Deserialization utilization chain detection method based on static analysis and large model
By constructing the AMethod data structure and object structure graph based on static analysis and large language models, the problems of path explosion and high false negative rate in Java deserialization vulnerability detection are solved, achieving high-precision vulnerability detection. It can completely reconstruct the non-linear payload structure, improving the accuracy and efficiency of detection.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- BEIJING UNIV OF POSTS & TELECOMM
- Filing Date
- 2026-01-23
- Publication Date
- 2026-05-08
AI Technical Summary
Existing technologies for detecting Java deserialization vulnerabilities suffer from problems such as path explosion, high false positive rate, high false negative rate, and insufficient support for Java polymorphism and dynamic features. They are particularly ineffective when dealing with complex Java features and deep logical constraints.
By employing a static analysis and large language model (LLM) approach, we construct the AMethod data structure and object structure graph, combine taint splitting and pruning strategies to identify deserialization exploit chains, and use LLM to simulate the Java Virtual Machine execution process for semantic verification, thus solving the problems of path explosion and high false negative rate.
It achieves high-precision detection of Java deserialization vulnerabilities, reduces false positive and false negative rates, can completely reconstruct non-linear payload structures, accurately identify complex vulnerabilities, and improves detection accuracy and efficiency.
Smart Images
Figure CN121997337A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of network security and software vulnerability detection technology, specifically to a method for detecting deserialization exploit chains based on static analysis and large models. Background Technology
[0002] Java's serialization and deserialization mechanisms play a crucial role in inter-process communication (IPC), network data transmission, and persistent storage. However, insecure deserialization can lead to serious security problems. Attackers can construct malicious serialized objects (payloads) and trigger a series of method calls (i.e., a Gadget Chain) during deserialization, ultimately executing dangerous operations (such as remote code execution, denial of service, etc.).
[0003] Currently, the industry mainly uses the following automated detection technologies to detect such vulnerabilities: Pure static taint analysis techniques: represented by Gadget Inspector. This type of method traces tainted serialized data streams through static taint analysis and uses breadth-first search (BFS) to find the call path from the deserialization entry point (Source) to the sensitive function (Sink).
[0004] Static analysis combined with dynamic fuzzing techniques: represented by ODDFuzz, SerHybrid, and JDD. These methods attempt to combine the coverage of static analysis with the verification capabilities of dynamic testing. For example, SerHybrid uses pointer analysis to construct a call graph; ODDFuzz combines class hierarchy analysis (CHA) to generate latent chains and performs fuzzing verification; JDD employs bottom-up path search and uses the IOCD data structure to model the payload, finally verifying usability through fuzzing.
[0005] While the aforementioned existing technologies can detect vulnerabilities to some extent, they still have significant shortcomings when dealing with complex Java features and deep logical constraints, as specifically manifested as follows: (1) Path Candidate Explosion caused by polymorphic assignment: Existing static analysis tools (such as those based on the CHA algorithm) often employ a coarse-grained analysis strategy when dealing with Java polymorphism. When encountering polymorphic call points, these tools indiscriminately include all possible subclass implementations in their analysis. Due to the lack of domain-specific pruning strategies for serialization scenarios (e.g., failing to consider the non-serialization of fields modified by the `transient` keyword, or failing to filter non-Serializable classes), this full enumeration leads to an exponential explosion of analysis paths. This not only generates a massive number of invalid candidate chains, causing severe waste of computational resources, but also results in an extremely high false positive rate, making the analysis results contain a large number of practically unusable paths.
[0006] (2) Linear call graph analysis cannot identify "hidden objects" (Incomplete Payload Modeling): Existing analysis methods (such as ODDFuzz) primarily rely on tracing explicit method call paths to identify objects. However, when constructing complex payloads, non-linear object dependencies often exist. For example, some objects do not appear directly in the receiver or parameters of a method call, but exist as nested fields only to satisfy specific state conditions (such as in a HashMap attack chain, where specific auxiliary objects need to be constructed to trigger a hash collision). Existing linear call graph analysis cannot infer the necessity of these "hidden objects," resulting in incomplete payload structures that fail verification.
