Back door inspection apparatus, method and program

Abstract

To provide a back door inspection apparatus and so on which improve accuracy in inspection of a back door trigger.SOLUTION: A back door inspection apparatus 1 according to the present invention has an acquiring unit 11 for acquiring a program as an analysis target and start information of the analysis, a data flow analysis unit 12 for analyzing a data flow included in the program to output data flow analysis information based on the acquired program as an analysis target and start information of the analysis, and a conditional branch extracting unit 13 for extracting a conditional branch which an external input data directly propagates as a candidate for a back door trigger by using the data flow analysis information.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present disclosure relates to a backdoor inspection device, method, and program. [Background technology]

[0002] As one of the supply chain risk countermeasures, the detection of malicious functions (backdoors) in programs is becoming increasingly important. In order to check for malicious functions (backdoors) embedded in programs, expensive analysis using reverse engineering by experts is required.

[0003] In response to this, Patent Document 1 discloses a malicious code detection system that detects malicious code during evaluation testing when developing an application program for an operating system. [Prior art documents] [Patent documents]

[0004] [Patent Document 1] JP 2009-098851 A Summary of the Invention [Problem to be solved by the invention]

[0005] By the way, there are techniques such as Stringer's that focus on conditional branching as a backdoor trigger. However, since many conditional branchings are used in normal programs, the accuracy of testing backdoor triggers is still insufficient.

[0006] The present disclosure has been made to solve such problems, and aims to provide a backdoor inspection device, method, program, etc. that improves the inspection accuracy of backdoor triggers. [Means for solving the problem]

[0007] A backdoor inspection device according to one aspect of the present disclosure includes: an acquisition unit for acquiring a program to be analyzed and analysis start point information; a data flow analysis unit that analyzes a data flow included in the program based on the acquired program to be analyzed and the analysis starting point information, and outputs data flow analysis information; and a conditional branch extraction unit that uses the data flow analysis information to extract conditional branches through which external input data is directly propagated as candidates for backdoor triggers.

[0008] A backdoor inspection method according to one aspect of the present disclosure includes: Obtain the program to be analyzed and the starting point of the analysis, Analyzing a data flow included in the program based on the acquired program to be analyzed and the analysis starting point information, and outputting data flow analysis information; Using the data flow analysis information, conditional branches to which external input data is directly propagated are extracted as candidates for backdoor triggers.

[0009] A program according to one aspect of the present disclosure includes: Obtain the program to be analyzed and the starting point of the analysis, Analyzing a data flow included in the program based on the acquired program to be analyzed and the analysis starting point information, and outputting data flow analysis information; Using the data flow analysis information, the computer is caused to extract conditional branches through which external input data is directly propagated as candidates for backdoor triggers. Effect of the Invention

[0010] According to the present disclosure, it is possible to provide a backdoor inspection device etc. that has improved inspection accuracy for backdoor triggers. [Brief description of the drawings]

[0011] [Figure 1] FIG. 1 is a diagram illustrating an example of the configuration of a backdoor inspection device according to an embodiment. [Diagram 2] FIG. 1 is a diagram illustrating an overview of a backdoor inspection method according to some embodiments. [Diagram 3] 1A to 1C are diagrams illustrating a specific example of a backdoor inspection method according to some embodiments. [Figure 4] FIG. 1 illustrates a backdoor inspection method according to some embodiments. [Diagram 5] 11A to 11C are diagrams illustrating a backdoor inspection method according to some other embodiments. [Figure 6] FIG. 11 is a diagram illustrating specific examples of data dependencies and control dependencies according to some other embodiments. [Figure 7] 1A to 1C are diagrams illustrating the specific configuration and effects of a backdoor inspection device according to some embodiments. [Figure 8] FIG. 2 is a diagram illustrating an example of a hardware configuration of a backdoor inspection device according to some embodiments. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0012] Hereinafter, the present embodiment will be described with reference to the drawings. FIG. 1 is a diagram illustrating an example of the configuration of a backdoor inspection device. The backdoor inspection device 1 receives a program to be analyzed and analysis start point information, and inspects whether the program includes a backdoor. In this disclosure, attention is particularly focused on conditional branches that can be a trigger for a backdoor. The backdoor inspection device 1 can be realized by one or more computers including at least one memory that stores instructions and at least one processor that executes the instructions.

