Method and apparatus for determining a taint propagation path

Abstract

The application discloses a method and device for determining a pollution propagation path, the method comprising: obtaining a program dependency graph corresponding to a target vehicle-mounted system and a preset pollution source node; the program dependency graph comprising at least two program nodes and connecting edges; finding a program node matching the preset pollution source node in the program dependency graph to obtain a target program node; performing semantic slicing on the program dependency graph according to the target program node to obtain a program dependency subgraph; obtaining node attribute information of each program node in the program dependency subgraph and edge attribute information of each connecting edge; performing screening processing on the program nodes in the program dependency subgraph according to the node attribute information and the edge attribute information to obtain at least two pollution propagation nodes; and constructing a pollution propagation path according to a dependency relationship between the at least two pollution propagation nodes. The application improves the pollution analysis efficiency and ensures the accuracy of the obtained pollution propagation path.

Description

Technical Field

[0001] This application relates to the fields of information security analysis and software vulnerability analysis, and in particular to a method and apparatus for determining taint propagation paths. Background Technology

[0002] Taint analysis is a key information security analysis technique, and its basic principle can be described as triples.<source,sink, sanitizer> In taint analysis, a taint source is the introduction of untrusted or confidential data into the system; a sink is the taint sink, which triggers security-sensitive operations or leads to privacy leaks; and a sanitizer is the data cleansing process that eliminates data hazard through encryption or cleansing. The goal of taint analysis is to determine whether tainted data can bypass the cleansing process and propagate to the sink. Based on how taint sources propagate within the software system, taint propagation is divided into explicit propagation and implicit propagation. Explicit propagation is triggered by direct assignment or function calls; implicit propagation includes implicit control channels, termination channels, timing channels, and exception channels, which can indirectly infer tainted data through program branch behavior, loop termination, execution time, or exception information. Ignoring implicit channels can lead to under-taintization, while excessive labeling can cause over-taintization.

[0003] Taint analysis methods are mainly divided into two types: static and dynamic. Static analysis does not execute the program and examines explicit flow propagation through data dependency checks, but it is difficult to handle implicit flows and function calls in large programs. Dynamic analysis tracks taint markers at runtime and designs propagation rules, but its coverage path is limited and cannot guarantee path integrity. Summary of the Invention

[0004] This application provides a method and apparatus for determining taint propagation paths, which can improve the efficiency of taint analysis and ensure the accuracy of the obtained taint propagation paths.

[0005] On the one hand, this application provides a method for determining the propagation path of taint, the method comprising: Obtain the program dependency graph corresponding to the target vehicle system and the preset taint source node; the program dependency graph includes at least two program nodes and connecting edges; each program node represents a code segment; the connecting edge is used to connect two program nodes that have a semantic dependency relationship; the code segment corresponding to the preset taint source node includes abnormal data. The target program node is obtained by searching the program dependency graph for a program node that matches the preset taint source node. Based on the target program node, the program dependency graph is semantically sliced ​​to obtain a program dependency subgraph; Obtain the node attribute information of each program node and the edge attribute information of each connecting edge in the program dependency subgraph; Based on the node attribute information and the edge attribute information, the program nodes in the program dependency subgraph are filtered to obtain at least two taint propagation nodes. Based on the dependencies between the at least two taint propagation nodes, a taint propagation path is constructed.

[0006] In one exemplary embodiment, obtaining the program dependency graph and preset taint source nodes corresponding to the target vehicle system includes: Obtain the preset taint source node and initial source code corresponding to the target vehicle system; The initial source code is subjected to semantic analysis to obtain semantic analysis results; the semantic analysis results include at least two code snippets. The flow direction of data within two adjacent code segments in the semantic analysis results is analyzed to obtain the data flow analysis results. The control logic of data within two adjacent code segments in the semantic analysis results is analyzed to obtain the control logic analysis results. Based on the data flow analysis results and the control logic analysis results, the program dependency graph is constructed.

[0007] In one exemplary embodiment, the step of semantically slicing the program dependency graph based on the target program node to obtain a program dependency subgraph includes: Based on the data flow analysis results and the control logic analysis results, the dependency path corresponding to the target program node is determined; the dependency path includes the target program node and at least two program nodes corresponding to the target program node; and the dependency path starts from the target program node. Based on the dependency path, filter the branch program node corresponding to the target program node in the program dependency graph; Based on the target program node and the corresponding branch program node, the program dependency graph is semantically sliced ​​to obtain the program dependency subgraph.

[0008] In one exemplary embodiment, obtaining the program dependency graph and preset taint source nodes corresponding to the target vehicle system further includes: Obtain the program dependency graph, preset taint source node, and preset convergence point corresponding to the target vehicle system; the code segment corresponding to the preset convergence point includes the abnormal data; the abnormal data starts from the preset taint source node and flows to the preset convergence point along the dependency path; The process of filtering program nodes in the program dependency subgraph based on the node attribute information and the edge attribute information yields at least two taint propagation nodes, including: According to the dependency path, each program node in the program dependency subgraph is traversed sequentially. For the current program node that is traversed, the current program node is analyzed and processed according to the current node attribute information corresponding to the current program node and the current edge attribute information corresponding to the connection edge connected to the current program node, so as to obtain the current node analysis result corresponding to the current program node. A consistency comparison is performed between the current program node and the target program node to obtain the first node comparison result; A consistency comparison is performed between the current program node and the preset convergence point to obtain the second node comparison result; Based on the current node analysis result, the first node comparison result, and the second node comparison result, the program nodes in the program dependency subgraph are filtered to obtain the at least two taint propagation nodes.

[0009] In one exemplary embodiment, before sequentially traversing each program node in the program dependency subgraph according to the dependency path, and analyzing and processing the current program node based on the current node attribute information corresponding to the current program node and the current edge attribute information corresponding to the connection edge connected to the current program node to obtain the current node analysis result, the method further includes: In response to the taint propagation path determination instruction, an initial set of program nodes corresponding to the target vehicle system is constructed; The step of filtering program nodes in the program dependency subgraph based on the current node analysis result, the first node comparison result, and the second node comparison result to obtain the at least two taint propagation nodes includes: Based on the current node analysis result, the first node comparison result, and the second node comparison result, the initial program node set is updated to obtain the target program node set. The program nodes in the target program node set are used as the at least two taint propagation nodes.

[0010] In one exemplary embodiment, updating the initial program node set based on the current node analysis result, the first node comparison result, and the second node comparison result to obtain the target program node set includes: If the comparison result of the first node indicates that the current program node is consistent with the preset taint source node, a first path node corresponding to the current program node is created based on the analysis result of the current node. Add the first path node to the initial program node set to obtain the updated program node set; Filter the target branch program node corresponding to the current program node in the program dependency subgraph; Based on the target branch program node and the node attribute information corresponding to the target branch program node, generate the path node corresponding to the target branch program node; The path node corresponding to the target branch program node is added to the update program node set to obtain the target program node set.

[0011] In one exemplary embodiment, the current node analysis result includes the propagation type of the current program node; the step of updating the initial program node set based on the current node analysis result, the first node comparison result, and the second node comparison result to obtain the target program node set further includes: If the current node analysis result indicates that the propagation type of the current program node is explicit propagation, the first node comparison result indicates that the current program node is inconsistent with the preset taint source node, and the second node comparison result indicates that the current program node is inconsistent with the preset convergence point, then obtain the first conditional statement corresponding to the current program node. Based on the analysis results of the current node and the first conditional statement, create a second path node corresponding to the current program node; The second path node is added to the initial program node set to obtain the target program node set.

[0012] In one exemplary embodiment, the step of updating the initial program node set based on the current node analysis result, the first node comparison result, and the second node comparison result to obtain the target program node set further includes: If the analysis result of the current node indicates that the propagation type of the current program node is implicit propagation, obtain the second conditional statement corresponding to the current program node; The second conditional statement is used to check whether the preset taint source node exists, and the node search result is obtained. Based on the node search results and the current node analysis results, create a third path node corresponding to the current program node; The third path node is added to the initial program node set to obtain the target program node set.

[0013] In one exemplary embodiment, after constructing the taint propagation path based on the dependency relationship between the at least two taint propagation nodes, the method further includes: Obtain the propagation type and node source code corresponding to each program node in the taint propagation path; The path propagation type corresponding to the taint propagation path is determined based on the propagation type corresponding to each program node in the taint propagation path. Based on the source code of each program node in the taint propagation path, determine the path source code corresponding to the taint propagation path; Based on the path propagation type and path source code corresponding to the taint propagation path, a taint analysis report is generated.

[0014] On the other hand, a device for determining the propagation path of a stain is provided, the device comprising: The first acquisition module is used to acquire the program dependency graph corresponding to the target vehicle system and the preset taint source node; the program dependency graph includes at least two program nodes and connecting edges; each program node represents a code segment; the connecting edge is used to connect two program nodes that have a semantic dependency relationship; the code segment corresponding to the preset taint source node includes abnormal data; The target program node determination module is used to find the program node that matches the preset taint source node in the program dependency graph to obtain the target program node; The program dependency subgraph determination module is used to perform semantic slicing on the program dependency graph based on the target program node to obtain the program dependency subgraph; The attribute information acquisition module is used to acquire the node attribute information of each program node and the edge attribute information of each connecting edge in the program dependency subgraph. The taint propagation node determination module is used to filter program nodes in the program dependency subgraph based on the node attribute information and the edge attribute information to obtain at least two taint propagation nodes. The taint propagation path determination module is used to construct a taint propagation path based on the dependency relationship between the at least two taint propagation nodes.

