Program analysis device, program analysis method, and program

Abstract

A program analysis device (100) is provided with: an extraction unit (101) that extracts function call points indicating where a prescribed function is called in a program; a measurement unit (102) that measures, for each function call point, the number of executions or the execution frequency of the prescribed function during normal execution of the program; a narrowing-down unit (103) that, on the basis of the number of executions or execution frequency, narrows down and selects a point to be analyzed, which is to be subjected to processing flow analysis, from among the function call points; and an analysis unit (104) that analyzes a processing flow, the start or end point of which is the point to be analyzed.

Description

Program analysis device, program analysis method, and non-transitory computer-readable medium

[0001] The present disclosure relates to a program analysis apparatus, a program analysis method, and a non-transitory computer-readable medium.

[0002] In recent years, infrastructures and corporate systems have become increasingly complex. As a result, these infrastructures and corporate systems are no longer comprised of devices from a single company, but are instead commonly constructed by combining devices procured from various companies. As a countermeasure against risks associated with supply chains constructed in this way, technology to detect malicious functions within programs is becoming increasingly important.

[0003] As an example of a malicious function in a program, there have been many reported cases where backdoors have been discovered in software (or firmware) or hardware procured from external manufacturers. The term "backdoor" as used herein can be defined as a function that is incorporated as part of a program that includes multiple functions that make up the software, and that is neither known to nor desired by the user.

[0004] Manufacturers who coordinate the construction of infrastructure and corporate systems must inspect the programs that make up the software they procure from external manufacturers to ensure that they do not contain backdoors.

[0005] As a related technique, Patent Document 1 discloses an anti-malware system that analyzes applications and other executable objects at the subroutine level, and assigns an execution frequency score to each subroutine based on how frequently each subroutine is executed.

[0006] The system also assigns a reputation score to each subroutine based on the execution frequency score. A subroutine with a high reputation score indicates that it is potentially legitimate, while a subroutine with a low reputation score (e.g., a subroutine that is never executed) indicates that it may be infected with malware.

[0007] Special table 2017-505947 publication

[0008] Suppose a location where a backdoor may exist is extracted from a program using the technology disclosed in Patent Document 1. In such a case, it is necessary to identify the processing flow including the location and perform a detailed analysis to determine whether a backdoor actually exists. However, Patent Document 1 does not specifically mention how to perform the detailed analysis.

[0009] In view of the above-mentioned problems, an object of the present disclosure is to provide a program analysis device, a program analysis method, and a non-transitory computer-readable medium that are capable of appropriately analyzing a processing flow in which a backdoor may exist.

[0010] The program analysis device according to the present disclosure comprises an extraction means for extracting function call locations indicating locations in a program where a specified function is called; a measurement means for measuring the number of times or frequency of execution of the specified function for each function call location during normal execution of the program; a narrowing down means for narrowing down analysis target locations from the function call locations based on the number of times or frequency of execution; and an analysis means for analyzing the process flow that starts or ends at the analysis target location.

[0011] The program analysis method disclosed herein extracts function call locations that indicate locations in a program where a specific function is called, measures the number of times or frequency of execution of the specific function during normal execution of the program for each function call location, narrows down analysis target locations that are the subject of process flow analysis from the function call locations based on the number of times or frequency of execution, and analyzes the process flow that starts or ends at the analysis target locations.

[0012] The non-transitory computer-readable medium disclosed herein stores a program that causes a computer to execute the following processes: extracting function call locations that indicate locations in a program where a specific function is called; measuring the number of times or frequency of execution of the specific function for each function call location during normal execution of the program; narrowing down analysis locations from the function call locations to be the subject of processing flow analysis based on the number of times or frequency of execution; and analyzing the processing flow that starts or ends at the analysis location.

[0013] The present disclosure makes it possible to provide a program analysis device, a program analysis method, and a non-transitory computer-readable medium that are capable of appropriately analyzing a process flow in which a backdoor may exist.

[0014] 1 is a block diagram showing the configuration of a program analysis device according to a first embodiment; FIG. 2 is a flowchart showing processing performed by the program analysis device according to the first embodiment; FIG. 3 is a diagram showing an example of a backdoor included in the control flow of software; FIG. 4 is a diagram for explaining characteristics of a backdoor; FIG. 5 is a block diagram showing the configuration of a program analysis device according to a second embodiment; FIG. 6 is a diagram showing an example of call frequency information according to the second embodiment; FIG. 7 is a diagram showing schematically the processing of a measurement unit and a narrowing down unit according to the second embodiment; FIG. 8 is a flowchart showing processing performed by the program analysis device according to the second embodiment; FIG. 9 is a block diagram showing the configuration of a program analysis device according to a third embodiment; FIG. 10 is a flowchart showing processing performed by the program analysis device according to the third embodiment; and FIG. 11 is a block diagram showing an example of the hardware configuration of a computer that realizes the program analysis device according to the embodiments.

[0015] Hereinafter, embodiments of the present disclosure will be described in detail with reference to the drawings. In each drawing, the same or corresponding elements are designated by the same reference numerals. For clarity of explanation, duplicated explanations will be omitted as necessary.

[0016] First Embodiment A first embodiment will be described with reference to Fig. 1 and Fig. 2. Fig. 1 is a block diagram showing the configuration of a program analysis device 100 according to this embodiment. The program analysis device 100 includes an extraction unit 101, a measurement unit 102, a narrowing down unit 103, and an analysis unit 104.