[0013] The backdoor inspection device 1 includes an acquisition unit 11, a data flow analysis unit 12, and a conditional branch extraction unit 13. The acquisition unit 11 acquires a program to be analyzed and analysis starting point information. The program to be analyzed may include not only source code but also binary code. The analysis starting point may be a starting point of analysis arbitrarily set by an inspector. The acquired program to be analyzed may be stored in a storage unit of the backdoor inspection device 1.

[0014] The data flow analysis unit 12 analyzes the data flow contained in the program based on the acquired program to be analyzed and the analysis starting point information, and outputs data flow analysis information. The data flow analysis information includes the result of data flow analysis. Data flow analysis refers to analyzing how a certain variable data propagates within a program without changing its properties. More technically, data flow analysis refers to analyzing whether there is a data dependency between variables and extracting data that has a data dependency. For example, it is possible to analyze how external input data propagates within a program. The data flow analysis information can be displayed so that the analyst can recognize the result of the data flow analysis on a user interface (for example, by coloring, enclosing lines, arrows, etc.).

[0015] The conditional branch extraction unit 13 uses the analyzed data flow analysis information to extract conditional branches to which external input data is directly propagated as candidates for backdoor triggers. The external input is data provided from outside the program. The external input includes at least one of input from an input device (e.g., a hardware keyboard, a software keyboard), input via network communication, input by reading a file, input by reading an environmental variable, and input from another process.

[0016] Among many conditional branches, the system extracts conditional branches to which external input data is directly propagated. For example, if the external input is a hidden password or character string that only a backdoor attacker can know, the external input may go through a conditional branch and deviate from the normal route to launch a backdoor shell program. Therefore, by extracting conditional branches to which external input data is directly propagated from among the many conditional branches in a program, backdoor inspection can be performed with high accuracy. However, conditional branches to which external input data is not directly propagated, for example, conditional branches in which the external input is propagated by converting it to a different property (for example, from a character string to a numeric value), are not extracted because they are excluded from candidates for backdoor triggers.

[0017] One aspect of the present disclosure is a backdoor inspection method, which includes acquiring a program to be analyzed and analysis start point information, analyzing a data flow included in the program based on the acquired program to be analyzed and the analysis start point information, and using the data flow analysis information to extract a conditional branch to which external input data is directly propagated as a backdoor trigger candidate.

[0018] One aspect of the present disclosure is a backdoor inspection program that causes a computer to acquire a program to be analyzed and analysis start point information, analyze a data flow included in the program based on the acquired program to be analyzed and the analysis start point information, and use the data flow analysis information to extract a conditional branch through which external input data is directly propagated as a backdoor trigger candidate.

[0019] FIG. 2 is a diagram for explaining an overview of a backdoor inspection method according to some embodiments. Figure 2 shows the data flow of a program. Since many conditional branches are used in a typical program, the accuracy of backdoor inspection cannot be improved by simply focusing on conditional branches as backdoor triggers, as in the case of the existing technology Stringer. Note that, as used in this specification, a program may include not only source code but also binary code.

[0020] As a result of intensive research, the inventors have found that, as shown in FIG. 2, a sensitive operation is executed on the system from a conditional branch where an external input is directly propagated. When a certain requirement is satisfied in a conditional branch, the process deviates from the normal route and a sensitive operation is executed on the system. The certain requirement in this conditional branch is often the case where, for example, when an external input such as a password known only to an attacker is input, a sensitive operation (e.g., a command, file output, etc.) that should not be executed is executed. For example, a hidden password may be input from outside in a conditional branch, and a shell program may be started. The backdoor inspection system according to the present disclosure may include a backdoor inspection device and an information processing device (including an input device) of an attacker connected to the backdoor inspection device via a wired or wireless network.