[0015] On the other hand, a method for determining the taint propagation path is provided, the method comprising: Obtain the preset taint source nodes and initial source code corresponding to the target vehicle system; The initial source code is subjected to semantic analysis to obtain semantic analysis results; the semantic analysis results include at least two code snippets. The flow direction of data within two adjacent code segments in the semantic analysis results is analyzed to obtain the data flow analysis results. The control logic of data within two adjacent code segments in the semantic analysis results is analyzed to obtain the control logic analysis results. Based on the data flow analysis results and the control logic analysis results, the program dependency graph is constructed; the program dependency graph includes at least two program nodes and connecting edges; each program node represents a code segment; the connecting edges are used to connect two program nodes that have a semantic dependency relationship; the code segment corresponding to the preset taint source node includes abnormal data. The target program node is obtained by searching the program dependency graph for a program node that matches the preset taint source node. Based on the data flow analysis results and the control logic analysis results, the dependency path corresponding to the target program node is determined; the dependency path includes the target program node and at least two program nodes corresponding to the target program node; and the dependency path starts from the target program node. Based on the dependency path, filter the branch program node corresponding to the target program node in the program dependency graph; Based on the target program node and the corresponding branch program node, the program dependency graph is semantically sliced ​​to obtain a program dependency subgraph. Obtain the node attribute information of each program node and the edge attribute information of each connecting edge in the program dependency subgraph; Obtain the preset convergence point corresponding to the target vehicle system; the code segment corresponding to the preset convergence point includes the abnormal data; the abnormal data starts from the preset taint source node and flows to the preset convergence point along the dependency path; In response to the taint propagation path determination instruction, an initial set of program nodes corresponding to the target vehicle system is constructed; Based on the dependency path, each program node in the program dependency subgraph is traversed sequentially. For the current program node that is traversed, the current program node is analyzed and processed according to the current node attribute information corresponding to the current program node and the current edge attribute information corresponding to the connection edge connected to the current program node, so as to obtain the current node analysis result corresponding to the current program node; the current node analysis result includes the propagation type of the current program node. A consistency comparison is performed between the current program node and the target program node to obtain the first node comparison result; A consistency comparison is performed between the current program node and the preset convergence point to obtain the second node comparison result; If the comparison result of the first node indicates that the current program node is consistent with the preset taint source node, a first path node corresponding to the current program node is created based on the analysis result of the current node. Add the first path node to the initial program node set to obtain the updated program node set; Filter the target branch program node corresponding to the current program node in the program dependency subgraph; Based on the target branch program node and the node attribute information corresponding to the target branch program node, generate the path node corresponding to the target branch program node; Add the path node corresponding to the target branch program node to the update program node set to obtain the target program node set; If the current node analysis result indicates that the propagation type of the current program node is explicit propagation, the first node comparison result indicates that the current program node is inconsistent with the preset taint source node, and the second node comparison result indicates that the current program node is inconsistent with the preset convergence point, then obtain the first conditional statement corresponding to the current program node. Based on the analysis results of the current node and the first conditional statement, create a second path node corresponding to the current program node; Add the second path node to the initial program node set to obtain the target program node set; If the analysis result of the current node indicates that the propagation type of the current program node is implicit propagation, obtain the second conditional statement corresponding to the current program node; The second conditional statement is used to check whether the preset taint source node exists, and the node search result is obtained. Based on the node search results and the current node analysis results, create a third path node corresponding to the current program node; The third path node is added to the initial program node set to obtain the target program node set; The program nodes in the target program node set are used as at least two taint propagation nodes; Construct an taint propagation path based on the dependencies between the at least two taint propagation nodes; Obtain the propagation type and node source code corresponding to each program node in the taint propagation path; The path propagation type corresponding to the taint propagation path is determined based on the propagation type corresponding to each program node in the taint propagation path. Based on the source code of each program node in the taint propagation path, determine the path source code corresponding to the taint propagation path; Based on the path propagation type and path source code corresponding to the taint propagation path, a taint analysis report is generated.

[0016] On the other hand, an electronic device is provided, the device including a processor and a memory, the memory storing at least one instruction or at least one program, the at least one instruction or the at least one program being loaded by the processor and executed as described above for determining the taint propagation path.

[0017] On the other hand, a computer-readable storage medium is provided, wherein at least one instruction or at least one program is stored therein, the at least one instruction or at least one program being loaded and executed by a processor to implement the method for determining the taint propagation path as described above.

[0018] On the other hand, a computer program product or computer program is provided, which includes computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium, executes the computer instructions, and causes the computer device to perform the method for determining the taint propagation path as described above.

[0019] This application provides a method and apparatus for determining a taint propagation path, which has the following technical effects: This application obtains a program dependency graph corresponding to a target vehicle system and a preset taint source node; the program dependency graph includes at least two program nodes and connecting edges; each program node represents a code segment; the connecting edge is used to connect two program nodes with a semantic dependency relationship; the code segment corresponding to the preset taint source node includes abnormal data; a program node matching the preset taint source node is found in the program dependency graph to obtain a target program node; the program dependency graph is semantically sliced ​​according to the target program node to obtain a program dependency subgraph; node attribute information of each program node and edge attribute information of each connecting edge in the program dependency subgraph are obtained; the program nodes in the program dependency subgraph are filtered according to the node attribute information and the edge attribute information to obtain at least two taint propagation nodes; a taint propagation path is constructed according to the dependency relationship between the at least two taint propagation nodes. Semantic slicing of the program dependency graph based on preset contamination source nodes yields a program dependency subgraph, reducing the scale of the taint analysis task. Based on the node attribute information of each program node and the edge attribute information of each connecting edge in the program dependency subgraph, the program nodes in the program dependency subgraph are filtered to obtain taint propagation nodes, until a taint propagation path is generated. This avoids the need to predefine taint propagation rules and can identify all types of taint propagation paths, achieving automatic determination of taint propagation paths and improving the efficiency of taint analysis. Attached Figure Description

[0020] To more clearly illustrate the technical solutions and advantages in the embodiments or prior art of this specification, the drawings used in the description of the embodiments or prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0021] Figure 1 This is a schematic diagram of the structure of a system for analyzing the propagation of all types of taints based on a program dependency graph, as provided in the embodiments of this specification. Figure 2 This is a schematic flowchart of a stain analysis method provided in the embodiments of this specification; Figure 3 This is a flowchart illustrating an implicit flow propagation type identification method provided in the embodiments of this specification; Figure 4 This is a flowchart illustrating a method for collecting conditional statements provided in an embodiment of this specification. Figure 5 This is a flowchart illustrating a method for determining a taint propagation path provided in the embodiments of this specification; Figure 6 This is a schematic diagram of the device for determining the path of stain propagation provided in the embodiments of this specification; Figure 7 This is a schematic diagram of the server structure for a method of determining a taint propagation path provided in an embodiment of this specification. Detailed Implementation

[0022] The technical solutions in the embodiments of this specification will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0023] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or server that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or devices.

[0024] The following describes a system for analyzing the propagation of all types of taints based on program dependency graphs, as described in this application. Figure 1 As shown, Figure 1 This is a schematic diagram of the structure of a system for analyzing the propagation of all types of taints based on a program dependency graph, as provided in the embodiments of this specification, including: 101: Program Dependency Graph Construction Module; The program dependency graph is the foundation of taint analysis. It can capture data dependencies and control dependencies in a program. Therefore, it is necessary to construct a program dependency graph to track the dependencies between variables in the program, thereby simulating the propagation of tainted data. The program dependency graph construction module works based on the LLVM IR intermediate representation. For the source code to be analyzed, the LLVM toolchain is used to compile and link to obtain the LLVM IR module, which is then used as the input to the program dependency graph construction module. This is because LLVM IR is a low-level intermediate representation, which is easy to analyze and platform-independent. Specifically, the program to be analyzed is compiled into an LLVM IR module using an LLVM toolchain (such as clang). For the compiled LLVM IR module, pointer analysis (to determine the memory locations that pointer variables may point to, avoiding false data dependency reports) and reachability definition analysis (to find the usage points that each variable definition can reach, ensuring the accuracy of data dependency edges) are first performed. Specifically, the pointer analysis tools built into LLVM are used to process pointer operations in LLVM IR, identify pointer alias relationships, and traverse the basic blocks in LLVM IR to calculate the usage points that the definition point of each variable may affect, thereby adding data usage edges (indicating that the variable is used) and data dependency edges (indicating value passing) from each variable definition point to the usage point. Next, since control dependency indicates whether the execution of one statement is governed by the control condition of another statement (such as an if statement), it is necessary to construct a control flow graph by using LLVM IR basic blocks as nodes and control flow transitions as edges. A post-dominant tree of the control flow graph is generated using a standard algorithm. For example, post-dominant node B dominates node A, meaning that all paths from A to the program exit must pass through B. Based on the post-dominant tree, control dependency edges are added to each node. If the control condition of node A directly affects the execution of node B, then a control dependency edge from A to B is added. For example, control dependency edges are added from the condition node of an if statement to nodes in the then branch. Secondly, since the program needs to analyze the data flow across functions when it contains function calls, inter-process analysis is performed. This involves traversing the function call points in LLVM IR, identifying the calling function and the called function, associating the actual parameter node with the formal parameter node of the called function for each call point, adding parameter equivalence edges (representing parameter passing), and analyzing the function body to summarize which input parameters affect the return value or output parameters, and constructing a summary edge from the formal parameters to the return value. By combining all nodes, control dependency edges, data dependency edges, parameter edges, call edges, and summary edges, a program dependency graph is constructed.