[0007] (3) Dynamic verification is limited by high false negatives caused by runtime "binary rigidity": When using fuzzing for dynamic verification (such as JDD), tools typically perform random mutations or simple rule-based mutations on object fields. However, the Java Runtime Environment (JVM) has extremely high rigidity (i.e., "binary rigidity"). Any minor serialization format error or type mismatch of irrelevant fields will cause the JVM to throw an exception (such as StreamCorruptedException) and terminate the deserialization process. This means that even if the core logic of the exploit is correct, verification will fail if the payload has flaws in non-critical parts. Furthermore, existing fuzzing methods struggle to infer complex path-sensitive constraints (such as hash collisions of specific field values, conditional branching if logic, etc.), and blind mutations are unlikely to meet these deep semantic requirements, resulting in a large number of truly exploitable vulnerability chains being incorrectly discarded (False Negative).
[0008] (4) Pointer analysis has insufficient support for reflection and dynamic characteristics: While some tools (such as SerHybrid) use pointer analysis to improve accuracy, they often struggle to precisely handle Java's reflection mechanism and dynamic proxy features. When mining open-source third-party libraries, the inability to accurately simulate the data flow under reflection calls can easily disrupt taint propagation, thus missing critical attack paths. Summary of the Invention
[0009] To address the aforementioned shortcomings in existing technologies, this invention provides a deserialization exploit chain detection method based on static analysis and large models. This method solves the problems of path explosion and high false positives caused by existing static analysis under polymorphic dispatch, incomplete payload construction caused by the inability to identify nonlinear dependencies in complex nested payloads, and high false negatives caused by the "binary rigidity" of traditional dynamic verification during runtime.
[0010] To achieve the aforementioned objectives, the technical solution adopted by this invention is: a deserialization exploit chain detection method based on static analysis and a large model, comprising: Obtain the deserialization entry point in the Java application to be tested; Identify all reachable paths from the deserialization entry point to the dangerous function call point in a Java application, and denote them as the exploit chain; Analyze and utilize the data dependencies of the chain to construct the AMethod data structure; Based on the AMethod data structure, infer the object structure graph; By using LLM as a “mini JVM” and combining it with the inferred object structure graph, partial symbolic execution and semantic verification are performed on the exploit chain.
[0011] The beneficial effects of this invention are as follows: 1. An object structure inference algorithm based on the association method (AMethod) can completely reconstruct the non-linear payload structure, including parallel objects and deeply nested fields, by analyzing data flow relationships.
[0012] 2. The Hierarchical Field-Aware P / Taint Analysis (HFPTA) adopted in this invention creates an independent taint state for each specific subclass of the polymorphic call point through taint-splitting, and combines class-pruning and absolute-fault-pruning strategies to filter out a large number of paths that do not conform to serialization specifications and have logical errors in the early stages of analysis.
[0013] 3. This invention employs an LLM-based "miniature JVM" simulation verification, elevating verification from the physical execution level to the logical semantic level. It eliminates the need to generate a perfectly byte-perfect payload; it can determine whether logical constraints such as conditional branches and type checks within the exploit chain can be satisfied through simulated execution. Attached Figure Description
[0014] Figure 1 The flowchart illustrates a deserialization exploit chain detection method based on static analysis and a large model, provided as an example. Detailed Implementation
[0015] The specific embodiments of the present invention are described below to enable those skilled in the art to understand the present invention. However, it should be understood that the present invention is not limited to the scope of the specific embodiments. For those skilled in the art, various changes are obvious as long as they are within the spirit and scope of the present invention as defined and determined by the appended claims. All inventions utilizing the concept of the present invention are protected.
[0016] like Figure 1 As shown, in one embodiment of the present invention, a deserialization exploit chain detection method based on static analysis and a large model includes the following steps: S1. Obtain the deserialization entry point in the Java application to be tested.
[0017] In this embodiment, the deserialization entry point in the Java application to be detected is obtained through static analysis or dynamic analysis methods.
[0018] S2. Identify all reachable paths from the deserialization entry point to the dangerous function call point in the Java application, and denote them as the exploit chain.