[0021] In the present disclosure, by focusing on conditional branches where such external inputs are directly propagated, it is possible to detect not only known backdoors but also unknown backdoors. In addition, the present disclosure makes it possible to check for backdoors contained within a program at low cost without requiring reverse engineering by an expert.

[0022] FIG. 3 is a diagram for explaining the relationship between data flows and programs. As shown in Figure 3, the variables that make up a conditional branch that is a backdoor trigger directly reference an external input (or its propagation result or part of the input). Therefore, in order to narrow down the number of conditional branches to which candidates for a backdoor trigger are available, it is effective to use data flow analysis information from the external input. By finding the variable (input in Figure 3) to which the external input data is propagated from data flow analysis information that shows how the external input (input in Figure 3) is propagated, it is possible to narrow down the number of conditional branches to which candidates for a backdoor trigger are available. A conditional branch branches processing based on the results of comparing values. In what follows, we will explain from the perspective of whether the external input data is directly propagated as the value to be compared in a conditional branch.

[0023] When the properties of an external input (for example, the number of characters from a string) are converted and the data is propagated, such as len = strlen(input), it can be said to be a conditional branch in which the external input is not propagated directly.

[0024] On the other hand, when the input is directly compared in a conditional branch, such as if(input == "backdoor") == 0) (note that in practice, the strcmp function or similar is used, as in Figure 3), it can be said to be a conditional branch where the external input is directly propagated. In other words, in data flow analysis, the external input does not change its nature, and at least a part of it (for example, the entire external input, or some of the forward characters) is propagated as is and compared, and a conditional branch is extracted.

[0025] FIG. 4 is a diagram illustrating a backdoor inspection method according to some embodiments. The data flow analysis unit 121 performs a data flow analysis to analyze how data is propagating in the program acquired by the acquisition unit 110. The data flow analysis unit 121 outputs data flow analysis information to the conditional branch extraction unit 130 as the analysis result.

[0026] The conditional branch extraction unit 130 extracts, from the data flow analysis information, conditional branches to which external inputs are directly propagated (a group of conditional branches surrounded by a solid line in FIG. 4) as candidates for backdoor triggers. On the other hand, the conditional branch extraction unit 130 excludes conditional branches to which external inputs are not directly propagated (a group of conditional branches surrounded by a dashed line in FIG. 4).

[0027] The conditional branch evaluation unit 140 may also perform scoring according to the characteristics of some conditional branches to which external inputs are directly propagated. This allows the accuracy of backdoor inspection to be further improved by increasing the scores of conditional branches such as string comparisons and prioritizing many conditional branches.

[0028] FIG. 5 illustrates a backdoor inspection method according to some other embodiments. In this embodiment, not only data flow analysis but also control flow analysis is performed on the program. That is, the process flow analysis unit 120 includes a data flow analysis unit 121 and a control flow analysis unit 122. The control flow analysis unit 122 performs control flow analysis up to the end point of the analysis based on the acquired program to be analyzed and the acquired start point and end point of the analysis, and outputs control flow analysis information. The control flow analysis information includes the result of the control flow analysis. In addition, in this embodiment, the conditional branches to be extracted can be those that have a direct data dependency relationship with the external input, as well as those that have an indirect data dependency relationship with the external input. That is, the conditional branch extraction unit 130a extracts conditional branches that have an indirect data dependency relationship with the external input, as well as those that have a direct data dependency relationship with the external input.

[0029] In order to obtain conditional branches that have indirect data dependencies with external inputs, in addition to data flow analysis starting from the external input, analysis is performed on the control flow between the start and end points of the analysis.

[0030] As described above, data flow analysis refers to analyzing how a variable propagates within a program without changing its properties. More technically, data flow analysis refers to analyzing whether there is a data dependency between variables and extracting data that has a data dependency. Data flow analysis information can be displayed on a user interface so that the analyst can recognize the results of the data flow analysis (for example, by coloring, encircling lines, arrows, etc.). The output data flow analysis information can be stored in a memory unit or the like of the backdoor inspection device.

