Information processing device, information processing method, and program

Abstract

To provide an information processing device capable of properly performing analysis according to a resource to be operated by a function in a program to be inspected.SOLUTION: An information processing device includes: an extraction unit that extracts a function call part indicating a part to be called by a function in a program to be inspected; an identifying unit that identifies a resource to be operated as a target operated by the function; and a narrowing unit that narrows a part to be analyzed as a target of processing flow analysis from the function call part. The program to be inspected includes variable definition processing of defining a variable indicating the resource to be operated. The identifying unit identifies the resource to be operated indicated by the variable defined in the variable definition processing.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present disclosure relates to an information processing device, an information processing method, and a program. [Background technology]

[0002] In recent years, infrastructures and corporate systems have become more complex. As a result, these infrastructures and corporate systems are not composed of only devices from a single company, but are generally constructed by procuring devices from various companies from outside and combining these devices. As a countermeasure against risks related to supply chains constructed in this way, technology to detect malicious functions in programs is becoming increasingly important.

[0003] As an example of an unauthorized function in a program, there have been many reported cases where backdoors have been found in software (or firmware) or hardware procured from external manufacturers. The "backdoor" referred to in this specification can be defined as a function that is neither known to nor desired by the user and that is incorporated as part of a program that includes multiple functions that make up the software.

[0004] Manufacturers who organize the construction of infrastructure and corporate systems need to check whether the programs that make up the software they procure from external manufacturers contain backdoors. For example, it is known that static analysis of a program can be used to analyze the process flow contained in the program. Backdoors can be detected by performing process flow analysis using operations that require privileges or operations that are dangerous if executed illegally as indicators.

[0005] As a related technique, Patent Document 1 discloses a vulnerability checker capable of detecting locations where vulnerable libraries are not used appropriately. The vulnerability checker disclosed in Patent Document 1 extracts external input variables in a program based on the use of functions that use predefined external inputs and arguments passed to the main function according to a predetermined judgment rule. The vulnerability checker also audits the extracted external input variables. [Prior art documents] [Patent documents]

[0006] [Patent Document 1] JP 2011-150716 A Summary of the Invention [Problem to be solved by the invention]

[0007] When performing process flow analysis, it is possible to specify a call point of a widely used library function as the start or end point of the process flow. However, there are many such function call points in a program. Therefore, if process flow analysis is performed without appropriately narrowing down the function call points to be used as the start or end point, the analysis will be performed on process flows that are not highly necessary to be analyzed. As a result, there is a risk of an increase in false positives of malicious functions such as backdoors.

[0008] Therefore, it is desirable to set the target scope of the process flow analysis appropriately according to the targets that will be affected when the unauthorized function is executed. The technology disclosed in Patent Document 1 does not sufficiently consider such a problem.

[0009] In consideration of the above-mentioned problems, the object of the present disclosure is to provide an information processing device, an information processing method, and a program that are capable of performing appropriate analysis depending on the resources that are operated by functions in a program to be inspected. [Means for solving the problem]

[0010] The information processing device according to the present disclosure includes: an extraction unit that extracts function call locations indicating locations where functions are called in a program to be inspected; an identification unit that identifies an operation target resource to be operated by the function; a narrowing-down unit that narrows down an analysis target location that is a target of a process flow analysis from the function call location based on the operation content of the function on the operation target resource, the program to be inspected includes a variable definition process for defining a variable indicating the resource to be operated; The identification unit identifies the operation target resource indicated by a variable defined in the variable definition process.

[0011] The information processing method according to the present disclosure includes: The computer An extraction step of extracting function call locations indicating locations where functions are called in a program to be inspected; a specifying step of specifying an operation target resource to be operated by the function; a narrowing down step of narrowing down an analysis target location that is a target of a process flow analysis from the function call location based on the operation content of the function on the operation target resource; the program to be inspected includes a variable definition process for defining a variable indicating the resource to be operated; In the identifying step, the operation target resource indicated by the variable defined in the variable definition process is identified.

[0012] The program according to the present disclosure is An extraction step of extracting function call locations indicating locations where functions are called in a program to be inspected; a specifying step of specifying an operation target resource to be operated by the function; a narrowing down step of narrowing down an analysis target location that is a target of a process flow analysis from the function call location based on the operation content of the function on the operation target resource; the program to be inspected includes a variable definition process for defining a variable indicating the resource to be operated; In the identifying step, the operation target resource indicated by the variable defined in the variable definition process is identified. Effect of the Invention

[0013] An information processing device, an information processing method, and a program according to the present disclosure make it possible to appropriately perform analysis depending on resources that are operated by functions in a program to be inspected. [Brief description of the drawings]

[0014] [Figure 1] FIG. 2 is a block diagram showing a functional configuration of an information processing device according to the present disclosure. [Diagram 2] 1 is a flowchart showing a flow of processing performed by an information processing device according to the present disclosure. [Diagram 3] FIG. 13 is a diagram illustrating an example of a backdoor included in the control flow of the software according to the present disclosure. [Figure 4] 1 is a diagram showing source code illustrating the essential points of processing performed by an information processing device according to the present disclosure. [Diagram 5] FIG. 13 is a diagram illustrating source code for explaining an example of writing to a file using a file pointer. [Figure 6] FIG. 13 is a source code diagram illustrating an example of a socket write using a file pointer. [Figure 7] FIG. 13 is a diagram illustrating source code illustrating an example of code to be specifically targeted in order to narrow down function call locations according to the present disclosure. [Figure 8] FIG. 2 is a block diagram showing a functional configuration of an information processing device according to the present disclosure. [Figure 9] FIG. 2 is a diagram illustrating a process flow of an information processing device according to the present disclosure. [Figure 10] FIG. 13 is a diagram illustrating an example of a registered function list according to the present disclosure. [Figure 11]FIG. 13 is a diagram illustrating an example of an extracted function list according to the present disclosure. [Figure 12] FIG. 13 is a diagram illustrating an example of an argument information list according to the present disclosure. [Figure 13] FIG. 13 illustrates an example of a corresponding resource list according to the present disclosure. [Figure 14] 13 is a flowchart showing a process flow of a specification unit according to the present disclosure. [Figure 15] FIG. 13 illustrates an example of a resource identification function list according to the present disclosure. [Figure 16] FIG. 13 is a diagram illustrating an example of a narrowing-down rule according to the present disclosure. [Figure 17] 11 is a flowchart showing a flow of processing performed by a narrowing-down unit according to the present disclosure. [Figure 18] FIG. 13 is a diagram illustrating an example of an analysis target function list according to the present disclosure. [Figure 19] 1 is a flowchart showing an overall flow of processing performed by an information processing device according to the present disclosure. [Figure 20] FIG. 2 is a diagram illustrating a schematic diagram of a process performed by an information processing device according to the present disclosure. [Figure 21] FIG. 2 is a block diagram illustrating a hardware configuration of a computer that realizes an information processing device according to the present disclosure. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0015] Hereinafter, embodiments of the present disclosure will be described in detail with reference to the drawings. In each drawing, the same or corresponding elements are denoted by the same reference numerals. For clarity of explanation, duplicate explanations will be omitted as necessary.