[0019] The specific method is as follows: S21. Using a static analysis framework (such as Soot), the bytecode corresponding to the Java application to be tested is converted into an intermediate representation (such as Jimple IR), and a call graph is constructed based on the intermediate representation. A call graph is a directed graph used to represent the call relationships between methods (functions) in a program. It shows nodes (methods / call points in the program) and edges (method call relationships, such as A calling B).
[0020] S22. Mark the deserialization entry point in the call graph as Source, and mark all potentially exploitable dangerous function call points (such as Runtime.exec, Method.invoke) in the call graph as Sink; S23. Based on the marked call graph, perform hierarchical field-aware P / Taint analysis to obtain the propagation path of tainted data from Source to Sink in the program statements.
[0021] include: Stain Split: When dealing with polymorphic call points, instead of blindly propagating the entire call, an independent tainted abstract state is created for each possible concrete class based on the specific set of pointers of the receiver.
[0022] The process identifies polymorphic call points in the Java application to be detected and obtains the concrete pointer set of the receiver. This concrete pointer set is obtained through static or dynamic analysis. For each concrete class in the concrete pointer set, it checks whether it satisfies serialization constraints. For concrete classes that satisfy serialization constraints, an independent tainted abstract state is created, and taint propagation is performed in this state. For concrete classes that do not satisfy serialization constraints, no tainted abstract state is created, and no taint propagation is performed. Serialization constraints specifically include: the class must implement the java.io.Serializable interface, must have an accessible constructor, and must not be prohibited from instantiation by the security manager.
[0023] Analysis of taint propagation: Monitoring method calls to tainted objects identifies access operations to object fields within those methods. A tainted object is an object originating from an untrusted external source that may be maliciously controlled by an attacker. When a method of this object is called or a field is accessed, it may trigger malicious behavior or spread malicious data. The tainted object refers to a Java object reconstructed through deserialization; these objects may be carefully crafted by attackers to trigger malicious actions.
[0024] For write operations on fields within a method, the propagation conditions of the object fields are checked to ensure they meet specific predefined propagation rules. These rules include: the field type is not a primitive type, the field is not marked as transient, or the field is marked as transient but assigned a value in `readObject`. `transient` is a Java keyword used to indicate that a member variable is not part of the object's serialization. In Java programming, the `transient` keyword is primarily used in object serialization scenarios. When an object needs to be serialized (i.e., converted to a byte stream for saving to a file or transmitting over a network), fields modified with `transient` will not be serialized. `readObject` is the core deserialization method in Java's serialization mechanism; it's a magic method that converts a byte stream back into an in-memory object, responsible for reading serialized data and reconstructing a complete Java object.
[0025] Propagate taints to fields within an object that satisfy specific predefined propagation rules, thus establishing a taint propagation chain.
[0026] In the hierarchical field-aware P / Taint analysis process, pruning strategies are applied for analysis optimization. These pruning strategies specifically include: Class-level pruning: During taint splitting, filter out concrete classes that do not meet serialization requirements; the filtering criteria include: excluding concrete classes that cannot be instantiated (abstract classes, interfaces), excluding concrete classes that do not implement the java.io.Serializable interface, and excluding primitive data types and primitive data arrays; Absolute error pruning: During the search of propagation paths, paths with predefined invalid behavior patterns are eliminated, including: paths containing meaningless general methods (such as Object.hashCode), paths with redundant recursion or repeated calls, and paths that violate predefined strong constraints (such as paths that must meet the HashMap hash collision condition but whose class characteristics are obviously inconsistent).
[0027] By introducing taint propagation rules based on object fields (such as this-to-this.field) and taint-splitting techniques for polymorphic call points, combined with domain-specific pruning strategies (such as class-pruning), different specific types of taint states can be accurately distinguished during the static analysis phase. This significantly reduces the generation of invalid candidate chains and improves the accuracy of the analysis while covering the deserialization-specific data stream.
[0028] S3. Analyze and utilize the data dependencies of the chain to construct the AMethod data structure; based on the AMethod data structure, infer the object structure graph.
