Java deserialization vulnerability chain detection method and related device

Abstract

The application provides a Java deserialization vulnerability chain detection method and related equipment. The Java deserialization vulnerability chain detection method comprises the following steps: identifying a plurality of Gadget segments of a target Java application, obtaining a predicate context of the Gadget segment based on a predicate constraint of the Gadget segment; determining a plurality of candidate Gadget segment link pairs based on a taint analysis; determining whether there is a predicate conflict between the predicate context of a candidate predecessor Gadget segment and the predicate context of a corresponding candidate successor Gadget segment; in response to the absence of the conflict, performing merging to obtain a merged predicate context; propagating the merged predicate context to a vulnerability chain to obtain a candidate vulnerability chain; analyzing global predicate constraint satisfiability of the candidate vulnerability chain, and in response to the path condition of the candidate vulnerability chain being satisfiable, determining that the candidate vulnerability chain is a Java deserialization vulnerability chain. The detection accuracy can be improved.

Description

Technical Field

[0001] This application relates to the field of computer network security technology, and in particular to a method and related equipment for detecting Java deserialization vulnerability chains. Background Technology

[0002] While Java's deserialization mechanism allows for convenient conversion between objects and byte streams, it also introduces security risks. Attackers can exploit this mechanism to construct malicious data, triggering a series of method calls and ultimately leading to high-risk vulnerabilities such as remote code execution.

[0003] Current mainstream static code analysis techniques rely on taint analysis, which identifies attack paths from the deserialization entry point to dangerous methods by segmenting the code into multiple "gadget fragments" and concatenating them. This method has a high false positive rate. Summary of the Invention

[0004] In view of this, the purpose of this application is to propose a method and related equipment for detecting Java deserialization vulnerability chains.

[0005] For the purposes described above, this application provides a method for detecting Java deserialization vulnerability chains, including: Identify multiple Gadget fragments of a target Java application, and obtain the predicate context of the Gadget fragments based on the predicate constraints of the Gadget fragments; Multiple candidate Gadget fragment link pairs were identified based on taint analysis; each candidate Gadget fragment link pair includes a candidate precursor Gadget fragment and a corresponding candidate successor Gadget fragment. Determine whether there is a predicate conflict between the predicate context of the candidate predecessor Gadget fragment and the predicate context of the corresponding candidate successor Gadget fragment; merge the predicate contexts of the candidate predecessor Gadget fragment and the corresponding candidate successor Gadget fragment that do not have a predicate conflict to obtain a merged predicate context; propagate the merged predicate context to the vulnerability chain to obtain a candidate vulnerability chain. Analyze the global predicate constraint satisfiability of the candidate vulnerability chain. In response to the path condition of the candidate vulnerability chain being satisfied, determine that the candidate vulnerability chain is a Java deserialization vulnerability chain.

[0006] In some embodiments, the predicate constraint is represented by a predicate label; the predicate constraint includes a predicate type indicating the constraint category, a predicate keyword identifying the object of action, a comparison operator defining the comparison relationship, and a constraint value specifying the specific requirements; The data structure of the Gadget fragment includes: the entry Gadget fragment header method, the exit Gadget fragment tail method, the method call sequence, the taint propagation matrix, the pre-predicate constraints required for linking, and the predicate context and linking history that record all constraints.

[0007] In some embodiments, obtaining the predicate context of the Gadget fragment based on the predicate constraints of the Gadget fragment includes: Extract the predicate tags of the execution path of the obtained Gadget fragment; Add the predicate tag to the predicate context container of the Gadget fragment to obtain the predicate context of the Gadget fragment.

[0008] In some embodiments, the predicate tags for extracting the execution path of the Gadget fragment include: The control flow graph of the identified Gadget fragment is obtained by performing control flow graph analysis on the Gadget fragment. By traversing all nodes in the control flow graph of the Gadget fragment and combining the results of taint analysis, the key conditional branch nodes are obtained. Extract the conditional expression of the conditional branch node; Based on the semantic features of the conditional expression, determine the type of the predicate constraint of the conditional expression, and generate the corresponding type of predicate label.

[0009] In some embodiments, determining whether there is a predicate conflict between the predicate context of the candidate predecessor Gadget fragment and the predicate context of the corresponding candidate successor Gadget fragment includes: Extract all predicate tag pairs from the candidate Gadget fragment link pairs; the predicate tag pair includes the first predicate tag of the candidate predecessor Gadget fragment and the second predicate tag of the corresponding candidate successor Gadget fragment; Read the predicate type field and predicate keyword field of the predicate tag pair to obtain the first predicate type field and first predicate keyword field of the first predicate tag, and the second predicate type field and second predicate keyword field of the second predicate tag; Based on the first predicate type field and the first predicate keyword field, and the second predicate type field and the second predicate keyword field of the second predicate label, determine whether the first predicate label and the second predicate label belong to the same dimension; In response to the first predicate label and the second predicate label belonging to the same dimension, the first comparison operator type and the first constraint value content of the first predicate label are extracted, and the second comparison operator type and the second constraint value content of the second predicate label are extracted; Based on the first comparison operator type and the first constraint value content, as well as the second comparison operator type and the second constraint value content, determine whether there is a logical contradiction between the first target predicate label and the second target predicate label.

[0010] In some embodiments, extracting predicate tag pairs from the candidate Gadget fragment link pairs includes: Extract the predicate tags from the predicate context of the candidate predecessor Gadget fragment to obtain the predecessor predicate constraint set; Extract the predicate tags of the predicate context of the corresponding candidate successor Gadget fragment to obtain the successor predicate constraint set; Perform a Cartesian product operation on the set of predecessor predicate constraints and the set of successor predicate constraints to obtain all predicate tag pairs in the candidate Gadget fragment link pairs.

[0011] In some embodiments, the analysis of the global predicate constraint satisfiability of the candidate vulnerability chain includes: Extract all predicate tags from the predicate context of the candidate vulnerability chain; Perform global pairwise conflict detection to determine whether there are logical contradictions among all the predicate tag pairs.

[0012] This application embodiment also provides a Java deserialization vulnerability chain detection device, including: An extraction module is used to identify multiple Gadget fragments of a target Java application and obtain the predicate context of the Gadget fragments based on the predicate constraints of the Gadget fragments. The candidate Gadget fragment link pair determination module is used to determine multiple candidate Gadget fragment link pairs based on taint analysis; the candidate Gadget fragment link pair includes a candidate predecessor Gadget fragment and a corresponding candidate successor Gadget fragment. The candidate leaky copper chain generation module determines whether there is a predicate conflict between the predicate context of the candidate predecessor Gadget fragment and the predicate context of the corresponding candidate successor Gadget fragment; merges the predicate contexts of the candidate predecessor Gadget fragment and the corresponding candidate successor Gadget fragment that do not have a predicate conflict to obtain a merged predicate context; and propagates the merged predicate context to the leaky chain to obtain the candidate leaky copper chain. The Java deserialization vulnerability chain determination module analyzes the global predicate constraint satisfiability of the candidate vulnerability chain, and determines the candidate vulnerability chain as a Java deserialization vulnerability chain in response to the satisfiability of the path conditions of the candidate vulnerability chain.

[0013] This application also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the method described in any of the preceding claims.

