

[0096] The dual-mode design enables the synchronous acquisition of instruction data and taint markers, providing a complete data foundation for subsequent accurate analysis. At the same time, the dual-mode acquisition scheme ensures the system's adaptability in different application scenarios.

[0097] S520. Store the instruction data into the instruction queue.

[0098] Specifically, the system uses a depth-configurable FIFO queue as an instruction buffer, and the queue capacity can be dynamically adjusted according to hardware resources. The storage process is managed by a dedicated DMA controller, enabling efficient data transfer.

[0099] Hardware-level queue management effectively solves the problem of data processing rate mismatch, providing a stable data supply for subsequent analysis modules. At the same time, DMA control significantly reduces CPU overhead.

[0100] According to a data flow analysis method provided by the present invention, after storing the instruction data into the instruction queue, the queue counter is updated.

[0101] Specifically, the queue status counter is implemented using hardware atomic operations and is automatically updated every clock cycle. The counter has multiple threshold detection points to reflect the queue load status in real time. This achieves accurate queue status monitoring, providing real-time data for flow control decisions, while the hardware-level counting mechanism avoids the performance overhead associated with software counting.

[0102] According to a data flow analysis method provided by the present invention, when the instruction queue is full, instruction input is paused or the main central processing unit is paused until the instruction queue is processed.

[0103] Specifically, the flow control module intelligently selects a control strategy based on the queue status: in standalone hardware mode, it directly controls the data source via hardware signal lines; in coprocessor mode, it interacts with the main CPU through the inter-processor interrupt (IPI) mechanism. This design achieves flow control without data loss, ensuring the integrity of the analysis, while the intelligent control strategy takes into account the characteristics of different working modes.

[0104] S530. Obtain an instruction from the instruction queue as the current instruction, decode the current instruction, and determine its code semantics.

[0105] Specifically, the instruction decoding employs a multi-stage pipeline architecture, comprising three stages: pre-decoding, semantic analysis, and micro-operation generation. Dedicated decoding circuitry supports multiple instruction sets, including x86 and ARM, completing complex instruction parsing in a single cycle. This design significantly improves decoding efficiency, enhancing performance compared to software solutions, while multi-architecture support strengthens the system's versatility.

[0106] S540. Determine the taint propagation rules of the corresponding execution circuit based on the code semantics; perform taint propagation calculation on the current instruction based on the taint propagation rules and the taint source information, and obtain taint propagation data.

[0107] Specifically, the system incorporates a programmable rule engine that stores propagation rules for different instruction types. The computation process employs a parallel processing unit array, supporting simultaneous tracking and precise calculation of multi-source taints. The rule engine provides flexible taint policy configuration capabilities, while hardware parallel computing achieves extremely high processing throughput, meeting the demands of real-time analysis.

[0108] S550, Write the taint propagation data into the memory-mapped taint record.

[0109] Specifically, memory writes employ a batch processing mechanism, using a 64-bit wide bus interface for efficient data transfer. Memory regions support dynamic mapping, allowing access to both host memory and dedicated storage devices. This design significantly reduces memory access latency, optimizes storage bandwidth utilization through batch writes, and provides a flexible memory mapping scheme to adapt to different system configuration requirements.

[0110] According to a data stream analysis method provided by the present invention, after obtaining taint propagation data, the taint propagation data is synchronously written into the shadow register and the cache.

[0111] Specifically, the system maintains a set of shadow registers that correspond one-to-one with the physical registers, as well as a multi-cascaded taint state cache. The update process is implemented through a dedicated data path and is executed in parallel with main memory writes. By storing frequently accessed taint states in nearby locations, the number of memory accesses is significantly reduced, which can lower storage access latency in typical application scenarios.

[0112] S560. When all instructions in the instruction queue have been executed, output the taint source information at the location where the exception occurred.

[0113] Specifically, the anomaly output module integrates all diagnostic data from the analysis process to generate a comprehensive report containing information such as taint propagation paths, source data offsets, and the scope of impact. The output supports multiple interfaces, including memory-mapped I / O and network transmission. This design provides complete analytical conclusions, and the byte-level taint localization capability offers valuable diagnostic information to security analysts.

[0114] like Figure 6 The diagram shown is a hardware implementation flowchart provided by the present invention, which mainly includes the following steps:

[0115] Step 1: Obtaining Command Information

[0116] The system acquires input instruction data in real time through the instruction information acquisition interface in the data receiving module. This interface has multi-source adaptation capabilities, supporting both receiving pre-processed instruction streams from dedicated data channels and directly monitoring the CPU instruction pipeline to obtain raw execution information, ensuring the comprehensiveness and real-time nature of data acquisition. Instruction information acquisition can be achieved not only through CPU pipeline mirroring but also through memory mapping, interrupt handling, and other methods.