[0017] The extraction unit 101 extracts function call locations that indicate locations where a specific function is called in a program. The measurement unit 102 measures the number of times or frequency of execution of a specific function during normal execution of the program for each function call location. The narrowing down unit 103 narrows down analysis target locations that are the subject of process flow analysis from the function call locations based on the number of times or frequency of execution. The analysis unit 104 analyzes the process flow that starts or ends at the analysis target location.

[0018] The program analysis device 100 includes a processor, a memory, and a storage device (not shown). The storage device stores a computer program that implements the processing according to this embodiment. The processor can load the computer program from the storage device into the memory and execute the computer program. In this way, the processor realizes the functions of an extraction unit 101, a measurement unit 102, a narrowing down unit 103, and an analysis unit 104.

[0019] Next, the processing performed by the program analysis device 100 will be described with reference to Fig. 2. Fig. 2 is a flowchart showing the processing performed by the program analysis device 100.

[0020] First, the extraction unit 101 extracts function call locations (S1). Next, the measurement unit 102 measures the number of executions or execution frequency of a predetermined function during normal program execution for each function call location (S2). The narrowing down unit 103 narrows down the analysis target locations from the function call locations based on the number of executions or execution frequency (S3). The analysis unit 104 analyzes the processing flow that starts or ends at the analysis target location (S4).

[0021] As described above, the program analysis device 100 according to this embodiment narrows down the analysis target location based on the number of executions or execution frequency of a predetermined function at a function call location, and analyzes the process flow that starts or ends at the analysis target location. In this way, the program analysis device 100 can appropriately analyze the process flow that may contain a backdoor.

[0022] <Second Embodiment> Next, a second embodiment will be described with reference to Figures 3 to 8. The second embodiment is a specific example of the first embodiment described above. A program analysis device 10 according to this embodiment will be described below. The program analysis device 10 is an information processing device capable of performing a predetermined program analysis process on a program to be analyzed.

[0023] First, a program inspection technique will be described as a technique related to the program analysis device 10 according to this embodiment. In order to inspect whether a program to be analyzed contains a malicious function such as a backdoor, it is necessary to analyze the code contained in the program. There are two analysis methods: one that uses the source code of the program to be analyzed, and one that uses the code contained in the binary of the program to be analyzed (hereinafter referred to as the "target binary").

[0024] In this embodiment, an analysis method using code included in the target binary will be described as an example. By using such an analysis method, it is possible to extract, for example, control flow and data flow that depend on data input from outside the program. This makes it possible to automatically detect backdoor triggers.

[0025] Furthermore, by using this analysis method, it is possible to track inputs and outputs to registers and memory, and extract the relationship between security-sensitive code and backdoor triggers, thereby automatically detecting malicious data flows.

[0026] Here, a sensitive operation is, for example, an operation that, if executed improperly, is considered to have a significant impact on a system including a program and the environment in which the program is executed, and is an operation that has been predetermined by a user. The user may be, for example, a client who requests a program inspection, an analyst who performs the inspection, or a security officer.

[0027] Here, an example of a backdoor installed in a program will be described with reference to Figure 3. Figure 3 is a diagram showing an example of a backdoor included in software control flows CF1 and CF2. In the figure, circles represent functions or procedures. In the following description, functions and procedures may be referred to as "nodes." In addition, in the figure, thin arrows indicate normal processing flows, and thick arrows indicate backdoor processing flows.

[0028] In the control flow CF1 shown in the upper part of Fig. 3, nodes A1 to A5 are the execution path of the regular code. Normally, when a regular user executes the control flow CF1, processing is executed along a path such as nodes A1, A2, A3, A4, and A5.

[0029] However, in the example shown in the figure, a backdoor has been installed to allow processing to proceed from node A4 to node A6. By entering a specific input at node A4, an attacker can execute processing at node A6 without going through the legitimate node A5. The attacker could be, for example, the person who installed the backdoor in the program, or someone related to that person.

[0030] The predetermined input made by the attacker is a special input for realizing a malicious function. The predetermined input is, for example, an input for making a program execute a sensitive operation without going through the normal processing flow. The predetermined input may include, for example, input information known only to the attacker or those involved. The input information may be, for example, information about a hidden function not described in specifications, information for circumventing an authentication function, or a predetermined command string. These are just examples, and the input information may include various input data for realizing a malicious function.

[0031] Node A6 contains code for performing sensitive operations on the system (e.g., command execution, file output, etc.). Attackers attempt to perform unauthorized operations by installing a backdoor to create a process flow that differs from the normal process flow. For example, attackers may install such a backdoor in a program as a hidden function.

[0032] The lower part of Fig. 3 shows an example of a control flow CF2 including a branch and a rough outline of the processing performed by the program analysis device 10 according to this embodiment. In this example, a backdoor for executing unauthorized processing on the path of nodes B1, B2, B3, and B5 is installed in the control flow CF2. For example, an attacker can input predetermined data at node B1 to cause processing to be executed on the path of nodes B1, B2, B3, and B5. Node B5 includes code for performing sensitive operations on a system, etc.

[0033] Here, node B5 is a node that can also be passed through in the normal processing flow. For example, assume that node B4 is an authentication function for authenticating that the user is a legitimate user. In the normal processing flow, the authentication function is executed in node B4, and if authentication is successful, processing of node B5 is executed, and if authentication is unsuccessful, processing of node B6 is executed. In this way, in the normal processing flow, sensitive operations can be executed only if the user is successfully authenticated, and sensitive operations cannot be executed if authentication is unsuccessful.

