Program inspection device, program inspection method, and program

Abstract

To reduce erroneous detection when detecting a conditional branch that triggers a predetermined operation included in a program.SOLUTION: A program inspection device includes: a processing flow analysis unit that analyzes, based on an input program and analysis start point information, a processing flow included in the program; a candidate extraction unit that uses an analysis result of the processing flow to extract a specific conditional branch as a candidate for a trigger of a predetermined operation; a code block extraction unit that extracts one or more code blocks included in the program; an error processing specifying unit that specifies a code block for which error processing is performed among the extracted one or more code blocks; and a conditional branch evaluation unit that excludes the conditional branch from the candidate for the trigger of the predetermined operation when at least one of the code blocks in which the execution is controlled by the conditional branch extracted as the candidate for the trigger of the predetermined operation is specified as the code block for which the error processing is performed.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] The present disclosure relates to a program inspection device, a program inspection method, and a program. [Background technology]

[0002] As a related technique, Patent Document 1 discloses a program analysis device. The program analysis device edits an input program based on the control flow and data flow, and classifies the program into groups of processes such as external module call processing, error processing, and error determination processing. In Patent Document 1, some of the processes required for error processing are pre-registered in the program analysis device. Using the registered information, the program analysis device automatically recognizes the entire error processing performed in the input program, and also recognizes the error determination processing portion.

[0003] As another related technique, Patent Document 2 discloses a fraud detection device. The fraud detection device described in Patent Document 2 stores a list of functions that have been identified as requiring caution based on call sites that call functions that have a sensitive impact on the system and preliminary analysis of the function's internal structure. The fraud detection device analyzes an input program and extracts functions to be included in the list. The fraud detection device also analyzes the program and extracts execution paths and conditional branches. For each extracted conditional branch, the fraud detection device calculates a score according to the probability that the condition of the conditional branch is satisfied. The fraud detection device calculates the probability of reaching the extracted function based on the score. The fraud detection device identifies execution paths with a low calculated probability of reaching the function as execution paths that are likely to be backdoor execution paths. [Prior art documents] [Patent documents]

[0004] [Patent Document 1] Japanese Patent Application Publication No. 7-93144 [Patent Document 2] International Publication No. 2023 / 062736 Summary of the Invention [Problem to be solved by the invention]

[0005] As one of the countermeasures for supply chain risk, it is becoming increasingly important to detect malicious functions within programs, such as backdoors. Inspecting malicious functions embedded within programs requires costly analysis using reverse engineering by experts. Backdoors often only execute when specific conditions are met. Focusing on this, a known method for backdoor inspection is to analyze the control flow information between system-sensitive operations and conditional branches.

[0006] However, since conditional branches in a program include simple error checks on inputs, the above method may erroneously detect the conditional branches that perform error checks as backdoor triggers.

[0007] One object of the present disclosure is to provide a program inspection device, a program inspection method, and a program that can reduce false detections when detecting a conditional branch that triggers a predetermined operation included in a program. [Means for solving the problem]

[0008] A program inspection device according to a first aspect of the present disclosure includes a processing flow analysis unit that analyzes a processing flow included in an input program based on an input program and analysis starting point information; a candidate extraction unit that uses the analysis results of the processing flow to extract specific conditional branches as candidates for triggering a specified operation; a code block extraction unit that extracts one or more code blocks included in the program; an error processing identification unit that identifies a code block that performs error processing among the one or more extracted code blocks; and a conditional branch evaluation unit that, if at least one code block among the code blocks whose execution is controlled by a conditional branch extracted as a candidate for triggering the specified operation is a code block identified as the error processing code block, excludes the conditional branch from the candidates for triggering the specified operation.

[0009] A program inspection device according to a second aspect of the present disclosure includes a processing flow analysis unit that analyzes a processing flow contained in an input program based on an input program and analysis start point information; a candidate extraction unit that uses the analysis results of the processing flow to extract a specific conditional branch as a candidate for triggering a specified operation; a code block extraction unit that extracts one or more code blocks contained in the program; an error processing identification unit that assigns a first score to each of the extracted one or more code blocks indicating the possibility that the code block is a code block that performs error processing; and a conditional branch evaluation unit that determines a second score indicating the possibility that the conditional branch will be used as a trigger for a specified operation based on the first score assigned to the code block whose execution is controlled by the conditional branch extracted as a candidate for triggering the specified operation.

[0010] A program inspection method according to a third aspect of the present disclosure includes analyzing a processing flow included in an input program based on an input program and analysis starting point information, using the analysis results of the processing flow to extract a specific conditional branch as a candidate for triggering a specified operation, extracting one or more code blocks included in the program, identifying a code block that performs error handling among the extracted one or more code blocks, and, if at least one code block among the code blocks whose execution is controlled by the conditional branch extracted as a candidate for triggering the specified operation is a code block identified as the code block for the error handling, excluding the conditional branch from the candidates for triggering the specified operation.

[0011] A program inspection method according to a fourth aspect of the present disclosure includes analyzing a processing flow included in an input program based on an input program and analysis starting point information, using the analysis results of the processing flow to extract a specific conditional branch as a candidate for triggering a predetermined operation, extracting one or more code blocks included in the program, assigning a first score to each of the extracted one or more code blocks indicating the possibility that each code block is a code block that performs error processing, and determining a second score indicating the possibility that the conditional branch will be used as a trigger for a predetermined operation based on the first score assigned to the code block whose execution is controlled by the conditional branch extracted as a candidate for triggering the predetermined operation.

[0012] A program according to a fifth aspect of the present disclosure causes a computer to perform processing including: analyzing a processing flow included in an input program based on an input program and analysis starting point information; using the analysis results of the processing flow to extract a specific conditional branch as a candidate for triggering a specified operation; extracting one or more code blocks included in the program; identifying a code block that performs error processing among the extracted one or more code blocks; and, if at least one code block among the code blocks whose execution is controlled by the conditional branch extracted as a candidate for triggering the specified operation is a code block identified as the code block for the error processing, excluding the conditional branch from the candidates for triggering the specified operation.