[0016] <Embodiment 1> An information processing device 100 according to the present disclosure will be described with reference to Fig. 1. Fig. 1 is a block diagram showing a functional configuration of the information processing device 100. The information processing device 100 includes an extraction unit 101, a specification unit 102, and a narrowing unit 103.

[0017] The extraction unit 101 extracts function call locations indicating locations where functions are called in the program to be inspected. The identification unit 102 identifies operation target resources that are targets of operation by the function. The narrowing down unit 103 narrows down analysis target locations that are targets of process flow analysis from the function call locations based on the operation content of the function on the operation target resource. The program to be inspected also includes a variable definition process that defines a variable indicating the operation target resource. The identification unit 102 identifies the operation target resource indicated by the variable defined in the variable definition process.

[0018] The information processing device 100 includes a processor, a memory, and a storage device, which are not shown in the figure. A computer program in which the processing according to the present disclosure is implemented is stored in the storage device. The processor can load the computer program from the storage device into the memory and execute the computer program. In this way, the processor realizes the functions of an extraction unit 101, an identification unit 102, and a narrowing down unit 103.

[0019] The extraction unit 101, the identification unit 102, and the narrowing down unit 103 may each be realized by dedicated hardware. In addition, a part or all of the components of each device may be realized by a general-purpose or dedicated circuit, processor, etc., or a combination of these. These may be configured by a single chip, or may be configured by multiple chips connected via a bus. A part or all of the components of each device may be realized by a combination of the above-mentioned circuits, etc., and a program.

[0020] The flow of processing performed by the information processing device 100 will be described with reference to FIG. 2. FIG. 2 is a flowchart showing the flow of processing performed by the information processing device 100. It is assumed that the program to be inspected includes a variable definition process that defines a variable indicating a target resource. First, the extraction unit 101 extracts a function call location from the program to be inspected (S1). Next, the identification unit 102 identifies a target resource that is the target of operation by the function (S2). The identification unit 102 identifies a target resource indicated by a variable defined in the variable definition process. Next, the narrowing down unit 103 narrows down the analysis target location from the function call location based on the operation content of the function on the target resource (S3).

[0021] With this configuration, the information processing device 100 according to the present disclosure can perform an appropriate analysis depending on the resource that is the target of operation by the function in the program to be inspected.

[0022] <Embodiment 2> Next, a second embodiment will be described. The second embodiment is a specific example of the first embodiment described above. An information processing device 10 according to the present disclosure will be described below. The information processing device 10 is a device that can appropriately narrow down function call locations that are the start or end points of a process flow analysis according to resources that are the targets of operations of functions in a program to be inspected by performing a predetermined process. This also enables the information processing device 10 to appropriately analyze the program to be inspected.

[0023] First, a program inspection technique will be described as a technique related to the present disclosure. In order to inspect whether a program contains a malicious function, it is necessary to analyze the code contained in the program to be inspected. In the following, a backdoor will be used as an example of a malicious function. However, the present disclosure is not limited to this and can also be applied to malicious functions other than a backdoor.

[0024] There are two methods for analyzing a program: a method for performing analysis using the source code of the program to be inspected, and a method for performing analysis using the code included in the binary of the program to be inspected. In this embodiment, an example will be described in which the information processing device 10 performs a process flow analysis of the program to be inspected using the source code of the program to be inspected.

[0025] By performing process flow analysis, the information processing device 10 can detect code that performs operations that are sensitive in terms of security. Here, a sensitive operation refers to an operation that, if executed improperly, is considered to have a significant effect on a system including the program to be inspected and the environment in which the program to be inspected is executed. Sensitive operations may be determined in advance by a user. The user may be, for example, an inspector who inspects the program to be inspected, a client who requests the inspection, or a security officer.

[0026] An example of a backdoor installed in a program will be described with reference to Fig. 3. Fig. 3 is a diagram showing an example of a backdoor included in software control flows CF1 and CF2. In the diagram, circles represent functions or procedures. In the following description, functions and procedures may be referred to as "nodes." In the diagram, thin arrows represent normal processing flows, and thick arrows represent backdoor processing flows. In the diagram, an inspector U is shown as a user.

[0027] In the control flow CF1 shown in the upper part of FIG. 3, nodes A1 to A5 are the execution path of the regular code. Usually, when a regular user executes the control flow CF1, the process is executed along a route such as nodes A1, A2, A3, A4, and A5. However, in the example shown in the figure, a backdoor is installed to advance the process from node A4 to node A6. By making a predetermined input at node A4, an attacker can execute the process at node A6 without passing through the regular node A5. The attacker is, for example, a person who installed the backdoor in the program, or a related person.

[0028] The specified input made by the attacker is a special input for realizing an unauthorized function. The specified input is, for example, an input for making a program execute a sensitive operation without going through a normal processing flow. The specified input may include, for example, input information known only to the attacker or those related to him / her. The input information is, for example, information regarding a hidden function not described in a specification or the like, information for circumventing an authentication function, or a specified command character string. These are only examples, and the input information may include various input data for realizing an unauthorized function.

[0029] Node A6 includes code for performing sensitive operations on the system, etc. (e.g., command execution, file output, etc.). Attackers attempt to perform unauthorized operations by establishing a backdoor to create a process flow that differs from the normal process flow. For example, an attacker may establish such a backdoor in a program as a hidden function.

[0030] The lower part of Figure 3 shows an example of a control flow CF2 that includes a branch. In this example, a backdoor is installed in the control flow CF2 to execute unauthorized processing on the path of nodes B1, B2, B3, and B5. For example, an attacker can input specific data in node B1 to cause processing to be executed on the path of nodes B1, B2, B3, and B5. Node B5 includes code for performing sensitive operations on the system, etc.

