A security detection method of AST drop box contract and detection isolation

Abstract

The application discloses a kind of AST fall disk contract and the security detection method of detection isolation.It is modeled as layered graph product to front end target language source code and falls disk: AST complete save syntax information and as only syntax trusted source, upper layer only save AST node reference mark, CPG only save call index and node reference, AST whole tree and CFG, VDG complete subgraph are not stored repeatedly.Detection stage bypass access control default close line scanning, source code tree traversal, corpus scanning and file additional supplementary detection, main path only consumes fall disk product by unified graph query, and dynamically assembles dependent data when querying.Detection is layered according to hard boundary: syntax domain only consumes AST, whole graph domain executes pollution and path protection determination, dependent domain and configuration domain do not access code graph, semantic filtering domain only filters and prohibits new vulnerability generation, compliance mapping domain only maps and prohibits reanalysis;Optional, after compliance mapping, post-similarity check independent of rule execution path is carried out.The application improves detection reproducibility, and reduces graph storage redundancy and layered risk of exceeding authority.

Description

Technical Field

[0001] This invention belongs to the field of Static Application Security Testing (SAST) and software security testing technology. Specifically, it relates to a security testing method for AST disk contract and detection isolation, which is applicable to vulnerability mining, false positive reduction and compliance classification in multilingual source code engineering. Background Technology

[0002] Existing static code security detection technologies widely employ intermediate representations such as AST, CFG, PDG, and CPG. Publicly available solutions have addressed multi-layer graph modeling, cross-language unified analysis, and post-detection large-scale false positive discrimination, with representative literature including CN103793652A, CN118860904A, and US9785777. However, in terms of industrial-grade engineering implementation, existing technologies still generally suffer from the following shortcomings: (1) Coupling of modeling and detection: The original source code can still be directly traversed or read during the detection stage, the main detection path is not unique, and the results are difficult to reproduce stably; (2) Graph storage redundancy: In order to facilitate querying, the entire AST tree and the complete subgraph of CFG / VDG are often written to the fused CPG simultaneously, resulting in high disk and memory overhead for large projects; (3) Insufficient layered constraints: The analysis layers of the pipeline lack mandatory data access boundaries, which can easily lead to unauthorized access such as the syntax layer reading tainted edges, the filtering layer generating new vulnerabilities, and the compliance layer redoing the underlying code analysis. (4) Insufficient controllability of AI embedding: Placing large models in the rule execution path for real-time invocation results in insufficient stability and interpretability.

[0003] Therefore, it is necessary to provide a method that simultaneously constrains "syntactic unique disk storage, detection main path isolation, hierarchical access to hard boundaries, and decoupling of AI and rules" at the implementation level. For ease of review and understanding, the following provides a distinction between representative comparative literature.

[0004] Compared to CN103793652A: This scheme performs data flow and control flow analysis and matches the rule base on the AST, but does not restrict the main detection path from traversing the original source code tree as the vulnerability detection path, nor does it stipulate that the AST is the only source for syntax write-to-disk, or that the CPG cannot persist the entire AST tree and the complete CFG / VDG subgraph. This invention emphasizes the isolation between the write-to-disk contract and the main detection path, and the technical issues and constraints are different.

[0005] Compared to CN118860904A, its main improvement lies in adding edges related to C++ parameters to the value flow graph to reduce false alarms. Overall, it still follows the conventional path of detection after graph construction. Hard boundary constraints such as the default closure of undisclosed bypass access control, prohibition of generating new vulnerabilities in the semantic filtering domain, and prohibition of vulnerability technology re-analysis in the compliance mapping domain are not disclosed.

[0006] Compared to CN119066667A: it focuses on building multi-level graphs based on AST and combining graph theory for vulnerability mining, without limiting thin CPG and read-time dynamic assembly, and without setting up filtering domains or compliance domains with rights and responsibilities prohibitions.

[0007] Compared with schemes such as CN118627080A that are based on CPG simplification or machine learning classification, their optimization direction is mainly graph compression and classification discrimination, which is different from the detection link isolation, disk contract and multi-detection domain hard boundary scheduling that this invention aims to solve.

[0008] Compared to US9785777, which discloses the archiving of abstract program representations for static analysis, its main purpose is to achieve compact representation and protect source code information. This invention, however, focuses on controllable detection processes: bypass access control, multi-detection domain access boundaries, and read-time assembly without writing back the complete dependency subgraph as a disk-side fat CPG; the technical goals and constraint systems are different.

[0009] Compared to US12596537 and US20250138797, which distinguish between the representation of structure towards the middle layer and the representation of data flow towards the lower layer, this invention focuses on the collaborative constraints of the unified syntax trusted source disk persistence contract, the isolation of the main detection path, and the access boundaries of multiple service detection domains, with different methods and effects.

[0010] Compared to CN117077153B, which discloses using a large model to identify false positives after static detection, this invention does not use a large model as a necessary technical feature; post-similarity verification is only an optional step after compliance mapping, and the rule execution path prohibits triggering this verification, thereby decoupling the rule path from the post-verification.