[0013] A program according to a sixth aspect of the present disclosure is for causing a computer to perform a process including: analyzing a processing flow included in an input program based on an input program and analysis starting point information; using the analysis results of the processing flow to extract a specific conditional branch as a candidate for triggering a predetermined operation; extracting one or more code blocks included in the program; assigning a first score to each of the extracted one or more code blocks indicating the possibility that each code block is a code block that performs error processing; and determining a second score indicating the possibility that the conditional branch will be used as a trigger for a predetermined operation based on the first score assigned to the code block whose execution is controlled by the conditional branch extracted as a candidate for triggering the predetermined operation. [Effects of the Invention]

[0014] The program inspection device, program inspection method, and program according to the present disclosure can reduce false detections when detecting a conditional branch that triggers a predetermined operation included in a program. [Brief explanation of the drawings]

[0015] [Figure 1] 1 is a block diagram showing an example of a schematic configuration of a program checking device according to the present disclosure; [Figure 2] FIG. 1 is a block diagram showing an example of the configuration of an information processing device according to the present disclosure. [Figure 3] FIG. 10 is a diagram showing an example of a processing flow included in a program to be inspected. [Figure 4] A schematic diagram showing the relationship between a conditional branch and the code block whose execution it controls. [Figure 5] FIG. 2 is a diagram showing an example of a portion of source code of a program to be inspected. [Figure 6] FIG. 10 is a diagram showing another example of a portion of the source code of the program to be inspected. [Figure 7] FIG. 10 is a diagram showing an example of a table used to assign a first score. [Figure 8] FIG. 10 is a schematic diagram showing a code block and a first score assigned to the code block. [Figure 9] 10 is a flowchart showing an operation procedure of the information processing device. [Figure 10] FIG. 2 is a diagram showing an example of a portion of source code of a program to be inspected. [Figure 11] FIG. 1 is a block diagram showing an example of a hardware configuration of a computer device. DETAILED DESCRIPTION OF THE INVENTION

[0016] Prior to describing embodiments of the present disclosure, an overview of the present disclosure will be described. Fig. 1 shows an example of a schematic configuration of a program checking device according to the present disclosure. The program checking device 10 shown in Fig. 1 includes a process flow analysis unit 11, a candidate extraction unit 12, a code block extraction unit 13, an error handling identification unit 14, and a conditional branch evaluation unit 15.

[0017] In one example, the process flow analysis unit 11 analyzes the process flow included in the program based on the input program and analysis start point information. The candidate extraction unit 12 uses the analysis results of the process flow to extract specific conditional branches as candidates for triggering a predetermined operation. The code block extraction unit 13 extracts one or more code blocks included in the program. The error handling identification unit 14 identifies a code block that performs error handling from the one or more extracted code blocks.

[0018] The conditional branch evaluation unit 15 determines whether at least one code block, among the code blocks whose execution is controlled by a conditional branch extracted as a candidate for triggering a predetermined operation, is a code block identified as a code block for performing error processing. When the conditional branch evaluation unit 15 determines that at least one code block, among the code blocks whose execution is controlled by a conditional branch, is a code block identified as a code block for performing error processing, it excludes the conditional branch from the candidates for triggering a predetermined operation.

[0019] In the present disclosure, the error processing identification unit 14 identifies code blocks that are likely to perform error processing among code blocks included in a program. The candidate extraction unit 12 uses the results of the process flow analysis to extract specific conditional branches as candidates for triggering a predetermined operation. If a code block that performs error processing is included in a code block whose execution is controlled by a conditional branch, the conditional branch evaluation unit 15 excludes the conditional branch from candidates for triggering a predetermined operation. If one of the conditional branches is an error path, it is considered unlikely that the other path is a path through which a predetermined operation, such as a backdoor, is performed. In the present disclosure, by excluding conditional branches that branch to error processing from candidates for triggering a predetermined operation, it is possible to prevent a user from mistakenly detecting a conditional branch for an error check as a trigger for a predetermined operation, such as a backdoor.

[0020] As another example, the error handling identification unit 14 assigns a first score to one or more code blocks extracted by the code block extraction unit 13, indicating the possibility that each code block is a code block that performs error handling. The conditional branch evaluation unit 15 acquires the first score assigned to a code block whose execution is controlled by a conditional branch extracted as a candidate for triggering a predetermined operation. Based on the acquired first score, the conditional branch evaluation unit 15 determines a second score that indicates the possibility that the conditional branch will be used as a trigger for a predetermined operation.

[0021] In the above-described another example, the error processing identification unit 14 assigns a first score to each code block. The conditional branch evaluation unit 15 uses the first score to determine a second score for each conditional branch extracted by the candidate extraction unit 12, indicating the possibility that the conditional branch is a trigger for a predetermined operation. The program inspection device 10 can output to the user the conditional branches extracted as candidates for triggering a predetermined operation and the second scores determined for the conditional branches. In this case, the user can refer to the second scores to determine which conditional branches are related to the trigger for the predetermined operation and which conditional branches are conditional branches for error checks. This prevents the user from mistakenly detecting conditional branches for error checks as triggers for a predetermined operation, such as a backdoor.

[0022] Hereinafter, embodiments of the present disclosure will be described in detail with reference to the drawings. Note that the following description and drawings have been omitted and simplified as appropriate for clarity of explanation. In addition, in each drawing, the same or similar elements are designated by the same reference numerals, and duplicate explanations are omitted as necessary.

[0023] A first embodiment of the present disclosure will be described. FIG. 2 shows an example of the configuration of an information processing device according to the present disclosure. The information processing device 100 includes an input unit 101, a code block extraction unit 102, an error processing identification unit 103, a flow analysis unit 104, a candidate extraction unit 105, a conditional branch evaluation unit 106, and an output unit 107. The information processing device 100 may be physically configured as a device having one or more processors and one or more memories. In the information processing device 100, at least some of the functions of each unit in the information processing device 100 may be realized by the one or more processors performing processing in accordance with instructions read from the one or more memories. The information processing device 100 corresponds to the program checking device 10 shown in FIG. 1.