[0031] On the other hand, control flow analysis, which will be described in detail later, refers to analyzing whether or not there is a control dependency, that is, whether or not the definition of the value of one variable is controlled by the value or condition of another variable. The control flow analysis information can be displayed on a user interface so that the analyst can recognize the results of the control flow analysis (for example, by coloring, encircling lines, arrows, etc.). The output control flow analysis information can be stored in a memory unit or the like of the backdoor inspection device.

[0032] In addition, in the control flow analysis, the inspector may provide end point information of the program to be analyzed. The end point information of the program may be stored in a database as inspection knowledge. The end point information may be selected, for example, from a list of functions that may have a sensitive effect on the system (for example, an operation to start a shell or to write important information to a file). The list of functions may be stored in a storage unit of the backdoor inspection device.

[0033] FIG. 6 is a diagram for explaining a specific example of data dependency and control dependency. In FIG. 6, it is determined by data flow analysis that there is a data dependency between input=recv_input(); which is the starting point of the external input, and cond=check_cond(input);.

[0034] In addition, in Figure 6, the variable "trigger" can take on either the value "backdoor" or "no", which is determined by the value of the variable "cond". In other words, the variable "cond" controls the variable "trigger". Therefore, it can be said that the variables "cond" and "trigger" have a control dependency.

[0035] Next, the conditional branch if (cond) is a conditional branch in which the external input is directly propagated because the variable cond is directly indicated. In this specification, such a conditional branch is called a conditional branch at the 0th level from the perspective of the external input.

[0036] Next, in the conditional branch if (strcmp(trigger, "backdoor") ==0), the variable trigger takes on the value "backdoor" or "no", which is determined by the value of the variable cond. In other words, the variable cond controls the variable trigger. It can be said that the variables cond and trigger have a control dependency. Therefore, in this specification, the conditional branch if (strcmp(trigger, "backdoor") ==0) is said to be a first-level conditional branch from the perspective of the external input. In this specification, such a conditional branch can be said to be a conditional branch to which the external input is indirectly propagated.

[0037] As described above, in this embodiment, not only the conditional branch "if (cond)" but also the conditional branch "if (strcmp(trigger, "backdoor")==0)" is extracted. An external input is indirectly propagated when the external input "input" and the variable "trigger" are in a relationship that sandwiches one level of control dependency. In the following description, the above relationship is defined as a first-level data dependency or a first-level conditional branch when viewed from the external input. Furthermore, in the lower diagram of FIG. 6, this relationship is expanded to n levels (n is a positive integer) by combining data flow analysis and control flow analysis.

[0038] Furthermore, according to this embodiment, by performing not only data flow analysis but also control flow analysis, it is possible to extract conditional branches that may affect subsequent instructions or operations.

[0039] FIG. 7 is a diagram for explaining a specific configuration and effects of a backdoor inspection device according to some embodiments. The acquisition unit 110 acquires a program to be analyzed, and a start point and an end point of the analysis. The process flow analysis unit 120 includes a data flow analysis unit 121 and a control flow analysis unit 122, and performs data flow analysis and control flow analysis between the start point and the end point of the analysis. An example of the start point of the analysis may be an external input, input = recv_input();. An example of the end point of the analysis may be system(" / bin / sh");. The process flow analysis unit 120 outputs a process flow analysis result including the result of the data flow analysis and the result of the control flow analysis.

[0040] The conditional branch extraction unit 130 receives the results of the process flow analysis and extracts the conditions to which the external input is directly propagated as candidates for backdoor triggers. In some embodiments, the conditional branch extraction unit 130 receives the results of the process flow analysis and can extract the conditional branches to which the external input is directly or indirectly propagated.