[0034] However, in the control flow CF2, an attacker creates a flow that bypasses the authentication function by installing a backdoor that does not go through node B4, which allows the attacker to execute sensitive operations while bypassing the authentication function.

[0035] The program analysis device 10 according to this embodiment performs a predetermined analysis, focusing on the characteristics of a backdoor, which will be described later. Specifically, the program analysis device 10 performs an analysis on a process flow that includes a predetermined starting point and a predetermined ending point. In the example shown in the figure, the predetermined starting point is node B1, where an attacker inputs data. The predetermined ending point is node B5, which includes sensitive code. The sensitive code may include a function that can perform a sensitive operation. In the following description, a function that can perform a sensitive operation may be referred to as a "sensitive function."

[0036] The program analysis device 10 analyzes a process flow PF1 that starts at node B1 and ends at node B5. For example, the program analysis device 10 performs control flow analysis and data flow analysis on the process flow PF1 to extract a relationship between an external input made by an attacker and a sensitive operation.

[0037] The program analysis device 10 outputs the results of the backdoor inspection as an inspection report based on the analysis results. The inspection report indicates information about the backdoor, such as "A shell program is started by inputting a hidden password from outside" or "Password information is output to a log file by inputting a hidden command from outside."

[0038] Next, the characteristics of a backdoor will be described with reference to Fig. 4. Fig. 4 is a diagram for explaining the characteristics of a backdoor. The control flow CF3 shown in the figure includes nodes C1 to C5. The control flow CF3 starts processing from entry point P1, and enables the processing of each node to be executed according to branching.

[0039] In the figure, solid black arrows indicate normal processing flow. Solid white arrows and dashed white arrows indicate processing flow dependent on external input EI, which is information input from outside. In control flow CF3, node C5 contains code for performing sensitive operations. Processing flows that contain backdoors share common characteristics, as explained below.

[0040] The first feature is the presence of input information (trigger) known only to the attacker. The input information known only to the attacker is, for example, hidden authentication information or a predetermined command string. In the figure, a conditional branch T1 is shown as an example of a trigger.

[0041] The second feature is that the execution path satisfies a specific condition. An execution path that satisfies a specific condition is an irregular execution path. An irregular execution path may include a regular execution path in part.

[0042] An attacker may use unauthorized external input information to satisfy a specific condition. For example, the attacker may compare the unauthorized external input with predetermined information and branch the path depending on the comparison result. When an unauthorized external input is accepted, the subsequent processing flow can be executed via an illegal execution path. In the example shown in the figure, an illegal execution path is formed due to the presence of external input EI.

[0043] The third feature is that the above-mentioned irregular path is ultimately used to perform a sensitive operation on the system. The sensitive operation may be, for example, starting a shell, conducting unauthorized communication, or writing confidential data to a file. In the example shown in the figure, the sensitive operation is performed on node C5.

[0044] Sensitive operations that go through backdoor paths, such as hidden functions, are not executed during normal execution. Even if they are executed, they are executed less frequently or less frequently than operations that go through legitimate execution paths. The program analysis device according to the present disclosure focuses on these characteristics of backdoors to solve the above-mentioned problems.

[0045] (Configuration of Program Analysis Apparatus 10) Next, the configuration of the program analysis apparatus 10 according to this embodiment will be described with reference to Fig. 5. Fig. 5 is a block diagram showing the configuration of the program analysis apparatus 10. The program analysis apparatus 10 is an example of the program analysis apparatus 100 described above.

[0046] As shown in the figure, the program analysis device 10 includes an extraction unit 11 , a measurement unit 12 , a narrowing down unit 13 , an analysis unit 14 , an output unit 15 , and a storage unit 19 .

[0047] The extraction unit 11 is an example of the extraction unit 101. The extraction unit 11 extracts function call locations that indicate locations in a program where a predetermined function is called. The predetermined function is a sensitive function that, if executed fraudulently, may perform sensitive operations on a system including the program.

[0048] Examples of sensitive functions include system calls, predetermined library functions, and predetermined APIs (Application Programming Interfaces), or functions related to operations that require predetermined privileges.

[0049] Specifically, the sensitive function may be a source (src) function for acquiring information from outside the system, or a sink function for outputting information inside the system to the outside. Both the source (src) function and the sink function may be used as the sensitive function. Furthermore, a function other than the source (src) function and the sink function may be used as the sensitive function. In this embodiment, the sensitive function will be mainly described using the sink function.

[0050] The extraction unit 11 can extract function call locations based on a pre-defined function list. The function list is information indicating functions to be extracted by the extraction unit 11. For example, a user such as a security officer registers functions to be extracted in the program analysis device 10 in advance.

[0051] In this embodiment, an extraction target function list 191 is assumed to be stored in advance in the storage unit 19 as an example of a function list. The extraction target function can be an analysis target portion, which will be described later. Furthermore, the extraction target function can be the start point or end point of the processing flow to be analyzed.

[0052] The extraction unit 11 refers to a pre-registered extraction target function list 191 and extracts all locations in the program where functions registered in the extraction target function list 191 are called. This allows the extraction unit 11 to extract, for example, all locations in the program where sink functions are called.

[0053] The measurement unit 12 is an example of the above-mentioned measurement unit 102. The measurement unit 12 measures the number of times or frequency of execution of a sensitive function (predetermined function) for each function call location during normal execution of a program.