[0117] Step 2: Instruction Buffer

[0118] The acquired instruction information is stored in an ordered instruction buffer queue, and the queue status counter is automatically incremented. This queue adopts a first-in, first-out (FIFO) management strategy and is equipped with an intelligent capacity monitoring mechanism to provide a stable data supply for subsequent processing stages.

[0119] Step 3: Obtaining information on the source of contamination

[0120] The system receives taint-marked data through the taint source information acquisition interface of the data receiving module. This key information includes the specific memory address range where the taint source is located, the data length, and the corresponding multi-level taint label, laying the foundation for subsequent accurate analysis. Taint information can be acquired not only through memory mapping, but also through interrupts, exceptions, DMA, and other methods.

[0121] Step 4: Instruction Decoding

[0122] The computing engine extracts instructions to be processed sequentially from the virtualized processing units and performs real-time parsing of the instructions through a dedicated hardware decoding circuit. This decoding circuit adopts a parallel processing architecture, which can complete the semantic parsing of complex instructions within a single clock cycle.

[0123] Step 5: Function Assignment

[0124] Based on the output of the decoding circuit, the system automatically routes the data to the corresponding functional processing circuit. This process is implemented through a hardware-level state machine, ensuring that instructions with different semantics can obtain the optimal processing path.

[0125] Step 6: Check the stain status

[0126] The decoding circuit further integrates a pre-built taint propagation rule base to intelligently query the taint status of registers and memory regions involved in the current instruction. This query process is accelerated by multi-level caching, significantly reducing access latency.

[0127] Step 7: Calculation of taint propagation

[0128] The core computing module integrates taint propagation rules and real-time taint status records to perform precise taint propagation calculations for the current instruction. This module employs a parallel computing unit design, supporting simultaneous processing and differentiated calculations for multi-source taints.

[0129] Step 8: Update the stain status record

[0130] The calculated taint propagation results are updated in real-time to the memory-mapped taint state record area via a high-speed memory access interface. This write process employs a batch commit mechanism to maximize storage efficiency. Taint record updates can be performed directly to memory or by rebuilding a DCache to implement the process.

[0131] Step 9: Flow control mechanism (independent hardware mode)

[0132] In independent hardware operation mode, when the queue counter reaches the preset threshold, the system immediately triggers the flow control mechanism, notifying the data source to suspend input through hardware signals, and automatically restarting data reception after processing capacity is restored.

[0133] Step 10: Pause request signals (coprocessor mode)

[0134] In coprocessor mode, when the queue is full, a precise pause request signal is sent to the main CPU. Synchronous control of the execution flow is achieved through inter-processor communication protocols to ensure the integrity of analysis and processing.

[0135] Step 11: Anomaly Detection and Output

[0136] The system continues to run until all instructions have been analyzed, or it immediately terminates upon detecting a preset anomaly pattern. When an anomaly is triggered, the system outputs a diagnostic report containing precise information about the location of the taint source through the anomaly output module, including key information such as the original offset address and propagation path of the affected data.

[0137] Through the above steps, the system can achieve real-time monitoring and taint analysis of the instruction stream, ensuring the security and accuracy of data processing.

[0138] This invention achieves a significant improvement in data flow analysis performance through several innovative hardware designs. In instruction processing, the system employs dedicated logic circuits for code disassembly, breaking through the traditional requirement of numerous software instructions to complete the disassembly process within a single clock cycle, greatly improving processing efficiency. Furthermore, through a mirror interface design of the CPU instruction pipeline, the system can directly obtain pipelined translated instruction information, completely bypassing the disassembly process and minimizing data processing latency. In function scheduling, the hardware logic circuit-based function implementation and dispatch mechanism replaces traditional complex conditional judgments and multi-layered switch structures, enabling instantaneous startup of the data flow tracing calculation mechanism and completely eliminating the inherent scheduling latency of software solutions. The core taint propagation calculation module is implemented entirely in hardware, completing complex multi-source taint propagation analysis within a single clock cycle through a parallel computing architecture. The system also features an intelligent instruction buffer queue, effectively mitigating the processing speed mismatch caused by differences in clock frequencies between different hardware modules. In addition, the data processing scheme based on register groups and multi-level caching has been specially optimized for high-frequency access data. Through proximity storage and fast access mechanisms, the data reading speed is improved by orders of magnitude compared with the traditional memory swapping method.

[0139] Figure 7 An example is a schematic diagram of the physical structure of an electronic device, such as... Figure 7As shown, the electronic device may include a processor 710, a communications interface 720, a memory 730, and a communication bus 740. The processor 710, communications interface 720, and memory 730 communicate with each other via the communication bus 740. The processor 710 can call logical instructions in the memory 730 to execute a data flow analysis method. This method includes: acquiring instruction data and taint source information; storing the instruction data in an instruction queue; retrieving an instruction from the instruction queue as the current instruction, decoding the current instruction, and determining its code semantics; determining the taint propagation rules of the corresponding execution circuit based on the code semantics; performing taint propagation calculations on the current instruction based on the taint propagation rules and taint source information, and obtaining taint propagation data; writing the taint propagation data into a memory-mapped taint record; and outputting the taint source information of the exception location when all instructions in the instruction queue have been executed.