[0041] The conditional branch evaluation unit 140 performs scoring for some of the extracted conditional branches according to a scoring policy for the conditional branches, and evaluates the backdoor trigger. The scoring policy for the conditional branches may be determined in advance by an analyst or the like, and may be stored in the storage unit of the backdoor inspection device.

[0042] As described above, according to some embodiments, the backdoor inspection cost can be reduced by automatically extracting only particularly suspicious conditional branches that may be candidates for backdoor triggers from among the conditional branches contained in a program.

[0043] The conditional branch evaluation unit 140 can assign scores based on the number of layers seen from the external input of the target conditional branch. For example, a high score can be assigned to a condition in the 0th layer, and a low score can be assigned to the first layer and onward. Alternatively, the higher the number of layers, the lower the score can be assigned.

[0044] In addition, the conditional branch may be evaluated from other viewpoints, and the scores may be added together to determine the final evaluation. For example, the types of the variables that make up the conditional branch, or whether the comparison target is a specific character (or character string) may be taken into consideration.

[0045] When scoring is based on the type of variables that make up the conditional branch, for example, a high score can be given to character strings and character string types. On the other hand, a low score can be given to file pointers and numeric types such as integer types. For example, if an integer value is used as a backdoor trigger, even if a user other than the attacker randomly provides an integer value, it may be activated as a backdoor trigger, so attackers usually do not use integer values ​​as backdoor triggers. Also, among characters (or character strings), special characters (strings for escape processing, null characters, etc.) may be excluded from candidates for backdoor triggers.

[0046] In some embodiments, the conditional branch evaluator 140 scores the extracted conditional branch according to the hierarchy of data dependencies to determine how likely the conditional branch is to be a backdoor trigger.

[0047] The conditional branch evaluation unit 140 assigns a higher score to a backdoor trigger the shallower the hierarchy of data dependency is, or assigns a fixed low score to a conditional branch having a certain number of hierarchy levels or more.

[0048] The conditional branch evaluation unit 140 scores the extracted conditional branch based on the conditional branch scoring policy to determine the degree to which the conditional branch is likely to be a backdoor trigger, based on the characteristics of the type information of the variables that make up the conditional branch.

[0049] In this way, by using the conditional branch evaluation unit, the accuracy of testing the backdoor trigger can be further improved.

[0050] FIG. 8 is a block diagram showing a configuration example of the backdoor inspection device 1. Referring to FIG. 8, the backdoor inspection device 1 includes a network interface 1201, a processor 1202, and a memory 1203. The network interface 1201 is used to communicate with other network node devices constituting a communication system. The network interface 1201 may be used to perform wireless communication. For example, the network interface 1201 may be used to perform wireless LAN communication defined in the IEEE 802.11 series or mobile communication defined in 3GPP (registered trademark) (3rd Generation Partnership Project). Alternatively, the network interface 1201 may include, for example, a network interface card (NIC) conforming to the IEEE 802.3 series.

[0051] The processor 1202 reads out and executes software (computer programs) from the memory 1203 to perform the processing of the backdoor inspection device 1 described using the flowcharts or sequences in the above-mentioned embodiments. The processor 1202 may be, for example, a microprocessor, an MPU (Micro Processing Unit), a CPU (Central Processing Unit), or a GPU (Graphics Processing Unit). The processor 1202 may include multiple processors.

[0052] The memory 1203 is configured by a combination of volatile memory and non-volatile memory. The memory 1203 may include storage located remotely from the processor 1202. In this case, the processor 1202 may access the memory 1203 via an I / O interface (not shown).

[0053] 8, the memory 1203 is used to store software modules. The processor 1202 reads out and executes these software modules from the memory 1203, thereby performing the processing of the backdoor inspection device 1 described in the above embodiment.

[0054] As explained with reference to Fig. 8, each of the processors included in the backdoor inspection device 1 executes one or more programs including a set of instructions for causing a computer to execute the algorithm explained with reference to the drawings. Note that the information processing device used by an attacker may also have the same hardware configuration as that of Fig. 8.