[0024] The input unit 101 acquires a program to be inspected. The input unit 101 acquires, for example, the source code of the program to be inspected. The input unit 101 also acquires analysis starting point information, i.e., information indicating the starting point of analysis of the program to be inspected. The analysis starting point information includes, for example, a list of functions that are the starting points of analysis. In this embodiment, the input unit 101 acquires, as the analysis starting point information, a list of functions that execute predetermined processes that may have a significant impact on the security of the system on which the program runs, such as a function that executes a shell command. In the following description, processes that may have a significant impact on the security of the system are also referred to as sensitive processes.

[0025] The code block extraction unit 102 extracts code blocks included in the program to be inspected. In other words, the code block extraction unit 102 divides the program to be inspected into a plurality of code blocks. The error handling identification unit 103 identifies code blocks for which error handling is to be performed from among the code blocks extracted by the code block extraction unit 102. For example, the error handling identification unit 103 determines whether or not each of the extracted code blocks is a code block for which error handling is to be performed. The code block extraction unit 102 corresponds to the code block extraction unit 13 shown in FIG. 1.

[0026] The error processing identification unit 103 uses a known technique for identifying error processing to identify code blocks that are likely to require error processing among the extracted code blocks. The error processing identification unit 103 uses, for example, error processing knowledge prepared in advance to identify code blocks that require error processing. For example, it is known that specific library functions are often used in error processing. The error processing identification unit 103 may use a list of functions that are often used in error processing, which is included in the error processing knowledge, to determine for each code block whether the code block is an error processing code block.

[0027] The list of functions frequently used in error handling includes functions frequently used in error handling, such as log, exit, close, delete, and free. The list of functions frequently used in error handling includes library functions that implement error handling, such as printf-type functions, exit, error, abort, and free. Alternatively, the list of functions frequently used in error handling may include user-defined functions that implement error handling. User-defined functions include wrapper functions for library functions. User-defined functions include functions whose function names include character strings indicating error handling, such as err, log, and free. Error handling specification unit 103 corresponds to error handling specification unit 14 shown in FIG. 1.

[0028] The flow analysis unit 104 performs flow analysis on the program to be inspected. In this embodiment, the flow analysis unit 104 performs control flow analysis on the function acquired as the analysis starting point information. Here, the control flow analysis is an analysis of control dependency, and is an analysis that identifies, for a certain operation (instruction, function), the conditional branch that controls the execution of that operation and its condition variable. In this case, the operation has a control dependency relationship with the conditional branch and its condition variable. The flow analysis unit 104 outputs control flow information in the program as the control flow analysis result. The flow analysis unit 104 corresponds to the process flow analysis unit 11 shown in FIG. 1.

[0029] The candidate extraction unit 105 extracts specific conditional branches as candidates for triggering a predetermined operation based on the analysis results of the flow analysis unit 104, i.e., control flow information. The flow control information includes, for example, an operation that is the starting point of the analysis, a conditional branch that controls the execution of the operation, and a condition variable for the conditional branch. In this embodiment, the predetermined operation refers to, for example, an unintended function such as a backdoor. In this embodiment, the candidate extraction unit 105 extracts conditional branches that have a control dependency on a sensitive process as candidates for a backdoor trigger. The candidate extraction unit 105 corresponds to the candidate extraction unit 12 shown in FIG. 1.

[0030] FIG. 3 shows an example of a processing flow included in a program to be inspected. The processing flow shown in FIG. 3 will be explained. In this processing flow, the program receives data 1 from outside (F1). Then, the program processes data 1 to create data 1a (F2). The data 1a created in F2 has a data dependency relationship with the data 1 received in F1. In addition, the program processes data 1a to create data 1b (F3). The data 1b created in F3 has a data dependency relationship with the data 1a generated in F2.

[0031] The program determines whether data 1b satisfies a predetermined condition (F4). If the program determines that data 1b does not satisfy the predetermined condition, it terminates the processing of this processing flow. If the program determines in F4 that data 1b satisfies the predetermined condition, it creates data 2 (F5). In this conditional branch, data 1b is used as a condition variable, and there is a control dependency between the generation of data 2 and data 1b.

[0032] The program then creates data 2a from data 2 (F6). There is a data dependency between data 2a created in F6 and data 2. The program determines whether data 2a satisfies a predetermined condition (F7). If the program determines that data 2a does not satisfy the predetermined condition, it terminates the processing of this processing flow. If the program determines that data 2a satisfies the predetermined condition, it executes sensitive processing (F8). The execution of the sensitive processing in F8 has a control dependency on data 2a, which is the condition variable of F7.

[0033] The flow analysis unit 104 finds F8, where sensitive processing is executed, as the starting point of the analysis in the processing flow shown in Fig. 3. The candidate extraction unit 105 extracts the conditional branch of F7, which the flow analysis unit 104 has analyzed as having a control dependency with F8, as a candidate for a backdoor trigger.

[0034] FIG. 4 shows a schematic diagram of the relationship between a conditional branch and the code block whose execution the conditional branch controls. As shown in FIG. 4, a code block 201 containing a conditional branch "if(A)" has a control dependency relationship with a code block 202 that performs operation B and a code block 203 that performs operation C. A condition variable A in the conditional branch also has a control dependency relationship with a code block 202 that performs operation B and a code block 203 that performs operation C. Operation B is executed on a true edge for the conditional branch if(A). On the other hand, operation C is executed on a false edge for the conditional branch if(A). Operation B and operation C can be distinguished by the difference in edge or basic block.