[0025] 102: Configuration and parsing module; taint analysis requires users to define taint sources, sinks, and harmless treatment functions to adapt to different scenarios. Therefore, a configuration and parsing module is set up, which configures taint sources, sinks, and harmless treatment functions to provide rules for subsequent taint analysis and ensure the accuracy and flexibility of taint analysis. Specifically, users have preset taint analysis configuration files (such as JSON / YAML format) according to their needs, which are used as input to the configuration parsing module to parse the taint analysis configuration files and obtain taint source configuration, aggregation point configuration and harmless treatment configuration; The taint source configuration includes two attributes: function name and source parameter. The source parameter is a list of integer variables representing the number of tainted sources a tainted function can import. Each variable in the list represents a taint source number, starting from 0, indicating which parameter of the tainted function imports the taint source. Additionally, a taint source can come from the return value of the tainted function, represented by a special integer (e.g., 255, as the number of parameters in a function is usually a single digit). In short, the taint source configuration identifies the points in the program where tainted data is introduced. For the aggregation point configuration, a function name and a list of leaked parameters need to be specified. If the list of leaked parameters is empty, a leak is considered to have occurred if any tainted data is passed to the specified function; if the list of leaked parameters is not empty, each parameter in the list is checked, and a leak is considered to have occurred if any one of the parameters is tainted. In short, the aggregation point configuration identifies points where tainted data may leak. For the harmless treatment configuration, the harmless treatment function name and the harmless treatment parameter list must be specified. The harmless treatment parameter list must be configured, and propagation will only stop when the parameters specified in the parameter list are selected; in short, the harmless treatment configuration identifies the purification function.

[0026] Once these configurations are parsed, they can be stored in an in-memory data structure for use by the program slicing module and the taint propagation analysis module.

[0027] 103: Program Slicing Module; The program slicing module is used to reduce the analysis scale, retaining only the code related to the taint source, thus improving analysis efficiency; and the program dependency graph after slicing is smaller, which improves the efficiency of taint propagation analysis. Specifically, the program dependency graph output by the program dependency graph construction module and the various configurations output by the configuration parsing module are used as inputs to the program slicing module. First, taint source nodes are matched, program nodes in the program dependency graph are traversed, and taint source nodes are located according to the function names and parameter information in the taint analysis configuration. For example, if the taint source is the return value of getchar, then the node representing the return value of the getchar call is found. Next, starting from each taint source node, a forward traversal is performed along data dependency edges, control dependency edges, and inter-process edges (such as parameter edges) to collect all reachable nodes. These nodes constitute the program dependency subgraph of the slice code. Finally, based on the collected nodes, all edges (data dependencies, control dependencies, etc.) between these nodes in the original program dependency graph are retained, and a new program dependency graph is constructed. The sliced ​​program dependency graph of all taint sources will be used as input to the taint propagation analysis module.

[0028] 104: Taint Propagation Analysis Module; The taint propagation analysis module is used to perform taint propagation analysis, check whether tainted data propagates from the taint source to the sink point, and record the propagation path; it can also identify explicit streams, implicit streams, and hidden channels, and provide detailed vulnerability information; Specifically, the sliced ​​program dependency graph corresponding to each taint source is used as input; such as Figure 2 As shown, Figure 2 A schematic flowchart of a stain analysis method provided in the embodiments of this specification includes: S201: Initialize taint propagation context.

[0029] In the embodiments of this specification, a taint propagation context is initialized to record traversal paths and leakage results. Specifically, an empty node list is created to record the nodes traversed by the current path, and an empty path set is created to store all paths where leakage is discovered; the two are collectively referred to as the taint propagation context.

[0030] S202: Traverse the dependency graph starting from the node corresponding to the taint source.

[0031] In the embodiments described in this specification, the program dependency graph after the slice is traversed starting from the taint source node.

[0032] S203: Calculate the target node, whether it is leaking, and the propagation type.

[0033] In the embodiments described in this specification, along each traversed node and the edges connected to each node, the set of target nodes for taint propagation of the current node, whether it leaks, and the propagation type are calculated. Specifically, the current node is classified and processed as follows: 1) If the current node is a function parameter node, since parameter passing is an explicit data stream, the input parameter node corresponding to the parameter is added to the target node set, and the target node set is returned. This is not a leak and is an explicit stream propagation type. 2) If the current node calls the harmless processing function and meets the stop propagation condition, since the harmless function stops propagation, it returns an empty set, is not a leak, and is an explicit stream propagation type; 3) If the current node calls the sink function and meets the leakage condition, it is considered a leak when it reaches the sink. Therefore, it returns an empty set, is a leak, and is an explicit stream propagation type. 4) If the current node calls another function and has a return value, the propagation terminates because the function return value is not contaminated, and the return value of the called function is not affected by the current node (i.e., the contaminated parameter node). Therefore, it returns an empty set, is not a leak, and is an explicit stream propagation type. 5) If the current node is an implicit flow control node, since control dependencies may introduce implicit flow leakage, collect the variable nodes defined in the then and else branches (if they exist) and add them to the target node set. Return the target node set, whether it is a leakage, and the implicit flow propagation type. Additionally, for implicit flow control nodes, such as Figure 3 As shown, Figure 3 This is a flowchart illustrating an implicit flow propagation type identification method provided in the embodiments of this specification, including: S301: Instruction to retrieve the condition of a tainted variable.

[0034] In the embodiments of this specification, the condition instruction for obtaining the taint variable is used.

[0035] S302: Determine if the conditional instruction is a loop condition. If not, proceed to S307.

[0036] In the embodiments of this specification, since loops and branches need to be treated differently in implicit flow analysis because their semantics and potential threats are different, the LLVM LoopInfo Pass (the core of LLVM for analyzing loop structures within functions) is used to identify whether the condition instruction is a loop condition (such as the condition in while or for) or a normal branch condition (such as the condition in an if statement).

[0037] S303: Collect all instructions in the loop body.

[0038] In the embodiments described in this specification, after determining that it is a loop condition, the loop body controlled by the loop condition is identified, and all instructions within the loop body are collected.

[0039] S304: Determine if the instructions in the loop body use tainted variables; if so, proceed to S306.

[0040] In the embodiments described in this specification, each instruction in the loop body is checked to determine whether any instruction uses the tainted variable in the condition.

[0041] S305: Termination channel.

[0042] In the embodiments described in this specification, if a taint variable is not used, it is identified as a terminated channel (hidden channel).

[0043] S306: Skip implicit flow propagation type identification.

[0044] In the embodiments described in this specification, if tainted variables are used, it indicates that tainted data directly affects the program state through instructions in the loop body, suggesting a more complex hybrid propagation pattern. In this case, the identification of implicit flow propagation type is skipped because the main leakage risk may have already been borne by the explicit flow, and there is no need to mark it as an implicit flow to avoid duplicate reporting.

[0045] S307: Collect all instructions for the then branch.

[0046] In the embodiments described in this specification, after determining that it is not a loop condition, all instructions within the then branch are collected.

[0047] S308: Determine if an else branch exists.

[0048] In the embodiments of this specification, the existence of an else branch is determined in the condition.

[0049] S309: Collect all instructions in the else branch.

[0050] In the embodiments described in this specification, if an else branch exists, all instructions in the else branch are collected.

[0051] S310: Determine if a tainted variable is used in the then or else branch; if so, proceed to S306.

[0052] In the embodiments of this specification, it is determined whether tainted variables are used in the collected then and else branches.

[0053] S311: Recursively check the then branch or else branch.

[0054] In the embodiments of this specification, if no tainted variables are used in the collected then and else branches, then the then and else branches are recursively judged.

[0055] S312: Determine if a loop exists; if no loop exists, proceed to S314.

[0056] In the embodiments of this specification, it is determined whether a loop exists in the then branch and the else branch.

[0057] S313: Timing channel.

[0058] In the embodiments described in this specification, if a branch has a loop, it is identified as a timing channel.

[0059] S314: Determine if there is an exception-throwing call in the branch.

[0060] In the embodiments of this specification, if there is no loop in the branch, it is determined whether there is an exception-throwing call in the branch, that is, to check whether there is an instruction in the then branch or else branch that directly calls the function that throws the exception. At the same time, other functions called within the branch are recursively analyzed to determine whether they will throw exceptions internally.

[0061] S315: Abnormal channel.

[0062] In the embodiments described in this specification, if a branch throws an exception call, it is identified as an abnormal channel.

[0063] S316: Implicit flow propagation.

[0064] In the embodiments of this specification, if a branch does not throw an exception call, it is identified as implicit flow propagation.

[0065] This embodiment first distinguishes between loop conditions and branch conditions, and then filters out explicit flow-dominated cases by checking whether tainted variables are used within the branch. For pure implicit flow scenarios, it further identifies taint propagation behavior caused by control dependencies rather than data dependencies based on whether the branch contains abnormal calls or loop conditions, and further distinguishes its specific type (such as timing channels and abnormal channels), thereby more accurately assessing security risks and helping to identify all types of taint propagation paths.

[0066] 6) If the current node is the control node of the covert channel, since the covert channel does not directly depend on the data flow, it returns an empty set, which is one of the leakage and covert channel propagation types; 7) In other cases, the data is propagated along the data flow by default. Therefore, the target node is added to the target node set by using the edge and the data dependency edge of the node. The target node set is returned. This is a leak, explicit flow propagation type.

[0067] S204: Handling of taint propagation path nodes.

[0068] In the embodiments of this specification, in order to record path node information, including conditional statements, and for subsequent report generation, a path node is created using the current node; if the current node is not the first node, the condition node backtracking function is called, passing in the previous node and the current node, collecting conditional statements and saving them to the path node; and the obtained propagation type field is saved to the path node corresponding to the current node, and the path node is pushed into the node list to obtain the updated node list.

[0069] In taint propagation analysis, simply knowing which nodes tainted data passed through is insufficient. To understand the logical context of vulnerability triggering, it's essential to know the conditions under which tainted data propagated to the leak point; therefore, it's necessary to collect conditional statements, such as... Figure 4 As shown, Figure 4 This is a flowchart illustrating a method for collecting conditional statements provided in this embodiment, including: S401: List of initialization condition instructions.

[0070] In the embodiments described in this specification, an empty list is created to store all the conditional instructions that are finally collected, in preparation for storing the results.

[0071] S402: Initialize the basic block queue.

[0072] In the embodiments described in this specification, a first-in-first-out queue is created for subsequent breadth-first or depth-first traversal, thereby systematically managing the basic blocks to be processed.