[0014] This application also provides a non-transitory computer-readable storage medium that stores computer instructions for causing a computer to perform any of the methods described above.

[0015] This application also provides a computer program product, including computer program instructions that, when run on a computer, cause the computer to perform the method described in any of the preceding claims. Attached Figure Description

[0016] To more clearly illustrate the technical solutions in this application or related technologies, the drawings used in the description of the embodiments or related technologies will be briefly introduced below. Obviously, the drawings described below are only embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0017] Figure 1 This is a schematic diagram illustrating an application scenario of the Java deserialization vulnerability chain detection method based on predicate propagation, as described in this application.

[0018] Figure 2 This is a flowchart of a Java deserialization vulnerability chain detection method according to an embodiment of this application.

[0019] Figure 3 This is a flowchart illustrating the extraction of predicate tags for the execution path of Gadget fragments in an embodiment of this application. Figure 4 This is a flowchart illustrating how to determine whether a candidate Gadget fragment link pair has a predicate conflict, as described in this application embodiment.

[0020] Figure 5 This is a schematic diagram of the structure of an electronic device according to an embodiment of this application.

[0021] Figure 6 This is a schematic diagram of a Java deserialization vulnerability chain detection device based on predicate propagation, according to an embodiment of this application. Detailed Implementation

[0022] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with specific embodiments and the accompanying drawings.

[0023] It should be noted that, unless otherwise defined, the technical or scientific terms used in the embodiments of this application should have the ordinary meaning understood by one of ordinary skill in the art to which this application pertains. The terms "first," "second," and similar terms used in the embodiments of this application do not indicate any order, quantity, or importance, but are merely used to distinguish different components. Terms such as "comprising" or "including" mean that the element or object preceding the word covers the element or object listed following the word and its equivalents, without excluding other elements or objects. Terms such as "connected" or "linked" are not limited to physical or mechanical connections, but can include electrical connections, whether direct or indirect.

[0024] Current mainstream static vulnerability analysis techniques have significant flaws, leading to high false positive rates. Firstly, when linking fragments (i.e., connecting code segments after splitting), these techniques primarily focus on taint propagation and type matching, neglecting conditional constraints along the code execution path. This can result in logically contradictory segments being incorrectly linked, forming invalid vulnerability chains that cannot actually be triggered. Secondly, current mainstream static vulnerability analysis techniques lack logical consistency verification of all path conditions throughout the entire vulnerability chain, easily generating invalid vulnerability reports. Furthermore, these flaws result in static analysis results potentially containing a large number of false positives, increasing the verification costs for security personnel and severely reducing the efficiency of subsequent dynamic verification.

[0025] Therefore, there is an urgent need for a detection method that can understand and verify the path conditions along the entire vulnerability chain to improve the accuracy of the analysis.

[0026] Based on this, this application provides a Java deserialization vulnerability chain detection method. This method first identifies Gadget fragments in the target Java application. During the identification process, predicate constraints on the execution path of each fragment are extracted. These predicate constraints include at least one of method name constraints, parameter null value constraints, parameter length constraints, and type constraints. Each Gadget fragment is associated with a predicate context, which records all predicate constraints that the fragment's execution must satisfy. Next, when constructing a complete vulnerability chain by linking fragments, the predicate contexts of the preceding and succeeding fragments to be linked are merged, and predicate conflicts are detected during the merging process. When a predicate conflict is detected, the system determines that the fragment linking is infeasible and terminates the linking operation; otherwise, when no predicate conflict is detected, the fragment linking is completed, and the merged predicate context is propagated to the newly constructed chain. Finally, based on the satisfiability of predicate constraints, exploitable vulnerability chains whose path conditions can be satisfied are selected. By extracting, propagating, and verifying path predicate constraints during the static analysis phase, the high false positive rate, fragment linking errors, and insufficient dynamic verification guidance caused by ignoring path conditions in existing technologies can be addressed to some extent.

[0027] Please refer to Figure 1 This diagram illustrates an application scenario of an exemplary Java deserialization vulnerability chain detection method based on predicate propagation, provided in this application embodiment. The technical solution provided in this application embodiment can be widely applied to various scenarios such as security testing of enterprise-level Java applications and security auditing of third-party libraries. In a typical deployment architecture, this application scenario includes a client device 101, a vulnerability detection server 102, and a communication network 103 connecting the two. These three components work together to achieve comprehensive security testing of Java applications.

[0028] In this process, the Java application to be detected is uploaded as a compiled JAR package to the vulnerability detection service 102 for analysis via client device 101. Client device 101 not only handles data uploading but also provides a user-friendly interface. It can be used to configure detection parameters, monitor detection progress, and receive and view detection reports containing detailed predicate constraint information. After detection is complete, users can view the complete path predicate constraints of each candidate Gadget Chain, conflict detection results, satisfiability analysis reports, and automatically generated exploit construction hints on client device 101. This information significantly improves the understandability and operability of the vulnerability report.

[0029] The vulnerability detection server 102 is the core computing node of the entire system, and it is equipped with the predicate propagation-based vulnerability detection system according to this application embodiment. This vulnerability detection server S102 is typically configured with powerful computing resources to support static analysis tasks for large-scale Java applications.

[0030] In the vulnerability detection system based on predicate propagation in this application embodiment, the predicate propagation mechanism works collaboratively across three layers. These three layers may include a predicate extraction layer, a predicate propagation layer, and a predicate accumulation layer.

[0031] In the predicate extraction layer, the vulnerability detection system based on predicate propagation extracts the conditional constraints on the path through control flow analysis during the Gadget fragment identification stage.

[0032] In the predicate propagation layer, the vulnerability detection system based on predicate propagation merges the predicate context and detects conflicts when linking predecessor and successor Gadget fragments. This application adds predicate consistency verification, merging the predicate context of the predecessor Gadget fragment with the predicate constraints of the successor Gadget fragment, and detecting logically contradictory constraints. Only predicate-compatible predecessor and successor Gadget fragments are allowed to link; otherwise, merging is directly rejected. This mechanism can filter out infeasible links in the early stages of linking predecessor and successor Gadget fragments, avoiding the construction of logically contradictory Gadget chains. It solves the problem of high false positive rates caused by traditional methods that only check whether taints can propagate and whether types match when linking predecessor and successor Gadget fragments.

[0033] In the predicate accumulation layer, the vulnerability detection system based on predicate propagation achieves the propagation and accumulation of predicate constraints between fragments during multiple rounds of fragment linking. After each successful linking, the predicate context of the new fragment contains the accumulated constraints of all predecessor fragments, ensuring that the final constructed complete Gadget Chain contains full path constraints from the entry point to the sink. These constraints can then be used for final satisfiability verification and dynamic verification guidance.

[0034] Therefore, through a three-level predicate propagation mechanism, this application not only maintains the traditional taint analysis capabilities but also adds path constraint dimension analysis, realizing comprehensive analysis of data flow and control flow.

[0035] The predicate constraints extracted in this application can not only be used for false positive filtering in the static analysis stage, but also directly guide the construction of vulnerability exploitation objects in the dynamic verification stage.