[0035] When a conditional branch is a backdoor trigger, one of the code blocks controlled by the conditional branch is often a code block of a backdoor path and the other is a code block of a normal path. In the example of Figure 4, if the conditional branch if(A) is a backdoor trigger, and if code block 202 is a code block of a backdoor path, code block 203 is considered to be a code block of a normal path.

[0036] On the other hand, when a conditional branch is an error check, one of the code blocks controlled by the conditional branch is considered to be a code block of an error-free path, i.e., a normal path, and the other is considered to be a code block of an error path. In the example of Figure 4, if one of code blocks 202 and 203 is a code block that performs error handling, the conditional branch if(A) is considered to be a conditional branch for error checking, not a backdoor trigger. From this, it is considered possible to identify conditional branches that are not used as backdoor triggers by checking whether or not a code block that performs error handling is included in the code blocks controlled by the conditional branch.

[0037] In this embodiment, the conditional branch evaluation unit 106 evaluates the backdoor trigger candidates extracted by the candidate extraction unit 105. For each conditional branch extracted as a backdoor trigger candidate, the conditional branch evaluation unit 106 determines whether the code block controlled by the conditional branch includes a code block identified by the error processing identification unit 103. If any of the code blocks controlled by the conditional branch is a code block identified by the error processing identification unit 103, the conditional branch evaluation unit 106 determines that the conditional branch is not a backdoor trigger. In this case, the conditional branch evaluation unit 106 excludes the conditional branch determined not to be a backdoor trigger from the backdoor trigger candidates. The conditional branch evaluation unit 106 corresponds to the conditional branch evaluation unit 15 shown in FIG. 1.

[0038] The output unit 107 displays the conditional branches that are candidates for backdoor triggers evaluated by the conditional branch evaluation unit 106 on the screen of a display device (not shown). A conditional branch that does not have a control dependency relationship with the code block identified as the code block that performs error handling may be a conditional branch that is used as a backdoor trigger. Of the conditional branches extracted by the candidate extraction unit 105, the output unit 107 displays the conditional branches that do not have a control dependency relationship with the code block identified as the code block that performs error handling as candidates for backdoor triggers.

[0039] A specific example will be described below. FIG. 5 shows an example of a portion of source code of a program to be inspected. The source code is written in, for example, a predetermined language. A user inputs the source code of the program to be inspected into an input unit 101. A code block extraction unit 102 extracts multiple code blocks from the source code. The granularity of extraction may be arbitrarily specified by the user. The code block extraction unit 102 extracts code blocks at the granularity of a basic block, for example.

[0040] The error handling identification unit 103 identifies a code block for which error handling should be performed from among the extracted code blocks. For example, the error handling identification unit 103 references error handling knowledge that includes information for identifying error handling, and determines whether each code block is a code block for error handling. The error handling knowledge may be stored within the information processing device 100, or may be obtained from an external server or external storage. In the example of FIG. 5, the error handling identification unit 103 identifies a code block including code at line numbers 51 and 52 as a code block for which error handling should be performed.

[0041] The flow analysis unit 104 analyzes source code. The flow analysis unit 104 finds a sensitive process that serves as the starting point of the analysis and performs control flow analysis on the found sensitive process. In the example of FIG. 5, the flow analysis unit 104 finds the code at line number 71 as the starting point of the analysis. The flow analysis unit 104 also identifies the if statement at line number 50 as a conditional branch that has control dependency with respect to the starting point of the analysis. In this case, the candidate extraction unit 105 extracts the if statement at line number 50 as a candidate for a backdoor trigger. If the source code contains multiple sensitive processes, the flow analysis unit 104 performs control flow analysis on each of the multiple sensitive processes. The candidate extraction unit 105 extracts multiple conditional branches as candidates for a backdoor trigger.

[0042] The conditional branch evaluation unit 106 determines whether the code block controlled by the conditional branch extracted as a backdoor trigger candidate includes a code block identified as a code block that performs error handling. In the example of Figure 5, the code block controlled by the conditional branch on line number 50 includes a code block that performs error handling. In this case, the conditional branch evaluation unit 106 excludes the conditional branch on line number 50 from the backdoor trigger candidates.

[0043] 6 shows another example of a portion of source code of a program to be inspected. The code block extraction unit 102 extracts multiple code blocks from the source code. The error handling identification unit 103 identifies a code block for which error handling should be performed from among the extracted code blocks. In FIG. 6, there is no code block identified as a code block for which error handling should be performed.

[0044] The flow analysis unit 104 finds a sensitive process that will be the starting point of the analysis and performs control flow analysis on the found sensitive process. In the example of FIG. 6, the flow analysis unit 104 finds the code at line number 51 as the starting point of the analysis. The flow analysis unit 104 also identifies the if statement at line number 50 as a conditional branch that has control dependency on the sensitive process. The candidate extraction unit 105 extracts the if statement at line number 50 as a candidate for a backdoor trigger.

[0045] The conditional branch evaluation unit 106 determines whether the code blocks whose execution is controlled by the conditional branches extracted as backdoor trigger candidates include a code block identified as a code block that performs error handling. In the example of Figure 6, the code block including the code at line numbers 70 and 71 is determined not to be a code block that performs error handling. In this case, the conditional branch evaluation unit 106 determines that the conditional branch at line number 50 may be a backdoor trigger, and does not exclude that conditional branch from the backdoor trigger candidates.

[0046] In this embodiment, the error processing identification unit 103 may assign a first score to each code block indicating the possibility that error processing is being performed in that code block. In this case, the error processing identification unit 103 may determine whether or not each code block is a code block for which error processing is to be performed, based on the first score of each code block.

[0047] FIG. 7 shows an example of a table used by the error handling identification unit 103 to assign a first score. The table holds processes typically included in error handling and a score (first score) indicating the likelihood of the process being an error handling. For example, a larger score indicates a higher possibility of the process being an error handling. For example, suppose a code block includes a call to an error function, an exit function, or an abort function. In this case, the error handling identification unit 103 refers to the table shown in FIG. 7 and assigns a score of "10" to the code block. Alternatively, the error handling identification unit 103 adds a score of "10" to the score already assigned.