[0073] S403: Get the basic block where the current instruction is located and add it to the basic block queue.

[0074] In the embodiments described in this specification, the basic block to which the instruction belongs is found based on the LLVM IR instruction corresponding to the current node, and this basic block is added to the basic block queue, thereby starting backtracking from the current node.

[0075] S404: Determine if the basic block queue is empty.

[0076] In the embodiments described in this specification, this is the termination condition for the loop. The backtracking steps within the loop body continue execution as long as the queue is not empty.

[0077] S405: Pop-up head block.

[0078] In the embodiments described in this specification, a basic block to be processed is taken from the basic block queue, and processing of this basic block begins.

[0079] S406: Get the last condition instruction of the head block and add it to the condition instruction list.

[0080] In the embodiments described in this specification, the end instruction of the popped basic block is examined. If it is a conditional branch instruction, the instruction is added to the conditional instruction list, which directly determines whether the execution flow will enter the basic block containing the current node.

[0081] S407: Get all predecessor blocks of the head block and add them to the block queue.

[0082] In the embodiments of this specification, all predecessor basic blocks of the currently processed basic block (i.e., all basic blocks that directly point to the current block in the control flow graph) are obtained and added to the queue to continue backtracking upwards; since the conditional instructions at the end of these predecessor basic blocks determine whether the execution flow will enter the currently processed basic block, by continuously adding predecessors, it is possible to backtrack to all sources.

[0083] This embodiment continuously backtracks and collects all conditional statements that affect the execution of the current node. These conditional statements constitute the preconditions for the taint propagation path, which helps to generate a complete report and improves the accuracy of the taint propagation analysis results.

[0084] S205: Presentation of taint propagation pathways.

[0085] In the embodiments of this specification, for the target node set of the current node, if the target node set of the current node is empty and there is a leak, the list of the current nodes (which is a complete path at this time) is saved to the path set; if the target node set of the current node is not empty, the taint propagation context, the current node, and each node in the target node set are passed to the traversal function, and the next node is traversed recursively; when all target nodes have been processed, the last node in the node list is popped, and the traversal process of the current node is exited. Thus, the updated path set is obtained.

[0086] This embodiment performs taint propagation analysis based on the sliced ​​program dependency graph and taint source configuration, checks whether taint data propagates from the taint source to the convergence point, accurately identifies all types of taint propagation paths, and improves the efficiency of taint analysis and the accuracy of the obtained taint propagation paths.

[0087] 105: Taint Propagation Path Presentation Module; The taint propagation path presentation module is used to present the analysis results in a readable report format, helping users understand the location, propagation path, and type of vulnerabilities, facilitating remediation; Specifically, the path set output by the taint propagation analysis module is used as input. Since each path in the path set represents a potential leak, the path set is traversed. For each node in the path, the corresponding source code location is obtained using LLVM debugging information, the propagation type (explicit stream, implicit stream, hidden channel) is extracted, and the source code information of the conditional statements collected in the conditional node backtracking is extracted. Finally, a report is generated. The report includes multiple paths, and each path includes the taint source, the convergence point, the propagation type, the path node sequence (with source code location), and the conditional statements. The report output format can be text / JSON / HTML, etc.

[0088] In summary, through the collaborative work of five modules, a complete workflow from program compilation to taint propagation analysis was achieved. The LLVM IR-based approach ensured the accuracy of taint analysis, the configuration parsing module improved the flexibility of taint analysis, the program slicing module reduced the scale of taint analysis tasks and improved efficiency, the taint propagation analysis module identified multiple leakage types, and the taint propagation path presentation module generated detailed reports. The entire process effectively detected security vulnerabilities.

[0089] The following describes a method for determining the taint propagation path according to this application. Figure 5This is a flowchart illustrating a method for determining a taint propagation path provided in an embodiment of this specification. This specification provides the operational steps described in the embodiments or flowchart, but based on conventional or non-inventive labor, more or fewer operational steps may be included. The order of steps listed in the embodiments is merely one possible execution order among many and does not represent the only possible execution order. In actual system or server product execution, the methods shown in the embodiments or drawings can be executed sequentially or in parallel (e.g., in a parallel processor or multi-threaded processing environment). Specifically, as shown in the attached drawings... Figure 5 As shown, the method includes: S501: Obtain the program dependency graph and preset taint source node corresponding to the target vehicle system; the program dependency graph includes at least two program nodes and connecting edges; each program node represents a code segment; the connecting edge is used to connect two program nodes that have a semantic dependency relationship; the code segment corresponding to the preset taint source node includes abnormal data.

[0090] In the embodiments of this specification, a program dependency graph corresponding to the target vehicle system and preset taint source nodes are obtained. The program dependency graph is the foundation of taint analysis. It captures the data dependencies and control dependencies in the program. Constructing the program dependency graph helps to determine the dependencies between variables, thereby simulating the propagation of taints. Specifically, based on the LLVM IR intermediate representation work, the initial source code corresponding to the target vehicle system is taken as input, and the program dependency graph is output. The program dependency graph includes at least two program nodes and connecting edges. Each program node represents a code segment. Connecting edges are used to connect two program nodes with semantic dependencies, including control dependency edges, data dependency edges, parameter edges, call edges, and summary edges. A taint source is the starting point of tainted data. To determine the taint propagation path, it is necessary to accurately identify the taint source before starting the analysis. Therefore, users have preset taint analysis configurations according to their actual needs. These configurations can be in JSON, text, HTML, or other formats. The taint analysis configuration file is obtained and parsed to obtain taint source entries. Each entry includes two attributes: function name and source parameter. The source parameter is a list of integer variables, indicating that a tainted function can introduce one or more taint sources. Each variable in the list represents a taint source number, starting from 0, indicating which parameter of the tainted function introduces the taint source, i.e., the position of the function parameter. Furthermore, taint sources can originate from tainted functions. The return value of a number can be represented by a special integer, for example, 255. However, the number of parameters of a function is usually a single digit. The taint source entries are mapped in the program dependency graph as preset taint source nodes, including but not limited to function call nodes / function parameter nodes / function return value nodes in the program dependency graph. The code snippets corresponding to the preset taint source nodes include abnormal data, that is, the preset taint source nodes introduce user-preset untrusted data. For example, the taint source function is configured as read, and the source parameter is [0]. That is, the first parameter in the read function is the taint source. Therefore, all call nodes that call the read function are searched in the program dependency graph. For each call point, the first actual parameter node is found. These nodes are the preset taint source nodes.

[0091] In this embodiment of the specification, obtaining the program dependency graph and preset taint source nodes corresponding to the target vehicle system further includes: Obtain the preset taint source node and initial source code corresponding to the target vehicle system; In the embodiments of this specification, a taint analysis configuration file corresponding to the target vehicle system is obtained, and the taint analysis configuration file is parsed to obtain a preset taint source node; the initial source code corresponding to the target vehicle system is obtained, which is the object to be tainted.

[0092] The initial source code is subjected to semantic analysis to obtain semantic analysis results; the semantic analysis results include at least two code snippets. In the embodiments of this specification, semantic analysis is performed on the initial source code. Specifically, in order to eliminate language feature differences, since LLVM IR is a unified intermediate representation, analyzing it will simplify the analysis process. Therefore, the initial source code is compiled using a compiler (Low-Level Virtual Machine, LLVM) toolchain to obtain an LLVM IR module, which contains all functions, global variables, and debugging information corresponding to the initial source code. Each function includes multiple basic blocks, and each basic block is a continuous sequence of instructions ending with a termination instruction. The process iterates through each function in the LLVM IR module, identifies the basic blocks within the function, and establishes the control flow relationships between these basic blocks. This generates an independent control flow graph for each function, where each node represents a basic block within the function, and edges indicate control transfers between these blocks. Each control flow graph can be understood as a code snippet, including the execution order of all basic blocks within each function. By combining all the control flow graphs, the semantic analysis results are obtained. The flow direction of data within two adjacent code segments in the semantic analysis results is analyzed to obtain the data flow analysis results. In the embodiments of this specification, the flow direction of data within two adjacent code segments in the semantic analysis results is analyzed. Specifically, in order to determine the pointing relationship between pointers in different code segments and provide accurate memory access information for data dependency analysis, pointer analysis is performed on the semantic analysis results to obtain the pointer pointing relationship and clarify which memory locations each pointer may access. At the same time, in order to determine how variable definitions propagate between different code segments and find the possible definition sources of each variable usage point, reachability definition analysis is performed on the semantic analysis results to obtain the complete definition-usage relationship corresponding to the semantic analysis results and clarify where each variable value comes from and where it goes. The data flow analysis results are obtained by combining the pointer analysis results and the reachability definition analysis results.

[0093] The control logic of data within two adjacent code segments in the semantic analysis results is analyzed to obtain the control logic analysis results. In the embodiments of this specification, the control logic of data within two adjacent code segments in the semantic analysis results is analyzed. Specifically, for the semantic analysis results, the post-dominance relationship of each basic block is calculated. For example, if node A dominates node B, it means that every path from B to the program exit must pass through A, thereby constructing a post-dominance tree and obtaining the control logic analysis results.

[0094] Based on the data flow analysis results and the control logic analysis results, the program dependency graph is constructed.