[0055] In the above examples, the program includes instructions (or software code) that, when loaded into a computer, cause the computer to perform one or more functions described in the embodiments. The program may be stored in a non-transitory computer-readable medium or a tangible storage medium. By way of example and not limitation, the computer-readable medium or tangible storage medium includes random-access memory (RAM), read-only memory (ROM), flash memory, solid-state drive (SSD) or other memory technology, CD-ROM, digital versatile disc (DVD), Blu-ray® disk or other optical disk storage, magnetic cassette, magnetic tape, magnetic disk storage or other magnetic storage device. The program may be transmitted on a transitory computer-readable medium or communication medium. By way of example and not limitation, the transitory computer-readable medium or communication medium includes electrical, optical, acoustic, or other forms of propagated signals.

[0056] The present invention is not limited to the above-described embodiment, and can be modified as appropriate without departing from the spirit and scope of the present invention. The above-described examples can also be implemented in combination as appropriate.

[0057] A part or all of the above-described embodiments can be described as, but is not limited to, the following supplementary notes. (Appendix 1) an acquisition unit for acquiring a program to be analyzed and analysis start point information; a data flow analysis unit that analyzes a data flow included in the program based on the acquired program to be analyzed and the analysis starting point information, and outputs data flow analysis information; and a conditional branch extraction unit that uses the data flow analysis information to extract a conditional branch through which external input data is directly propagated as a candidate for a backdoor trigger. (Appendix 2) The external input data is data provided from outside the program, and includes at least one of input from an input device, input via network communication, input by reading a file, input by reading an environmental variable, and input from another process. (Appendix 3) A backdoor inspection device as described in Appendix 1 or 2, wherein the conditional branch to which the external input data is directly propagated includes a conditional branch in which the external input data is used as a comparison subject without changing its properties, and excludes a conditional branch in which the external input data changes its properties. (Appendix 4) the analysis starting point information is the external input data, The backdoor inspection device according to any one of appendices 1 to 3, wherein the data flow analysis unit analyzes a data flow from the external input data to the program based on the acquired external input data, which is the starting point information of the analysis. (Appendix 5) The acquisition unit further acquires analysis endpoint information selected from a list of functions that may affect the system; a control flow analysis unit that analyzes a control flow up to the end point of the analysis based on the acquired analysis target program and the acquired start point and end point of the analysis, and outputs control flow analysis information; The backdoor inspection device according to claim 4, wherein the conditional branch extraction unit uses the data flow analysis information from the analyzed external input data and the control flow analysis information up to the end point of the analysis to extract a conditional branch to which the external input data is directly propagated as a candidate for a backdoor trigger. (Appendix 6) the conditional branch extraction unit uses the data flow analysis information and the control flow analysis information to extract conditional branches up to an n-th hierarchy as candidates for a backdoor trigger, in addition to a conditional branch at a 0th hierarchy as viewed from the external input data; 6. A backdoor inspection device as described in appendix 5. (Appendix 7) The backdoor inspection device according to any one of appendix 1 to 6, further comprising a conditional branch evaluation unit that scores the degree to which the extracted conditional branch is likely to be a backdoor trigger according to a hierarchy of data dependency. (Appendix 8) The backdoor inspection device according to claim 7, wherein the conditional branch evaluation unit assigns a higher score to the backdoor trigger the shallower the hierarchy of data dependency, or assigns a constant low score to a conditional branch having a certain number of hierarchy levels or more. (Appendix 9) The backdoor inspection device according to any one of appendices 1 to 8, further comprising a conditional branch evaluation unit that scores the extracted conditional branch based on a conditional branch scoring policy to determine to what extent the conditional branch is a backdoor trigger, based on characteristics of type information of variables that constitute the conditional branch. (Appendix 10) Obtain the program to be analyzed and the starting point of the analysis, Analyzing a data flow included in the program based on the acquired program to be analyzed and the analysis starting point information, and outputting data flow analysis information; A backdoor inspection method using the data flow analysis information to extract conditional branches to which external input data is directly propagated as candidates for backdoor triggers. (Appendix 11) Obtain the program to be analyzed and the starting point of the analysis, Analyzing a data flow included in the program based on the acquired program to be analyzed and the analysis starting point information, and outputting data flow analysis information; A program that causes a computer to execute the following: extracting, using the data flow analysis information, conditional branches to which external input data is directly propagated, as candidates for backdoor triggers. [Explanation of symbols]