[0048] 8 schematically shows code blocks and first scores assigned to the code blocks. The error processing identification unit 103 assigns a score to each code block extracted by the code block extraction unit 102, for example, using the table shown in FIG. 7. In the example of FIG. 8, the error processing identification unit 103 assigns a score of "0" to code block #1, a score of "20" to code block #2, and a score of "3" to code block #3. The error processing identification unit 103 may perform threshold processing on the scores and identify code blocks whose scores are equal to or greater than the threshold as code blocks for which error processing should be performed.

[0049] Next, the operation procedure will be explained. Fig. 9 shows the operation procedure of the information processing device 100. The operation procedure of the information processing device 100 corresponds to a program inspection method. The input unit 101 acquires an inspection target program (step S1). In step S1, the input unit 101 acquires, for example, the source code of the inspection target program. The code block extraction unit 102 extracts code blocks included in the inspection target program (step S2). The error handling identification unit 103 identifies a code block for which error handling is to be performed (step S3).

[0050] The flow analysis unit 104 performs control flow analysis on the program to be inspected and extracts conditional branches that are candidates for backdoor triggers (step S4). In step S4, the flow analysis unit 104 performs control flow analysis on, for example, a sensitive operation and extracts conditional branches that control the execution of the sensitive operation as candidates for backdoor triggers. Steps S2 and S3 and step S4 may be performed in any order, or may be performed in parallel.

[0051] For each extracted conditional branch, the candidate extraction unit 105 determines whether the code block whose execution is controlled by the conditional branch includes a code block that performs error handling (step S5). If the candidate extraction unit 105 determines that the code block whose execution is controlled by the conditional branch includes a code block that performs error handling, it excludes the conditional branch from candidates for backdoor triggers (step S6). The output unit 107 displays the conditional branches that are candidates for backdoor triggers on the display screen (step S7).

[0052] In this embodiment, the error processing identification unit 103 identifies code blocks included in the program that are likely to perform error processing. The candidate extraction unit 105 uses the control flow analysis results to extract conditional branches that have control dependencies with sensitive processing as backdoor trigger candidates. If a code block whose execution is controlled by a conditional branch includes a code block that performs error processing, the conditional branch evaluation unit 15 excludes the conditional branch from the backdoor trigger candidates. In this case, the backdoor trigger candidates output by the output unit 107 do not include a conditional branch for error checking to branch to error processing. This reduces the possibility that a user will mistakenly detect a conditional branch that is not a backdoor trigger as a backdoor trigger conditional branch. Furthermore, the user only needs to check the remaining conditional branches that are backdoor trigger candidates for illegal behavior, reducing the workload compared to checking all conditional branches to sensitive processing.

[0053] Next, a second embodiment of the present disclosure will be described. In the second embodiment, a user inputs a function that receives data from an external source, such as a function that receives data from a network, into the input unit 101 as analysis starting point information. The flow analysis unit 104 performs data flow analysis on the analysis starting point. Based on the results of the data flow analysis, i.e., the data flow information, the candidate extraction unit 105 extracts the analysis starting point, i.e., a conditional branch that has data dependency on the externally input data, as a candidate for triggering a predetermined operation.

[0054] Undocumented functions that may cause unintended behavior are often implemented to be activated when externally input data meets certain conditions. Undocumented functions include backdoors inserted into programs by malicious individuals. Undocumented functions may also include functions that were incorporated into programs for debugging purposes but were intended to be deleted after program development. When checking whether a program being inspected contains undocumented functions, it is important to pay particular attention to external inputs and identify locations where data dependent on external inputs is used in conditional branching.

[0055] FIG. 10 shows an example of a portion of source code of a program to be inspected. A user inputs the source code of the program to be inspected into the input unit 101. The code block extraction unit 102 extracts a plurality of code blocks from the source code. The error handling identification unit 103 identifies a code block for which error handling is to be performed from among the extracted code blocks. In the example of FIG. 10, the error handling identification unit 103 identifies a code block including code at line numbers 61 and 62 as a code block for which error handling is to be performed. The method for identifying a code block for which error handling is to be performed may be the same as the method for identifying a code block for which error handling is to be performed in the first embodiment.

[0056] The flow analysis unit 104 analyzes source code. The flow analysis unit 104 finds code that receives external data input and serves as the starting point of the analysis, and performs data flow analysis on the found code. In the example of FIG. 10, the flow analysis unit 104 finds the code at line number 10 as the starting point of the analysis. The flow analysis unit 104 analyzes conditional branches where a condition variable has data dependency with externally input data (variables).

[0057] The candidate extraction unit 105 extracts, as a candidate for a backdoor trigger, a conditional branch in which a condition variable has data dependency with externally input data. In the example of Fig. 10, the condition variable of the if statement on line number 60 has data dependency with data input on line number 10. Therefore, the candidate extraction unit 105 extracts the if statement on line number 60 as a candidate for a backdoor trigger.

[0058] The conditional branch evaluation unit 106 determines whether a code block controlled by a conditional branch extracted as a candidate for a backdoor trigger includes a code block identified as a code block that performs error handling. In the example of FIG. 10, the code block controlled by the conditional branch on line number 60 includes a code block that performs error handling. In this case, the conditional branch evaluation unit 106 excludes the conditional branch on line number 60 from the candidates for a backdoor trigger. If it is determined that the code block controlled by the conditional branch on line number 60 does not include a code block that performs error handling, the conditional branch on line number 60 remains as a candidate for a backdoor trigger.

[0059] In this embodiment, the flow analysis unit 104 analyzes conditional branches that use condition variables that have a data dependency relationship with externally input data. The candidate extraction unit 105 uses the data flow analysis results to extract conditional branches that have a data dependency relationship with externally input data as candidates for backdoor triggers. If a code block whose execution is controlled by a conditional branch includes a code block that performs error handling, the conditional branch evaluation unit 15 excludes the conditional branch from candidates for backdoor triggers. This reduces the possibility that a user will mistakenly detect a conditional branch that is not a backdoor trigger as a backdoor trigger. Other effects are the same as those described in the first embodiment.