[0029] The specific method is as follows: S31. For each method call point in the utilization chain, analyze the definition location and source of the receiver object and parameter object in the container method to obtain the AMethod data structure. AMethod is used to describe the source relationship between the variables (receivers and parameters) at the call point and the variables in the container method.
[0030] S32. Link the multiple AMethod data structures in the chain according to the calling order to form an associated method path AMethod Path; S33. Using a backward traversal algorithm, the object structure graph is gradually constructed from the dangerous function call point Sink towards the deserialization entry point Source, based on the associated method path AMethod Path.
[0031] S331. Initialize the object structure diagram, with the Source object as the root node; S332. Traverse each method in the associated method path AMethod Path and determine the relationship between the current method and the declaration class of the previous method: S333. If the current method has the same declared class as the previous method, then perform an internal traversal of the object: when the associated type is this.field, add a new field node under the current object node. this.field represents the field of the current object.
[0032] S334. If the current method is different from the declared class of the previous method, then perform object traversal: based on the parameter association, identify the hidden objects that must exist to satisfy the method call conditions, and instantiate new object nodes or field nodes in the object structure graph. S335. Continue traversing all associated method paths (AMethod Path) to generate a complete deserialization exploit chain object structure graph.
[0033] In the process of constructing the object structure graph, inference-level pruning is performed: if it is found that the receiver of a certain call point is of unknown origin and is a non-critical class, the exploit chain corresponding to the call point is determined to be invalid and pruning is performed.
[0034] This invention models the relationship between call point receivers and parameters by constructing the AMethod data structure, and uses an information flow inference algorithm to transform the linear method call chain into a hierarchical object structure graph. This invention can automatically identify and complete "hidden objects" and parallel branches that are easily missed by existing linear analysis, ensuring that the generated payload structure can satisfy the deep dependencies required for vulnerability triggering.
[0035] S4. Using LLM as a “mini JVM”, and combining the inferred object structure graph, perform partial symbolic execution and semantic verification on the exploit chain.
[0036] include: Precise code context extraction: Using an abstract syntax tree parser, for each specific class involved in the exploit chain, only the code fragments related to the execution of that exploit chain are extracted to generate the target code context; the target code context includes the source code of the methods involved in the chain execution, relevant field descriptions, and class constructors; Utilize the chain to perform simulation: Input the target code context, object structure graph and exploit chain into the LLM, so that the LLM can perform simulation execution based on the thought chain protocol; only when the LLM successfully simulates and verifies to the Sink point and no logical interruption occurs, the exploit chain is marked as "exploitable" and the corresponding verification trajectory is output.
[0037] LLM's analysis of each method call in the chain includes: Context recognition: Identifies the currently executing object instance and method; Path analysis: Based on source code analysis, path-sensitive constraints (such as if conditions, loop conditions, NOT NULL checks, type conversions, etc.) are required to enter the next method call. State verification: Compare with the object structure diagram and check whether the object types, field values and reference relationships defined in the object structure diagram meet the path sensitivity constraints. If they do, the state verification is passed. State transition determination: If the state verification passes, output "Success" and proceed to the next method; if the state verification fails, output "Failure" and terminate the verification.
[0038] Leveraging the code understanding and logical reasoning capabilities of a large language model, this method simulates the execution process of a Java Virtual Machine (Micro-JVM). By extracting the critical code context (PCCE) and combining it with the inferred object structure, it performs step-by-step semantic verification of potential exploit chains. This approach overcomes the "binary rigidity" barrier of traditional runtime verification, directly verifying whether path-sensitive constraints (such as conditional branches and logical operations) are logically satisfyable. Therefore, it efficiently and accurately confirms the validity of vulnerabilities without needing to generate perfect binary streams.
[0039] Through the above steps, this invention can accurately identify structurally complete and semantically feasible Java deserialization exploit chains from massive amounts of code, effectively solving the problems of path explosion and false positives and false negatives.
[0040] To verify the effectiveness of the method proposed in this invention, a comparative experiment was conducted with Gadget Inspector, ODDFuzz, and SerHybrid.