[0058] 1 Backdoor inspection device 10 Programs 11 Acquisition Department 12 Data flow analysis unit 13 Conditional branch extraction section 110 Acquisition Department 120 Processing flow analysis unit 121 Data Flow Analysis Unit 122 Control Flow Analysis 130 Conditional Branch Extraction 140 Conditional branch evaluation section

Claims

1. an acquisition unit for acquiring a program to be analyzed and analysis start point information; a data flow analysis unit that analyzes a data flow included in the program based on the acquired program to be analyzed and the analysis starting point information, and outputs data flow analysis information; and a conditional branch extraction unit that uses the data flow analysis information to extract a conditional branch through which external input data is directly propagated as a candidate for a backdoor trigger.

2. 2. The backdoor inspection device of claim 1, wherein the external input data is data provided from outside the program and includes at least one of input from an input device, input via network communication, input by reading a file, input by reading an environmental variable, and input from another process.

3. 2. The backdoor inspection device according to claim 1, wherein the conditional branch to which the external input data is directly propagated includes a conditional branch in which the external input data is used as a comparison target without changing its nature, and excludes a conditional branch in which the external input data changes its nature.

4. the analysis starting point information is the external input data, The backdoor inspection device according to claim 1 , wherein the data flow analysis unit analyzes a data flow from the external input data to the program based on the acquired external input data that is the starting point information of the analysis.

5. The acquisition unit further acquires analysis endpoint information selected from a list of functions that may affect the system; a control flow analysis unit that analyzes a control flow up to the end point of the analysis based on the acquired program to be analyzed and the acquired start point and end point of the analysis, and outputs control flow analysis information; 5. The backdoor inspection device according to claim 4, wherein the conditional branch extraction unit extracts a conditional branch to which the external input data is directly propagated as a candidate for a backdoor trigger, using the data flow analysis information from the analyzed external input data and the control flow analysis information up to an end point of the analysis.

6. the conditional branch extraction unit extracts, as candidates for a backdoor trigger, conditional branches up to an n-th hierarchy in addition to a conditional branch at a 0th hierarchy as viewed from the external input data, using the data flow analysis information and the control flow analysis information; The back door inspection device according to claim 5.

7. 3. The backdoor inspection device according to claim 1, further comprising a conditional branch evaluation unit that scores the extracted conditional branch according to a hierarchy of data dependency to what extent the conditional branch is likely to be a backdoor trigger.

8. 8. The backdoor inspection device according to claim 7, wherein the conditional branch evaluation unit assigns a higher score to a backdoor trigger the shallower the hierarchy of data dependency is, or assigns a constant low score to a conditional branch having a certain number of hierarchy levels or more.

9. 3. The backdoor inspection device according to claim 1, further comprising a conditional branch evaluation unit that scores the extracted conditional branch based on a conditional branch scoring policy to determine to what extent the conditional branch is a backdoor trigger, based on characteristics of type information of variables that constitute the conditional branch.

10. Obtain the program to be analyzed and the starting point of the analysis, Analyzing a data flow included in the program based on the acquired program to be analyzed and the analysis starting point information, and outputting data flow analysis information; A backdoor inspection method using the data flow analysis information to extract conditional branches to which external input data is directly propagated as candidates for backdoor triggers.

11. Obtain the program to be analyzed and the starting point of the analysis, Analyzing a data flow included in the program based on the acquired program to be analyzed and the analysis starting point information, and outputting data flow analysis information; A program that causes a computer to execute the following: extracting, using the data flow analysis information, conditional branches to which external input data is directly propagated, as candidates for backdoor triggers.

Images