Vulnerability Detection Tool Testing System Based on Dynamic and Static Analysis

Abstract

A vulnerability detection tool testing system based on dynamic and static analysis includes: a vulnerability sensitive node identification module, a static taint propagation analysis module, a vulnerability injection point selection module, a dynamic tracking and triggering test case generation module, and a vulnerability injection and sample generation module. This invention can solve the problem of automatically generating reproducible, verifiable, and highly difficult-to-detect software vulnerability samples while maintaining the original program context semantics and functions.

Description

Technical Field

[0001] This invention relates to a technology in the field of information security, specifically a vulnerability detection tool testing system based on dynamic and static analysis. Background Technology

[0002] Existing automated vulnerability sample generation technologies attempt to generate large-scale program samples containing vulnerabilities through program analysis and code injection, while simultaneously providing corresponding vulnerability trigger inputs and vulnerability annotation information. Although such technologies alleviate the problem of insufficient vulnerability sample quantity to some extent, they still generally suffer from problems such as insufficient authenticity of vulnerability samples, unclear vulnerability trigger conditions, limited coverage of generated vulnerability types, and significant differences between some generated samples and real software environments, making it difficult to accurately reflect the detection capabilities of fuzzing tools in real-world scenarios. Summary of the Invention

[0003] To address the aforementioned shortcomings of existing technologies, this invention proposes a vulnerability detection tool testing system based on dynamic and static analysis. This system can automatically generate a large number of vulnerability samples while maintaining the original program's contextual semantics and functionality. These samples are used to evaluate the actual vulnerability discovery performance of different vulnerability detection tools, thus solving the problem of automatically generating software vulnerability samples that are reproducible, verifiable, and highly difficult to detect.

[0004] This invention is achieved through the following technical solution:

[0005] This invention relates to a vulnerability detection tool testing system based on dynamic and static analysis, comprising: a vulnerability-sensitive node identification module, a static taint propagation analysis module, a vulnerability injection point selection module, a dynamic tracing and triggering test case generation module, and a vulnerability injection and sample generation module. Specifically: the vulnerability-sensitive node identification module queries potential vulnerability injection candidate locations in the target program source code based on preset vulnerability-sensitive feature rules; the static taint propagation analysis module converts the target program source code into a code attribute graph (CPG) and obtains the data and control dependencies between external inputs and vulnerability-sensitive nodes through static taint propagation analysis; the vulnerability injection point selection module selects vulnerabilities from the vulnerability-sensitive node identification module and the taint propagation analysis module. The point propagation analysis module extracts candidate vulnerability sensitive nodes and data dependency and control dependency branch nodes, selecting specific code paths and location information that can be used for subsequent vulnerability injection to determine the specific location of vulnerability injection; the dynamic tracking and trigger test case generation module verifies the reachability of the selected vulnerability injection location and generates reproducible trigger test cases, while collecting runtime variable information of the target program source code to be injected to support controlled injection; the vulnerability injection and sample generation module rewrites the original program without changing its normal function, generating vulnerability samples that are triggered only under specific input conditions, which are used to input vulnerability detection tools and compare the detection results with the trigger conditions to achieve testing.

[0006] The aforementioned query for potential vulnerability injection candidate locations refers to: after constructing an abstract syntax tree (AST) based on the target program source code, performing syntax query and matching on the AST based on preset vulnerability sensitivity feature rules, extracting syntax nodes that meet the rules as candidate vulnerability sensitive nodes, recording the position information of the candidate vulnerability sensitive nodes in the source code, and forming a set of vulnerability sensitive nodes.

[0007] The target program source code is, but is not limited to, C / C++ source code.

[0008] The preset vulnerability sensitivity feature rules include: the calling characteristics of string processing functions, memory operation functions, and input / output related functions, and the above functions are a set of sensitive functions that are prone to causing buffer overflows or out-of-bounds read / write.

[0009] The data dependency and control dependency relationships mentioned refer to the following: After converting the target program source code into a code attribute graph (CPG) that integrates the structural information of the abstract syntax tree, control flow graph (CFG), and data dependency graph (DDG), external untrusted inputs are defined as taint sources, vulnerability-sensitive nodes are defined as taint sinks, and the checking statements for input or tainted variables in the target program source code are defined as sanitizers. Then, static taint propagation analysis is performed on the CPG to extract the set of tainted variables on the reachable path from the source to the sink, as well as the set of control flow branch nodes associated with them, and outputs candidate data dependency nodes and control dependency nodes for program rewriting.

[0010] The static taint propagation analysis refers to identifying, without running the target program, all data flow statements involving variable data changes and control flow branch statements affecting program execution path branch determination between the source and sink nodes using CPG parsing. Simultaneously, all intermediate variables involving data changes are extracted as taint variables.