[0011] As can be seen from the above, the aforementioned literature involves aspects such as AST / graph analysis, representation archiving, dual-track IR, or false alarm judgment after detection. However, none of them disclose a fixed technical solution that can be implemented by combining constraints such as "unique AST syntax stored on disk and CPG prohibiting the storage of whole trees / complete subgraphs, graph product main path consumption under bypass access control constraints, semantic filtering domain prohibiting out-of-hole operations, compliance mapping domain prohibiting re-analysis, and read-time assembly without writing back to fat CPG". This invention has targeted improvements compared to the prior art. Summary of the Invention

[0012] The purpose of this invention is to provide a secure detection method for AST disk write-to-disk contract and detection isolation. By using disk write-to-disk contracts, bypass access control, hard boundaries of multiple detection domains, and optional post-verification, it improves detection reproducibility, reduces graph storage redundancy, and reduces hierarchical privilege escalation and uncontrollable calls in rule paths.

[0013] To achieve the above objectives, the present invention adopts the following technical solution: S1 Front-end Modeling and Disk Layout: The source code of at least one target programming language is parsed, generating and layering disk layout products. The AST layer fully stores syntax node information and serves as the sole reliable source of syntax. In upper-level dependent layers, including at least CFG and VDG, edges and nodes only store references to AST nodes, without repeatedly copying the entire AST tree content. The CPG layer only stores global call indices and node reference relationships, without repeatedly storing the entire AST tree or complete subgraphs of CFG and VDG. S2 detection link isolation: Configure bypass access control and disable original file line scanning, source code tree traversal, corpus scanning and additional file inspection by default; the backend detection main path prohibits the use of the original source code tree as the vulnerability detection path, and only reads the disk graph artifacts described in S1 through the unified graph query interface; S3 Hard Boundary Layered Detection: The following detection domains are scheduled and candidates are aggregated: The syntax detection domain consumes only the AST and outputs syntax morphology candidates; the full graph detection domain consumes CFG, VDG, and CPG related layers via unified graph query, and dynamically assembles CFG and / or VDG dependency data during querying before performing data flow taint propagation and path protection determination; the dependency detection domain consumes only the dependency list or component vulnerability knowledge base, without accessing code graph artifacts; the configuration detection domain consumes only the configuration structured view, without accessing code graph artifacts; the semantic filtering domain performs deduplication, false positive suppression, and / or incremental range filtering only on generated candidates, prohibiting the generation of new vulnerability candidates; the compliance mapping domain binds compliance tags to filtered candidates, prohibiting vulnerability technology re-analysis. S4 Output: Aggregate the candidates after semantic filtering and compliance mapping to generate a detection report; Optionally, perform post-similarity verification on some or all candidates after compliance mapping, independent of the rule execution path, and prohibit triggering this verification in the rule execution path; Beneficial effects

[0014] Beneficial effects include: (1) Using the unique syntax of AST to write to disk and consume the graph product on the main path, the result fluctuation caused by the inconsistency of the detection path is reduced and the reproducibility is improved; (2) Use lean CPG and read-time assembly to reduce persistent size while retaining the dependency information required for full-image detection; (3) Reduce unauthorized analysis and cross-domain noise by using multi-domain access restrictions; (4) Decouple post-validation from rule execution path to reduce stability risks caused by uncontrollable calls during the rule phase. Attached Figure Description

[0015] Attachment image description Figure 1 This is a schematic diagram of the overall method flow of the present invention; Figure 2 This is a schematic diagram illustrating the relationship between AST disk write-to-disk contracts and read-time assembly. Figure 3 This is a schematic diagram illustrating data access constraints across multiple detection domains. Figure 4 Schematic diagram of optional post-verification gating process Detailed Implementation

[0016] The following description, in conjunction with the accompanying drawings, illustrates the embodiments of the invention and does not limit the scope of protection. The implementation scheme should be consistent with the aforementioned disk write-in contract, bypass access control, hard boundary constraints, and "assembly without write-back" requirements.

[0017] Example 1: Full Detection of Mixed Language Engineering For projects containing Java, Python, and JavaScript: Front-ends for each language are written to the storage directory according to the disk write contract; the AST is the sole trusted source of syntax; the CPG does not store the entire AST tree or complete CFG / VDG subgraphs; bypass access control remains disabled by default; the backend only loads artifacts through unified graph queries. The syntax domain outputs candidate forms such as dangerous calls and hard-coded values; the full graph domain assembles CFG / VDG dependencies in the in-memory working view and performs taint classification, without writing the complete subgraph back to the disk-side fat CPG; the dependency domain and configuration domain consume lists and configuration views respectively; the semantic filtering domain deduplicates and filters test file hits, prohibiting the generation of new vulnerabilities; the compliance mapping domain binds tags, prohibiting further analysis; post-similarity verification can be enabled as needed to output reports.

[0018] Example 2: Incremental Detection Based on historical disk artifacts, only Git changed files are remodeled and unchanged layers are reused; semantic filtering domains are used to select candidates by incremental range, reducing the cost of full reconstruction.

