De-serialization utilization chain mining method for Dotnet
By combining code property graphs and large language models, the problem of automated verification of deserialization exploit chains in the .NET environment is solved, achieving efficient and accurate deserialization exploit chain mining and judgment, and improving the intelligence level of Web security analysis.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-11-20
- Publication Date
- 2026-03-13
AI Technical Summary
The lack of highly adaptable white-box analysis tools in the .NET environment makes it difficult to automatically verify deserialization exploit chains, and existing methods are not effective in discovering and identifying deserialization exploit chains.
Using code property graphs and a large language model, C# source code is generated through decompilation, an abstract syntax tree is generated and function bodies are standardized, a code property graph for .NET is constructed, and potential exploit chains are queried using the Neo4j database and predefined rules, and the large language model is used to determine validity.
It enables efficient and accurate discovery and identification of .NET deserialization exploit chains, improves the level of automation and the accuracy of vulnerability analysis, reduces the workload of manual auditing, and has good versatility and scalability.
Smart Images
Figure CN121658684A_ABST
Abstract
Description
Technical Field
[0001] This invention belongs to the field of Web security, specifically relating to a method for deserialization exploit chain mining for .NET. Background Technology
[0002] The widespread adoption of web applications has also brought significant security risks. Besides common vulnerabilities such as cross-site scripting (XSS), SQL injection, and server-side request forgery, deserialization vulnerabilities also pose a serious threat to web application security. In research methods for automated deserialization exploit chain mining, white-box exploit chain mining is a common approach. This involves combining white-box tools with taint analysis assistance, and finally verifying the results through manual code auditing. In the Java deserialization field, code attribute graphs are often used to mine deserialization exploit chains, but no research has applied code attribute graphs to .NET deserialization exploit chain mining. Furthermore, the C# language lacks widely applicable white-box underlying tools. Currently, the only available method is to generate an abstract syntax tree (AST) for the C# language using the official C# compiler. However, performing taint analysis on top of the AST is extremely difficult. Therefore, how to migrate code attribute graphs to .NET deserialization exploit chain mining, and how to determine the validity of deserialization exploit chains based on code attribute graphs, are pressing issues that need to be addressed. Summary of the Invention
[0003] The purpose of this invention is to propose a method for mining deserialization exploit chains in .NET. Based on the core methods of code attribute graphs and large language models, it aims to solve the problems of the lack of highly adaptable white-box analysis tools in the .NET environment and the difficulty of automated verification of deserialization exploit chains in the existing technology, so as to achieve the effect of efficiently and accurately mining and determining .NET deserialization exploit chains.
[0004] To achieve the above objectives, the present invention adopts the following technical solution.
[0005] A deserialization exploit chain mining method for Dotnet includes the following steps: 1) Use a decompilation tool to decompile the target .NET assembly into C# source code; 2) Generate an abstract syntax tree from the C# source code, and based on the abstract syntax tree, normalize the function bodies in the source code that appear in simplified syntax form into the traditional function format; 3) Parse the normalized C# source code to obtain the XML parsing result, parse and construct based on the XML parsing result, generate the .NET-oriented code property graph and store it in the Neo4j database; 4) Perform graph queries in the Neo4j database based on predefined Source and Sink rules to obtain potential deserialization exploit chains. Input the potential deserialization exploit chain, the source code of the involved functions, and the source code of the calling functions at one level into the large language model to judge the validity of the potential deserialization exploit chain.
[0006] Furthermore, the normalization described in step 2) is the process of expanding automatic properties, expression body members, or other simplified syntax forms into explicit getter / setter or ordinary methods.
[0007] Furthermore, step 3) involves parsing and constructing based on the XML parsing results, including: Iterate through the XML parsing results and construct all class nodes and method nodes, and set node attributes for each node; Identify implicit function call relationships and complete the method call edges for the corresponding implicit calls; Complete the call edges between method nodes based on the method call information obtained from explicit parsing; Based on the processing results of the above steps, a code property graph for .NET is generated.
[0008] Furthermore, the implicit function call relationships include calling functions of the current class through `this`, calling functions of the parent class through `base`, implicit getter and setter calls of properties, and call relationships generated by delegates.