[0031] Here, node B5 is a node that may be passed through in a normal processing flow. For example, node B4 is an authentication function for authenticating that the user is a normal user. In the normal processing flow, the authentication function is executed in node B4, and if the authentication is successful, the processing of node B5 is executed, and if the authentication is unsuccessful, the processing of node B6 is executed. In this way, in the normal processing flow, sensitive operations are executed only when the user is successfully authenticated, and if the authentication is unsuccessful, sensitive operations are not executed. However, in the control flow CF2, an attacker forms a flow that avoids the authentication function by setting up a backdoor that does not go through node B4. This allows the attacker to execute sensitive operations while avoiding the authentication function.

[0032] The information processing device 10 performs a backdoor inspection to detect a backdoor by performing a process flow analysis on a process flow defined by a predetermined start point and a predetermined end point in a program to be inspected. For example, in the example in the lower part of FIG. 3, the predetermined start point is node B1 where an attacker inputs data. Also, the predetermined end point is node B5 which includes sensitive code. The sensitive code may include a function which may execute a sensitive operation.

[0033] For example, the information processing device 10 analyzes the process flow PF1 starting from node B1 and ending at node B5. In this way, the information processing device 10 checks whether or not a backdoor exists in the process flow PF1. The information processing device 10 notifies the checker U of the result of the backdoor check based on the analysis result.

[0034] (Summary of the Disclosure) As described above, the information processing device 10 can specify the call points of a widely used library function as the start and end points of the process flow in the process flow analysis. However, when such a function call point is specified as the start or end point, the information processing device 10 will also analyze process flows for which the necessity for process flow analysis is not high. As a result, there is a risk of an increase in false detections of backdoors. There is also a problem that the burden on the inspector U who checks the analysis results increases. To solve such problems, the information processing device 10 sets the target range of the process flow analysis taking into consideration the targets that will be affected when the unauthorized function is executed.

[0035] In the present disclosure, attention is paid to the target resource that is the target of the operation of the function at the function call point in the program to be inspected. Specifically, attention is paid to the fact that the function used in the variable definition process that defines the variable indicating the target resource in the program to be inspected is different for each resource.

[0036] Examples of the operation target resource include operations on files, sockets, processes, users, etc., buffers, pipes, named pipes, or memory outside the detection target program. Other resources may be used as the operation target resource. The call points of functions that operate these operation target resources can be the starting point or end point of the process flow analysis.

[0037] Moreover, an example of a variable indicating a resource to be operated on is a file descriptor. A file descriptor is identification information assigned to identify a file to be operated on when the file is operated from a program. A file descriptor is expressed, for example, as an integer value. Also, a socket is accessed by accessing a file in a special file system called sockfs. Therefore, socket communication can also be read and written (sent and received) using a file descriptor.

[0038] For example, suppose that the program to be inspected includes a call to a function that operates on a file, and a variable definition process that defines a file descriptor that indicates the file to be operated on. The information processing device 10 identifies the file indicated by the file descriptor defined in the variable definition process. The information processing device 10 also determines whether or not to subject the function call location to a process flow analysis, depending on the operation content of the function on the identified file (e.g., writing to a file).

[0039] By doing this, the information processing device 10 can narrow down the analysis target locations depending on the resources operated by functions in the program to be inspected, thereby reducing the number of flows to be subject to processing flow analysis.

[0040] (Key points of processing performed by information processing device 10) Here, the main points of the processing performed by the information processing device 10 will be specifically described. Usually, a program to be inspected includes a src (source) function, which is a function for acquiring an external input, and a sink function that may perform sensitive operations on a system including the program to be inspected. The arguments of the src function and the sink function include variables that indicate the resources to be operated on, such as a file descriptor and a socket descriptor. The program to be inspected also includes a variable definition process that defines such variables.

[0041] This disclosure focuses on the fact that the function used in the variable definition process and the arguments passed to the function have characteristics that appear depending on the resource to be operated. For example, if the function operates a file, the open function is used in the variable definition process. Also, if the function operates a socket, the socket function is used in the variable definition process. Also, for example, assume that the write function included in a program is extracted to detect unauthorized rewriting of a confidential file. In this case, whether the file to be rewritten is a confidential file or not differs depending on the file path passed to the argument of the open function.

[0042] The information processing device 10 according to the present disclosure defines in advance which argument of a function that can be a src function or a sink function is given a variable indicating a target resource. Hereinafter, among the arguments of a function, an argument to which a variable indicating a target resource is given may be referred to as a "target argument." Furthermore, the information processing device 10 also defines in advance the functions to be used in the program to be inspected for each operation on a resource. The information processing device 10 refers to this information during analysis to narrow down the calling locations of src functions or sink functions included in the program to be inspected.

[0043] FIG. 4 is a diagram showing source code 110 explaining the main points of the processing performed by the information processing device 10. The source code 110 includes code 111 and code 112. The open function in code 111 is an example of a src function, and the write function in code 112 is an example of a sink function. As shown in the figure, in code 111, a variable definition process is performed to define a variable fd indicating a file descriptor. The first argument of the open function, path, indicates a resource to be operated on by the open function. In addition, in code 112, the variable fd defined in code 111 is used as the first argument of the write function. The variable fd corresponds to the target argument described above.

[0044] The arrows shown in Fig. 4 indicate the propagation of information. The arrows indicate the propagation from the variable fd of the code 112 to the variable fd of the code 111. By tracing the propagation of the variable fd, the information processing device 10 identifies the variable defined in the variable definition process and identifies the operation target resource indicated by the variable. For example, data flow analysis for detecting unauthorized functions such as a backdoor is performed for each process flow that starts or ends at a src function and a sink function. The information processing device 10 can appropriately perform process flow analysis by appropriately narrowing down the start and end points of the process flow.

[0045] For example, in the example of Fig. 4, the write function of code 112 is the starting point of the process flow, and the open function of code 111 is the end point of the process flow. Note that in Fig. 4, the starting point of the narrowing down is the descriptor given to the src function or the sink function, but the starting point may be the descriptor output by the open function. In other words, the propagation of the variable fd in the opposite direction to the arrow shown in Fig. 4 may be considered.

[0046] In the above description, the narrowing down point is explained using the descriptor, but the narrowing down point is not limited to the descriptor. For example, the fread and fwrite functions take as an argument a pointer to the FILE structure of the target file. As in the case of the descriptor, these functions can identify the target resource by identifying the function used in the definition process of the pointer to the FILE structure and the descriptor used in that process.