[0036] See Figure 2 This is a flowchart illustrating a Java deserialization vulnerability chain detection method provided in an embodiment of this application. The Java deserialization vulnerability chain detection method may include: Step S100: Identify multiple Gadget fragments of the target Java application, and obtain the predicate context of the Gadget fragments based on the predicate constraints of the Gadget fragments; Step S200: Based on taint analysis, determine multiple candidate Gadget fragment link pairs; the candidate Gadget fragment link pairs include candidate predecessor Gadget fragments and corresponding candidate successor Gadget fragments. Step S300: Determine whether there is a predicate conflict between the predicate context of the candidate predecessor Gadget fragment and the predicate context of the corresponding candidate successor Gadget fragment; merge the predicate contexts of the candidate predecessor Gadget fragment and the corresponding candidate successor Gadget fragment that do not have a predicate conflict to obtain a merged predicate context; propagate the merged predicate context to the vulnerability chain to obtain multiple candidate vulnerability chains; Step S400: Analyze the global predicate constraint satisfiability of the candidate vulnerability chain and determine the candidate vulnerability chain whose path conditions can be satisfied as the Java deserialization vulnerability chain.

[0037] In some embodiments, step S100, identifying multiple Gadget fragments of the target Java application, may include: Scan all classes in the target Java application to obtain all classes that implement the Serializable interface.

[0038] Extract the deserialization entry methods such as readObjec or readResolve defined in the class that implements the Serializable interface to form a set of entry points.

[0039] Using the set of entry points as taint sources, initiate inter-process taint analysis to trace the taint data stream flowing out from the deserialized input parameters.

[0040] In some possible embodiments, intelligent pruning based on predicate constraints can pre-analyze the predicate context of each segment during the Gadget segment identification stage. If an unsatisfiable conflicting combination of predicate constraints in the same dimension is detected, the segment is directly marked as invalid; dynamic verification is supported; and exploitation hints are generated.

[0041] In some embodiments, the data structure of the Gadget fragment includes: an entry Gadget fragment header method, an exit Gadget fragment tail method, a method call sequence, a taint propagation matrix, pre-predicate constraints required for linking, and a predicate context and linking history that record all constraints.

[0042] In some embodiments, during the process of identifying Gadget fragments of a target Java application, predicate constraints on the execution path of each Gadget fragment can be extracted. The predicate constraints may include at least one of method name constraints, parameter null value constraints, parameter length constraints, and type constraints. Each resulting Gadget fragment is associated with a predicate context. The predicate context records all predicate constraints that the execution of the Gadget fragment must satisfy. That is, obtaining the predicate context of the Gadget fragment based on its predicate constraints includes: extracting predicate tags from the execution path of the obtained Gadget fragment; adding the predicate tags to the predicate context container of the Gadget fragment to obtain the predicate context of the Gadget fragment.

[0043] In some of these embodiments, see Figure 3 The predicate tags for extracting the execution path of the Gadget fragment may include: Step S110 involves performing control flow graph analysis on the identified Gadget fragment to obtain its control flow graph. Typically, the control flow graph of a Gadget fragment includes a complete control flow graph from its entry method to its exit method. The entry method is the method at which the Gadget fragment begins execution, while the exit method is usually a dynamic method call point or a call point for a security-sensitive method. The control flow graph contains all possible code paths that the Gadget fragment may traverse during execution, as well as all possible branch structures encountered along these paths. Therefore, by constructing and analyzing such a control flow graph, a comprehensive understanding of the Gadget fragment's execution logic can be obtained, identifying which code paths are actually reachable and which conditional judgments affect the program's execution flow.

[0044] Step S120: Traverse all nodes in the control flow graph of the Gadget fragment and, combined with the results of taint analysis, obtain the key conditional branch nodes. Conditional branch nodes are nodes with special significance in the control flow graph, representing decision points in the program execution process. At the location of a conditional branch node, the program execution flow will make a choice based on the truth value of a certain condition, thus entering different execution branches. Therefore, obtaining the conditional branch nodes reveals the main source of the logical complexity of the target Java application and the root cause of path constraints.

[0045] In some embodiments, when traversing all nodes in the control flow graph of a Gadget fragment, each node can be checked to determine if it is a conditional branch node. A typical characteristic of a conditional branch node is that it has multiple outgoing edges, each corresponding to a possible execution direction. In Java, conditional branches are typically represented by various statement forms. The most common is the conditional statement, which determines the program's direction based on the value of a Boolean expression. In addition, multi-branch selection statements also produce conditional branches; these statements allow the program to jump to different code blocks based on different values ​​of a variable. Furthermore, loop statements also contain conditional branches; the continuation and termination of the loop depend on the result of evaluating the loop condition.

[0046] Typically, not all conditional branch nodes have a substantial impact on the exploit path. When identifying conditional branch nodes, special attention should be paid to critical conditional statements that can affect the execution of the gadget fragment. Therefore, when identifying conditional branch nodes, combining the results of taint analysis, priority should be given to conditional statements involving tainted data. When specifically determining whether a node is a conditional branch node, if the conditional expression contains data from an untrusted source, or if the choice of the conditional branch node directly affects whether a dangerous method can be called subsequently, then this conditional branch node is the object of focused analysis.

[0047] In some embodiments, for each identified conditional branch node, not only is its location information recorded, but the actual direction taken by that conditional branch within the currently analyzed Gadget fragment execution path is also determined. By combining this with contextual information from static analysis, it can be inferred which branch the target Java application will enter in the current exploit scenario.

[0048] In some embodiments, a set of conditional branches can be generated. This set includes the identification results of the conditional branch nodes. Furthermore, the set contains all the conditional judgment points that need to be satisfied along the execution path of the Gadget fragment. Each conditional branch is associated with its position in the control flow graph, the statement type of the branch, and the actual branch direction taken. This information provides a clear target object for the next step of conditional expression extraction, enabling focus on the conditional constraints that truly affect the execution path and avoiding wasting analysis resources on irrelevant code details.

[0049] Step S130: Extract the conditional expression of the conditional branch node. The conditional expression is the core of the conditional branch, defining the basis for branch selection and containing specific constraints that need to be satisfied. By parsing the structure and semantics of the conditional expression, implicit execution constraints can be transformed into explicit, formally representable predicate labels.

[0050] In some embodiments, detailed information about the corresponding conditional expression, including the conditional branch statements within the expression, can be extracted through in-depth analysis of each conditional branch node. This in-depth analysis can be a deep semantic analysis to determine which elements in the target Java program the operands represent.

[0051] In some embodiments, different processing strategies can be employed for different types of conditional expressions to extract conditional branch statements. For example, for conditional expressions involving null values, a null check can be performed by identifying which parameter or variable is being checked to determine if a reference is null. This facilitates recording whether parameters or objects at specific positions in the path must be null or non-null. Typically, in the context of a Gadget chain, whether an object at a certain position is null directly determines whether subsequent code can execute correctly. When a conditional expression involves judging the length of an array or set, the array or set being judged, along with the numerical conditions that the length must satisfy, can be extracted.

[0052] In some embodiments, after extracting the conditional branch statements from the conditional expression, the conditions can be appropriately adjusted according to the actual execution direction of the conditional branch. For example, if the target Java application executes the branch where the condition is true, then the conditional expression itself is the constraint that needs to be satisfied. If the target Java application executes the branch where the condition is false, the condition needs to be logically negated.