[0011] The specific location of the vulnerability injection refers to the candidate nodes and program paths that are more deeply embedded and influenced by external input. This is obtained through the following method: For each candidate vulnerability-sensitive node, the number of data-dependent nodes and control-dependent nodes associated with it and the taint source are counted. Based on the preset injection point selection metric, a comprehensive score is calculated for the candidate vulnerability-sensitive node. Nodes with a score of zero are discarded, and the nodes with the highest score or that meet the threshold are selected as the final vulnerability injection location set. The complexity score is calculated for the taint variables and control flow branches respectively. Variables and branches with deeper relationships and deeper paths to the input are preferentially selected as the key contexts on which subsequent injections depend.

[0012] The aforementioned verification of the reachability of the injection location refers to: performing source code-level instrumentation on the set of injection locations and related tainted variables, with the instrumented code outputting the variable type, length, numerical range, or specific value; executing dynamic symbols on the instrumented program, converting external inputs into symbolic variables, traversing the program path and solving branch constraints, and when symbolic execution reaches the injection location, recording the specific input corresponding to that path as a trigger test case, and simultaneously recording the runtime variable value information required for injection.

[0013] The reproducible triggering use cases include: recording the runtime variable values ​​required for injection when verifying the reachability of the injection location, the triggering use cases corresponding to each injection location, and runtime information.

[0014] The aforementioned targeted rewriting without altering the normal functionality of the original program refers to: selecting vulnerability injection rules from a preset set of injection rules based on the type of vulnerability-sensitive nodes; inserting vulnerability triggering condition judgment statements near the original control flow structure, so that the vulnerability triggering branch is entered only when the input meets the triggering test case or the tainted variable value meets the runtime information; applying the vulnerability injection rules within the vulnerability triggering branch or at the location of the vulnerability-sensitive function parameter to generate a vulnerability code fragment.

[0015] The targeted rewriting removes instrumented code that is only dynamically collected and outputs vulnerability code samples and their corresponding triggering use cases.

[0016] The aforementioned vulnerability injection rules include:

[0017] 1) Target address offset: Offset the dst pointer or the base address of the target buffer to cause an out-of-bounds write;

[0018] 2) Source address offset: Offset the src pointer or the base address of the source buffer to cause an out-of-bounds read;

[0019] 3) Change the operation length: Increase or adjust the n parameter to make the write / read length exceed the buffer boundary;

[0020] 4) String Terminator Removal: Disrupts string processing logic bounded by terminators to induce out-of-bounds access.

[0021] The vulnerability triggering condition judgment statement preferably includes a control flow branch and its conditional branch, as well as a conditional expression embedded in the sensitive function parameter expression, so as to achieve the uniqueness and verifiability of vulnerability triggering without affecting the original execution path.

[0022] The vulnerability samples described above, which are triggered only under specific input conditions, ensure both the triggerability of the vulnerability samples and the uniqueness of the triggering conditions, increasing the difficulty of vulnerability detection and allowing for a better evaluation of the actual performance of vulnerability detection tools. Simultaneously, they avoid disrupting the original semantics and functionality of the target program, preserving as much of the original contextual and functional characteristics of the code as possible, thus enhancing the realism of the vulnerability samples.

[0023] Technical effect

[0024] This invention, based on abstract syntax tree matching and static taint analysis, introduces dynamic symbolic execution during the vulnerability sample generation process. While verifying the reachability of the vulnerability injection path, it generates test cases to verify the triggerability of the generated vulnerability samples. Compared with existing technologies, this invention, based on the original code characteristics of the target program, achieves automated generation of vulnerability samples without introducing additional intermediate variables or disrupting the original functionality of the target program, thus ensuring the authenticity and triggerability of the vulnerability samples. Attached Figure Description

[0025] Figure 1 This is a schematic diagram of the structure of the present invention;

[0026] Figure 2 This is a flowchart illustrating an example.

[0027] Figure 3 , Figure 4 This is a schematic diagram of the target program and the generated vulnerability sample in the example embodiment;

[0028] Figure 5 This is a schematic diagram illustrating the identification of vulnerability-sensitive nodes in an example. Detailed Implementation

[0029] like Figure 1 As shown in the figure, this embodiment relates to a vulnerability detection tool testing system based on dynamic and static analysis, including: a vulnerability sensitive node identification module, a static taint propagation analysis module, a vulnerability injection point selection module, a dynamic tracking and triggering test case generation module, and a vulnerability injection and sample generation module.