[0054] Here, "normal execution" refers to the timing when a program is executed in a normal execution environment. Normal execution is, for example, the timing when the program to be analyzed is actually running in a service or business. Normal execution may also be the timing when an operation test of the program is being performed in a test environment.

[0055] For example, the measurement unit 12 measures the number of times a sensitive function is executed in a predetermined period. Furthermore, the measurement unit 12 measures the execution frequency of the sensitive function in that period based on the number of times of execution measured in that period. The measurement unit 12 may measure only the number of times of execution, or may measure both the number of times of execution and the execution frequency. Alternatively, the measurement unit 12 may execute a program a predetermined number of times in a test environment or the like and measure the number of times or the execution frequency of the sensitive function. A specific image of the processing of the measurement unit 12 will be described later with reference to the drawings.

[0056] The measurement unit 12 stores the measured number of executions or execution frequency in the storage unit 19. Here, the measurement unit 12 stores the number of executions of a sensitive function in a predetermined period as call frequency information 192.

[0057] The call frequency information 192 will now be described with reference to Fig. 6. Fig. 6 is a diagram showing an example of the call frequency information 192. As shown in the figure, the call frequency information 192 is information that associates, for example, a function ID, a call location, and the number of executions.

[0058] The function ID is information for identifying the sensitive function. The call location is information indicating the location where the sensitive function is called in the processing flow. The execution count is information indicating the number of times the sensitive function is executed in a predetermined period. Here, a sink function is used as the sensitive function, but the sensitive function may be another function.

[0059] As indicated by the function ID "sink #1," the measurement unit 12 measures the number of executions for each call location, even for the same sink function. This allows the measurement unit 12 to manage the number of executions or the execution frequency for each call location.

[0060] Returning to Fig. 5, the explanation will be continued. The narrowing down unit 13 is an example of the narrowing down unit 103 described above. The narrowing down unit 13 narrows down the analysis target locations to be subjected to process flow analysis from the function call locations based on the number of executions or execution frequency of a predetermined function during normal execution measured by the measurement unit 12. The narrowing down unit 13 may narrow down the analysis target locations using only either the number of executions or the execution frequency, or may narrow down the analysis target locations using both.

[0061] The narrowing down unit 13 may narrow down the analysis target locations using a predetermined threshold. For example, the narrowing down unit 13 narrows down the analysis target locations to function call locations whose execution count or execution frequency is less than a predetermined threshold. The threshold may be set in advance according to a user input. The threshold may be fixed or may be changed as appropriate. For example, it is assumed that a backdoor such as a hidden function will never be executed during normal execution of a program. Therefore, for example, the threshold may be set to "1". However, the user may set any threshold value.

[0062] For example, in the example of FIG. 6, assume that the threshold is "1." As shown in the shaded area in the figure, the number of executions at call location "CS #12" is "0." Therefore, this number of executions is less than the threshold. Furthermore, the execution counts of all other call locations are equal to or greater than the threshold. Therefore, the narrowing-down unit 13 narrows down the call locations shown in the figure to call location "CS #12" as the location to be analyzed.

[0063] In this way, the narrowing down unit 13 can narrow down some of the function call locations extracted by the extraction unit 11 as locations to be analyzed. As a result, the narrowing down unit 13 marks functions with an extremely low number of executions or execution frequency as candidates for functions to be executed via a backdoor path. The narrowing down unit 13 outputs information about the locations to be analyzed to the analysis unit 14. This allows the analysis unit 14 to perform analysis efficiently.

[0064] The narrowing unit 13 may narrow down the analysis target locations using a method other than the above-described method. For example, the narrowing unit 13 may narrow down the analysis target locations using a dynamic analysis method of the program in addition to monitoring the normal execution of the program during the predetermined period described above. When performing dynamic analysis, the narrowing unit 13 may use emulation or a real machine. Furthermore, the narrowing unit 13 may narrow down the analysis target locations using a commonly used profiling method or the like. Furthermore, the narrowing unit 13 may narrow down the analysis target locations to locations among multiple function call locations that have a relatively low number of executions, etc., at other call locations.

[0065] Here, the processing of the measurement unit 12 and the narrowing down unit 13 will be specifically described with reference to Fig. 7. Fig. 7 is a diagram schematically showing the processing of the measurement unit 12 and the narrowing down unit 13. In the figure, black arrows indicate normal processing flows, and white arrows indicate backdoor processing flows.

[0066] The figure shows a function flow FF1 that indicates the flow of functions executed in the control flow of the program being analyzed. The function flow FF1 has multiple nodes D1 to D7. Each of the nodes D1 to D7 indicates a function that is called in the control flow shown in the function flow FF1. Each function is called at a different call point.

[0067] In the figure, nodes D5 and D7 indicated by light shading are sensitive functions. The functions indicated by nodes D5 and D7 are registered in advance in the extraction target function list 191 as functions to be extracted by the extraction unit 11. In the analysis process according to this embodiment, the measurement unit 12 refers to the extraction target function list 191 and measures the number of times or frequency of execution of nodes D5 and D7 during normal execution of the program.

[0068] Based on the measurement results, the narrowing-down unit 13 narrows down the analysis target locations to be subjected to the process flow analysis among the nodes D5 and D7. For example, the narrowing-down unit 13 narrows down the analysis target locations to function call locations whose execution count or execution frequency is less than a predetermined threshold.