[0009] Furthermore, the code attribute graph generated in step 3) includes an object relationship graph and a function call graph.
[0010] Furthermore, the predefined Source rules in step 4) include the class's serialization constructor, the class's setter and getter functions, and the class's parameterized constructor.
[0011] Furthermore, the predefined Sink rules in step 4) include functions for initiating DNS requests, file operation-related functions, functions for detecting server request forgery, serializer deserialization functions, and assembly loading functions.
[0012] Further, in step 4), the predefined Source rules and Sink rules are written as Cypher query statements for the Neo4j database. The Cypher query statements are executed in the Neo4j database to query potential deserialization exploit chains, and the queried potential deserialization exploit chains are converted into JSON format.
[0013] Furthermore, in step 4), prior knowledge is input simultaneously when inputting the large language model. This prior knowledge includes the auditing approach for deserialization exploitation chains, auditing precautions, and typical code examples.
[0014] Furthermore, step 4) involves the large language model determining the effectiveness of potential deserialization exploit chains, including: When Source is the serialization constructor of a class, the serialization information SerializationInfo info parameter of that constructor is identified as a controllable taint source, and all data subsequently obtained from info is considered a controllable taint. When Source is a setter or getter function, provide the large language model with the parameterless constructor of the class and all callable setter functions of the class to guide the model to complete the initial taint propagation analysis and determine which class properties are controllable taints. When Source is a parameterized constructor of a class, each parameter of the constructor is evaluated one by one: basic type parameters, including strings, are directly identified as controllable taints; for object type parameters, the parameterless constructor and setter methods of the object class are combined for further analysis to determine the controllable taint properties.
[0015] The present invention has achieved the following beneficial effects.
[0016] 1. This invention is the first to apply code attribute graphs to .NET deserialization exploit chain mining, realizing structured modeling of classes, methods and their calling relationships in C# source code, breaking through the limitation of the lack of underlying white-box analysis base in the existing .NET environment.
[0017] 2. This invention, by customizing Source and Sink rules and combining them with the Neo4j database for query analysis, can systematically uncover potential deserialization exploit chains, thus improving the automation level of vulnerability chain discovery.
[0018] 3. This invention utilizes a large language model combined with prior knowledge and source code context information to determine the validity of the discovered exploit chains, significantly reducing the workload of manual auditing and improving the accuracy and scalability of vulnerability analysis results.
[0019] 4. The unified modeling method based on code attribute graph proposed in this invention can adapt to different types of implicit function call relationships, including intra-class calls, parent class calls, attribute access and delegate calls, etc., and has good versatility and scalability.
[0020] 5. The overall process of this invention automates the processing of deserialization vulnerabilities from code parsing and structural modeling to exploit chain determination in the .NET environment, significantly improving the intelligence level of the Web security analysis and protection system. Attached Figure Description
[0021] Figure 1 This is an overall flowchart of a deserialization chain mining method according to the present invention.
[0022] Figure 2 A flowchart for parsing C# source code and generating code property graphs.
[0023] Figure 3 A flowchart for querying potential deserialization exploit chains and inputting them into a large language model for judgment.
[0024] Figure 4 This is an example diagram of a potential deserialization exploit chain found in the query. Detailed Implementation
[0025] To enable those skilled in the art to better understand the technical solutions in the embodiments of the present invention, and to make the objectives, features and advantages of the present invention more apparent and understandable, the present invention will be further described in detail below with reference to the accompanying drawings and embodiments.
[0026] This invention discloses a method for exploiting Dotnet deserialization chains, such as... Figure 1 As shown, it includes the following steps.
[0027] Step 100: Use the decompilation tool JetBrains dotPeek to decompile the target .NET assembly into C# source code for subsequent static analysis.
[0028] Step 200: Generate an Abstract Syntax Tree (AST) from the obtained C# source code using Roslyn (.NET compilation platform), and standardize the simplified syntax in the source code based on the AST. Convert the simplified function bodies in properties and methods into traditional function formats. For example, expand automatic properties and expression body members into explicit Getter / Setter functions or ordinary methods.