[0030] The vulnerability-sensitive node identification module includes a syntax tree construction unit, a node query unit, and an archiving unit. The syntax tree construction unit performs syntax parsing on the target program source code to generate an abstract syntax tree (AST). AST nodes include at least function calls, variable definitions, array / pointer operations, expressions, and statement blocks. The node query unit pre-configures a set of vulnerability-sensitive nodes and sensitive feature rules (e.g., sensitive function call patterns related to buffer overflows, array / pointer write patterns with missing boundary checks, etc.). Through AST traversal and pattern matching, it obtains a set of candidate vulnerability-sensitive nodes and records their corresponding source code locations. The archiving unit writes the vulnerability-sensitive nodes and their associated functions, files, parameter expression structures, etc., into a candidate node table for subsequent taint analysis and injection point scoring.

[0031] Examples of vulnerability-sensitive node identification, such as Figure 5 As shown.

[0032] In this embodiment, if the generated vulnerability type is buffer overflow / out-of-bounds read / write, the sensitive node can preferably be a function call node and its parameter expression node such as string copy / concatenation, memory copy / move, or input reading.

[0033] The static taint propagation analysis module includes an attribute graph construction unit and a propagation analysis unit. The attribute graph construction unit constructs a data dependency graph (DDG), a control flow graph (CFG), and a program dependency graph (PDG) based on the abstract syntax tree (AST), and merges them to obtain a code attribute graph (CPG) to provide cross-statement data dependency and control dependency information. The propagation analysis unit calculates the reachable taint flow from sources to sinks in the taint triples on the CPG, extracts the set of data dependency nodes and taint variables related to taint propagation, as well as the set of control dependency nodes (including key branch conditions) related to reaching sinks, and outputs a list of candidate rewriteable statements / expressions, injection point selection, and subsequent instrumentation.

[0034] The taint triple includes: external input points (sources), candidate vulnerability sensitive nodes (sinks) obtained from the previous module, and sanitizers (the logic for checking / filtering input or taint variables in the program).

[0035] Examples of data flow and control flow node identification are shown in the table below:

[0036] The vulnerability injection point selection module includes: a sensitive node scoring unit, a tainted variable scoring unit, a control flow branch scoring unit, and a set generation unit. Specifically: the sensitive node scoring unit calculates a comprehensive score for each candidate sensitive node by counting the number of data-dependent nodes and control-dependent nodes along the path from its sources to that node; the tainted variable scoring unit extracts a set of tainted variables from the set of data-dependent nodes, calculates the dependency complexity of each variable from input to variable, obtains an evaluation score, and prioritizes high-scoring variables for injection condition construction and parameter rewriting; the control flow branch scoring unit calculates the forward branch depth or number of branches for each control-dependent node, obtains an evaluation score, and prioritizes branches near deeper paths as injection point contexts to improve vulnerability trigger concealment and detection difficulty; the set generation unit synthesizes the scoring results to form the final vulnerability injection point set, where each injection point is associated with at least: the target sensitive node, key tainted variables, key control branch conditions, and the position of candidate rewriting expressions.

[0037] When the score is 0, the node is considered unaffected by external input and is ignored. Conversely, the higher the score, the higher the priority.

[0038] The dynamic tracking and trigger test case generation module includes an instrumentation unit, an exploration unit, and a deduplication verification unit. The instrumentation unit inserts lightweight probes (e.g., output variable length, range, value, etc.) into tainted variables and sensitive call parameter expressions associated with the injection point set to obtain the instrumented program. Instrumentation only collects information and does not change the original program semantics. The exploration unit symbolizes external input variables, performs dynamic symbolic execution, and solves constraints on branch path conditions. When a reachable injection point path is discovered, the specific inputs that can reach that path are recorded (as vulnerability trigger test cases / PoCs). The values ​​of key variables required for injection are also recorded. The deduplication verification unit performs deduplication and executability verification on the generated inputs, retaining the set of inputs that can reliably reach the target injection location and establishing a one-to-one mapping relationship with the injection points to ensure the reproducible triggering of subsequent vulnerability samples.

[0039] The vulnerability injection and sample output module includes: a rule selection unit, a conditional injection unit, a source code rewriting unit, and an output and annotation unit. Specifically: the rule selection unit selects rules from the injection rule set based on different sensitive function types or parameter forms; the conditional injection unit inserts trigger gated logic based on the test user and tainted variable values, adding an if statement after the critical control branch, entering the vulnerability branch only when the input satisfies the test case input (or the tainted variable satisfies a fixed value), or embedding a conditional expression in the sensitive function parameter expression, causing the parameter to shift / increase when the trigger condition is met and maintain its original behavior when the condition is not met; the source code rewriting unit applies the selected injection rules under the protection of the gated logic to generate a vulnerability sample program, while removing only collected instrumented code, retaining as much original context and identifiers as possible, and avoiding the introduction of features unrelated to the original program; the output and annotation unit generates vulnerability samples and trigger test cases, and outputs vulnerability injection location annotations (e.g., file, function, sensitive node location, injection rule type, etc.) for subsequent evaluation dataset construction.