[0095] In the embodiments of this specification, data usage edges and data dependency edges are constructed based on the data flow analysis results; for data usage edges, they extend from the variable node to the instruction node that uses the variable; for data dependency edges, they extend from the definition node to the usage point node. Based on the control logic analysis results, control dependency edges are constructed. Specifically, for each control point, the nodes it depends on are determined. For example, for a branch instruction S, all nodes N controlled by S (i.e., the execution of N depends on the conditions of S) are found. This is achieved by checking the dominion relationship. Specifically, if S is the direct dominator of N and there is a path between S and N, then a control dependency edge from S to N is added. Additionally, since programs typically involve function calls, taints need to propagate across functions. Therefore, inter-process analysis of the semantic analysis results is also required to connect actual and formal parameters, ensuring that taints can be passed between functions. Specifically, for each function call point, the actual and formal parameters are identified, and parameter equivalence edges are added from the actual parameter node to the formal parameter node. At the same time, a summary is constructed for each function to summarize how the function affects parameters and return values. For example, if a parameter is tainted inside a function, the summary records that the parameter may be tainted. Summary edges connect from the function call point to the function summary node, representing dependencies brought about by the call. By integrating all code snippets, control dependencies, data dependencies, parameter dependencies, call variables, and summary edges between each snippet, a program dependency graph is constructed. The initial source code is converted into an intermediate representation, and pointer analysis and reachability definition analysis are performed to build a post-dominance tree. Inter-procedural analysis is then executed to convert the semantic analysis results into concrete dependencies, ultimately integrating them into the program dependency graph. This clarifies the semantic dependencies between different program nodes, facilitating the simulation of tainted data propagation and improving taint analysis efficiency.

[0096] S503: Search the program node in the program dependency graph that matches the preset taint source node to obtain the target program node.

[0097] In the embodiments of this specification, a program node that matches a preset taint source node is searched in the program dependency graph to obtain the target program node, which is the function call node / function parameter node / function return value node that corresponds to the preset taint source configuration in the program dependency graph, so as to perform taint analysis; and there can be multiple target program nodes, the specific number of which is determined according to the user's taint analysis configuration.

[0098] S505: Perform semantic slicing on the program dependency graph based on the target program node to obtain a program dependency subgraph.

[0099] In the embodiments of this specification, in order to improve the efficiency of taint analysis, reduce the code size, retain only the parts related to taints, and ensure that the taint propagation path is not missed, a forward traversal is performed along the connection edges of the program dependency graph starting from the target program node, reaching reachable nodes, collecting all visited program nodes, and semantically slicing the program dependency graph based on the collected program nodes to obtain the program dependency subgraph.

[0100] In this embodiment of the specification, the step of semantically slicing the program dependency graph based on the target program node to obtain a program dependency subgraph includes: Based on the data flow analysis results and the control logic analysis results, the dependency path corresponding to the target program node is determined; the dependency path includes the target program node and at least two program nodes corresponding to the target program node; and the dependency path starts from the target program node. In the embodiments of this specification, based on the data flow analysis results and control logic analysis results, since the target program node is the starting point of taint analysis, the dependency path is identified starting from the target program node. Specifically, the propagation of values ​​is tracked along the data dependency edge, and the control influence is tracked along the control dependency edge, thereby recording the complete path from the taint source to each influence point, and obtaining the dependency path corresponding to the target program node. If there are multiple target program nodes, there is a dependency path corresponding to each node. Each path represents a possible propagation route of taint data, and the endpoint of the path may be a convergence point / detoxification point / propagation termination point.

[0101] Based on the dependency path, filter the branch program node corresponding to the target program node in the program dependency graph; In the embodiments of this specification, if there are multiple dependency paths, each dependency path is traversed, and all nodes on each path are filtered in the program dependency graph. The extracted nodes are merged and deduplicated to obtain a complete slice node set. Additionally, the slice node set can be optimized. Specifically, isolated nodes in the slice node set, i.e., nodes not on any dependency path, are removed to avoid false filtering. The slice node set is also checked for completeness to ensure that the dependency path of each taint source is fully included. The optimized slice node set is then used as a branch program node.

[0102] Based on the target program node and the corresponding branch program node, the program dependency graph is semantically sliced ​​to obtain the program dependency subgraph.

[0103] In the embodiments of this specification, target program nodes and their corresponding branch program nodes are extracted from the program dependency graph. All dependency edges between these nodes (data dependency edges / control dependency edges / parameter edges / call edges / Summary edges) are retained, while edges pointing to external nodes are removed. This achieves semantic slicing of the program dependency graph, resulting in a program dependency subgraph. If multiple target program nodes exist, a program dependency subgraph is set for each target program node. Based on data flow analysis results and control logic analysis results, the dependency paths corresponding to the target program nodes are determined. This allows for the selection of branch program nodes corresponding to the target program nodes from the program dependency graph, ensuring that only truly tainted nodes are selected, avoiding interference from irrelevant code, improving the accuracy of subsequent taint analysis, and reducing the complexity of taint propagation analysis.

[0104] S507: Obtain the node attribute information of each program node and the edge attribute information of each connecting edge in the program dependency subgraph.

[0105] In the embodiments of this specification, the node attribute information of each program node and the edge attribute information of each connecting edge in the program dependency subgraph are obtained; wherein, the node attribute information includes, but is not limited to, whether the node is a function parameter node / whether the node calls the harmless processing function and satisfies the stop propagation condition / whether the node calls the convergence point function and satisfies the leakage condition / whether the node calls other functions and has a return value / whether the node is an implicit flow control node / whether the node is a hidden channel control node; the edge attribute information includes, but is not limited to, whether the edge is a data usage edge / whether the edge is a data dependency edge.

[0106] S509: Based on the node attribute information and the edge attribute information, the program nodes in the program dependency subgraph are filtered to obtain at least two taint propagation nodes.

[0107] In the embodiments of this specification, program nodes in the program dependency subgraph are filtered based on node attribute information and edge attribute information to obtain program nodes that are affected or cause leakage, i.e., at least two taint propagation nodes.

[0108] In the embodiments of this specification, obtaining the program dependency graph and preset taint source nodes corresponding to the target vehicle system includes: Obtain the program dependency graph, preset taint source node, and preset convergence point corresponding to the target vehicle system; the code segment corresponding to the preset convergence point includes the abnormal data; the abnormal data starts from the preset taint source node and flows to the preset convergence point along the dependency path; In the embodiments of this specification, the program dependency graph, preset taint source nodes, and taint analysis configuration file corresponding to the target vehicle system are obtained. The taint analysis configuration file is parsed to obtain a preset convergence point. The preset convergence point is the point where tainted data may be leaked, and the user configures when a leak is considered to have occurred. Specifically, the convergence point configuration needs to specify the function name and the list of leaked parameters. If the list of leaked parameters is empty, a leak is considered to have occurred as long as tainted data is passed to the specified function. If the list of leaked parameters is not empty, each parameter is checked according to the parameter list, and a leak is considered to have occurred as long as any parameter is contaminated. Therefore, it can be considered that tainted data, i.e., abnormal data, flows from the preset taint source node along the dependency path to the preset convergence point, which may cause a leak.

[0109] In this embodiment of the specification, the step of filtering program nodes in the program dependency subgraph based on the node attribute information and the edge attribute information to obtain at least two taint propagation nodes includes: According to the dependency path, each program node in the program dependency subgraph is traversed sequentially. For the current program node that is traversed, the current program node is analyzed and processed according to the current node attribute information corresponding to the current program node and the current edge attribute information corresponding to the connection edge connected to the current program node, so as to obtain the current node analysis result corresponding to the current program node. In the embodiments of this specification, each program node in the program dependency subgraph is traversed sequentially according to the dependency path. For the current program node, the attribute information of the current program node is obtained, such as whether the node is a function parameter node, whether the node calls a harmless processing function and meets the stop propagation condition, whether the node calls a convergence point function and meets the leakage condition, whether the node calls other functions and has a return value, whether the node is an implicit flow control node, and whether the node is a hidden channel control node. The attribute information of the current edge corresponding to the connection edge connected to the current program node is obtained, including but not limited to whether the edge is a data usage edge and whether the edge is a data dependency edge. Based on the attribute information of the current node and the attribute information of the current edge, the current program node is analyzed and processed to obtain the current node analysis result. The current node analysis result includes three parameters: the set of target nodes for taint propagation of the current node, whether leakage occurs, and the propagation type, as detailed in [link to documentation]. Figure 2 There are 7 possible scenarios for S203.

[0110] A consistency comparison is performed between the current program node and the target program node to obtain the first node comparison result; In the embodiments of this specification, a consistency comparison is performed between the current program node and the target program node to determine whether the current program node is a preset pollution source node, thereby obtaining the first node comparison result.

[0111] A consistency comparison is performed between the current program node and the preset convergence point to obtain the second node comparison result; In the embodiments of this specification, a consistency comparison is performed between the current program node and the preset convergence point, that is, to determine whether the current program node is the preset convergence point, and a second node comparison result is obtained.

[0112] Based on the current node analysis result, the first node comparison result, and the second node comparison result, the program nodes in the program dependency subgraph are filtered to obtain the at least two taint propagation nodes.

[0113] In the embodiments of this specification, based on the current node analysis results, the first node comparison results, and the second node comparison results, the program nodes in the program dependency subgraph are filtered to obtain nodes that may affect other nodes or cause leakage, i.e., at least two taint propagation nodes. By using the node attribute information and edge attribute information of each program node in the program dependency subgraph, the direction of tainted data flow is accurately identified, distinguishing between explicit and implicit flow propagation, thus improving the accuracy of taint analysis; and based on the first and second node comparison results, propagation is automatically controlled to stop, avoiding over-propagation or premature termination, ensuring the integrity of taint propagation nodes.

[0114] In this embodiment of the specification, before the step of sequentially traversing each program node in the program dependency subgraph according to the dependency path, and analyzing and processing the current program node based on the current node attribute information corresponding to the current program node and the current edge attribute information corresponding to the connection edge connected to the current program node to obtain the current node analysis result, the method further includes: In response to the taint propagation path determination instruction, an initial set of program nodes corresponding to the target vehicle system is constructed; In the embodiments of this specification, in response to the taint propagation path determination instruction, in order to record the nodes traversed in the path, an initial program node set corresponding to the target vehicle system is constructed. Specifically, an empty list is initialized to record the nodes traversed during the traversal process, and this list is called the node list.