[0069] In the lower part of the figure, functions that are frequently called during normal execution (those whose execution count is greater than or equal to a threshold) are shown in dark shading. The functions that are frequently called during normal execution are nodes D1, D2, D4, D5, and D6. The narrowing-down unit 13 narrows down the analysis target locations to functions that are sensitive functions and whose call count during normal execution is less than a threshold. In this example, the narrowing-down unit 13 narrows down the analysis target location to node D7. The narrowing-down unit 13 outputs information about node D7 to the analysis unit 14.

[0070] Returning to Fig. 5, the explanation will be continued. The analysis unit 14 is an example of the analysis unit 104 described above. The analysis unit 14 analyzes a processing flow that starts or ends at an analysis target location. For example, the analysis unit 14 performs control flow analysis or data flow analysis on the processing flow. The analysis unit 14 may perform both control flow analysis and data flow analysis on the processing flow.

[0071] For example, the analysis unit 14 analyzes the control dependency between an instruction included in the processing flow and a conditional branch as a control flow analysis. The analysis unit 14 can analyze the control dependency by acquiring a conditional branch that controls the reaching of a certain instruction in the control flow.

[0072] Furthermore, for example, the analysis unit 14 analyzes data dependencies between variables (or between instructions that use variables as inputs and outputs) as data flow analysis. The analysis unit 14 can analyze data dependencies by tracking the input and output of data.

[0073] For example, the analysis unit 14 analyzes a processing flow that starts from an src function and ends at a sink function. The start and end points may be registered in advance in the extraction target function list 191. In this case, the sink function that is the end point corresponds to the function call location narrowed down by the narrowing unit 13 as the location to be analyzed.

[0074] The analysis unit 14 may identify a sink function as the end point and an src function that is the starting point of a processing flow including the sink function as the starting point. Examples of src functions include standard library functions and APIs used to receive input. Examples of sink functions include standard library functions and APIs that may have a serious impact on the system if misused, operations that require privileges in the software, or operations specific to the software that should not be misused.

[0075] If there is a data flow from the src function to the sink function, the processing flow may cause information leakage, etc. The analysis unit 14 analyzes the processing flow that starts or ends at the analysis target location, thereby reducing the possibility that a sensitive operation will be executed.

[0076] Based on the analysis result, the analysis unit 14 determines whether a backdoor is installed in the program. The analysis unit 14 may further determine whether other malicious functions are included. The analysis unit 14 outputs the analysis result to the output unit 15.

[0077] The output unit 15 acquires the analysis results from the analysis unit 14 and outputs the analysis results. The output unit 15 may acquire the analysis target locations from the narrowing unit 13 and output the analysis target locations. The output unit 15 is, for example, a display device or other display device. The output unit 15 may output the analysis results as a report. The output unit 15 may output the analysis results, etc. in other modes. For example, the output unit 15 may output information to an information terminal used by a user via a network (not shown).

[0078] The storage unit 19 stores an extraction target function list 191 and call frequency information 192. The storage unit 19 can also store a computer program (not shown) in which the processing of the program analysis method according to this embodiment is implemented.

[0079] The above describes the configuration of the program analysis device 10. Note that the above-described configuration of the program analysis device 10 is merely an example and may be modified as appropriate. For example, when some or all of the components of the program analysis device 10 are realized by multiple information processing devices, circuits, etc., the multiple information processing devices, circuits, etc. may be centrally or decentralized. For example, the information processing devices, circuits, etc. may be realized as a client-server system, a cloud computing system, or the like, in a form in which each device is connected via a communication network. Furthermore, the functions of the program analysis device 10 may be provided in a SaaS (Software as a Service) format.

[0080] In the above description, it is assumed that the program to be analyzed is in binary format and that the binary of the program is input. However, the source code may also be the target of analysis. In this case, for example, the extraction unit 11 may input the source code to be analyzed, compile the input source code, and convert it into binary format. Furthermore, the extraction unit 11, the measurement unit 12, the narrowing down unit 13, the analysis unit 14, or a processing unit (not shown) may appropriately use information obtained from the source code for analysis.

[0081] (Processing of Program Analysis Apparatus 10) Next, processing performed by the program analysis apparatus 10 according to this embodiment will be described with reference to Fig. 8. Fig. 8 is a flowchart showing processing performed by the program analysis apparatus 10. Note that, although the description here uses a sink function as the sensitive function, an src function or another function may also be used as the sensitive function.

[0082] First, the extraction unit 11 extracts call locations in a program where a sink function is called (S11). The extraction unit 11 can extract the call locations of the sink function by referring to the extraction target function list 191 stored in advance in the storage unit 19. Next, the measurement unit 12 measures the number of times or frequency of execution of the sink function for each function call location during normal execution of the program (S12).

[0083] Next, the narrowing unit 13 narrows down the analysis target locations to be subjected to the process flow analysis from the function call locations based on the number of executions or execution frequency of the sensitive functions (S13 to S15). Specifically, the narrowing unit 13 first obtains the occurrence frequency F(CSn) of each call location of the sink function in a predetermined period (S13).

[0084] Next, the narrowing-down unit 13 compares the occurrence frequency F(CSn) with a predetermined threshold T, and determines whether there is a call location whose occurrence frequency F(CSn) is less than the threshold T (S14). The threshold T may be set in advance by a user such as an inspector. The threshold T is, for example, "1."