[0053] Step S140: Based on the semantic features of the conditional expression, determine the type of predicate constraint of the conditional expression, and generate predicate tags of the corresponding type. Predicate tags can express path constraints in a unified and formalized way, enabling constraints from different sources and in different forms to be managed, propagated, and verified within the same framework.

[0054] In some embodiments, the type of predicate constraint in a conditional expression can be determined based on its semantic features, and a corresponding predicate label can be generated. Each predicate label can contain four key fields that collectively describe the path's constraints. The first field is the predicate type, identifying the object category to which the predicate constraint applies. The second field is the predicate keyword, precisely specifying the object on which the predicate constraint applies. The third field is the comparison operator, defining the comparison relationship between the predicate constraints. The fourth field is the constraint value, providing the specific value that the constraint condition must satisfy. In some embodiments, for predicate constraints of type method name, predicate tags of type method name constraint can be generated. The predicate type field of this predicate tag is set to the method name constraint, the predicate keyword is typically set to a specific identifier to indicate that this is a constraint on a method name, the comparison operator is set to equal to or not equal to the condition, and the constraint value is the specific method name string. Generating this type of predicate tag of method name constraint facilitates the generation of Gadget chains involving reflection calls and dynamic proxies, thereby facilitating the detection of dynamic method calls that require routing based on method name.

[0055] In some embodiments, for predicate constraints involving null value checks on parameters, predicate tags of the parameter null constraint type can be generated. The predicate type field of this predicate tag is set to parameter null constraint, and the predicate keyword is used to identify which position the parameter is in. The comparison operator is set to equal to null or not equal to null, and the constraint value is typically a null value. Through this type of parameter null constraint predicate tag, it is possible to explicitly record whether a parameter at a specific position must be null or must not be null in that execution path. Such constraints are crucial for avoiding null pointer exceptions and ensuring the correct execution of subsequent code.

[0056] In some embodiments, for predicate constraints of array or set length type, predicate labels of parameter length constraint type can be generated. The predicate type field of this predicate label is set to parameter length constraint, the predicate keyword is used to identify the length of which specific parameter, the comparison operator can be greater than, less than, equal to, etc., and the constraint value is a specific integer representing the length threshold.

[0057] In some embodiments, for predicate constraints on object types, predicate labels of type constraint types can be generated. The predicate type field of this predicate label is set as the type constraint, the predicate keyword is used to identify the variable or parameter of the checked type, the comparison operator is typically a type matching relationship, and the constraint value is the specific type name. Type constraints ensure that objects have the expected type at runtime, thereby enabling subsequent type conversions and method calls to proceed safely. In strongly typed languages ​​like Java, type constraints guarantee program type safety.

[0058] In some embodiments, the constructed predicate tags can be added to the predicate context of the Gadget fragment. The predicate context is a container used to centrally manage all path constraints of a Gadget fragment. A specific data structure can be used to store the set of predicate tags in the predicate context, which can both maintain the insertion order of the predicate tags and efficiently support query and conflict detection operations. After the predicate tags are added to the predicate context, these predicate constraints are associated with the Gadget fragment and become inherent attributes of the fragment.

[0059] This allows for the systematic extraction of all key path constraints from the execution path of a Gadget fragment. Through in-depth analysis of the code execution path, the constraints implicit in conditional branch statements are made explicit and structured, providing necessary data support for subsequent predicate propagation and conflict detection.

[0060] In some embodiments, step S200 can employ a bottom-up strategy to construct the Gadget Chain. This can be done by tracing upwards from the sink segment. For each Gadget segment, the set of predecessor methods allowed for linking in its connection requirements can be searched. All segments with tail methods in this set of predecessor methods are enumerated as candidate predecessor Gadget segments. Then, candidate link pairs are formed between the predecessor Gadget segments and the candidate successor Gadget segments. Typically, for candidate Gadget segment link pairs, taint propagation conditions can be checked to verify whether taints in the tail method parameters of the candidate predecessor Gadget segment can propagate to the head method parameters of the candidate successor Gadget segment. Specifically, checking the taint propagation conditions can involve checking the taint propagation matrix to confirm the correspondence of parameter indices.

[0061] In some embodiments, for links involving dynamic proxies, additional routing checks may be performed on candidate Gadget fragment link pairs in addition to checking for taint propagation conditions. In some embodiments, after identifying multiple candidate Gadget fragment link pairs based on taint analysis, candidate links that pass conventional checks can be formed. For these candidate links, those that pass taint propagation, type compatibility, and dynamic proxy routing checks can be marked as pending predicate verification. Candidate links marked with the pending predicate verification status will proceed to the next step of the predicate merging and conflict detection process.

[0062] In some embodiments, step S300, the predicate conflict detection mechanism may include five core steps. These steps systematically perform conflict analysis on the predicate tags during the linking process of candidate Gadget fragment link pairs, ensuring that only candidate Gadget fragment link pairs with mutually compatible path constraints can be successfully linked. By identifying and preventing the merging of candidate Gadget fragment link pairs with logical contradictions at an early stage of linking, the construction of false vulnerability chains that cannot actually be triggered can be fundamentally avoided, thereby significantly reducing the false positive rate of static analysis. Since rejected candidate Gadget fragment link pairs will not enter the subsequent taint analysis and pointer analysis stages, analysis time can be avoided on logically infeasible paths. This early pruning strategy not only reduces the false positive rate but also saves computational resources for subsequent heavyweight analyses.

[0063] participate Figure 4 Determining whether there is a predicate conflict between the predicate context of the candidate predecessor Gadget fragment and the predicate context of the corresponding candidate successor Gadget fragment may include: Step S310: Extract all predicate tag pairs from the candidate Gadget fragment link pairs; each predicate tag pair includes the first predicate tag of the candidate predecessor Gadget fragment and the second predicate tag of the corresponding candidate successor Gadget fragment. Each candidate predecessor Gadget fragment and each candidate successor Gadget fragment are associated with a corresponding predicate context. This corresponding predicate context is used to maintain all path constraints that the candidate predecessor / successor Gadget fragment must satisfy to execute. When attempting to link a candidate predecessor Gadget fragment with a candidate successor Gadget fragment, check whether there are predicate conflicts in the constraints of the predicate contexts of these two fragments.

[0064] In some embodiments, a deep copy of the predicate context of the candidate predecessor Gadget fragment can be created. For example, a new PredicateContext object containing all predicate tags can be generated. The deep copy ensures that the predicate information of the original candidate predecessor Gadget fragment is not modified, and also supports parallel linking attempts between the same candidate predecessor Gadget fragment and multiple different successor Gadget fragments.

[0065] In some embodiments, extracting predicate tag pairs from the candidate Gadget fragment link pairs may include: Predicate tags are extracted from the predicate context of the candidate predecessor Gadget fragment to obtain the predecessor predicate constraint set. The predicate context of the candidate predecessor Gadget fragment records all path constraints accumulated from the entry point of the vulnerability chain to the exit point of that fragment. These path constraints may originate from the execution path of the fragment itself, or they may be accumulated constraints propagated from earlier predecessor fragments. Therefore, the predecessor predicate constraint set can completely describe all path conditions that the target Java application must satisfy before reaching the current link point.