[0115] Additionally, in order to generate reports later, it is necessary to record the current traversal path and the discovered leak paths, and initialize an empty set to save the leak paths when a leak is discovered. This set is called the path set.

[0116] In this embodiment of the specification, the step of filtering program nodes in the program dependency subgraph based on the current node analysis result, the first node comparison result, and the second node comparison result to obtain the at least two taint propagation nodes includes: Based on the current node analysis result, the first node comparison result, and the second node comparison result, the initial program node set is updated to obtain the target program node set. In the embodiments of this specification, based on the analysis results of the current node, the comparison results of the first node, and the comparison results of the second node, a path node is created for each node; the target program node and other program nodes are distinguished. If it is a target program node, the path node is directly added to the node list in the initial program node set, and the node list is updated to obtain the updated node list; if it is not a target program node, the condition node backtracking function is called to obtain the condition statement corresponding to the node, and the path node and the condition statement are added to the updated node list to obtain the target node list. In this embodiment of the specification, updating the initial program node set based on the current node analysis result, the first node comparison result, and the second node comparison result to obtain the target program node set includes: If the comparison result of the first node indicates that the current program node is consistent with the preset taint source node, a first path node corresponding to the current program node is created based on the analysis result of the current node. In the embodiments of this specification, if the comparison result of the first node indicates that the current program node is consistent with the preset pollution source node, that is, the current program node is the starting point of the taint analysis, the first path node corresponding to the current program node is created according to the analysis result of the current node. The first path node includes the node reference corresponding to the current program node, the propagation type of the current program node, the list of conditional statements, and the source code information. Among them, the node reference corresponding to the current program node refers to the specific node in the program dependency subgraph, which is the preset taint source node in this case; The propagation type for the current program node is determined based on the analysis results of the current node. The propagation type of the preset taint source node is usually explicit flow propagation because the tainted data propagates directly from the preset taint source node through value passing. However, if the preset taint source node involves control conditions (such as conditional assignment), it may be identified as implicit flow propagation. For the list of conditional statements for the current program node, since the preset taint source node is the first node in the taint propagation analysis and has no predecessor node, the conditional statement collection is empty. Based on the source code information of the current program node, extract the source code location corresponding to the preset taint source node from the LLVM debugging information.

[0117] Add the first path node to the initial program node set to obtain the updated program node set; In the embodiments described in this specification, the first path node is added to the initial program node set to obtain the updated program node set.

[0118] Filter the target branch program node corresponding to the current program node in the program dependency subgraph; In the embodiments of this specification, the next set of nodes to which the tainted data may propagate is determined based on the target node set in the current node analysis results corresponding to the preset tainted source node, thereby filtering out the target branch program node corresponding to the current program node in the program dependency subgraph.

[0119] Based on the target branch program node and the node attribute information corresponding to the target branch program node, generate the path node corresponding to the target branch program node; In the embodiments of this specification, a path node corresponding to the target branch program node is generated based on the target branch program node and the node attribute information corresponding to the target branch program node. This path node also includes the node reference corresponding to the target branch program node, the propagation type of the target branch program node, the list of conditional statements, and the source code information.

[0120] The path node corresponding to the target branch program node is added to the update program node set to obtain the target program node set.

[0121] In the embodiments of this specification, since the target branch program node is not the first node, after creating the path node, the condition node backtracking function is called, passing in the previous node (the last node in the update program node set) and the current node, collecting condition statements and saving them to the path node, and adding the updated path node to the update program node set to obtain the target program node set. The path is progressively expanded starting from the preset taint source node, with each new node undergoing condition backtracking based on the predecessor node context, ensuring the continuity of control dependencies; condition backtracking is only performed when actually needed, avoiding the overhead of full path pre-computation and improving the efficiency of taint propagation analysis.

[0122] In this embodiment of the specification, the current node analysis result includes the propagation type of the current program node; the step of updating the initial program node set based on the current node analysis result, the first node comparison result, and the second node comparison result to obtain the target program node set further includes: If the current node analysis result indicates that the propagation type of the current program node is explicit propagation (explicit flow propagation), the first node comparison result indicates that the current program node is inconsistent with the preset taint source node, and the second node comparison result indicates that the current program node is inconsistent with the preset convergence point, then obtain the first conditional statement corresponding to the current program node. In the embodiments of this specification, if the current node analysis result indicates that the propagation type of the current program node is explicit propagation, the first node comparison result indicates that the current program node is inconsistent with the preset taint source node, and the second node comparison result indicates that the current program node is inconsistent with the preset convergence point, the condition node backtracking function is called, passing in the previous node and the current node, and collecting all condition statements that affect the execution of the current node, i.e., the first condition statement, which can be understood as a list of condition statements.

[0123] Based on the analysis results of the current node and the first conditional statement, create a second path node corresponding to the current program node; In the embodiments of this specification, a second path node corresponding to the current program node is created based on the analysis result of the current node and the first conditional statement. The second path node includes a node reference corresponding to the current program node, the propagation type of the current program node, a list of conditional statements, source code information, and the first conditional statement.

[0124] The second path node is added to the initial program node set to obtain the target program node set.

[0125] In the embodiments of this specification, the second path node is added to the initial program node set to obtain the target program node set. Even if the propagation type is explicit flow propagation, the collected conditional statements can capture the control dependency environment that affects the execution of the node, ensuring the reproducibility of the taint propagation path; the current explicit flow node may subsequently trigger implicit flow propagation, so collecting conditional statements in advance provides a complete control context for subsequent taint analysis, which helps to clearly show in the taint analysis report the conditions under which data flows to this node, improving the understandability of the analysis results; when the explicit flow is subsequently converted to an implicit flow, the collected conditional statements can be seamlessly connected to avoid interruption of the control context.

[0126] In this embodiment of the specification, the step of updating the initial program node set based on the current node analysis result, the first node comparison result, and the second node comparison result to obtain the target program node set further includes: If the analysis result of the current node indicates that the propagation type of the current program node is implicit propagation, obtain the second conditional statement corresponding to the current program node; In the embodiments of this specification, implicit propagation refers to the fact that tainted data is not directly passed through assignment or parameters, but indirectly affects program behavior through control dependencies. This propagation method is more covert and more difficult to detect. If the analysis result of the current node indicates that the propagation type of the current program node is implicit propagation (implicit flow propagation), since implicit flow propagation includes ordinary implicit flow propagation / timing channel (loop exists within the branch) / exception channel (exception is thrown within the branch) / termination channel (propagation terminates under specific conditions), the second conditional statement (then branch / else branch) corresponding to the current program node is obtained.

[0127] The second conditional statement is used to check whether the preset taint source node exists, and the node search result is obtained. In the embodiments of this specification, the second conditional statement searches for the existence of a preset taint source node, or in other words, uses a preset taint source node. Additionally, it may include other variables that are directly or indirectly assigned by the preset taint source node, i.e., nodes affected by the preset taint source node, thereby obtaining the node search result; the node search result indicates that the propagation type of the node is implicit flow propagation / timing channel / abnormal channel.

[0128] Based on the node search results and the current node analysis results, create a third path node corresponding to the current program node; In the embodiments of this specification, the propagation type of the current program node is updated based on the node lookup result to obtain the updated propagation type; additionally, backtracking is performed based on the second conditional statement to obtain all conditional statements corresponding to the current program node. Based on the updated propagation type, all conditional statements corresponding to the current program node, and the analysis results of the current node, a third path node corresponding to the current program node is created. The third path node includes the node reference corresponding to the current program node, the updated propagation type, all conditional statements, and source code information.

[0129] The third path node is added to the initial program node set to obtain the target program node set.

[0130] In the embodiments of this specification, a third path node is added to the initial program node set to obtain the target program node set. For implicitly propagating program nodes, based on the second conditional statement for obtaining the program node, it is compared with a preset taint source node or other affected nodes. This further distinguishes implicit flow propagation into specific types such as abnormal channels and timing channels, thereby directly reflecting the potential attack methods and risk levels of vulnerabilities (e.g., timing channels are often used for side-channel attacks), thus improving the accuracy of taint analysis and enhancing the detection and assessment accuracy of data leakage vulnerabilities.

[0131] The program nodes in the target program node set are used as the at least two taint propagation nodes.

[0132] In the embodiments described in this specification, when the convergence point is reached, all nodes in the target program node set are pushed onto the node list in sequence. Therefore, the program nodes in the target program node set can be used as at least two taint propagation nodes. The target program node set, as a dynamic stack structure, accurately records the complete propagation path from the preset taint source node to the current node, ensuring that path information is not lost. At the same time, the context of conditional statements is collected synchronously when a node is pushed onto the stack, binding control dependencies to specific propagation paths, ensuring the accuracy of subsequently generated taint propagation paths.

[0133] S511: Construct a taint propagation path based on the dependency relationship between the at least two taint propagation nodes.

[0134] In the embodiments of this specification, since at least two taint propagation nodes are pushed into the node list, i.e. the target program node set, in sequence, the taint propagation nodes can be recursively constructed according to the dependency relationship between the at least two taint propagation nodes, and the obtained taint propagation path can be saved to the path set.

[0135] In this embodiment of the specification, after constructing the taint propagation path based on the dependency relationship between the at least two taint propagation nodes, the method further includes: Obtain the propagation type and node source code corresponding to each program node in the taint propagation path; In the embodiments of this specification, the propagation type corresponding to each program node is extracted from the path node corresponding to each program node in the taint propagation path, and the node source code corresponding to each program node is obtained using LLVM debugging information.

[0136] The path propagation type corresponding to the taint propagation path is determined based on the propagation type corresponding to each program node in the taint propagation path. In the embodiments of this specification, the propagation type corresponding to each program node in the taint propagation path is obtained by combining the propagation types.

[0137] Based on the source code of each program node in the taint propagation path, determine the path source code corresponding to the taint propagation path; In the embodiments of this specification, the source code of the node corresponding to each program node in the taint propagation path is combined to obtain the path source code corresponding to the taint propagation path.