[0047] 5 is a diagram showing source code 120 illustrating an example of writing to a file using a file pointer. A variable fp is defined in a variable definition process shown in code 121. In code 122, the variable fp is used as the fourth argument of the fwrite function.

[0048] 6 shows source code 130 illustrating an example of socket writing using a file pointer. In the variable definition process shown in code 131, a variable sockfd is defined. In code 132, the variable sockfd is converted to a variable fp. In code 133, the variable fp is used as the first argument of the fprintf function.

[0049] 7 is a diagram showing source code 140 illustrating an example of code to be specified in order to narrow down function call locations. In Fig. 7, solid arrows indicate flows to be detected, and dashed arrows indicate flows not to be detected.

[0050] In code 141, a variable fp is defined. Also, in code 142, a variable sockfd is defined. The processes of codes 141 and 142 are variable definition processes that define a variable indicating a target resource. For the sake of explanation, the process indicated by code 141 may be referred to as variable definition process V1 below. Also, the process indicated by code 142 may be referred to as variable definition process V2 below.

[0051] In code 143, external input is received from the socket into buf by the read function. In code 144, some processing is performed by FuncA, and buf is stored into var1. In code 146, within the error handling of the FuncA function, the external input data is written to a file by the fwrite function. In normal processing shown in code 148, var1, to which the external input has been propagated, is written to the socket by the write function. As a result, the contents of var1 are sent to the outside.

[0052] For example, suppose a sink function that transmits data to an external device is set as the target of process flow analysis. The src function includes the read function of code 143. The sink functions include the fwrite function of code 146 and the write function of code 148. Here, the fwrite function of code 146 simply performs normal writing to the socket read by code 143 for error processing. For this reason, as indicated by the dashed arrow, it is desirable to exclude the fwrite function of code 146 from the target of process flow analysis. On the other hand, the write function of code 148 targets the socket for writing. For this reason, as indicated by the solid arrow, the write function of code 148 needs to be the target of process flow analysis.

[0053] (Configuration of information processing device 10) Next, the configuration of the information processing device 10 according to the present disclosure will be described with reference to Fig. 8 and Fig. 9. Fig. 8 is a block diagram showing the functional configuration of the information processing device 10. Fig. 9 is a diagram showing a schematic flow of processing of the information processing device 10.

[0054] In the following, the process performed by the information processing device 10 will be specifically described using the source code 140 shown in Fig. 7. In the following, the address of the location where the fwrite function is called in the code 146 shown in Fig. 7 is assumed to be "0x4000". In addition, the address of the location where the write function is called in the code 148 is assumed to be "0x3000".

[0055] 9 are stored in advance in, for example, the storage unit 19 of the information processing device 10. The information processing device 10 acquires this information by referring to the storage unit 19. Without being limited to this, the registered function list 210, the corresponding resource list 240, and the narrowing down rule 260 may be stored in a device other than the information processing device 10. The information processing device 10 may acquire this information via a network (not shown). Note that the various lists described below may be configured in a format other than a list format.

[0056] The information processing device 10 is an example of the above-mentioned information processing device 100. As shown in FIG. 8, the information processing device 10 includes an extraction unit 11, a specification unit 12, a narrowing down unit 13, an analysis unit 14, a notification unit 15, and a storage unit 19.

[0057] The extraction unit 11 is an example of the above-mentioned extraction unit 101. The extraction unit 11 extracts function call locations indicating locations where functions are called in a test target program P, which is a program to be tested. The extraction unit 11 extracts function call locations based on a registered function list 210 in which functions that may perform sensitive operations on a system including the test target program P when executed fraudulently and functions that obtain external inputs are registered in advance.

[0058] 10 is a diagram showing an example of the registered function list 210. The registered function list 210 includes a registered function list 210a related to sink functions and a registered function list 210b related to src functions. The sink function is a function that may perform sensitive operations on a system including the program P to be inspected. The src function is a function that obtains an external input. The extraction unit 11 refers to the registered function list 210 and extracts all the locations in the program P to be inspected that call these functions. The extraction unit 11 stores the extraction result in the extracted function list 220 and outputs the extracted function list 220 to the identification unit 12.

[0059] 11 is a diagram showing an example of the extracted function list 220. The extracted function list 220 includes an extracted function list 220a related to sink functions and an extracted function list 220b related to src functions. The extracted function list 220 is a list that associates function names with caller addresses indicating the call locations.

[0060] Returning to Fig. 8 and Fig. 9, the identification unit 12 is an example of the identification unit 102 described above. The identification unit 12 identifies an operation target resource that is the target of an operation by a function. As shown in codes 141 and 142 of source code 140 shown in Fig. 7, the inspection target program P includes variable definition processes V1 and V2 that define variables indicating the operation target resource. The identification unit 12 identifies the operation target resource indicated by the variables defined in the variable definition processes V1 and V2.

[0061] Specifically, the identification unit 12 identifies the target resource based on an argument information list 230 in which an argument number indicating the target resource is defined for each function, and a corresponding resource list 240 indicating the type of resource corresponding to the functions used in the variable definition processes V1 and V2.

[0062] FIG. 12 is a diagram showing an example of argument information list 230. Argument information list 230 includes argument information list 230a related to sink function and argument information list 230b related to src function. Argument information list 230 is a list that associates function name, target argument input, and operation content. Target argument input indicates the argument number of the function. Argument information list 230 is defined in advance for each function. Identification unit 12 extracts functions included in argument information list 230 from functions included in extracted function list 220 output from extraction unit 11.

[0063] Furthermore, for the extracted function, the identification unit 12 identifies the variable of the argument number listed in the argument information list 230 and the variable definition process that defines the variable. As described above, the identification unit 12 can identify the variable definition process by tracing the propagation of information related to the variable indicated by the target argument. In the example of Fig. 7, the identification unit 12 identifies the variable definition process V1 that defines the variable fp. Furthermore, the identification unit 12 identifies the variable definition process V2 that defines the variable sockfd.

[0064] The identification unit 12 identifies the types of resources corresponding to the functions used in the variable definition processes V1 and V2 by referring to the corresponding resource list 240. Fig. 13 is a diagram showing an example of the corresponding resource list 240. The corresponding resource list 240 includes a corresponding resource list 240a related to file operations and a corresponding resource list 240b related to socket operations. The corresponding resource list 240 is a list that associates function names with target argument outputs.

[0065] (Processing of identification unit 12) The flow of processing by the identification unit 12 will be described with reference to Fig. 14. Fig. 14 is a flowchart showing the flow of processing by the identification unit 12. First, the identification unit 12 extracts one function and one target argument from the argument information list 230 for each function (S11). Next, the identification unit 12 extracts function calls that have the target argument as a return value or an argument (S12). Next, the identification unit 12 identifies a variable definition process (S13).