[0066] Extract the predicate tags from the predicate context of the corresponding candidate successor Gadget fragment to obtain a successor predicate constraint set. The candidate successor Gadget fragment explicitly specifies the preconditions that the predecessor Gadget fragment must satisfy to link with it through linking requirements. These preconditions define the necessary conditions for the successor Gadget fragment to be correctly activated and executed. By extracting the preconditions of the candidate successor Gadget fragment and the path constraints generated during the execution of the candidate successor Gadget fragment itself, a successor constraint set can be formed. The successor constraint set can describe the expectation of the candidate successor Gadget fragment on the state of the corresponding candidate predecessor Gadget fragment and the execution constraints of the fragment itself.

[0067] A Cartesian product operation is performed on the set of predecessor predicate constraints and the set of successor predicate constraints to obtain all predicate label pairs in the candidate Gadget fragment link pairs. The resulting predicate label pairs may be single or multiple, serving as input data for conflict detection. Multiple predicate label pairs constitute the input dataset for conflict detection.

[0068] In some embodiments, not all predicate tag pairs need to undergo conflict detection. Potentially conflicting tag pairs—those belonging to the same constraint dimension—can be selected in subsequent steps and subjected to detailed conflict analysis. Specifically, for each predicate tag to be merged, the existing tags in the base context are traversed. It is checked whether the tag to be merged belongs to the same dimension as existing tags. Conflicts are handled. If any predicate conflict is detected, the merging operation is immediately terminated. The link to that segment is rejected to avoid generating logically unsatisfactory Gadget Chains. This early pruning mechanism avoids subsequent invalid analysis.

[0069] This establishes the set of analysis objects for conflict detection, providing the necessary input data for subsequent dimensionality judgment and logical conflict analysis. By systematically enumerating all predicate label pairs that need to be detected, complete conflict detection is achieved, ensuring that no potential constraint contradictions are overlooked.

[0070] Next, the attribute extraction stage for predicate tag pairs begins. In step S320, data structure access and attribute reading operations are performed on the two predicate tags in each predicate tag pair to extract their core identification information, laying the foundation for subsequent dimensional comparisons. Specifically, the predicate type field and predicate keyword field of the predicate tag pair can be read to obtain the first predicate type field and first predicate keyword field of the first predicate tag, and the second predicate type field and second predicate keyword field of the second predicate tag. The predicate type field identifies the object category targeted by the corresponding predicate constraint (i.e., the predicate tag), and is used to define the semantic classification of the predicate constraint. Different predicate types represent predicate constraints on different aspects of the execution state of the target JAVA program. By reading the predicate type field, it is possible to quickly determine which semantic category the predicate constraint expressed by the predicate tag belongs to. The predicate keyword field further specifies the object on which the constraint applies. Under the same predicate type, there may be multiple different constraint objects. The predicate keyword explicitly indicates, in the form of an identifier, which method, which parameter position, which object field, or which program element the constraint specifically targets. This precise object identification enables the system to distinguish constraints for different objects, even if they belong to the same predicate type.

[0071] The extracted predicate type and predicate keyword information will serve as input data for the next step, used to determine whether the two predicate labels in a predicate label pair belong to the same constraint dimension. By obtaining the first predicate type field and the first predicate keyword field of the first predicate label, and the second predicate type field and the second predicate keyword field of the second predicate label, the core elements of the predicate constraint dimension can be obtained. Only on this basis can effective dimension comparison and conflict judgment be performed.

[0072] It should be understood that attribute extraction is a purely data access operation, involving no logical judgments or numerical calculations. It merely exposes the type and keyword information stored within the predicate tags, making it usable by subsequent comparison and analysis steps. By making attribute extraction a distinct step, separation of concerns is achieved, ensuring that each stage of the conflict detection process has clear responsibilities and defined inputs and outputs.

[0073] Then, the dimension determination stage begins. In step S330, based on the first predicate type field and the first predicate keyword field, and the second predicate type field and the second predicate keyword field of the second predicate label, it is determined whether the first predicate label and the second predicate label belong to the same dimension. That is, it can be determined whether the first predicate label and the second predicate label constrain the same attribute of the same object. Dimension determination is a prerequisite for conflict detection because only constraints of the same dimension can produce logical contradictions; constraints of different dimensions can coexist peacefully without causing conflicts. Dimension determination can avoid false detections.

[0074] In some embodiments, the predicate type fields of the first predicate label and the second predicate label can be compared to determine whether the constraints of the two predicate labels belong to the same semantic category. Only when the type fields of the two predicate labels are completely identical can they constrain program attributes of the same type. Specifically, the equality of strings or enumeration values ​​can be used to quickly determine whether the predicate types match.

[0075] Having the same predicate type is insufficient to determine that two constraints belong to the same dimension. Under the same predicate type, there may be multiple different constraint objects. Therefore, the predicate keyword fields of the two predicate labels can be compared to determine if the two constraints apply to the same specific object. This determination can be performed using string or identifier equality comparisons. Only when the predicate keywords are also completely identical can it be determined that the two constraints attempt to impose restrictions on the same program element. That is, the first predicate label and the second predicate label are determined to belong to the same dimension.

[0076] Next, for predicate tag pairs determined to be in the same dimension, the deep information extraction stage begins. In step S340, in response to the first predicate tag and the second predicate tag belonging to the same dimension, the first comparison operator type and the first constraint value content of the first predicate tag are extracted, and the second comparison operator type and the second constraint value content of the second predicate tag are extracted. The comparison operator field defines the comparison relationship of the constraint condition, explicitly specifying the mathematical or logical relationship that the constraint object must satisfy with the constraint value. The constraint value field specifies the specific value that the constraint condition must satisfy. The comparison operator and the constraint value together completely define the specific semantics of a constraint condition. Neither a single comparison operator nor a single constraint value can fully express the meaning of the constraint; both must be combined to form a meaningful constraint condition judgment. Therefore, by extracting the operator field and the constraint value field, detailed information necessary for conflict logic judgment can be obtained. Obtaining the complete constraint semantics expressed by each predicate tag enables subsequent conflict logic judgments to perform accurate logical reasoning based on complete constraint information.

[0077] In some embodiments, comparison operator and constraint value extraction operations can be performed separately on the first predicate label and the second predicate label. Specifically, for the first predicate label, its comparison operator type and constraint value content are obtained and stored in a dedicated data structure. For the second predicate label, the same extraction operation is performed to obtain its comparison operator and constraint value information. By extracting detailed constraint information for both predicate labels separately, data preparation can be made for pairwise comparisons and conflict analysis. Complete and accurate extraction of detailed constraint information is a prerequisite for effective conflict judgment, enabling accurate identification of constraint combinations with logical contradictions.

[0078] The extracted comparison operator and constraint value information will be directly used for conflict logic judgment in the final step. Next, in step S350, the combination of operators and constraint values ​​of the first predicate label and the second predicate label can be analyzed to determine whether they constitute a logical contradiction. Specifically, based on the first comparison operator type and the first constraint value content, as well as the second comparison operator type and the second constraint value content, it can be determined whether there is a logical contradiction between the first target predicate label and the second target predicate label.

[0079] Determining whether there is a logical contradiction between the first target predicate label and the second target predicate label is the core of the entire predicate conflict detection mechanism. By performing logical analysis on the combination of comparison operators and constraint values, it is possible to determine whether the two constraints—the comparison operator type and the constraint value content—can be satisfied simultaneously, or whether there is an irreconcilable logical contradiction between them.