[0138] Based on the path propagation type and path source code corresponding to the taint propagation path, a taint analysis report is generated.

[0139] In the embodiments of this specification, additionally, conditional statements corresponding to each program node are extracted from the path nodes corresponding to each program node in the taint propagation path. A taint analysis report is generated by combining the path propagation type, path source code, preset taint source nodes, preset convergence points, and conditional statements. By generating a taint analysis report that includes path propagation type, path source code, preset taint source nodes, preset convergence points, and conditional statements, the threat level of vulnerabilities in the code is intuitively displayed. The source code helps users accurately locate the points requiring remediation, and the conditional statements demonstrate the complete logical context required for tainted data to trigger leakage. This not only completes the taint analysis report but also improves the traceability of code vulnerabilities.

[0140] This manual also provides a device for determining the path of stain propagation, such as... Figure 6 As shown, the device includes: The first acquisition module 601 is used to acquire the program dependency graph corresponding to the target vehicle system and the preset taint source node; the program dependency graph includes at least two program nodes and connecting edges; each program node represents a code segment; the connecting edge is used to connect two program nodes that have a semantic dependency relationship; the code segment corresponding to the preset taint source node includes abnormal data. The target program node determination module 602 is used to find the program node that matches the preset taint source node in the program dependency graph to obtain the target program node; The program dependency subgraph determination module 603 is used to perform semantic slicing on the program dependency graph based on the target program node to obtain the program dependency subgraph. The attribute information acquisition module 604 is used to acquire the node attribute information of each program node and the edge attribute information of each connecting edge in the program dependency subgraph. The taint propagation node determination module 605 is used to filter program nodes in the program dependency subgraph according to the node attribute information and the edge attribute information to obtain at least two taint propagation nodes. The taint propagation path determination module 606 is used to construct a taint propagation path based on the dependency relationship between the at least two taint propagation nodes.

[0141] In some embodiments, the first acquisition module further includes: The first acquisition submodule is used to acquire the preset taint source node and initial source code corresponding to the target vehicle system; A semantic analysis result determination submodule is used to perform semantic analysis on the initial source code to obtain semantic analysis results; the semantic analysis results include at least two code snippets. The data flow analysis result determination submodule is used to analyze the flow direction of data within two adjacent code segments in the semantic analysis result to obtain the data flow analysis result; The control logic analysis result determination submodule is used to analyze the control logic of data in two adjacent code segments in the semantic analysis result to obtain the control logic analysis result; The program dependency graph construction submodule is used to construct the program dependency graph based on the data flow analysis results and the control logic analysis results.

[0142] In some embodiments, the program-dependent subgraph determination module further includes: The dependency path determination submodule is used to determine the dependency path corresponding to the target program node based on the data flow analysis results and the control logic analysis results; the dependency path includes the target program node and at least two program nodes corresponding to the target program node; and the dependency path starts from the target program node. The branch program node determination submodule is used to filter the branch program node corresponding to the target program node in the program dependency graph according to the dependency path. The program dependency subgraph determination submodule is used to perform semantic slicing on the program dependency graph based on the target program node and the branch program node corresponding to the target program node to obtain the program dependency subgraph.

[0143] In some embodiments, the first acquisition module further includes: The second acquisition submodule is used to acquire the program dependency graph, preset taint source node, and preset convergence point corresponding to the target vehicle system; the code segment corresponding to the preset convergence point includes the abnormal data; the abnormal data starts from the preset taint source node and flows to the preset convergence point along the dependency path; In some embodiments, the taint propagation node determination module further includes: The current node analysis result determination submodule is used to traverse each program node in the program dependency subgraph according to the dependency path, and for the current program node that is traversed, analyze and process the current program node according to the current node attribute information corresponding to the current program node and the current edge attribute information corresponding to the connection edge connected to the current program node to obtain the current node analysis result corresponding to the current program node. The first node comparison result determination submodule is used to perform a consistency comparison between the current program node and the target program node to obtain the first node comparison result. The second node comparison result determination submodule is used to perform a consistency comparison between the current program node and the preset convergence point to obtain the second node comparison result. The taint propagation node determination submodule is used to filter program nodes in the program dependency subgraph based on the current node analysis result, the first node comparison result, and the second node comparison result to obtain the at least two taint propagation nodes.

[0144] In some embodiments, the apparatus further includes: An initial program node set construction module is used to construct the initial program node set corresponding to the target vehicle system in response to the taint propagation path determination instruction. In some embodiments, the taint propagation node determination submodule further includes: The target program node set determination unit is used to update the initial program node set based on the current node analysis result, the first node comparison result, and the second node comparison result to obtain the target program node set. The taint propagation node determination unit is used to identify program nodes in the target program node set as the at least two taint propagation nodes.

[0145] In some embodiments, the target program node set determination unit further includes: The first path node creation subunit is used to create a first path node corresponding to the current program node based on the analysis result of the current node if the comparison result of the first node indicates that the current program node is consistent with the preset taint source node. The update program node set determination subunit is used to add the first path node to the initial program node set to obtain the updated program node set; The target branch program node determination subunit is used to filter the target branch program node corresponding to the current program node in the program dependency subgraph. The path node generation subunit is used to generate the path node corresponding to the target branch program node based on the target branch program node and the node attribute information corresponding to the target branch program node. The first target program node set determination subunit is used to add the path node corresponding to the target branch program node to the update program node set to obtain the target program node set.

[0146] In some embodiments, the target program node set determination unit further includes: The first conditional statement acquisition subunit is used to acquire the first conditional statement corresponding to the current program node if the current node analysis result indicates that the propagation type of the current program node is explicit propagation, the first node comparison result indicates that the current program node is inconsistent with the preset taint source node, and the second node comparison result indicates that the current program node is inconsistent with the preset convergence point. The second path node creation subunit is used to create a second path node corresponding to the current program node based on the analysis result of the current node and the first conditional statement. The second target program node set determination subunit is used to add the second path node to the initial program node set to obtain the target program node set.

[0147] In some embodiments, the target program node set determination unit further includes: The second conditional statement acquisition subunit is used to acquire the second conditional statement corresponding to the current program node if the analysis result of the current node indicates that the propagation type of the current program node is implicit propagation. The node search result determination subunit is used to search for whether the preset taint source node exists in the second conditional statement, and obtain the node search result; The third path node creation subunit is used to create the third path node corresponding to the current program node based on the node search result and the current node analysis result. The third target program node set determination subunit is used to add the third path node to the initial program node set to obtain the target program node set.

[0148] In some embodiments, the apparatus further includes: The second acquisition module is used to acquire the propagation type and node source code corresponding to each program node in the taint propagation path. The path propagation type determination module is used to determine the path propagation type corresponding to the taint propagation path based on the propagation type corresponding to each program node in the taint propagation path. The path source code determination module is used to determine the path source code corresponding to the taint propagation path based on the node source code corresponding to each program node in the taint propagation path. The taint analysis report generation module is used to generate a taint analysis report based on the path propagation type and path source code corresponding to the taint propagation path.

[0149] The apparatus and method embodiments described herein are based on the same inventive concept.

[0150] This specification provides an electronic device including a processor and a memory. The memory stores at least one instruction or at least one program, which is loaded and executed by the processor to implement the method for determining the taint propagation path as provided in the above method embodiments.

[0151] Embodiments of this application also provide a computer storage medium, which can be disposed in a terminal to store at least one instruction or at least one program related to the determination of a taint propagation path in the method embodiment. The at least one instruction or at least one program is loaded and executed by the processor to implement the determination of the taint propagation path provided in the above method embodiment.

[0152] Embodiments of this application also provide a computer program product or computer program, which includes computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform the taint propagation path determination method provided in the above-described method embodiments.

[0153] The memory described in the embodiments of this specification can be used to store software programs and modules. The processor executes various functional applications and data processing by running the software programs and modules stored in the memory. The memory may mainly include a program storage area and a data storage area. The program storage area may store the operating system, application programs required for the functions, etc.; the data storage area may store data created according to the use of the device, etc. In addition, the memory may include high-speed random access memory, and may also include non-volatile memory, such as at least one disk storage device, flash memory device, or other volatile solid-state storage device. Accordingly, the memory may also include a memory controller to provide the processor with access to the memory.

[0154] The methods for determining taint propagation paths provided in the embodiments of this specification can be executed on mobile terminals, computer terminals, servers, or similar computing devices. Taking running on a server as an example, Figure 7 This is a hardware structure block diagram of a server for a method of determining a taint propagation path provided in an embodiment of this specification. For example... Figure 7As shown, the server 700 can vary significantly due to different configurations or performance. It may include one or more Central Processing Units (CPUs) 710 (CPUs 710 may include, but are not limited to, microprocessors (MCUs) or programmable logic devices (FPGAs), a memory 730 for storing data, and one or more storage media 720 (e.g., one or more mass storage devices) for storing application programs 723 or data 722. The memory 730 and storage media 720 may be temporary or persistent storage. The program stored in the storage media 720 may include one or more modules, each module may include a series of instruction operations on the server. Furthermore, the CPU 710 may be configured to communicate with the storage media 720 and execute the series of instruction operations stored in the storage media 720 on the server 700. Server 700 may also include one or more power supplies 760, one or more wired or wireless network interfaces 750, one or more input / output interfaces 740, and / or one or more operating systems 721, such as Windows Server™, Mac OS X™, Unix™, Linux™, FreeBSD™, etc.

[0155] The input / output interface 740 can be used to receive or send data via a network. Specific examples of the network described above may include a wireless network provided by the communication provider of server 700. In one example, the input / output interface 740 includes a network interface controller (NIC), which can connect to other network devices via a base station to communicate with the Internet. In another example, the input / output interface 740 may be a radio frequency (RF) module used for wireless communication with the Internet.