[0085] If there is no call location whose occurrence frequency F(CSn) is less than the threshold T (NO in S14), the analysis unit 14 returns to the process of step S13 and repeats the process. If there is a call location whose occurrence frequency F(CSn) is less than the threshold T (YES in S14), the analysis unit 14 narrows down the analysis target locations to be subjected to the process flow analysis (S15).

[0086] Next, the analysis unit 14 analyzes the process flow that starts or ends at the analysis target location (S16). For example, the analysis unit 14 identifies the call location of the sink function that has been narrowed down as the analysis target location as the end point. The analysis unit 14 also identifies the src function that corresponds to the end point and identifies the src function as the start point.

[0087] The analysis unit 14 analyzes the processing flow from the src function at the start point to the sink function at the end point. The analysis unit 14 performs, for example, control flow analysis and data flow analysis on the processing flow. Based on the analysis results, the analysis unit 14 determines whether a backdoor is installed in the program.

[0088] The output unit 15 then outputs the analysis result (S17). The output unit 15 outputs the analysis result in, for example, a report format. The output unit 15 may output the analysis target location where the presence of a backdoor is suspected.

[0089] As described above, the program analysis device 10 according to this embodiment extracts function call locations in a program where a predetermined function is called, and measures the number of times or frequency of execution of the predetermined function during normal execution of the program for each function call location. Furthermore, the program analysis device 10 narrows down analysis target locations that are the subject of process flow analysis from the function call locations based on the number of times or frequency of execution. The program analysis device 10 then analyzes the process flow that starts or ends at the analysis target location.

[0090] In this way, the program analysis device 10 analyzes the processing flow that starts or ends at the extracted analysis target point, and can accurately determine whether a backdoor is installed in the program corresponding to the processing flow.

[0091] Furthermore, the program analysis device 10 can reduce the number of function call locations that are the end points of the process flow analysis, thereby reducing the number of process flows to be analyzed, thereby reducing analysis costs compared to when static analysis is performed simply using sensitive functions as indicators.

[0092] For example, in a process flow analysis (such as a data flow analysis), assume that there are m analysis start points and n analysis end points. In this case, there are m x n combinations of start points and end points. In such a case, there will be a huge number of process flows, which increases the analysis cost. By using the program analysis device 10 according to this embodiment, for example, if the number of end points is reduced to 1 / 10, the analysis cost will also be reduced to 1 / 10. In this way, the analysis cost can be reduced.

[0093] In this way, the program analysis device 10 according to this embodiment can appropriately analyze a process flow in which a backdoor may exist.

[0094] Third Embodiment Next, a third embodiment will be described. The third embodiment is a specific example of the first embodiment described above. The third embodiment is also a modified example of the second embodiment described above.

[0095] In the program analysis device 10 of the second embodiment, the configuration has been described in which the extracted function call locations are narrowed down to locations with a low number of executions or a low execution frequency as analysis target locations, and analysis is performed on the analysis target locations. In this embodiment, function call locations that cannot be reached during normal execution are excluded from the analysis target locations narrowed down based on the number of executions, etc.

[0096] (Configuration of Program Analysis Device 10a) The program analysis device 10a according to this embodiment will be described with reference to Fig. 9. Fig. 9 is a block diagram showing the configuration of the program analysis device 10a. As shown in the figure, the program analysis device 10a includes an extraction unit 11, a measurement unit 12, a first narrowing down unit 13a, a second narrowing down unit 13b, an analysis unit 14, an output unit 15, and a storage unit 19.

[0097] The first narrowing down unit 13a corresponds to the narrowing down unit 13 of the program analysis device 10 according to the second embodiment. The program analysis device 10a differs from the program analysis device 10 according to the second embodiment in that it further includes a second narrowing down unit 13b. The following mainly describes the differences from the second embodiment, and omits a description of overlapping points as appropriate.

[0098] The first narrowing down unit 13a corresponds to the narrowing down unit 13 of the above-described program analysis device 10. The first narrowing down unit 13a narrows down analysis target locations to be subjected to process flow analysis from function call locations based on the number of executions or execution frequency of a predetermined function during normal execution measured by the measurement unit 12.

[0099] The second narrowing unit 13b extracts, from the analysis target locations narrowed down by the first narrowing unit 13a, function call locations that cannot be reached during normal program execution as specific locations. The second narrowing unit 13b further narrows down the analysis target locations by excluding the specific locations from the analysis target locations. Function call locations that cannot be reached during normal program execution are also called dead code.

[0100] For example, the second narrowing down unit 13b extracts the specific location by performing dead code analysis. The second narrowing down unit 13b extracts the specific location by performing callee analysis of a function call instruction using, for example, static analysis of the program and identifying functions that do not exist as callee candidates. The second narrowing down unit 13b may extract the specific location by using a method other than the above.

[0101] The second narrowing-down unit 13b further narrows down the analysis target locations based on the result of the dead code analysis. Specifically, the second narrowing-down unit 13b excludes locations determined to be dead code from the analysis target locations.

[0102] (Processing of Program Analysis Apparatus 10a) Next, processing performed by the program analysis apparatus 10a according to this embodiment will be described with reference to Fig. 10. Fig. 10 is a flowchart showing processing performed by the program analysis apparatus 10a.

[0103] The processes of steps S11 to S15 are the same as those in the second embodiment described with reference to Fig. 8, and therefore detailed description thereof will be omitted. Note that the processes performed by the narrowing-down unit 13 in the second embodiment can be interpreted as the processes performed by the first narrowing-down unit 13a in this embodiment.