[0060] In the first embodiment, an example in which the flow analysis unit 104 performs control flow analysis has been described, and in the second embodiment, an example in which the flow analysis unit 104 performs data flow analysis has been described. However, the present disclosure is not limited to this. For example, the flow analysis unit 104 may analyze a processing flow that starts from any function included in the list of source functions and ends at any function included in the list of sink functions. The source function may be a function that receives data from an external source. Furthermore, the source function may be a function that executes a predetermined process that may have a significant impact on the security of the system. The flow analysis unit 104 performs data flow analysis and control flow analysis on the program. The candidate extraction unit 105 may extract, as a candidate for a backdoor trigger, a conditional branch in which a condition variable has data dependency with externally input data and control dependency with a sensitive process.

[0061] In the above embodiments, the conditional branch evaluation unit 106 excludes a conditional branch from candidates for a backdoor trigger if the code block whose execution is controlled by the conditional branch includes a code block that performs error handling. However, the present disclosure is not limited to this. For example, assume that the error handling identification unit 103 assigns the first score to each block. In this case, the conditional branch evaluation unit 106 may determine a second score for each conditional branch, indicating the possibility that each conditional block is a backdoor trigger, based on the first score of the code block whose execution is controlled by the conditional branch. For example, a larger value of the second score indicates a higher possibility that the conditional block is a backdoor trigger.

[0062] For example, the conditional branch evaluation unit 106 assigns a predetermined initial value as a second score to each conditional branch that is a candidate for a backdoor trigger. For each conditional branch, the conditional branch evaluation unit 106 obtains a first score for a code block whose execution is controlled by that conditional branch. The conditional branch evaluation unit 106 may reduce the second score by the obtained first score. For example, suppose that the first score of one code block whose execution is controlled by a certain conditional branch is "10" and the first score of the other code block is "3." In this case, the conditional branch evaluation unit 106 may reduce the second score of that code block by "13" from its initial value.

[0063] The output unit 107 may display the conditional branches that are candidates for backdoor triggers and the second scores of the conditional branches on the display screen. In this case, by referring to the second scores, the user can determine whether each conditional branch is a conditional branch that is likely to be a backdoor trigger, or a conditional branch that is an error check in error processing and is unlikely to be a backdoor trigger.

[0064] In the above embodiments, an example has been described in which the input unit 101 acquires the source code of the program to be inspected. However, the present disclosure is not limited to this. Instead of acquiring the source code, the input unit 101 may acquire the executable binary or intermediate code of the program to be inspected.

[0065] Next, a description will be given of the hardware configuration of the information processing device 100. Fig. 11 shows an example of the hardware configuration of a computer device that can be used as the information processing device 100. The computer device 300 has one or more processors 301 and one or more memories 302. The processor 301 may be, for example, a microprocessor, an MPU (Micro Processing Unit), or a CPU (Central Processing Unit).

[0066] The memory 302 stores programs executed by the processor 301. The memory 302 is configured by a combination of volatile memory and non-volatile memory. The memory 302 may include storage located remotely from the processor 301. In this case, the processor 301 may access the memory 302 via an I / O (Input / Output) interface or a network, not shown.

[0067] The program includes instructions or software code that, when loaded into a computer, causes the computer to perform one or more functions described in the embodiments. The program may be stored in a non-transitory computer-readable medium or a tangible storage medium and provided to the computer device 300. By way of example and not limitation, computer-readable media or tangible storage media include random-access memory (RAM), read-only memory (ROM), flash memory, solid-state drive (SSD) or other memory technologies, compact discs (CDs), digital versatile discs (DVDs), Blu-ray discs or other optical disk storage, magnetic cassettes, magnetic tapes, magnetic disk storage or other magnetic storage devices. The program may also be transmitted on a transitory computer-readable medium or communication medium. By way of example and not limitation, transitory computer-readable media or communication media include electrical, optical, acoustic, or other forms of propagated signals.

[0068] In the present disclosure, the information processing device 100 does not necessarily have to be a single device. The information processing device 100 may be configured using multiple physically separated devices. For example, the information processing device 100 may be configured using a server that provides the function of the error processing identification unit 103, a server that provides the function of the candidate extraction unit 105, and a server that provides the function of the conditional branch evaluation unit 106. At least some of the functions of each unit of the information processing device 100 may be provided by one or more cloud servers each performing a predetermined process.

[0069] Although the present disclosure has been described above with reference to the embodiments, the present disclosure is not limited to the above-described embodiments. Various modifications that can be understood by those skilled in the art can be made to the configuration and details of the present disclosure within the scope of the present disclosure.

[0070] Each drawing is merely an example for describing one or more embodiments. Each drawing may relate not only to one particular embodiment, but also to one or more other embodiments. As will be understood by those skilled in the art, various features or steps described with reference to any one drawing can be combined with features or steps shown in one or more other drawings to create, for example, an embodiment not explicitly shown or described. Not all features or steps shown in any one drawing are necessary to describe an exemplary embodiment, and some features or steps may be omitted. The order of steps described in any drawing may be changed as appropriate.

[0071] A part or all of the above-described embodiments can be described as, but not limited to, the following supplementary notes.

[0072] [Appendix 1] a process flow analysis unit that analyzes a process flow included in an input program based on the input program and analysis start point information; a candidate extraction unit that extracts a specific conditional branch as a candidate for triggering a predetermined operation using the analysis result of the processing flow; a code block extraction unit that extracts one or more code blocks included in the program; an error processing specification unit that specifies a code block for which error processing is to be performed from among the one or more extracted code blocks; and a conditional branch evaluation unit that, if at least one code block among the code blocks whose execution is controlled by a conditional branch extracted as a candidate for triggering the specified operation is a code block identified as the error processing code block, excludes the conditional branch from the candidates for triggering the specified operation.