[0029] Here is an example of a common simplified syntax in C# functions: The following is an example of the result after normalization transformation: The above example clearly illustrates the changes before and after the normalization transformation.
[0030] Step 300: Use a parsing tool to parse the normalized C# source code, obtaining the XML parsing results of classes and methods. Process these results: through implicit function call relationship identification, generating class and method nodes, and constructing function call relationships, generate a .NET-oriented code property graph (including object relationship graph and function call graph), and persist the generated code property graph to the Neo4j database. Implicit function call relationships include, but are not limited to: calls to functions of the current class via `this`, calls to parent class functions via `base`, implicit getter / setter calls to properties, and call relationships generated by delegates.
[0031] Figure 2 The flowchart for using tools to parse C# source code and generate code property graphs is as follows.
[0032] Step 310: Use Doxygen (a source code parser / documentation generator) to parse the C# source code and generate an XML result file.
[0033] Step 320: Traverse and parse all generated XML files, construct all class nodes and method nodes, and set relevant attributes for the nodes.
[0034] Step 330: For the identified implicit call relationships, complete the corresponding implicit method call edges.
[0035] Step 340: Based on the parsed method call information, complete the call edges between method nodes.
[0036] Step 350: Store the final constructed code property graph in the Neo4j database.
[0037] Step 400: In Neo4j, retrieve potential deserialization exploit chains based on custom Source and Sink rules, and then submit the retrieval results to the DeepSeek-R1-0528 large language model to determine the validity of the exploit chains. The specific process is as follows... Figure 3 As shown, it specifically includes...
[0038] Step 410: Define the Source and Sink rules used for .NET deserialization vulnerability mining, and write the rules as Neo4j Cypher query statements.
[0039] Step 420: Execute the Cypher query above in Neo4j to obtain potential deserialization exploit chains.
[0040] Step 430: Convert the queried potential deserialization exploit chains into JSON format for easier subsequent processing and transmission.
[0041] Step 440: Based on extensive manual auditing and analysis experience, summarize the auditing ideas, precautions and typical code examples of several deserialization exploit chains, and provide this empirical prior knowledge as input to the large language model.
[0042] Step 450: Provide the source code of the functions involved in the entire exploit chain and the source code of the calling functions at one level to the large language model. Under the conditions of combining the aforementioned prior knowledge and the specific task settings, the large language model judges the validity of each potential deserialization exploit chain.
[0043] To facilitate accurate judgments by large language models, this invention further specifies processing strategies for different Source types, serving as prior knowledge and guidance for model input, including the following steps.
[0044] 1) Use the audit ideas, precautions and typical code examples summarized by manual auditing and analysis as prior knowledge input for the large language model.
[0045] 2) When Source is the serialization constructor of a class, the SerializationInfo info parameter of the constructor is regarded as a controllable taint source, and all data obtained from info thereafter is regarded as a controllable taint.
[0046] 3) When the Source is a Setter or Getter, the large language model should be guided to complete the initial taint propagation analysis first, and the parameterless constructor of the class and all callable setter functions of the class should be provided to determine which class properties can be regarded as controllable taints after processing.
[0047] 4) When Source is a parameterized constructor of a class, each parameter of the constructor should be judged one by one: For basic type parameters such as strings, they can be directly identified as controllable taints; for object type parameters, further analysis should be conducted in conjunction with the parameterless constructor and its setter methods of the object class to determine the controllable taint properties.
[0048] 5) Based on the above prior knowledge and strategies, the source code of the functions involved in the entire exploit chain and the source code of the calling functions at one level are provided to the large language model. The model then makes a comprehensive judgment on the exploit chain's exploitability, control flow / taint propagation, and potential impact under specific context conditions.
[0049] Figure 4 This example shows a potential deserialization exploit chain obtained from a Neo4j database query.
[0050] Table 1 below shows the results of deserialization exploit chain mining of .NET GAC using the method of this invention. The row headings on the left represent the source rules of the deserialization exploit chain, namely the class deserialization constructor, getter function, parameterized constructor (HasParamConstructor), and setter function; the column headings above represent the sink rules of the deserialization exploit chain, namely the assembly loading function (AssemblyLoad), the serializer deserializing function (Deserializing), the function that initiates DNS requests, the file operation related function (FILE), and the function that initiates server request forgery (SSRF).