[0104] In step S15, after the first narrowing-down unit 13a narrows down the analysis target locations, the second narrowing-down unit 13b excludes dead code from the analysis target locations (S15a). Specifically, for example, the second narrowing-down unit 13b performs dead code analysis. If dead code is present, the second narrowing-down unit 13b further narrows down the analysis target locations by excluding the dead code from the analysis target locations narrowed down by the first narrowing-down unit 13a. If dead code is not present, the second narrowing-down unit 13b proceeds to step S16a without performing any particular processing.

[0105] Next, the analysis unit 14 analyzes the process flow that starts or ends at the location to be analyzed that has been further narrowed down in step S15a (S16a). The analysis process and subsequent processes are similar to steps S16 and S17 in Fig. 8, and therefore detailed description thereof will be omitted here.

[0106] As described above, in the program analysis device 10a according to this embodiment, the first narrowing down unit 13a narrows down the analysis target locations, and the second narrowing down unit 13b extracts function call locations that cannot be reached during normal execution as specific locations. The second narrowing down unit 13b further narrows down the analysis target locations by excluding the specific locations from the analysis target locations. In this way, the second narrowing down unit 13b can reduce the analysis target locations by excluding function call locations that are unlikely to be executed during normal execution. This allows the program analysis device 10a according to this embodiment to more appropriately analyze processing flows in which a backdoor may exist.

[0107] <Example of Hardware Configuration> Each functional component of the program analysis device 100, 10, and 10a (hereinafter referred to as "program analysis device 100, etc.") may be realized by hardware that realizes each functional component (e.g., a hardwired electronic circuit, etc.), or may be realized by a combination of hardware and software (e.g., a combination of an electronic circuit and a program that controls it, etc.). Below, a case where each functional component of the program analysis device 100, etc., is realized by a combination of hardware and software will be further described.

[0108] 11 is a block diagram illustrating an example of a hardware configuration of a computer 900 that realizes the program analysis device 100, etc. The computer 900 may be a dedicated computer designed to realize the program analysis device 100, etc., or may be a general-purpose computer. The computer 900 may also be a portable computer such as a smartphone or a tablet terminal.

[0109] For example, by installing a predetermined application on the computer 900, the functions of the program analysis device 100 and the like are realized on the computer 900. The application is configured by a program for realizing the functional components of the program analysis device 100 and the like.

[0110] The computer 900 has a bus 902, a processor 904, a memory 906, a storage device 908, an input / output interface 910, and a network interface 912. The bus 902 is a data transmission path for the processor 904, the memory 906, the storage device 908, the input / output interface 910, and the network interface 912 to transmit and receive data to and from each other. However, the method of connecting the processor 904 and other components to each other is not limited to a bus connection.

[0111] The processor 904 is a variety of processors, such as a central processing unit (CPU), a graphics processing unit (GPU), a field-programmable gate array (FPGA), or a quantum processor (quantum computer control chip). The memory 906 is a main storage device realized using a random access memory (RAM) or the like. The storage device 908 is an auxiliary storage device realized using a hard disk, a solid state drive (SSD), a memory card, a read only memory (ROM), or the like.

[0112] The input / output interface 910 is an interface for connecting the computer 900 with input / output devices. For example, the input / output interface 910 is connected to an input device such as a keyboard and an output device such as a display device.

[0113] The network interface 912 is an interface for connecting the computer 900 to a network. This network may be a LAN (Local Area Network) or a WAN (Wide Area Network).

[0114] The storage device 908 stores programs (programs that realize the above-mentioned applications) that realize the various functional components of the program analysis device 100, etc. The processor 904 reads these programs into the memory 906 and executes them to realize the various functional components of the program analysis device 100, etc.

[0115] Each processor executes one or more programs containing instructions for causing a computer to perform the algorithms described with reference to the figures. The programs contain instructions (or software code) that, when loaded into a computer, cause the computer to perform one or more functions described in the embodiments. The programs may be stored on various types of non-transitory computer-readable or tangible storage media. By way of example and not limitation, non-transitory computer-readable or tangible storage media include random-access memory (RAM), read-only memory (ROM), flash memory, solid-state drive (SSD) or other memory technologies, CD-ROM, digital versatile disc (DVD), Blu-ray disc or other optical disk storage, magnetic cassette, magnetic tape, magnetic disk storage or other magnetic storage devices. The programs may also be transmitted over various types of transitory computer-readable or communication media. By way of example and not limitation, transitory computer-readable or communication media include electrical, optical, acoustic, or other forms of propagated signals.

[0116] The present disclosure is not limited to the above-described embodiments, and can be appropriately modified without departing from the spirit and scope of the present disclosure. In addition, the above-described embodiments can be combined in any manner.

[0117] A part or all of the above-described embodiments can be described as, but not limited to, the following supplementary notes.