[0066] Next, the identification unit 12 judges whether the extracted function is included in the corresponding resource list 240 (S14). When it is judged that the extracted function is not included in the corresponding resource list 240 (NO in S14), the identification unit 12 returns the process to step S12. When it is judged that the extracted function is included in the corresponding resource list 240 (YES in S14), the identification unit 12 stores information about the function in the resource identifying function list 250 (S15). In this case, the identification unit 12 returns the process to step S12 and repeats the subsequent processes. The identification unit 12 repeats the processes of steps S12 to S15 until it is completed for the functions and target arguments included in the argument information list 230. The identification unit 12 outputs the resource identifying function list 250 to the narrowing down unit 13.

[0067] 15 is a diagram showing an example of the resource specific function list 250. The resource specific function list 250 is a list that associates a function name, src / sink, address, operation target resource, and operation content. The src / sink indicates whether the function indicated by the function name is a src function or a sink function.

[0068] Returning to Fig. 8 and Fig. 9, the narrowing down unit 13 is an example of the narrowing down unit 103 described above. The narrowing down unit 13 narrows down the analysis target location, which is the target of the process flow analysis, from the function call location based on the operation content of the function on the operation target resource. The operation content is, for example, read or write. The narrowing down unit 13 may narrow down the analysis target location using narrowing down rules related to the operation content of the function on the operation target resource. Specifically, the narrowing down unit 13 narrows down the analysis target location based on the resource identification function list 250 output from the identification unit 12 and narrowing down rules 260 related to the operation content of the function on the operation target resource.

[0069] The narrowing down rules 260 include at least one of a rule that sets a function call location as an analysis target of the process flow analysis and a rule that excludes a function call location from an analysis target of the process flow analysis. Here, the narrowing down rules 260 are described as including a rule that sets a function call location as an analysis target of the process flow analysis, but the narrowing down rules 260 may include a rule that excludes a function call location from an analysis target of the process flow analysis. The narrowing down rules 260 may be set in advance by an inspector or the like. The narrowing down unit 13 narrows down the functions included in the resource identification function list 250 to functions that match the narrowing down rules 260 as functions to be analyzed.

[0070] FIG. 16 is a diagram showing an example of the narrowing down rules 260. The narrowing down rules 260 are a list that associates the operation target resource, src / sink, operation content, and target flag. The target flag is information that indicates whether the function call location is a target of process flow analysis. If the target flag is "True", the narrowing down unit 13 determines that the function call location is a target of process flow analysis. Also, if the target flag is "False", the narrowing down unit 13 determines that the function call location is not a target of process flow analysis.

[0071] The narrowing down rules 260 may include resource identification information for identifying the operation target resource as a rule. The resource identification information is, for example, the name of the resource. Specifically, the resource identification information is, for example, a path, a file name, a socket name, a process name, or the like, indicating the operation target resource. The resource identification information is not limited to these, and may be any information capable of identifying the operation target resource. The narrowing down unit 13 may narrow down the analysis target location further based on the resource identification information for identifying the operation target resource identified by the identification unit 12.

[0072] The narrowing-down unit 13 may narrow down the analysis target location according to the confidentiality level of the operation target resource indicated by the resource identification information. For example, it is assumed that the narrowing-down rule 260 is set as a rule that the path indicating the resource includes " / etc / passwd". In this case, the narrowing-down unit 13 narrows down the analysis target location according to the narrowing-down rule that the path to the operation target includes " / etc / passwd".

[0073] (Processing of narrowing down unit 13) The flow of processing by the narrowing down unit 13 will be described with reference to Fig. 17. Fig. 17 is a flowchart showing the flow of processing performed by the narrowing down unit 13. First, the narrowing down unit 13 extracts one function from the resource identifying function list 250 (S21). Next, the narrowing down unit 13 refers to the narrowing down rules 260 and acquires a target flag associated with the function extracted from the resource identifying function list 250 (S22). Specifically, the narrowing down unit 13 extracts a target flag of a function that matches the src / sink, operation target resource, and operation content (Read or Write) associated with the extracted function.

[0074] For example, in step S21, it is assumed that the narrowing down unit 13 extracts the write function from the resource identifying function list 250. The src / sink of the write function is "sink", the operation target resource is "socket", and the operation content is "write". The narrowing down unit 13 refers to the narrowing down rules 260 and acquires the target flag of the rule that matches this information of the write function. As shown in FIG. 16, here, the third rule from the top of the narrowing down rules 260 has information that matches this. The narrowing down unit 13 acquires "True" as the target flag. Similarly, when the narrowing down unit 13 extracts the fwrite function from the resource identifying function list 250, the narrowing down unit 13 acquires "False" as the target flag.

[0075] Next, the narrowing-down unit 13 judges whether the target flag is True or not (S23). If the narrowing-down unit 13 judges that the target flag is False (No in S23), the narrowing-down unit 13 returns the process to step S22. If the narrowing-down unit 13 judges that the target flag is True (YES in S23), the narrowing-down unit 13 stores information about the extracted function in the analysis target function list 270 (S24).

[0076] For example, in the above-mentioned example of the write function and the fwrite function, the narrowing down unit 13 stores information about the write function whose target flag is "True" in the analysis target function list 270. The narrowing down unit 13 stores information including the address "0x3000" of the call location of the write function in question in the analysis target function list 270. On the other hand, the narrowing down unit 13 does not store information about the fwrite function whose target flag is "False" in the analysis target function list 270.

[0077] Furthermore, the narrowing down unit 13 returns the process to step S22 and repeats the subsequent processes. The narrowing down unit 13 repeats the processes of steps S22 to S24 until it has finished for the functions included in the resource identifying function list 250. In this way, the narrowing down unit 13 can output the analysis target function list 270 as a result of narrowing down the analysis target locations that are the targets of the process flow analysis from the resource identifying function list 250. The narrowing down unit 13 outputs the analysis target function list 270 to the analysis unit 14.

[0078] 18 is a diagram showing an example of the analysis target function list 270. The analysis target function list 270 is a list that associates function names, src / sink, addresses, operation target resources, and operation contents. Since the function call locations are narrowed down by the narrowing down unit 13, the analysis target function list 270 has fewer function call locations than the resource identification function list 250.