[0041] Traditional methods rely on linear call graph tracing, which fails to identify "hidden objects" within the payload that exist to satisfy specific states, leading to incomplete payload modeling and consequently, missed detections. This invention's unique object structure inference algorithm based on the association method (AMethod) can fully reconstruct the non-linear payload structure, including parallel objects and deeply nested fields, by analyzing data flow relationships. In the ysoserial benchmark test, this invention successfully identified 150 correct exploit chains, while the best-performing baseline tool, ODDFuzz, only identified 16. Simultaneously, the invention's false negative rate (FNR) was reduced to 29.4%, significantly lower than ODDFuzz's 52.9% and Gadget Inspector's 91.2%, demonstrating its superior ability to discover complex and hidden vulnerabilities.
[0042] Traditional methods employ coarse-grained Class Hierarchy Analysis (CHA), leading to path explosion and a massive number of false positives. This invention utilizes Hierarchical Field-Aware P / Taint Analysis (HFPTA), which creates independent taint states for each specific subclass of the polymorphic call point through taint-splitting. Combined with class-pruning and absolute-fault-pruning strategies, it filters out a large number of paths that do not conform to serialization specifications and contain logical errors early in the analysis process. According to experimental data, this invention achieves a detection accuracy of 88.2%. In comparison, Gadget Inspector's accuracy is only 2.45%, ODDFuzz's is 2.74%, and SerHybrid's is 22.2%. This demonstrates that this invention can accurately identify truly exploitable vulnerabilities from a massive number of candidate chains, significantly reducing the cost and burden of manual verification.
[0043] Traditional dynamic fuzz testing has extremely stringent requirements for the byte format of the payload (binary rigidity). Any insignificant format error can cause verification to fail, and it is difficult to satisfy complex path-sensitive constraints. This invention uses an LLM-based "miniature JVM" to simulate verification, elevating the verification from the physical execution level to the logical semantic level. It does not require generating a perfectly byte-perfect payload; it can determine whether logical constraints such as conditional branches and type checks in the exploit chain can be satisfied through simulated execution.
[0044] In summary, this invention not only far surpasses existing technologies in terms of detection precision and recall, but also breaks through the limitations of traditional dynamic verification through an innovative semantic verification method, providing a more accurate, comprehensive, and robust technical solution for Java deserialization vulnerability detection.
Claims
1. A deserialization exploit chain detection method based on static analysis and a large model, characterized in that, include: Obtain the deserialization entry point in the Java application to be tested; Identify all reachable paths from the deserialization entry point to the dangerous function call point in a Java application, and denote them as the exploit chain; Analyze and utilize the data dependencies of the chain to construct the AMethod data structure; Based on the AMethod data structure, infer the object structure graph; By using LLM as a "mini JVM" and combining it with the inferred object structure graph, partial symbolic execution and semantic verification are performed on the exploit chain.
2. The method according to claim 1, characterized in that, The specific method for identifying all reachable paths from the deserialization entry point to dangerous function call points in a Java application is as follows: A static analysis framework is used to convert the bytecode of the Java application to be tested into an intermediate representation, and a call graph is constructed based on the intermediate representation. Mark the deserialization entry point in the call graph as Source, and mark all potentially exploitable dangerous function call points in the call graph as Sink; Based on the tagged call graph, perform hierarchical field-aware P / Taint analysis to obtain the propagation path of tainted data from Source to Sink in program statements.
3. The method according to claim 2, characterized in that, Hierarchical field-aware P / Taint analysis specifically includes: Stain Split: Identify polymorphic call points in the Java application to be detected and obtain the specific pointer set of the receiver; the specific pointer set is obtained through static analysis or dynamic analysis. For each concrete class in the concrete pointer set, check whether it satisfies the serialization constraint. Create an independent tainted abstract state for concrete classes that satisfy the serialization constraint and perform taint propagation in this state. For concrete classes that do not satisfy the serialization constraint, do not create a tainted abstract state or perform taint propagation. Analysis of taint propagation: Monitor method calls of tainted objects and identify access operations on object fields within the methods; For write operations on fields within a method, check whether the propagation conditions of the object field conform to a pre-defined specific propagation rule; Propagate taints to fields within an object that satisfy specific predefined propagation rules, thus establishing a taint propagation chain.