[0080] When a logical conflict exists between predicate tags, appropriate measures are taken immediately. The linking operation of the corresponding candidate Gadget fragment pair can be marked as infeasible, a linking failure flag can be set, and linking of the candidate predecessor Gadget fragment with the candidate successor Gadget fragment can be prevented. Typically, detailed conflict information can be recorded simultaneously, including the content of the conflicting predicate tags, the specific cause of the conflict, and the identifier of the fragment involved. This detailed information can be written to a log system to generate a visual conflict analysis report for subsequent analysis and debugging.

[0081] Conversely, if it is determined that the two predicate tags in a predicate tag pair do not have logical conflicts, meaning their constraints can be satisfied simultaneously, then the predicate tag pair is allowed to pass the conflict detection. When there are multiple predicate tags in a candidate Gadget fragment link pair, other predicate tag pairs involved in the fragment link can be further checked. Only when all relevant predicate tag pairs pass the conflict detection is the fragment link finally determined to be feasible. Then, the predicate contexts in the candidate predecessor Gadget fragments and the corresponding candidate successor Gadget fragments without logical conflicts are merged to generate a new merged fragment. The merged predicate constraints are then propagated to the newly constructed vulnerability chain to obtain the candidate vulnerability chain.

[0082] Specifically, the merged predicate context can be assigned to the predicateContext field of the new fragment. This enables the propagation of predicate constraints from predecessor and successor fragments to the newly constructed chain. During multiple iterations of linking, each newly generated fragment carries the complete path predicate constraints accumulated from the source.

[0083] In some embodiments, step S400 may involve traversing candidate gadget chains. After multiple rounds of fragment linking, several candidate gadget chains are generated. These candidate gadget chains have passed local predicate conflict detection during the linking process. A global predicate constraint satisfiability analysis is performed on each candidate chain.

[0084] In some embodiments, performing a global predicate constraint satisfiability analysis on each candidate vulnerability chain may include extracting all predicate tags from the predicate context of the candidate vulnerability chain. These predicate tags record the full path constraints from the deserialization entry point to the final sink method. Then, a global pairwise conflict detection is performed. Specifically, global pairwise conflict detection may include traversing any combination of two predicate tags in the constraint set to check for previously undetected logical contradictions. Invalid candidate vulnerability chains are marked and filtered; specifically, candidate vulnerability chains with detected predicate conflicts are marked as unsatisfiable. These invalid candidate vulnerability chains are filtered out from the final result. Only valid candidate Gadget Chains whose path conditions are satisfiable are retained. The number of filtered invalid candidate vulnerability chains is counted to evaluate the pruning effect of predicate propagation. Finally, exploit hints guided by predicate constraints are generated. For each valid Gadget Chain, an exploit construction hint is automatically generated based on its predicate constraints. For method name constraints, the hint suggests the method name to be set in the dynamic proxy call.

[0085] In some embodiments, a detailed detection report containing predicate constraint information can also be generated. The report can list the complete method call sequence for each valid Gadget Chain. Finally, the number of candidate chains filtered out by predicate conflicts is counted, quantifying the false positive reduction effect.

[0086] It is understood that before using the technical solutions of the various embodiments in this application, users will be informed of the type, scope of use, and usage scenarios of the personal information involved in an appropriate manner, and user authorization will be obtained.

[0087] For example, upon receiving a user's active request, a prompt message is sent to the user to explicitly inform them that the requested operation will require the acquisition and use of the user's personal information. This allows the user to independently choose, based on the prompt message, whether to provide personal information to the software or hardware such as electronic devices, applications, servers, or storage media performing the operations described in this application.

[0088] As an optional but not limited implementation, in response to a user's active request, sending a prompt message to the user can be done via a pop-up window, where the prompt message can be presented in text format. Furthermore, the pop-up window can also include a selection control allowing the user to choose "agree" or "disagree" to provide personal information to the electronic device.

[0089] It is understood that the above notification and user authorization process is merely illustrative and does not limit the implementation of this application. Other methods that comply with relevant laws and regulations may also be applied to the implementation of this application.

[0090] It should be noted that the method in this embodiment can be executed by a single device, such as a computer or server. The method can also be applied in a distributed scenario, where multiple devices cooperate to complete the task. In such a distributed scenario, one of these devices may execute only one or more steps of the method in this embodiment, and the multiple devices will interact with each other to complete the method described.

[0091] It should be noted that the above description describes some embodiments of this application. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in a different order than that shown in the above embodiments and still achieve the desired result. Furthermore, the processes depicted in the drawings do not necessarily require a specific or sequential order to achieve the desired result. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0092] Based on the same inventive concept, corresponding to the methods of any of the above embodiments, this application also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the JAVA deserialization vulnerability chain detection method described in any of the above embodiments.

[0093] like Figure 5 As shown, the electronic device in this embodiment may include a processor S510, a memory S520, an input / output interface S530, a communication interface S540, and a bus S550. The processor S510, memory S520, input / output interface S530, and communication interface S540 are interconnected internally via the bus S550.

[0094] The processor S510 is the core computing unit of this electronic device, used to execute the Java deserialization vulnerability chain detection method based on predicate propagation provided in this application. The processor S510 can be implemented using a general-purpose central processing unit, microprocessor, application-specific integrated circuit (ASIC), or one or more integrated circuits. The processor S510 executes program instructions stored in the memory S520, sequentially performing operations such as Gadget fragment identification, path predicate extraction, predicate context construction, fragment linking, predicate conflict detection, predicate propagation, and satisfiability verification. The processor S510 coordinates the work of other hardware components through the bus S550, ensuring that all components work together to complete the vulnerability detection task.

[0095] The S520 memory provides data storage for electronic devices and can be implemented using read-only memory, random access memory, static storage devices, or dynamic storage devices. The S520 memory stores program code such as the operating system, static analysis tools, predicate extraction modules, and predicate propagation engines, as well as intermediate data generated during the detection process, including control flow graphs, predicate labels, predicate contexts, gadget fragment sets, and candidate gadget chain sets. The S520 memory also saves system configuration parameters and output results such as final reports, statistical data, and log files generated after detection.

[0096] The S530 input / output interface is used to connect input / output modules, enabling information exchange between electronic devices and external devices. The S530 input / output interface receives user-specified input information such as the Java application to be tested and configuration parameters, and supports JAR packages. The S530 outputs result data including a detection report containing predicate constraint information, predicate conflict statistics, and analysis time, supporting multiple output formats such as text, JSON, XML, and HTML.

[0097] The S540 communication interface is used to connect to the communication module, enabling data interaction between the device and clients or other systems. The S540 supports a client-server architecture deployment mode, receiving applications to be tested from clients and returning detection reports to them. The S540 also supports a distributed analysis deployment mode, where multiple devices form an analysis cluster through the communication interface to collaboratively complete large-scale application detection tasks. The S540 communication interface can also be used to access remote predicate knowledge bases and vulnerability databases, supporting encrypted transmission protocols to ensure data security.

[0098] The S550 bus is the communication backbone connecting various hardware components within the electronic device. It is responsible for transmitting data, addresses, and control signals between the processor S510, memory S520, input / output interface S530, and communication interface S540. The S550 bus adopts high-speed data transmission technology, follows standard bus protocols and specifications, supports multiple masters and arbitration mechanisms, and ensures fast and efficient communication between components.