[0073] [Appendix 2] 2. The program inspection device according to claim 1, wherein the processing flow analysis unit performs at least one of control flow analysis and data flow analysis on the program, and outputs at least one of control flow information and data flow information in the program.

[0074] [Appendix 3] The program inspection device described in Appendix 2, wherein the candidate extraction unit extracts, for a specified code or a specified instruction included in the program, a conditional branch that is determined by the control flow analysis to control the execution of the code or instruction, as a candidate for triggering the specified operation.

[0075] [Appendix 4] The program inspection device according to claim 2 or 3, wherein the candidate extraction unit uses the data flow analysis to extract, for an external input received by the program, a conditional branch in which a conditional variable having a data dependency with the external input is used, as a candidate for triggering the specified operation.

[0076] [Appendix 5] The program inspection device described in any one of appendixes 1 to 4, wherein the error processing identification unit assigns a score to each of the extracted one or more code blocks indicating the possibility that each code block is a code block that performs error processing, and identifies code blocks whose scores are equal to or greater than a predetermined threshold as code blocks that perform the error processing.

[0077] [Appendix 6] a process flow analysis unit that analyzes a process flow included in an input program based on the input program and analysis start point information; a candidate extraction unit that extracts a specific conditional branch as a candidate for triggering a predetermined operation using the analysis result of the processing flow; a code block extraction unit that extracts one or more code blocks included in the program; an error processing specification unit that assigns a first score to each of the extracted one or more code blocks, the first score indicating a possibility that the code block is a code block for which error processing is to be performed; and a conditional branch evaluation unit that determines a second score indicating the possibility that the conditional branch extracted as a candidate for triggering the specified operation will be used as a trigger for the specified operation, based on the first score assigned to a code block whose execution is controlled by the conditional branch extracted as a candidate for triggering the specified operation.

[0078] [Appendix 7] The program inspection device described in Appendix 6, wherein the conditional branch evaluation unit determines the second score as a score obtained by reducing a predetermined initial value by the first score assigned to the code block whose execution is controlled by the conditional branch.

[0079] [Appendix 8] 8. The program inspection device according to claim 6, wherein the processing flow analysis unit performs at least one of control flow analysis and data flow analysis on the program, and outputs at least one of control flow information and data flow information in the program.

[0080] [Appendix 9] The program inspection device described in Appendix 8, wherein the candidate extraction unit extracts, for a predetermined code or a predetermined instruction included in the program, a conditional branch that is determined by the control flow analysis to control the execution of the code or instruction, as a candidate for triggering the predetermined operation.

[0081] [Appendix 10] The program inspection device according to claim 8 or 9, wherein the candidate extraction unit uses the data flow analysis to extract, for an external input received by the program, a conditional branch in which a conditional variable having a data dependency with the external input is used, as a candidate for triggering the specified operation.

[0082] [Appendix 11] The computer analyzes a processing flow included in the input program based on the input program and analysis start point information, the computer uses the analysis result of the processing flow to extract a specific conditional branch as a candidate for triggering a predetermined operation; The computer extracts one or more code blocks included in the program, the computer identifies a code block that performs error processing among the one or more extracted code blocks; A program inspection method in which the computer excludes a conditional branch from candidates for triggering the specified operation if at least one code block, among the code blocks whose execution is controlled by a conditional branch extracted as a candidate for triggering the specified operation, is a code block identified as the error handling code block.

[0083] [Appendix 12] The computer analyzes a processing flow included in the input program based on the input program and analysis start point information, the computer uses the analysis result of the processing flow to extract a specific conditional branch as a candidate for triggering a predetermined operation; The computer extracts one or more code blocks included in the program, the computer assigns a first score to the extracted one or more code blocks, the first score indicating a possibility that each code block is a code block that performs error processing; The computer determines a second score indicating the possibility that the conditional branch will be used as a trigger for the specified operation based on the first score assigned to a code block whose execution is controlled by a conditional branch extracted as a candidate for triggering the specified operation.

[0084] [Appendix 13] Analyzing a processing flow included in the program based on the input program and analysis start point information; Using the analysis results of the processing flow, extracting specific conditional branches as candidates for triggering a predetermined operation; extracting one or more code blocks contained in the program; Identifying a code block that performs error processing from the one or more extracted code blocks; A program for causing a computer to execute a process that includes excluding a conditional branch from candidates for triggering the specified operation when at least one code block, among the code blocks whose execution is controlled by a conditional branch extracted as a candidate for triggering the specified operation, is a code block identified as the error processing code block.

[0085] [Appendix 14] Analyzing a processing flow included in the program based on the input program and analysis start point information; Using the analysis results of the processing flow, extracting specific conditional branches as candidates for triggering a predetermined operation; extracting one or more code blocks contained in the program; assigning a first score to the extracted one or more code blocks, the first score indicating a possibility that each code block is a code block for which error processing is to be performed; A program for causing a computer to execute a process including determining a second score indicating the possibility that the conditional branch extracted as a candidate for triggering the predetermined operation will be used as a trigger for the predetermined operation, based on the first score assigned to a code block whose execution is controlled by the conditional branch extracted as a candidate for triggering the predetermined operation.