[0079] Returning to Fig. 8 and Fig. 9, the analysis unit 14 performs an analysis of the process flow starting or ending at the analysis target location narrowed down by the narrowing down unit 13. The analysis unit 14 performs the process flow analysis based on the addresses stored in the analysis target function list 270. The analysis unit 14 may perform the process flow analysis using any analysis method. The analysis unit 14 also outputs the analysis result to the notification unit 15.

[0080] The notification unit 15 notifies the inspector U (user) of the analysis results from the analysis unit 14. For example, the notification unit 15 notifies the inspector U of the analysis results via a communication interface for wired or wireless communication (not shown) to a PC used by the inspector U. The notification unit 15 may notify by outputting the inspection results as an inspection report. The inspection report indicates information about the backdoor, such as "shell program launched by inputting a hidden password from outside" or "password information output to a log file by a hidden command from outside." The inspection report may include information about the resource to be operated. For example, the inspection report may include information such as "resource to be operated: confidential document X."

[0081] The storage unit 19 is composed of a semiconductor memory or the like, and stores various data and programs. At least a part of the storage unit 19 is composed of a non-volatile memory so that data is retained even when the power of the information processing device 10 is turned off. The storage unit 19 may store the various lists described above in addition to the program according to this embodiment.

[0082] (Processing of information processing device 10) The overall flow of processing by the information processing device 10 will be described with reference to Fig. 19. Fig. 19 is a flowchart showing the overall flow of processing performed by the information processing device 10.

[0083] First, the extraction unit 11 acquires the source code of the program P to be inspected (S31). The extraction unit 11 extracts function call locations from the acquired source code (S32). The extraction unit 11 may extract the function call locations using a registered function list 210 that is registered in advance. The extraction unit 11 outputs an extracted function list 220 as the extraction result.

[0084] Next, the identification unit 12 identifies the operation target resource that is the target of the operation by the function extracted in step S32, using the argument information list 230 and the corresponding resource list 240 (S33). The identification unit 12 identifies the variable definition process by tracing the propagation of information related to the variable indicated by the target argument. The identification unit 12 also identifies the operation target resource indicated by the variable defined in the variable definition process. The identification unit 12 outputs a resource identification function list 250 as the identification result of the operation target resource.

[0085] Next, the narrowing down unit 13 narrows down the analysis target locations from the function call locations based on the operation content of the function on the operation target resource identified by the identification unit 12 (S34). Specifically, the narrowing down unit 13 narrows down the analysis target locations from the function call locations included in the resource identification function list 250 using the narrowing down rules 260. The narrowing down unit 13 outputs the analysis target function list 270 as a result of the narrowing down.

[0086] Next, the analysis unit 14 performs a process flow analysis of the analysis target portion included in the analysis target function list 270 (S35). Finally, the notification unit 15 notifies the inspector U of the analysis result (S36).

[0087] As described above, in the information processing device 10 according to the present disclosure, the extraction unit 11 extracts a function call location indicating a location where a function is called in the program to be inspected. The identification unit 12 identifies a target resource that is the target of operation by the function. The program to be inspected includes a variable definition process that defines a variable indicating the target resource. The identification unit 12 identifies the target resource indicated by the variable defined in the variable definition process. The narrowing down unit 13 narrows down the analysis target location that is the target of the process flow analysis from the function call location based on the operation content of the function on the target resource.

[0088] Furthermore, the information processing device 10 can narrow down the resources to be analyzed by prioritizing them. For example, the information processing device 10 can narrow down the analysis target locations according to the confidentiality of the resources to be operated.

[0089] With this configuration, the information processing device 10 can reduce the number of functions that are the start or end points of the process flow analysis. This can shorten the time required for the process flow analysis and reduce the number of results notified to the inspector, thereby reducing the burden on the inspector and the cost of inspection. Therefore, the information processing device 10 according to the present disclosure can perform an appropriate analysis depending on the resources that are operated by the functions in the program to be inspected.

[0090] <Modification> In the configuration of the information processing device 10 described above, the narrowing down unit 13 narrows down the call locations of the src function or sink function to be inspected, and the analysis unit 14 performs process flow analysis on the narrowed down call locations. As shown in this modification, the information processing device 10 may be configured to first execute the process flow analysis, and then the narrowing down unit 13 narrows down the information to be notified to the inspector U. An information processing device 10a according to this modification will be described below. Descriptions of contents that overlap with the information processing device 10 described in the second embodiment will be omitted, and differences from the information processing device 10 will be mainly described.

[0091] The functional configuration of the information processing device 10a is the same as that of the information processing device 10 shown in Fig. 8, and is therefore not shown in the figure. Like the information processing device 10, the information processing device 10a includes an extraction unit 11, an identification unit 12, a narrowing down unit 13, an analysis unit 14, a notification unit 15, and a storage unit 19. In the information processing device 10a, the analysis unit 14 identifies a process flow that may include an unauthorized function. Furthermore, the narrowing down unit 13 narrows down the analysis target location from the function call location based on the process flow that may include an unauthorized function identified by the analysis unit 14.

[0092] Fig. 20 is a diagram showing a schematic diagram of the processing of the information processing device 10a according to the present disclosure. In the second embodiment, as described with reference to Fig. 9, the information processing device 10 proceeds with the processing in the order of the extraction unit 11, the identification unit 12, the narrowing down unit 13, and the analysis unit 14. In this modification, the information processing device 10a proceeds with the processing in the order shown in Fig. 20. The information processing device 10a performs the processing through a path A indicated by a thin solid line and a path B indicated by a thick solid line. In the path A, the information processing device 10a performs the processing in the order of the extraction unit 11, the identification unit 12, and the narrowing down unit 13, similar to the processing flow of the second embodiment.

[0093] The process of path B will be described. In path B, the information processing device 10a performs the process of the extraction unit 11 and then the process of the analysis unit 14. First, the extraction unit 11 extracts a process flow that may include an unauthorized function such as a backdoor based on the registered function list 210. The extraction unit 11 outputs a function list L1 including the extracted information to the analysis unit 14. The function list L1 includes information on src functions and sink functions included in the process flow that may include an unauthorized function.

[0094] The analysis unit 14 performs a process flow analysis based on the function list L1. The analysis unit 14 outputs a process flow list L2 including information on process flows that may include unauthorized functions such as a backdoor to the narrowing down unit 13. The narrowing down unit 13 narrows down the analysis target locations based on the resource identification function list 250 output from the identification unit 12 and the process flow list L2.