[0040] The rules include:

[0041] 1) Target address offset rule: Offset the base address of dst or the target buffer to construct an out-of-bounds write;

[0042] 2) Source address offset rule: Offset the src or source buffer base address to construct an out-of-bounds read;

[0043] 3) Length parameter modification rules: Increase or reconstruct length parameters such as n to construct a superboundary copy;

[0044] 4) Termination character removal rules: Remove / destroy the string termination marker to prevent out-of-bounds access in operations based on the termination character;

[0045] The gating logic described does not affect the normal function and output of the original program under non-triggered input.

[0046] Through practical application experiments, the vulnerability detection tool test system based on dynamic and static analysis of this invention was run on the GNU Coreutils program component, and the experimental data obtained are as follows:

[0047] The generated vulnerability samples and node analysis results are shown in the table below:

[0048] The GNU Coreutils component identified 136 C language source files, containing 62,412 lines of valid code. During the vulnerability-sensitive node identification and static analysis phase, 444 vulnerability-sensitive nodes, 1,823 candidate data dependency nodes, and 1,855 candidate control dependency nodes were identified. After vulnerability injection location screening, 96 vulnerability-sensitive nodes were selected for vulnerability injection, along with 462 data dependency nodes and 439 control dependency nodes to provide path and variable information for specific vulnerability injections. Ultimately, 576 vulnerability program samples were successfully generated.

[0049] Compared with existing technologies, this invention determines the real data flow / control flow context related to external input based on static taint propagation, and performs targeted rewriting without changing the original functionality and semantic continuity, reducing manual features unrelated to the original program; it generates trigger test cases that can reach the injection location through dynamic symbolic execution, and records key runtime variable information, so that the generated vulnerability sample has a stable PoC input, achieving the reproducibility and verifiability of the vulnerability sample; through the injection point scoring mechanism, it prioritizes injection at locations with deeper paths and more complex dependencies, thereby improving the vulnerability hiding depth and triggering complexity, and more effectively distinguishing the detection capabilities of different fuzzing tools; it forms a pipeline process from sensitive node identification, taint analysis, injection point selection, dynamic solution to code injection, which can generate vulnerability samples and corresponding trigger test cases in batches, reducing the cost of manual construction and annotation, and providing more comprehensive data support for vulnerability detection tool evaluation.

[0050] The above-described specific implementations can be partially adjusted by those skilled in the art in different ways without departing from the principles and purpose of the present invention. The scope of protection of the present invention is defined by the claims and is not limited to the above-described specific implementations. All implementation schemes within the scope of the claims are bound by the present invention.

Claims

1. A vulnerability detection tool testing system based on dynamic and static analysis, characterized in that, include: The system comprises four modules: a vulnerability-sensitive node identification module, a static taint propagation analysis module, a vulnerability injection point selection module, a dynamic tracing and trigger test case generation module, and a vulnerability injection and sample generation module. Specifically: the vulnerability-sensitive node identification module queries potential vulnerability injection candidate locations in the target program source code based on preset vulnerability-sensitive feature rules; the static taint propagation analysis module converts the target program source code into a code attribute graph (CPG) and obtains the data and control dependencies between external inputs and vulnerability-sensitive nodes through static taint propagation analysis; the vulnerability injection point selection module selects specific code paths and location information that can be used for subsequent vulnerability injection from the candidate vulnerability-sensitive nodes and data and control dependency branch nodes extracted by the vulnerability-sensitive node identification and taint propagation analysis modules, determining the specific location for vulnerability injection; and the dynamic tracing and trigger test case generation module verifies the reachability of the selected vulnerability injection location and generates reproducible trigger test cases, while simultaneously collecting runtime variable information from the target program source code to be injected to support controlled injection. The vulnerability injection and sample generation module is rewritten in a targeted manner without changing the normal function of the original program. It generates vulnerability samples that are triggered only under specific input conditions. These samples are then input into vulnerability detection tools, and the detection results are compared with the triggering conditions to achieve testing.