[0140] Furthermore, the logical instructions in the aforementioned memory 730 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, essentially, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0141] On the other hand, the present invention also provides a computer program product, which includes a computer program that can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can execute the data flow analysis method provided by the above methods. The method includes: acquiring instruction data and taint source information; storing the instruction data in an instruction queue; retrieving an instruction from the instruction queue as the current instruction, decoding the current instruction, and determining its code semantics; determining the taint propagation rule of the corresponding execution circuit based on the code semantics; performing taint propagation calculation on the current instruction based on the taint propagation rule and taint source information, and obtaining taint propagation data; writing the taint propagation data into a memory-mapped taint record; and outputting the taint source information of the location where the exception occurred when all instructions in the instruction queue have been executed.

[0142] In another aspect, the present invention also provides a non-transitory computer-readable storage medium storing a computer program thereon. When executed by a processor, the computer program implements the data flow analysis method provided by the above methods. The method includes: acquiring instruction data and taint source information; storing the instruction data in an instruction queue; retrieving an instruction from the instruction queue as the current instruction, decoding the current instruction, and determining its code semantics; determining the taint propagation rule of the corresponding execution circuit based on the code semantics; performing taint propagation calculation on the current instruction based on the taint propagation rule and taint source information, and obtaining taint propagation data; writing the taint propagation data into a memory-mapped taint record; and outputting the taint source information of the location where the exception occurred when all instructions in the instruction queue have been executed.

[0143] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0144] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0145] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A data stream analysis device, characterized in that, include: The data receiving module includes a CPU pipeline mirror interface and a general peripheral interface, used to receive instructions from the CPU pipeline or external devices in real time, as well as to obtain taint source information. The queue management module includes a queue full signal notification interface, which is used to store the instruction data into the instruction queue. When the instruction buffer reaches the capacity threshold, a pause signal is sent to the main CPU or input device through a hardware interrupt mechanism. The instruction decoding module includes a hardware decoding circuit, used to retrieve an instruction from the instruction queue as the current instruction, decode the current instruction, and determine its code semantics; The multi-level caching system includes a taint record cache and a shadow register. The taint record cache is used to cache accessed memory tainted data, and the shadow register is used to synchronize the taint status of general-purpose registers in real time. The taint calculation module adopts a parallel pipeline architecture to determine the taint propagation rules of the corresponding execution circuit based on the code semantics; based on the taint propagation rules and the taint source information, it performs taint propagation calculation on the current instruction based on the execution circuit to obtain taint propagation data, supporting accurate differentiation and propagation of multi-source taints; The memory access interface supports dual-mode memory management and is used to write the taint propagation data into a memory-mapped taint record. It can dynamically allocate taint record areas in the host system memory space or access dedicated memory devices. The exception output module integrates a rule matching circuit to monitor exception patterns in the taint propagation process in real time. When all instructions in the instruction queue have been executed, the taint source information at the location where the exception occurred is output through a dedicated interface.

2. The data stream analysis device according to claim 1, characterized in that, The CPU pipeline mirror interface is used to directly connect to the CPU instruction pipeline mirror interface in the mode where the data flow analysis device is used as a coprocessor. The general peripheral interface is used to receive instruction data when the data flow analysis device is used as independent hardware.

3. A data stream analysis method, applied to the data stream analysis apparatus according to any one of claims 1-2, characterized in that, include: Acquire command data and taint source information; Store the instruction data into the instruction queue; Obtain an instruction from the instruction queue as the current instruction, decode the current instruction, and determine its code semantics; The taint propagation rules of the corresponding execution circuit are determined based on the code semantics; Based on the taint propagation rules and the taint source information, taint propagation calculations are performed on the current instruction using the execution circuit to obtain taint propagation data. Write the taint propagation data into a memory-mapped taint record; When all instructions in the instruction queue have been executed, the taint source information at the location where the exception occurred is output.

4. The data stream analysis method according to claim 3, characterized in that, After storing the instruction data into the instruction queue, the method further includes: Update the queue counter.

5. The data stream analysis method according to claim 4, characterized in that, When the instruction queue is full, instruction input is paused or the main central processing unit is suspended until the instruction queue is processed.

6. The data stream analysis method according to claim 3, characterized in that, After obtaining the taint propagation data, the method further includes: The taint propagation data is synchronously written to the shadow register and cache.

7. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the data flow analysis method as described in any one of claims 3 to 6.

8. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the data flow analysis method as described in any one of claims 3 to 6.

9. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the data flow analysis method as described in any one of claims 3 to 6.

Images