[0099] It should be noted that the hardware configuration of the above-mentioned electronic device is exemplary and can be adjusted according to specific needs during actual deployment. The device may also include other components necessary for normal operation, or it may only contain the components necessary for implementing the solution of this application. The technical solution of this application has good hardware adaptability and scalability, and can operate effectively on a variety of electronic devices with different configurations.

[0100] The electronic device described above is used to implement the corresponding JAVA deserialization vulnerability chain detection method in any of the foregoing embodiments, and has the beneficial effects of the corresponding method embodiments, which will not be elaborated here.

[0101] Based on the same inventive concept, corresponding to any of the above embodiments, this application also provides a Java deserialization vulnerability chain detection device.

[0102] refer to Figure 6 The Java deserialization vulnerability chain detection device 600 includes: Extraction module 610 is used to identify multiple Gadget fragments of a target Java application and obtain the predicate context of the Gadget fragments based on the predicate constraints of the Gadget fragments; The candidate Gadget fragment link pair determination module 620 is used to determine multiple candidate Gadget fragment link pairs based on taint analysis; the candidate Gadget fragment link pair includes a candidate predecessor Gadget fragment and a corresponding candidate successor Gadget fragment. The candidate leaky copper chain generation module 630 determines whether there is a predicate conflict between the predicate context of the candidate predecessor Gadget fragment and the predicate context of the corresponding candidate successor Gadget fragment; merges the predicate contexts of the candidate predecessor Gadget fragment and the corresponding candidate successor Gadget fragment that do not have a predicate conflict to obtain a merged predicate context; and propagates the merged predicate context to the leaky chain to obtain the candidate leaky copper chain. The Java deserialization vulnerability chain determination module 640 analyzes the global predicate constraint satisfiability of the candidate vulnerability chain, and determines the candidate vulnerability chain as a Java deserialization vulnerability chain in response to the fact that the path conditions of the candidate vulnerability chain are satisfied.

[0103] In some embodiments, the predicate constraint is represented by a predicate label; the predicate constraint includes a predicate type indicating the constraint category, a predicate keyword identifying the object of action, a comparison operator defining the comparison relationship, and a constraint value specifying the specific requirements; The data structure of the Gadget fragment includes: the entry Gadget fragment header method, the exit Gadget fragment tail method, the method call sequence, the taint propagation matrix, the pre-predicate constraints required for linking, and the predicate context and linking history that record all constraints.

[0104] In some embodiments, the extraction module 610 is specifically used for: Extract the predicate tags of the execution path of the obtained Gadget fragment; Add the predicate tag to the predicate context container of the Gadget fragment to obtain the predicate context of the Gadget fragment.

[0105] In some embodiments, the extraction module 610 is further configured to: The control flow graph of the identified Gadget fragment is obtained by performing control flow graph analysis on the Gadget fragment. By traversing all nodes in the control flow graph of the Gadget fragment and combining the results of taint analysis, the key conditional branch nodes are obtained. Extract the conditional expression of the conditional branch node; Based on the semantic features of the conditional expression, determine the type of the predicate constraint of the conditional expression, and generate the corresponding type of predicate label.

[0106] In some embodiments, the candidate copper drain chain generation module 630 is specifically used for: Extract all predicate tag pairs from the candidate Gadget fragment link pairs; the predicate tag pair includes the first predicate tag of the candidate predecessor Gadget fragment and the second predicate tag of the corresponding candidate successor Gadget fragment; Read the predicate type field and predicate keyword field of the predicate tag pair to obtain the first predicate type field and first predicate keyword field of the first predicate tag, and the second predicate type field and second predicate keyword field of the second predicate tag; Based on the first predicate type field and the first predicate keyword field, and the second predicate type field and the second predicate keyword field of the second predicate label, determine whether the first predicate label and the second predicate label belong to the same dimension; In response to the first predicate label and the second predicate label belonging to the same dimension, the first comparison operator type and the first constraint value content of the first predicate label are extracted, and the second comparison operator type and the second constraint value content of the second predicate label are extracted; Based on the first comparison operator type and the first constraint value content, as well as the second comparison operator type and the second constraint value content, determine whether there is a logical contradiction between the first target predicate label and the second target predicate label.

[0107] In some embodiments, the candidate copper drain chain generation module 630 is further configured to: Extract the predicate tags from the predicate context of the candidate predecessor Gadget fragment to obtain the predecessor predicate constraint set; Extract the predicate tags of the predicate context of the corresponding candidate successor Gadget fragment to obtain the successor predicate constraint set; Perform a Cartesian product operation on the set of predecessor predicate constraints and the set of successor predicate constraints to obtain all predicate tag pairs in the candidate Gadget fragment link pairs.

[0108] In some embodiments, the Java deserialization vulnerability chain determination module is specifically used for: Extract all predicate tags from the predicate context of the candidate vulnerability chain; Perform global pairwise conflict detection to determine whether there are logical contradictions among all the predicate tag pairs.

[0109] For ease of description, the above devices are described in terms of function, divided into various modules. Of course, in implementing this application, the functions of each module can be implemented in one or more software and / or hardware.

[0110] The apparatus described above is used to implement the corresponding JAVA deserialization vulnerability chain detection method in any of the foregoing embodiments, and has the beneficial effects of the corresponding method embodiments, which will not be repeated here.

[0111] Based on the same inventive concept, corresponding to the methods of any of the above embodiments, this application also provides a non-transitory computer-readable storage medium that stores computer instructions for causing the computer to execute the JAVA deserialization vulnerability chain detection method as described in any of the above embodiments.

[0112] The computer-readable medium of this embodiment includes permanent and non-permanent, removable and non-removable media, and information storage can be implemented by any method or technology. Information can be computer-readable instructions, data structures, program modules, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic magnetic disk storage or other magnetic storage devices, or any other non-transfer medium that can be used to store information accessible by a computing device.

[0113] The computer instructions stored in the storage medium of the above embodiments are used to cause the computer to execute the JAVA deserialization vulnerability chain detection method as described in any of the above embodiments, and have the beneficial effects of the corresponding method embodiments, which will not be repeated here.

[0114] Based on the same inventive concept, corresponding to the JAVA deserialization vulnerability chain detection method described in any of the above embodiments, this application also provides a computer program product, which includes computer program instructions. In some embodiments, the computer program instructions can be executed by one or more processors of a computer to cause the computer and / or the processor to execute the JAVA deserialization vulnerability chain detection method. Corresponding to the execution entity for each step in each embodiment of the JAVA deserialization vulnerability chain detection method, the processor executing the corresponding step can belong to the corresponding execution entity.

[0115] The computer program product of the above embodiments is used to cause the computer and / or the processor to execute the JAVA deserialization vulnerability chain detection method as described in any of the above embodiments, and has the beneficial effects of the corresponding method embodiments, which will not be repeated here.

[0116] Those skilled in the art should understand that the discussion of any of the above embodiments is merely exemplary and is not intended to imply that the scope of this application (including the claims) is limited to these examples; within the framework of this application, the technical features of the above embodiments or different embodiments can also be combined, the steps can be implemented in any order, and there are many other variations of different aspects of the embodiments of this application as described above, which are not provided in the details for the sake of brevity.