2. The vulnerability detection tool testing system based on dynamic and static analysis according to claim 1, characterized in that, The aforementioned query for potential vulnerability injection candidate locations refers to: after constructing an abstract syntax tree (AST) based on the target program source code, performing syntax query and matching on the AST based on preset vulnerability sensitivity feature rules, extracting syntax nodes that meet the rules as candidate vulnerability sensitive nodes, recording the position information of the candidate vulnerability sensitive nodes in the source code, and forming a set of vulnerability sensitive nodes; The preset vulnerability sensitivity feature rules include: the calling characteristics of string processing functions, memory operation functions, and input / output related functions, and the above functions are a set of sensitive functions that are prone to causing buffer overflows or out-of-bounds read / write.

3. The vulnerability detection tool testing system based on dynamic and static analysis according to claim 1, characterized in that, The data dependency and control dependency relationships mentioned refer to the following: After converting the target program source code into a code attribute graph (CPG) that integrates the structural information of the abstract syntax tree, control flow graph (CFG), and data dependency graph (DDG), external untrusted inputs are defined as taint sources, vulnerability-sensitive nodes are defined as taint sinks, and the checking statements for input or tainted variables in the target program source code are defined as sanitizers. Then, static taint propagation analysis is performed on the CPG to extract the set of tainted variables on the reachable path from the source to the sink and the set of control flow branch nodes related to them, and output the candidate data dependency nodes and control dependency nodes for program rewriting. The static taint propagation analysis refers to identifying, without running the target program, all data flow statements involving variable data changes and control flow branch statements affecting program execution path branch determination between the source and sink nodes using CPG parsing. Simultaneously, all intermediate variables involving data changes are extracted as taint variables.

4. The vulnerability detection tool testing system based on dynamic and static analysis according to claim 1, characterized in that, The specific location of the vulnerability injection refers to the candidate nodes and program paths that are more deeply embedded and influenced by external input. This is obtained through the following method: For each candidate vulnerability-sensitive node, the number of data-dependent nodes and control-dependent nodes associated with it and the taint source are counted. Based on the preset injection point selection metric, a comprehensive score is calculated for the candidate vulnerability-sensitive node. Nodes with a score of zero are discarded, and the nodes with the highest score or that meet the threshold are selected as the final vulnerability injection location set. The complexity score is calculated for the taint variables and control flow branches respectively. Variables and branches with deeper relationships and deeper paths to the input are preferentially selected as the key contexts on which subsequent injections depend.

5. The vulnerability detection tool testing system based on dynamic and static analysis according to claim 1, characterized in that, The verification of the reachability of the selected vulnerability injection location refers to: performing source code-level instrumentation on the set of injection locations and related tainted variables, with the instrumented code outputting the variable type, length, numerical range, or specific value; executing dynamic symbols on the instrumented program, converting external inputs into symbolic variables, traversing the program path and solving branch constraints, and when symbolic execution reaches the injection location, recording the specific input corresponding to that path as a trigger test case, and simultaneously recording the runtime variable value information required for injection; The reproducible triggering use cases include: recording the runtime variable values ​​required for injection when verifying the reachability of the injection location, the triggering use cases corresponding to each injection location, and runtime information.

6. The vulnerability detection tool testing system based on dynamic and static analysis according to claim 1, characterized in that, The targeted rewriting refers to: selecting vulnerability injection rules from a preset injection rule set based on the vulnerability sensitive node type, inserting vulnerability triggering condition judgment statements near the original control flow structure, so that the vulnerability triggering branch is only entered when the input meets the triggering test case or the tainted variable value meets the runtime information; Vulnerability injection rules are applied within the vulnerability trigger branch or at the location of vulnerability-sensitive function parameters to generate vulnerable code snippets.

7. The vulnerability detection tool testing system based on dynamic and static analysis according to claim 1 or 6, characterized in that, The targeted rewriting removes instrumented code that is only dynamically collected and outputs vulnerability code samples and their corresponding triggering use cases.

8. The vulnerability detection tool testing system based on dynamic and static analysis according to claim 6, characterized in that, The aforementioned vulnerability injection rules include: 1) Target address offset: Offset the dst pointer or the base address of the target buffer to cause an out-of-bounds write; 2) Source address offset: Offset the src pointer or the base address of the source buffer to cause an out-of-bounds read; 3) Change the operation length: Increase or adjust the n parameter to make the write / read length exceed the buffer boundary; 4) String Terminator Removal: Disrupts string processing logic bounded by terminators to induce out-of-bounds access.

9. The vulnerability detection tool testing system based on dynamic and static analysis according to claim 6, characterized in that, The vulnerability triggering condition judgment statement includes control flow branches and their conditional branches, as well as conditional expressions embedded in sensitive function parameter expressions, so as to achieve the uniqueness and verifiability of vulnerability triggering without affecting the original execution path.

Images