[0118] (Supplementary Note 1) A program analysis device comprising: extraction means for extracting function call locations indicating locations where a predetermined function is called in a program; measurement means for measuring, for each function call location, the number of executions or the frequency of execution of the predetermined function during normal execution of the program; narrowing down analysis target locations to be subject to process flow analysis from the function call locations based on the number of executions or the frequency of execution; and analysis means for analyzing the process flow starting from or ending at the analysis target location. (Supplementary Note 2) The program analysis device according to Supplementary Note 1, wherein the narrowing down means narrows down the analysis target locations to function call locations where the number of executions or the frequency of execution is less than a predetermined threshold. (Supplementary Note 3) The program analysis device according to Supplementary Note 1 or 2, further comprising second narrowing down means for extracting, from the analysis target locations, function call locations that cannot be reached during normal execution of the program as specific locations, and excluding the specific locations from the analysis target locations, thereby further narrowing down the analysis target locations. (Supplementary Note 4) The program analysis device according to any one of Supplements 1 to 3, wherein the extraction means extracts the function call locations based on a pre-established function list. (Supplementary Note 5) The program analysis device according to any one of Supplements 1 to 4, wherein the analysis means performs control flow analysis or data flow analysis on the processing flow. (Supplementary Note 6) The program analysis device according to any one of Supplements 1 to 5, wherein the predetermined function is a function that, if executed fraudulently, may perform a sensitive operation on a system including the program. (Supplementary Note 7) The program analysis device according to any one of Supplements 1 to 6, wherein the predetermined function includes at least one of a system call, a predetermined library function, a predetermined API (Application Programming Interface), and a function related to an operation that requires predetermined authority.(Supplementary Note 8) A program analysis method comprising: extracting function call locations indicating locations where a predetermined function is called in a program; measuring the number of executions or execution frequency of the predetermined function during normal execution of the program for each of the function call locations; narrowing down analysis target locations that are to be the subject of process flow analysis from the function call locations based on the number of executions or the execution frequency; and analyzing the process flow that starts or ends at the analysis target locations. (Supplementary Note 9) The program analysis method according to Supplementary Note 8, wherein in narrowing down the analysis target locations, function call locations whose number of executions or the execution frequency are less than a predetermined threshold are narrowed down as the analysis target locations. (Supplementary Note 10) A non-transitory computer-readable medium storing a program that causes a computer to execute the following steps: extracting function call locations that indicate locations where a predetermined function is called in a program, measuring the number of executions or execution frequency of the predetermined function for each of the function call locations during normal execution of the program, narrowing down analysis target locations that are to be the subject of process flow analysis from the function call locations based on the number of executions or the execution frequency, and analyzing the process flow that starts or ends at the analysis target locations. (Supplementary Note 11) The non-transitory computer-readable medium according to Supplementary Note 10, wherein the process of narrowing down analysis target locations narrows down the analysis target locations to function call locations whose number of executions or the execution frequency is less than a predetermined threshold.

[0119] 10, 10a, 100 Program analysis device 11, 101 Extraction unit 12, 102 Measurement unit 13, 103 Narrowing unit 13a First narrowing unit 13b Second narrowing unit 14, 104 Analysis unit 15 Output unit 19 Storage unit 191 Extraction target function list 192 Call frequency information A1 to A6 Nodes B1 to B6 Nodes C1 to C5 Nodes D1 to D7 Nodes CF1 to CF3 Control flow EI External input FF1 Function flow P1 Entry point PF1 Processing flow T1 Conditional branch 900 Computer 902 Bus 904 Processor 906 Memory 908 Storage device 910 Input / output interface 912 Network interface

Claims

1. an extraction means for extracting function call locations indicating locations where predetermined functions are called in a program; a measuring means for measuring the number of times or frequency of execution of the predetermined function for each function call location during normal execution of the program; a narrowing-down means for narrowing down analysis target locations to be subjected to process flow analysis from the function call locations based on the number of executions or the execution frequency; and an analysis means for analyzing a processing flow that starts or ends at the analysis target point. Program analysis device.

2. The narrowing means narrows down the analysis target locations to function call locations whose execution count or execution frequency is less than a predetermined threshold. The program analysis device according to claim 1 .

3. The program further includes a second narrowing-down unit that extracts, from the analysis target portions, function call portions that cannot be reached during normal execution of the program as specific portions, and further narrows down the analysis target portions by excluding the specific portions from the analysis target portions.

3. The program analysis device according to claim 1.

4. The extraction means extracts the function call locations based on a pre-defined function list.

3. The program analysis device according to claim 1.

5. The analysis means performs a control flow analysis or a data flow analysis on the processing flow.

3. The program analysis device according to claim 1.

6. The predetermined function is a function that, if executed improperly, can perform a sensitive operation on a system including the program.

3. The program analysis device according to claim 1.

7. The predetermined function includes at least one of a system call, a predetermined library function, a predetermined API (Application Programming Interface), and a function related to an operation that requires a predetermined authority.

3. The program analysis device according to claim 1.

8. A computer comprising: extracting function call locations indicating locations where predetermined functions are called in a program; measuring the number of times or frequency of execution of the predetermined function during normal execution of the program for each of the function call locations; narrowing down analysis target locations to be subjected to process flow analysis from the function call locations based on the number of executions or the execution frequency; Analyze the processing flow that starts or ends at the analysis target point Program analysis methods.

9. In the narrowing down of the analysis target locations, function call locations whose execution count or execution frequency is less than a predetermined threshold are narrowed down as the analysis target locations. The program analysis method according to claim 8.

10. A process of extracting function call locations indicating locations where predetermined functions are called in a program; a process of measuring the number of times or frequency of execution of the predetermined function for each function call location during normal execution of the program; narrowing down analysis target locations to be subjected to process flow analysis from the function call locations based on the number of executions or the execution frequency; A process of analyzing a process flow that starts or ends at the analysis target point; A program that causes a computer to execute the following.