[0051] Table 1 Results of reverse sequence mining The mining results in the table above are presented in the form of x / y / z, where z represents the total number of exploit chains, y represents the number of exploit chains that the large language model determines are actually effective and harmful, and x represents the number of actually effective exploit chains confirmed by manual auditing. After merging the reused chains, a total of 19 known deserialization exploit chains and 6 unknown exploit chains were identified.
[0052] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and not to limit it. Although the present invention has been described in detail using examples, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the spirit and scope of the technical solutions of the present invention, and all such modifications or substitutions should be covered within the scope of the claims of the present invention.
Claims
1. A deserialization exploit chain mining method for Dotnet, characterized in that, Includes the following steps: 1) Use a decompilation tool to decompile the target .NET assembly into C# source code; 2) Generate an abstract syntax tree from the C# source code, and based on the abstract syntax tree, normalize the function bodies in the source code that appear in simplified syntax form into the traditional function format; 3) Parse the normalized C# source code to obtain the XML parsing result, parse and construct based on the XML parsing result, generate the .NET-oriented code property graph and store it in the Neo4j database; 4) Perform graph queries in the Neo4j database based on predefined Source and Sink rules to obtain potential deserialization exploit chains. Input the potential deserialization exploit chain, the source code of the involved functions, and the source code of the calling functions at one level into the large language model to judge the validity of the potential deserialization exploit chain.
2. The method as described in claim 1, characterized in that, The normalization described in step 2) is the process of expanding automatic properties, expression body members, or other simplified syntax forms into explicit getter / setter or ordinary methods.
3. The method as described in claim 1, characterized in that, Step 3) involves parsing and constructing based on the XML parsing results, including: Iterate through the XML parsing results and construct all class nodes and method nodes, and set node attributes for each node; Identify implicit function call relationships and complete the method call edges for the corresponding implicit calls; Complete the call edges between method nodes based on the method call information obtained from explicit parsing; Based on the processing results of the above steps, a code property graph for .NET is generated.
4. The method as described in claim 3, characterized in that, The implicit function call relationships include calling functions of the current class via `this`, calling functions of the parent class via `base`, implicit getter and setter calls of properties, and call relationships generated by delegates.
5. The method as described in claim 1, characterized in that, The code property graph generated in step 3) includes an object relationship graph and a function call graph.
6. The method as described in claim 1, characterized in that, The predefined Source rules in step 4) include the class's serialization constructor, the class's setter and getter functions, and the class's parameterized constructor.
7. The method as described in claim 6, characterized in that, Step 4) The steps by which the large language model judges the effectiveness of potential deserialization exploit chains include: When Source is the serialization constructor of a class, the serialization information SerializationInfo info parameter of that constructor is identified as a controllable taint source, and all data subsequently obtained from info is considered a controllable taint. When Source is a setter or getter function, provide the large language model with the parameterless constructor of the class and all callable setter functions of the class to guide the model to complete the initial taint propagation analysis and determine which class properties are controllable taints. When Source is a parameterized constructor of a class, each parameter of the constructor is evaluated one by one: basic type parameters, including strings, are directly identified as controllable taints; for object type parameters, the parameterless constructor and setter methods of the object class are combined for further analysis to determine the controllable taint properties.
8. The method as described in claim 1, characterized in that, The predefined Sink rules in step 4) include functions for initiating DNS requests, file operation-related functions, functions for detecting server request forgery, serializer deserialization functions, and assembly loading functions.
9. The method as described in claim 1, characterized in that, In step 4), the predefined Source and Sink rules are written as Cypher query statements for the Neo4j database. The Cypher query statements are executed in the Neo4j database to query potential deserialization exploit chains, and the queried potential deserialization exploit chains are converted into JSON format.
10. The method as described in claim 1, characterized in that, In step 4), prior knowledge is input simultaneously when inputting the large language model. This prior knowledge includes the auditing approach for deserialization exploitation chains, auditing precautions, and typical code examples.