[0095] In this modified example, analysis is performed in the analysis unit 14 before the narrowing down of the analysis target locations in the narrowing down unit 13. Therefore, in this modified example, the analysis unit 14 analyzes more analysis target locations than when analysis is performed after narrowing down. However, when the size of the analysis target data of the analysis unit 14 is small, the processing load of the analysis unit 14 is kept below a predetermined size. Therefore, the information processing device 10a may select between the processing of embodiment 2 and the processing of this modified example depending on the size of the analysis target data, etc.

[0096] With such a configuration, in this modification, the information processing device 10a can achieve the same effects as the information processing device 10 according to the embodiment 2. In addition, the information processing device 10a can perform the processes of the paths A and B in parallel, thereby reducing the processing time.

[0097] The configuration of the information processing devices 100, 10, and 10a (hereinafter referred to as "information processing devices 100, etc.") and the processes performed by each of them have been described above. The configuration of the information processing device 100, etc. described above is merely an example and may be changed as appropriate. For example, when a part or all of each component of the information processing device 100, etc. is realized by multiple information processing devices, circuits, etc., the multiple information processing devices, circuits, etc. may be centrally arranged or distributed. For example, the information processing devices, circuits, etc. may be realized as a client-server system, a cloud computing system, etc., in a form in which each is connected via a communication network. In addition, the functions of the information processing device 100, etc. may be provided in a SaaS (Software as a Service) format.

[0098] <Hardware configuration example> Each functional component of the information processing device 100 etc. may be realized by hardware that realizes each functional component (e.g., a hardwired electronic circuit, etc.), or may be realized by a combination of hardware and software (e.g., a combination of an electronic circuit and a program that controls it, etc.). Below, a further description will be given of the case where each functional component of the information processing device 100 etc. is realized by a combination of hardware and software.

[0099] 21 is a block diagram illustrating a hardware configuration of a computer 900 that realizes the information processing device 100, etc. The computer 900 may be a dedicated computer designed to realize the information processing device 100, etc., or may be a general-purpose computer. The computer 900 may be a portable computer such as a smartphone or a tablet terminal.

[0100] For example, by installing a specific application on the computer 900, the computer 900 realizes each function of the information processing device 100, etc. The application is configured by a program for realizing the functional components of the information processing device 100, etc.

[0101] The computer 900 includes a bus 902, a processor 904, a memory 906, a storage device 908, an input / output interface 910, and a network interface 912. The bus 902 is a data transmission path for the processor 904, the memory 906, the storage device 908, the input / output interface 910, and the network interface 912 to transmit and receive data to and from each other. However, the method of connecting the processor 904 and other components to each other is not limited to a bus connection.

[0102] The processor 904 is a variety of processors, such as a central processing unit (CPU), a graphics processing unit (GPU), a field-programmable gate array (FPGA), or a quantum processor (quantum computer control chip). The memory 906 is a main storage device realized using a random access memory (RAM) or the like. The storage device 908 is an auxiliary storage device realized using a hard disk, a solid state drive (SSD), a memory card, or a read only memory (ROM) or the like.

[0103] The input / output interface 910 is an interface for connecting the computer 900 to an input / output device. For example, an input device such as a keyboard and an output device such as a display device are connected to the input / output interface 910. The network interface 912 is an interface for connecting the computer 900 to a network. This network may be a LAN (Local Area Network) or a WAN (Wide Area Network).

[0104] The storage device 908 stores a program (a program that realizes the above-mentioned application) that realizes each functional component of the information processing device 100, etc. The processor 904 reads this program into the memory 906 and executes it to realize each functional component of the information processing device 100, etc.

[0105] Each of the processors executes one or more programs including instructions for making the computer perform the algorithms described with the drawings. The programs include instructions (or software code) for making the computer perform one or more functions described in the embodiments when loaded into the computer. The programs may be stored on various types of non-transitory computer readable medium or tangible storage medium. By way of example and not limitation, non-transitory computer readable medium or tangible storage medium includes RAM, ROM, flash memory, SSD or other memory technology, CD-ROM, DVD (digital versatile disc), Blu-ray® disk or other optical disk storage, magnetic cassette, magnetic tape, magnetic disk storage or other magnetic storage device. The programs may also be transmitted on various types of transitory computer readable medium or communication medium. By way of example and not limitation, transitory computer readable medium or communication medium includes electrical, optical, acoustic, or other form of propagated signal.

[0106] Although the present disclosure has been described above with reference to the embodiments, the present disclosure is not limited to the above-mentioned embodiments. Various modifications that can be understood by a person skilled in the art can be made to the configuration and details of the present disclosure within the scope of the present disclosure. Furthermore, each embodiment can be appropriately combined with other embodiments.

[0107] Each drawing is merely an example for describing one or more embodiments. Each drawing may relate not only to one particular embodiment, but to one or more other embodiments. As can be understood by those skilled in the art, various features or steps described with reference to any one drawing may be combined with features or steps shown in one or more other drawings to create an embodiment not explicitly shown or described, for example. Not all features or steps shown in any one drawing are necessary to describe an exemplary embodiment, and some features or steps may be omitted. The order of steps described in any drawing may be changed as appropriate.

[0108] The present disclosure is not limited to the above-described embodiment, and can be modified as appropriate without departing from the spirit and scope of the present disclosure.