[0156] Those skilled in the art will understand that Figure 7 The structure shown is for illustrative purposes only and does not limit the structure of the aforementioned electronic device. For example, server 700 may also include... Figure 7 The more or fewer components shown, or having the same Figure 7 The different configurations shown.

[0157] As can be seen from the embodiments of the taint propagation path determination method and apparatus provided in this application, this application obtains a program dependency graph corresponding to the target vehicle system and a preset taint source node; the program dependency graph includes at least two program nodes and connecting edges; each program node represents a code segment; the connecting edge is used to connect two program nodes with a semantic dependency relationship; the code segment corresponding to the preset taint source node includes abnormal data; a program node matching the preset taint source node is found in the program dependency graph to obtain a target program node; the program dependency graph is semantically sliced ​​according to the target program node to obtain a program dependency subgraph; the node attribute information of each program node and the edge attribute information of each connecting edge in the program dependency subgraph are obtained; the program nodes in the program dependency subgraph are filtered according to the node attribute information and the edge attribute information to obtain at least two taint propagation nodes; and a taint propagation path is constructed according to the dependency relationship between the at least two taint propagation nodes. By converting the initial source code into an intermediate representation, a program dependency graph is generated, clarifying the semantic dependencies between different program nodes. This helps simulate the propagation of tainted data and improves the efficiency of taint analysis. Semantic slicing of the program dependency graph based on preset taint source nodes yields a program dependency subgraph, reducing the scale of the taint analysis task. Based on the node attribute information of each program node and the edge attribute information of each connecting edge in the program dependency subgraph, program nodes in the subgraph are filtered to obtain taint propagation nodes, until a taint propagation path is generated. This avoids pre-defining taint propagation rules, helps accurately identify the direction of tainted data flow, distinguishes between explicit and implicit propagation, improves the accuracy of taint analysis, and achieves automatic determination of taint propagation paths, thus improving the efficiency of taint analysis.

[0158] It should be noted that the order of the embodiments described above is merely for descriptive purposes and does not represent the superiority or inferiority of the embodiments. Furthermore, specific embodiments of this specification have been described above. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in a different order than that shown in the embodiments and still achieve the desired result. Additionally, the processes depicted in the drawings do not necessarily require a specific or sequential order to achieve the desired result. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0159] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, the embodiments of apparatus, devices, and storage media are basically similar to the method embodiments, so the descriptions are relatively simple; relevant parts can be referred to the descriptions of the method embodiments.

[0160] Those skilled in the art will understand that all or part of the steps of the above embodiments can be implemented by hardware or by a program instructing related hardware. The program can be stored in a computer storage medium, such as a read-only memory, a disk, or an optical disk.

[0161] The above description is only a preferred embodiment of this application and is not intended to limit this application. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the protection scope of this application.

Claims

1. A method for determining the propagation path of a taint, characterized in that, The method includes: Obtain the program dependency graph corresponding to the target vehicle system and the preset taint source node; the program dependency graph includes at least two program nodes and connecting edges; each program node represents a code segment; the connecting edge is used to connect two program nodes that have a semantic dependency relationship; the code segment corresponding to the preset taint source node includes abnormal data. The target program node is obtained by searching the program dependency graph for a program node that matches the preset taint source node. Based on the target program node, the program dependency graph is semantically sliced ​​to obtain a program dependency subgraph; Obtain the node attribute information of each program node and the edge attribute information of each connecting edge in the program dependency subgraph; Based on the node attribute information and the edge attribute information, the program nodes in the program dependency subgraph are filtered to obtain at least two taint propagation nodes. Based on the dependencies between the at least two taint propagation nodes, a taint propagation path is constructed.

2. The method according to claim 1, characterized in that, The process of obtaining the program dependency graph and preset taint source nodes corresponding to the target vehicle system includes: Obtain the preset taint source node and initial source code corresponding to the target vehicle system; The initial source code is subjected to semantic analysis to obtain semantic analysis results; the semantic analysis results include at least two code snippets. The flow direction of data within two adjacent code segments in the semantic analysis results is analyzed to obtain the data flow analysis results. The control logic of data within two adjacent code segments in the semantic analysis results is analyzed to obtain the control logic analysis results. Based on the data flow analysis results and the control logic analysis results, the program dependency graph is constructed.

3. The method according to claim 2, characterized in that, The step of semantically slicing the program dependency graph based on the target program node to obtain a program dependency subgraph includes: Based on the data flow analysis results and the control logic analysis results, the dependency path corresponding to the target program node is determined; the dependency path includes the target program node and at least two program nodes corresponding to the target program node; and the dependency path starts from the target program node. Based on the dependency path, filter the branch program node corresponding to the target program node in the program dependency graph; Based on the target program node and the corresponding branch program node, the program dependency graph is semantically sliced ​​to obtain the program dependency subgraph.

4. The method according to claim 3, characterized in that, The process of obtaining the program dependency graph and preset taint source nodes corresponding to the target vehicle system also includes: Obtain the program dependency graph, preset taint source node, and preset convergence point corresponding to the target vehicle system; the code segment corresponding to the preset convergence point includes the abnormal data; the abnormal data starts from the preset taint source node and flows to the preset convergence point along the dependency path; The process of filtering program nodes in the program dependency subgraph based on the node attribute information and the edge attribute information yields at least two taint propagation nodes, including: According to the dependency path, each program node in the program dependency subgraph is traversed sequentially. For the current program node that is traversed, the current program node is analyzed and processed according to the current node attribute information corresponding to the current program node and the current edge attribute information corresponding to the connection edge connected to the current program node, so as to obtain the current node analysis result corresponding to the current program node. A consistency comparison is performed between the current program node and the target program node to obtain the first node comparison result; A consistency comparison is performed between the current program node and the preset convergence point to obtain the second node comparison result; Based on the current node analysis result, the first node comparison result, and the second node comparison result, the program nodes in the program dependency subgraph are filtered to obtain the at least two taint propagation nodes.

5. The method according to claim 4, characterized in that, Before the step of sequentially traversing each program node in the program dependency subgraph according to the dependency path, and analyzing and processing the current program node based on the current node attribute information and the current edge attribute information of the connection edge connected to the current program node to obtain the current node analysis result, the method further includes: In response to the taint propagation path determination instruction, an initial set of program nodes corresponding to the target vehicle system is constructed; The step of filtering program nodes in the program dependency subgraph based on the current node analysis result, the first node comparison result, and the second node comparison result to obtain the at least two taint propagation nodes includes: Based on the current node analysis result, the first node comparison result, and the second node comparison result, the initial program node set is updated to obtain the target program node set. The program nodes in the target program node set are used as the at least two taint propagation nodes.

6. The method according to claim 5, characterized in that, The step of updating the initial program node set based on the current node analysis result, the first node comparison result, and the second node comparison result to obtain the target program node set includes: If the comparison result of the first node indicates that the current program node is consistent with the preset taint source node, a first path node corresponding to the current program node is created based on the analysis result of the current node. Add the first path node to the initial program node set to obtain the updated program node set; Filter the target branch program node corresponding to the current program node in the program dependency subgraph; Based on the target branch program node and the node attribute information corresponding to the target branch program node, generate the path node corresponding to the target branch program node; The path node corresponding to the target branch program node is added to the update program node set to obtain the target program node set.

7. The method according to claim 5, characterized in that, The current node analysis result includes the propagation type of the current program node; the step of updating the initial program node set based on the current node analysis result, the first node comparison result, and the second node comparison result to obtain the target program node set further includes: If the current node analysis result indicates that the propagation type of the current program node is explicit propagation, the first node comparison result indicates that the current program node is inconsistent with the preset taint source node, and the second node comparison result indicates that the current program node is inconsistent with the preset convergence point, then obtain the first conditional statement corresponding to the current program node. Based on the analysis results of the current node and the first conditional statement, create a second path node corresponding to the current program node; The second path node is added to the initial program node set to obtain the target program node set.

8. The method according to claim 7, characterized in that, The step of updating the initial program node set based on the current node analysis result, the first node comparison result, and the second node comparison result to obtain the target program node set further includes: If the analysis result of the current node indicates that the propagation type of the current program node is implicit propagation, obtain the second conditional statement corresponding to the current program node; The second conditional statement is used to check whether the preset taint source node exists, and the node search result is obtained. Based on the node search results and the current node analysis results, create a third path node corresponding to the current program node; The third path node is added to the initial program node set to obtain the target program node set.

9. The method according to claim 8, characterized in that, After constructing the taint propagation path based on the dependency relationship between the at least two taint propagation nodes, the method further includes: Obtain the propagation type and node source code corresponding to each program node in the taint propagation path; The path propagation type corresponding to the taint propagation path is determined based on the propagation type corresponding to each program node in the taint propagation path. Based on the source code of each program node in the taint propagation path, determine the path source code corresponding to the taint propagation path; Based on the path propagation type and path source code corresponding to the taint propagation path, a taint analysis report is generated.

10. A device for determining the propagation path of a stain, characterized in that, The device includes: The first acquisition module is used to acquire the program dependency graph corresponding to the target vehicle system and the preset taint source node; the program dependency graph includes at least two program nodes and connecting edges; each program node represents a code segment; the connecting edge is used to connect two program nodes that have a semantic dependency relationship; the code segment corresponding to the preset taint source node includes abnormal data; The target program node determination module is used to find the program node that matches the preset taint source node in the program dependency graph to obtain the target program node; The program dependency subgraph determination module is used to perform semantic slicing on the program dependency graph based on the target program node to obtain the program dependency subgraph; The attribute information acquisition module is used to acquire the node attribute information of each program node and the edge attribute information of each connecting edge in the program dependency subgraph. The taint propagation node determination module is used to filter program nodes in the program dependency subgraph based on the node attribute information and the edge attribute information to obtain at least two taint propagation nodes. The taint propagation path determination module is used to construct a taint propagation path based on the dependency relationship between the at least two taint propagation nodes.

Images