[0019] Example 3: Bypass Access Control Forced Isolation Verification In the CI, a call using the original source code tree as the main detection path is injected; access control and / or empty stub verification intercepts this call and blocks its merging, to verify that the isolation of the main detection path can be enforced. Furthermore, it can be verified that the semantic filtering domain cannot register new vulnerability rule outputs, and the compliance mapping domain cannot trigger taint reanalysis; and the persistent storage volume difference between the converged fat CPG and this contract's disk write-down is compared under the same project to verify the thin storage effect.

Claims

1. A secure detection method for AST disk write-to-disk contract and detection isolation, characterized in that, include: S1. Front-end modeling and disk plotting: Parse the source code of at least one target programming language, generate and layer the disk plotting output; among them, the AST layer fully stores the syntax node information and serves as the only reliable source of syntax; in the upper-level dependent layers, including at least CFG and VDG, edges and nodes only save reference identifiers pointing to AST nodes, without repeatedly copying the entire AST tree content; the CPG layer only saves the global call index and node reference relationships, without repeatedly storing the entire AST tree, nor repeatedly storing the complete subgraphs of CFG and VDG; S2. Detection link isolation: Configure bypass access control and disable original file line scanning, source code tree traversal, corpus scanning and additional file inspection by default; the backend detection main path prohibits the use of the original source code tree as the vulnerability detection path, and only reads the disk graph artifacts described in S1 through the unified graph query interface. S3. Hard Boundary Layered Detection: The following detection domains are scheduled in parallel and / or serially, and candidate results are aggregated: The syntax detection domain consumes only the AST layer and outputs syntax morphology candidates; the full graph detection domain consumes CFG, VDG, and CPG related layers through the unified graph query interface, and dynamically assembles CFG and / or VDG dependency data during the query before performing data flow taint propagation and path protection determination; the dependency detection domain consumes only the dependency list or component vulnerability knowledge base and does not access code graph artifacts; the configuration detection domain consumes only the configuration structured view and does not access code graph artifacts; the semantic filtering domain performs deduplication, false positive suppression, and / or incremental range filtering only on the generated candidates and prohibits the generation of new vulnerability candidates; the compliance mapping domain binds compliance tags to the filtered candidates and prohibits the re-analysis of vulnerability technologies. S4. Output Results: Aggregate the candidates after semantic filtering and compliance mapping to generate a detection report.

2. The method according to claim 1, characterized in that: The upper-level dependency layer in S1 also includes one or more of HG, CG, CDG, GuardedVDG, and PDG; the GuardedVDG is used to characterize the variable dependency relationship constrained by the protection conditions, for the whole-map detection domain to make path protection determination.

3. The method according to claim 1, characterized in that: S2 also uses code stubs and / or continuous integration access control verification to intercept calls that use the original source code tree as the main detection path.

4. The method according to claim 1, characterized in that: In S3, the syntax detection domain, full graph detection domain, dependency detection domain, and configuration detection domain generate candidates in parallel, while the semantic filtering domain and compliance mapping domain are processed serially in the post-processing stage.

5. The method according to claim 1, characterized in that: The CFG and VDG data used for the dynamic assembly are derived from disk-based layer files independent of the CPG.

6. The method according to claim 1, characterized in that: The syntax detection domain can use structure matching based on AST node type and / or call pattern to generate syntax pattern candidates; after completing the dynamic assembly, the full graph detection domain can use at least one of taint reachability determination, protection condition determination, and sensitive call matching to generate vulnerability candidates. The risk entries used for sensitive call matching can be loaded from a configuration file or knowledge base.

7. The method according to claim 1, characterized in that: After the compliance mapping domain is completed and before the detection report is generated, post-verification independent of the rule execution path can be selectively performed on some or all candidates; the post-verification is based on the similarity comparison between the candidate-related code fragments and the reference sample to suppress low-confidence candidates and / or supplement missed variants; the post-verification is prohibited from being triggered in the rule execution path.

8. The method according to claim 1, characterized in that: Concurrency detection is scheduled by a unified worker thread pool, and each language frontend or rule package is prohibited from building its own detection thread pool.

9. The method according to claim 1, characterized in that: The semantic filtering domain combines test file identification with Git incremental difference range and location deduplication rules for filtering.

10. The method according to claim 1, characterized in that: The compliance mapping domain binds at least one compliance tag to the candidate based on the rule metadata and / or mapping table corresponding to the candidate; the compliance tag may correspond to one or more of the following categories: industry security classification, graded protection related clauses, and privacy protection related clauses.

11. The method according to claim 1, characterized in that: The target programming language can be one or more; when there are multiple target programming languages, each language completes the front-end modeling and disk placement described in S1, and follows the same disk placement contract; the back-end detection reuses the same graph query interface and the hard boundary scheduling relationship described in S3.

12. An electronic device comprising a memory and a processor, wherein the processor executes a program in the memory to implement the method of any one of claims 1 to 11.

Images