4. The method according to claim 3, characterized in that, The conditions for satisfying the preset specific propagation rules include either condition one or condition two; condition one is: the field type is not a primitive type and the field is not marked as transient; condition two is: the field is marked as transient but is assigned a value in readObject.
5. The method according to claim 3, characterized in that, In the hierarchical field-aware P / Taint analysis process, pruning strategies are applied for analysis optimization. These pruning strategies specifically include: Class-level pruning: During taint splitting, filter out concrete classes that do not meet serialization requirements; the filtering criteria include: excluding concrete classes that cannot be instantiated, excluding concrete classes that do not implement the java.io.Serializable interface, and excluding primitive data types and primitive data arrays. Absolute error pruning: During the search for propagation paths, paths with predefined invalid behavior patterns are eliminated, including: paths containing meaningless general methods, paths with redundant recursion or repeated calls, and paths that violate predefined strong constraints.
6. The method according to claim 2, characterized in that, The analysis utilizes the data dependencies of chains to construct the AMethod data structure. Based on the AMethod data structure, the specific method for constructing the object structure graph is as follows: By utilizing each method call point in the chain, we analyze the definition location and source of the receiver object and parameter object in the container method to obtain the AMethod data structure. Multiple AMethod data structures in the chain will be linked together in the order of invocation to form an associated method path AMethodPath; A backward traversal algorithm is used to gradually construct the object structure graph from the dangerous function call point Sink to the deserialization entry point Source, based on the associated method path AMethod Path.
7. The method according to claim 6, characterized in that, Starting from the dangerous function call point Sink and moving towards the deserialization entry point Source, the object structure graph is constructed step by step based on the associated method path AMethod Path. The specific method is as follows: Initialize the object structure graph, with the Source object as the root node; Iterate through each method in the associated method path AMethod Path and determine the relationship between the current method and the declaration class of the previous method; If the current method has the same declaration class as the previous method, then the object is traversed: when the associated type is this.field, a new field node is added under the current object node; If the current method is different from the declared class of the previous method, then object traversal is performed: based on the parameter association, the hidden objects that must exist to satisfy the method call conditions are identified, and new object nodes or field nodes are instantiated in the object structure graph. The process continues until all associated method paths (AMethod Path) have been traversed, generating a complete deserialization exploit chain object structure graph.
8. The method according to claim 7, characterized in that, In the process of constructing the object structure graph, inference-level pruning is performed: if it is found that the receiver of a certain call point is of unknown origin and is a non-critical class, the exploit chain corresponding to the call point is determined to be invalid and pruning is performed.
9. The method according to claim 1, characterized in that, By leveraging the LLM as a "miniature JVM" and combining it with the inferred object structure graph, partial symbolic execution and semantic verification are performed on the exploit chain, including: Precise code context extraction: Using an abstract syntax tree parser, for each specific class involved in the exploit chain, only the code fragments related to the execution of that exploit chain are extracted to generate the target code context; the target code context includes the source code of the methods involved in the chain execution, relevant field descriptions, and class constructors; Utilize the chain to perform simulation: Input the target code context, object structure graph and exploit chain into the LLM, so that the LLM can perform simulation execution based on the thought chain protocol; only when the LLM successfully simulates and verifies to the Sink point and no logical interruption occurs, the exploit chain is marked as "exploitable" and the corresponding verification trajectory is output.
10. The method according to claim 9, characterized in that, During LLM simulation execution, the analysis performed for each method call in the chain includes: Context recognition: Identifies the currently executing object instance and method; Path analysis: Based on source code analysis, path-sensitive constraints are required to enter the next method call; State verification: Compare with the object structure diagram and check whether the object types, field values and reference relationships defined in the object structure diagram meet the path sensitivity constraints. If they do, the state verification is passed. State transition determination: If the state verification passes, output "Success" and proceed to the next method; if the state verification fails, output "Failure" and terminate the verification.