[0117] Additionally, to simplify the description and discussion, and to avoid obscuring the embodiments of this application, the well-known power / ground connections to integrated circuit (IC) chips and other components may or may not be shown in the provided drawings. Furthermore, the apparatus may be shown in block diagram form to avoid obscuring the embodiments of this application, and this also takes into account the fact that the details of the implementation of these block diagram apparatuses are highly dependent on the platform on which the embodiments of this application will be implemented (i.e., these details should be fully understood by those skilled in the art). While specific details (e.g., circuits) have been set forth to describe exemplary embodiments of this application, it will be apparent to those skilled in the art that the embodiments of this application can be implemented without these specific details or with variations thereof. Therefore, these descriptions should be considered illustrative rather than restrictive.

[0118] Although this application has been described in conjunction with specific embodiments thereof, many substitutions, modifications, and variations of these embodiments will be apparent to those skilled in the art from the foregoing description. For example, other memory architectures (e.g., dynamic RAM (DRAM)) may be used with the embodiments discussed.

[0119] The embodiments of this application are intended to cover all such substitutions, modifications, and variations that fall within the broad scope of the appended claims. Therefore, any omissions, modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the embodiments of this application should be included within the protection scope of this application.

Claims

1. A method for detecting Java deserialization vulnerability chains, characterized in that, include: Identify multiple Gadget fragments of a target Java application, and obtain the predicate context of the Gadget fragments based on the predicate constraints of the Gadget fragments; Multiple candidate Gadget fragment link pairs were identified based on taint analysis; each candidate Gadget fragment link pair includes a candidate precursor Gadget fragment and a corresponding candidate successor Gadget fragment. Determine whether there is a predicate conflict between the predicate context of the candidate predecessor Gadget fragment and the predicate context of the corresponding candidate successor Gadget fragment; Merge the predicate contexts of the candidate predecessor Gadget fragments that do not have predicate conflicts with the predicate contexts of the corresponding candidate successor Gadget fragments to obtain a merged predicate context; propagate the merged predicate context to the vulnerability chain to obtain a candidate vulnerability chain; Analyze the global predicate constraint satisfiability of the candidate vulnerability chain. In response to the path condition of the candidate vulnerability chain being satisfied, determine that the candidate vulnerability chain is a Java deserialization vulnerability chain.

2. The Java deserialization vulnerability chain detection method according to claim 1, characterized in that, The predicate constraint is represented by a predicate label; the predicate constraint includes a predicate type indicating the constraint category, a predicate keyword identifying the object of action, a comparison operator defining the comparison relationship, and a constraint value specifying the specific requirements. The data structure of the Gadget fragment includes: the entry Gadget fragment header method, the exit Gadget fragment tail method, the method call sequence, the taint propagation matrix, the pre-predicate constraints required for linking, and the predicate context and linking history that record all constraints.

3. The Java deserialization vulnerability chain detection method according to claim 2, characterized in that, The predicate context of the Gadget fragment obtained based on the predicate constraints of the Gadget fragment includes: Extract the predicate tags of the execution path of the obtained Gadget fragment; Add the predicate tag to the predicate context container of the Gadget fragment to obtain the predicate context of the Gadget fragment.

4. The Java deserialization vulnerability chain detection method according to claim 3, characterized in that, The predicate tags for extracting the execution path of the Gadget fragment include: The control flow graph of the identified Gadget fragment is obtained by performing control flow graph analysis on the Gadget fragment. By traversing all nodes in the control flow graph of the Gadget fragment and combining the results of taint analysis, the key conditional branch nodes are obtained. Extract the conditional expression of the conditional branch node; Based on the semantic features of the conditional expression, determine the type of the predicate constraint of the conditional expression, and generate the corresponding type of predicate label.

5. The Java deserialization vulnerability chain detection method according to claim 1, characterized in that, Determining whether there is a predicate conflict between the predicate context of the candidate predecessor Gadget fragment and the predicate context of the corresponding candidate successor Gadget fragment includes: Extract all predicate tag pairs from the candidate Gadget fragment link pairs; the predicate tag pair includes the first predicate tag of the candidate predecessor Gadget fragment and the second predicate tag of the corresponding candidate successor Gadget fragment; Read the predicate type field and predicate keyword field of the predicate tag pair to obtain the first predicate type field and first predicate keyword field of the first predicate tag, and the second predicate type field and second predicate keyword field of the second predicate tag; Based on the first predicate type field and the first predicate keyword field, and the second predicate type field and the second predicate keyword field of the second predicate label, determine whether the first predicate label and the second predicate label belong to the same dimension; In response to the first predicate label and the second predicate label belonging to the same dimension, the first comparison operator type and the first constraint value content of the first predicate label are extracted, and the second comparison operator type and the second constraint value content of the second predicate label are extracted; Based on the first comparison operator type and the first constraint value content, as well as the second comparison operator type and the second constraint value content, determine whether there is a logical contradiction between the first predicate label and the second predicate label.

6. The Java deserialization vulnerability chain detection method according to claim 5, characterized in that, The extraction of predicate tag pairs from the candidate Gadget fragment link pairs includes: Extract the predicate tags from the predicate context of the candidate predecessor Gadget fragment to obtain the predecessor predicate constraint set; Extract the predicate tags of the predicate context of the corresponding candidate successor Gadget fragment to obtain the successor predicate constraint set; Perform a Cartesian product operation on the set of predecessor predicate constraints and the set of successor predicate constraints to obtain all predicate tag pairs in the candidate Gadget fragment link pairs.

7. The Java deserialization vulnerability chain detection method according to claim 1, characterized in that, The analysis of the global predicate constraint satisfiability of the candidate vulnerability chain includes: Extract all predicate tags from the predicate context of the candidate vulnerability chain; Perform global pairwise conflict detection to determine whether there are logical contradictions among all the predicate tag pairs.

8. A Java deserialization vulnerability chain detection device, characterized in that, include: An extraction module is used to identify multiple Gadget fragments of a target Java application and obtain the predicate context of the Gadget fragments based on the predicate constraints of the Gadget fragments. The candidate Gadget fragment link pair determination module is used to determine multiple candidate Gadget fragment link pairs based on taint analysis; the candidate Gadget fragment link pair includes a candidate predecessor Gadget fragment and a corresponding candidate successor Gadget fragment. The candidate leaky copper chain generation module determines whether there is a predicate conflict between the predicate context of the candidate predecessor Gadget fragment and the predicate context of the corresponding candidate successor Gadget fragment. Merge the predicate contexts of the candidate predecessor Gadget fragments that do not have predicate conflicts with the predicate contexts of the corresponding candidate successor Gadget fragments to obtain a merged predicate context; propagate the merged predicate context to the vulnerability chain to obtain a candidate vulnerability chain; The Java deserialization vulnerability chain determination module analyzes the global predicate constraint satisfiability of the candidate vulnerability chain, and determines the candidate vulnerability chain as a Java deserialization vulnerability chain in response to the satisfiability of the path conditions of the candidate vulnerability chain.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor, when executing the program, implements the method as claimed in any one of claims 1 to 7.

10. A non-transitory computer-readable storage medium storing computer instructions for causing a computer to perform the method of any one of claims 1 to 7.

Images