[0109] A part or all of the above-described embodiments can be described as, but is not limited to, the following supplementary notes. (Appendix 1) an extraction unit that extracts function call locations indicating locations where functions are called in a program to be inspected; an identification unit that identifies an operation target resource to be operated by the function; a narrowing-down unit that narrows down an analysis target location that is a target of a process flow analysis from the function call location based on the operation content of the function on the operation target resource, the program to be inspected includes a variable definition process for defining a variable indicating the resource to be operated; The identification unit identifies the operation target resource indicated by a variable defined in the variable definition process. Information processing device. (Appendix 2) The extraction unit extracts the function call locations based on a registered function list in which functions that, if executed fraudulently, may perform sensitive operations on a system including the inspection target program and functions that obtain external inputs are registered in advance. 2. An information processing device according to claim 1. (Appendix 3) The identification unit identifies the operation target resource based on an argument information list in which an argument number indicating the operation target resource is determined for each function, and a corresponding resource list indicating a type of resource corresponding to a function used in the variable definition process. 3. The information processing device according to claim 1 or 2. (Appendix 4) The narrowing-down unit narrows down the analysis target portion using narrowing-down rules related to the operation content of the function on the operation target resource. 4. The information processing device according to claim 1, (Appendix 5) The narrowing down rule includes at least one of a rule for making the function call location a target of the process flow analysis and a rule for making the function call location an exception to the target of the process flow analysis. 5. The information processing device according to claim 4. (Appendix 6) The narrowing-down unit narrows down the analysis target portion based on resource identification information that identifies the operation target resource. 6. The information processing device according to any one of claims 1 to 5. (Appendix 7) The narrowing-down unit narrows down the analysis target locations according to a level of confidentiality of the operation target resource indicated by the resource identification information. 7. The information processing device according to claim 6. (Appendix 8) The narrowing-down unit further includes an analysis unit that analyzes a process flow that starts or ends at the analysis target location narrowed down by the narrowing-down unit. 8. The information processing device according to any one of claims 1 to 7. (Appendix 9) an analysis unit that analyzes a process flow starting or ending at the function call location extracted by the extraction unit, The analysis unit identifies a process flow that may include an unauthorized function, The narrowing unit narrows down the analysis target location from the function call location based on a process flow that may include the unauthorized function. 8. The information processing device according to any one of claims 1 to 7. (Appendix 10) The analysis unit further includes a notification unit that notifies a user of the analysis result. 10. The information processing device according to claim 8 or 9. (Appendix 11) The computer An extraction step of extracting function call locations indicating locations where functions are called in a program to be inspected; a specifying step of specifying an operation target resource to be operated by the function; a narrowing down step of narrowing down an analysis target location that is a target of a process flow analysis from the function call location based on the operation content of the function on the operation target resource; the program to be inspected includes a variable definition process for defining a variable indicating the resource to be operated; In the identifying step, the operation target resource indicated by the variable defined in the variable definition process is identified. Information processing methods. (Appendix 12) An extraction step of extracting function call locations indicating locations where functions are called in a program to be inspected; a specifying step of specifying an operation target resource to be operated by the function; a narrowing down step of narrowing down an analysis target location that is a target of a process flow analysis from the function call location based on the operation content of the function on the operation target resource; the program to be inspected includes a variable definition process for defining a variable indicating the resource to be operated; In the identifying step, the operation target resource indicated by the variable defined in the variable definition process is identified. program.

[0110] Some or all of the elements (e.g., configurations and functions) described in Supplementary Note 2 to Supplementary Note 10 that are dependent on Supplementary Note 1 may also be dependent on Supplementary Note 11 and Supplementary Note 12 in the same dependent relationship as Supplementary Note 2 to Supplementary Note 10. Some or all of the elements described in any Supplementary Note may be applied to various hardware, software, recording means for recording software, systems, and methods. [Explanation of symbols]

[0111] 10, 10a, 100 Information processing device 11, 101 Extraction part 12, 102 Specific part 13, 103 Narrowing section 14 Analysis Department 15 Notification Department 19 Memory section 110, 120, 130, 140 Source Code 210, 210a, 210b Registered Function List 220, 220a, 220b Extraction Function List 230, 230a, 230b Argument information list 240, 240a, 240b Resource List 250 Resource Specific Function List 260 Filtering Rules 270 List of Analyzed Functions 900 Computers 902 Bus 904 Processor 906 Memory 908 Storage Devices 910 Input / Output Interface 912 Network Interface A1~A6 nodes B1~B6 nodes CF1, CF2 control flow L1 Function List L2 Processing Flow List P Program to be inspected PF1 Processing Flow U Inspector V1, V2 variable definition process

Claims

1. an extraction unit that extracts function call locations indicating locations where functions are called in a program to be inspected; an identification unit that identifies an operation target resource to be operated by the function; a narrowing-down unit that narrows down an analysis target location that is a target of a process flow analysis from the function call location based on the operation content of the function with respect to the operation target resource, the program to be inspected includes a variable definition process for defining a variable indicating the resource to be operated; The identification unit identifies the operation target resource indicated by a variable defined in the variable definition process. Information processing device.

2. The extraction unit extracts the function call locations based on a registered function list in which functions that, if executed fraudulently, may perform sensitive operations on a system including the inspection target program and functions that obtain external inputs are registered in advance. The information processing device according to claim 1 .

3. The identification unit identifies the operation target resource based on an argument information list in which an argument number indicating the operation target resource is determined for each function, and a corresponding resource list indicating a type of resource corresponding to a function used in the variable definition process.

3. The information processing device according to claim 1 or 2.

4. The narrowing-down unit narrows down the analysis target portion using narrowing-down rules related to the operation content of the function on the operation target resource.

3. The information processing device according to claim 1 or 2.

5. The narrowing down rule includes at least one of a rule for making the function call location a target of the process flow analysis and a rule for making the function call location an exception to the target of the process flow analysis. The information processing device according to claim 4.

6. The narrowing-down unit narrows down the analysis target portion based on resource identification information that identifies the operation target resource.

3. The information processing device according to claim 1 or 2.

7. The narrowing-down unit narrows down the analysis target locations according to a level of confidentiality of the operation target resource indicated by the resource identification information. The information processing device according to claim 6.

8. The narrowing-down unit further includes an analysis unit that analyzes a process flow that starts or ends at the analysis target location narrowed down by the narrowing-down unit.

3. The information processing device according to claim 1 or 2.

9. an analysis unit that analyzes a process flow starting or ending at the function call location extracted by the extraction unit, The analysis unit identifies a process flow that may include an unauthorized function, The narrowing unit narrows down the analysis target location from the function call location based on a process flow that may include the unauthorized function.

3. The information processing device according to claim 1 or 2.

10. The analysis unit further includes a notification unit that notifies a user of the analysis result. The information processing device according to claim 8.

11. The computer An extraction step of extracting function call locations indicating locations where functions are called in a program to be inspected; a specifying step of specifying an operation target resource to be operated by the function; a narrowing down step of narrowing down an analysis target location that is a target of a process flow analysis from the function call location based on the operation content of the function on the operation target resource; the program to be inspected includes a variable definition process for defining a variable indicating the resource to be operated; In the identifying step, the operation target resource indicated by the variable defined in the variable definition process is identified. Information processing methods.

12. An extraction step of extracting function call locations indicating locations where functions are called in a program to be inspected; a specifying step of specifying an operation target resource to be operated by the function; a narrowing down step of narrowing down an analysis target location that is a target of a process flow analysis from the function call location based on the operation content of the function on the operation target resource; the program to be inspected includes a variable definition process for defining a variable indicating the resource to be operated; In the identifying step, the operation target resource indicated by the variable defined in the variable definition process is identified. program.

Images