[0086] Some or all of the elements (e.g., configurations and functions) described in Supplementary Notes 2 to 5 that are dependent on Supplementary Note 1 may also be dependent on Supplementary Note 11 and Supplementary Note 13 in the same dependent relationship as Supplementary Note 2 to Supplementary Note 5. Also, some or all of the elements (e.g., configurations and functions) described in Supplementary Note 7 to Supplementary Note 10 that are dependent on Supplementary Note 6 may also be dependent on Supplementary Note 12 and Supplementary Note 14 in the same dependent relationship as Supplementary Note 7 to Supplementary Note 10. Some or all of the elements described in any Supplementary Note may be applicable to various hardware, software, recording means for recording software, systems, and methods. [Explanation of symbols]

[0087] 10: Program inspection device 11: Processing flow analysis part 12: Candidate extraction section 13: Code block extraction part 14: Error handling specific part 15: Conditional branch evaluation section 100: Information processing device 101: Input section 102: Code block extraction unit 103: Error processing specific part 104: Flow analysis unit 105: Candidate extraction unit 106: Conditional branch evaluation section 107: Output section 300: Computer equipment 301: Processor 302: Memory

Claims

1. a process flow analysis unit that analyzes a process flow included in an input program based on the input program and analysis start point information; a candidate extraction unit that extracts a specific conditional branch as a candidate for a trigger of a predetermined operation using a result of the analysis of the process flow; a code block extracting unit that extracts one or more code blocks included in the program; an error processing identification unit that identifies a code block for which an error processing is to be performed from among the one or more extracted code blocks; A program inspection device comprising: a conditional branch evaluation unit that, if at least one of the code blocks whose execution is controlled by a conditional branch extracted as a candidate for triggering the specified operation is a code block identified as the error handling code block, excludes the conditional branch from the candidates for triggering the specified operation.

2. 2. The program checking device according to claim 1, wherein the process flow analysis unit performs at least one of a control flow analysis and a data flow analysis on the program, and outputs at least one of control flow information and data flow information in the program.

3. 3. The program inspection device according to claim 2, wherein the candidate extraction unit extracts, for a specified code or instruction contained in the program, a conditional branch that is determined by the control flow analysis to control the execution of the code or instruction, as a candidate for triggering the specified operation.

4. 3. The program inspection device according to claim 2, wherein the candidate extraction unit extracts, by the data flow analysis, a conditional branch using a conditional variable having a data dependency with an external input received by the program, as a candidate for a trigger of the specified operation.

5. 5. The program inspection device according to claim 1, wherein the error processing identification unit assigns a score to the extracted one or more code blocks indicating the possibility that each code block is a code block that performs error processing, and identifies a code block whose score is equal to or greater than a predetermined threshold as a code block that performs the error processing.

6. a process flow analysis unit that analyzes a process flow included in an input program based on the input program and analysis start point information; a candidate extraction unit that extracts a specific conditional branch as a candidate for a trigger of a predetermined operation using a result of the analysis of the process flow; a code block extracting unit that extracts one or more code blocks included in the program; an error processing specification unit that assigns a first score to the extracted one or more code blocks, the first score indicating a possibility that each code block is a code block for which error processing is to be performed; and a conditional branch evaluation unit that determines a second score indicating the possibility that the conditional branch extracted as a candidate for a trigger of the specified operation is used as a trigger for the specified operation based on the first score assigned to a code block whose execution is controlled by the conditional branch extracted as a candidate for a trigger of the specified operation.

7. 7. The program inspection device according to claim 6, wherein the conditional branch evaluation unit determines the second score to be a score obtained by reducing a predetermined initial value by the first score assigned to a code block whose execution is controlled by a conditional branch.

8. 8. The program checking device according to claim 6, wherein the process flow analysis unit performs at least one of a control flow analysis and a data flow analysis on the program, and outputs at least one of control flow information and data flow information in the program.

9. 9. The program inspection device according to claim 8, wherein the candidate extraction unit extracts, for a specified code or instruction contained in the program, a conditional branch that is determined by the control flow analysis to control the execution of the code or instruction, as a candidate for triggering the specified operation.

10. 9. The program inspection device according to claim 8, wherein the candidate extraction unit extracts, by the data flow analysis, a conditional branch using a conditional variable having a data dependency with an external input received by the program, as a candidate for a trigger of the specified operation.

11. The computer analyzes a process flow included in the program based on the input program and the analysis start point information, the computer uses a result of the analysis of the process flow to extract a specific conditional branch as a candidate for a trigger of a predetermined operation; The computer extracts one or more code blocks included in the program, The computer identifies a code block that performs error processing among the one or more extracted code blocks; The program inspection method includes the computer excluding, when at least one code block whose execution is controlled by a conditional branch extracted as a candidate for triggering the specified operation is a code block identified as the error handling code block, the conditional branch from the candidates for triggering the specified operation.

12. The computer analyzes a process flow included in the program based on the input program and the analysis start point information, the computer uses a result of the analysis of the process flow to extract a specific conditional branch as a candidate for a trigger of a predetermined operation; The computer extracts one or more code blocks included in the program, the computer assigns a first score to the extracted one or more code blocks, the first score indicating a possibility that each code block is a code block that performs error processing; The program inspection method includes the computer determining a second score indicating the possibility that the conditional branch will be used as a trigger for a specified operation based on the first score assigned to a code block whose execution is controlled by a conditional branch extracted as a candidate for triggering the specified operation.

13. Analyzing a process flow included in the input program based on the input program and analysis start point information; extracting a specific conditional branch as a candidate for triggering a predetermined operation using the analysis result of the process flow; Extracting one or more code blocks contained in the program; Identifying a code block that performs error processing among the one or more extracted code blocks; A program for causing a computer to execute a process that includes excluding a conditional branch from candidates for triggering the specified operation when at least one of the code blocks whose execution is controlled by a conditional branch extracted as a candidate for triggering the specified operation is a code block identified as the error handling code block.

14. Analyzing a process flow included in the input program based on the input program and analysis start point information; extracting a specific conditional branch as a candidate for triggering a predetermined operation using the analysis result of the process flow; Extracting one or more code blocks contained in the program; assigning a first score to the extracted one or more code blocks, the first score indicating a possibility that each code block is a code block for which error processing is to be performed; A program for causing a computer to execute a process including determining a second score indicating the possibility that the conditional branch extracted as a candidate for triggering the specified operation is used as a trigger for the specified operation based on the first score assigned to a code block whose execution is controlled by the conditional branch extracted as a candidate for triggering the specified operation.

Images