Program analysis device, program analysis method, and program

Abstract

A program analysis device (1001) comprises: a flow length acquisition unit (1003) that, in a program, acquires flow length information indicating the length of an analysis target processing flow that includes a sensitive operation and that is defined by a prescribed start point and a prescribed end point; and a score calculation unit (1004) that calculates, on the basis of the flow length information, a backdoor score indicating a possibility that the analysis target processing flow has a backdoor code.

Description

Program analysis device, program analysis method, and non-transitory computer-readable medium

[0001] The present disclosure relates to a program analysis apparatus, a program analysis method, and a non-transitory computer-readable medium.

[0002] In recent years, infrastructures and corporate systems have become increasingly complex. As a result, these infrastructures and corporate systems are no longer comprised of devices from a single company, but are instead commonly constructed by combining devices procured from various companies. As a countermeasure against risks associated with supply chains constructed in this way, technology to detect malicious functions within programs is becoming increasingly important.

[0003] As an example of a malicious function in a program, there have been many reported cases where backdoors have been discovered in software (or firmware) or hardware procured from external manufacturers. The term "backdoor" as used herein can be defined as a function that is incorporated as part of a program that includes multiple functions that make up the software, and that is neither known to nor desired by the user.

[0004] Manufacturers who build infrastructure and corporate systems need to check whether the programs that make up the software they procure from external manufacturers contain backdoors. Checking whether such malicious functions are embedded in the programs requires expensive analysis using reverse engineering by experts.

[0005] As a related technique, Patent Document 1 provides a system for detecting sources of malicious activity in a computer system. The system disclosed in Patent Document 1 forms a graph in which relationships between objects are represented as edges based on information about objects in the computer system, and determines harmfulness coefficients of subgraphs. The system also discloses Patent Document 1 identifies an object associated with at least one vertex of the subgraph as a source of malicious activity based on the sum of the harmfulness coefficients.

[0006] Japanese Patent Application Laid-Open No. 2020-109611

[0007] Assume that a location where a backdoor may exist is automatically extracted from a program using a technology such as that disclosed in Patent Document 1. In such a case, it is necessary to identify the processing flow including the location and perform a detailed analysis. Furthermore, the inspector must determine whether a backdoor actually exists based on the analysis results. If there are many such locations, this places a heavy burden on the inspector, so it is desirable to identify the location among the multiple locations that should be checked as a priority. The technology disclosed in Patent Document 1 does not address this issue.

[0008] In view of the above-mentioned problems, an object of the present disclosure is to provide a program analysis device, a program analysis method, and a non-transitory computer-readable medium that are capable of appropriately identifying a processing flow that is likely to include a backdoor from among multiple candidate processing flows.

[0009] The program analysis device according to the present disclosure comprises: a flow length acquisition means for acquiring flow length information indicating the length of a processing flow to be analyzed that includes a sensitive operation and is defined by a predetermined starting point and a predetermined ending point in a program; and a score calculation means for calculating a backdoor score indicating the possibility that the processing flow to be analyzed is a backdoor code based on the flow length information.

[0010] The program analysis method according to the present disclosure acquires flow length information indicating the length of a processing flow to be analyzed that includes a sensitive operation and is defined by a predetermined starting point and a predetermined ending point in a program, and calculates a backdoor score indicating the possibility that the processing flow to be analyzed is a backdoor code based on the flow length information.

[0011] The non-transitory computer-readable medium according to the present disclosure stores a program that causes a computer to execute the following processes: obtaining flow length information indicating the length of a processing flow to be analyzed that includes a sensitive operation and is defined by a predetermined starting point and a predetermined ending point; and calculating a backdoor score that indicates the likelihood that the processing flow to be analyzed is a backdoor code based on the flow length information.

[0012] The present disclosure provides a program analysis device, a program analysis method, and a non-transitory computer-readable medium that can appropriately identify a process flow that is likely to include a backdoor from among multiple candidate process flows.

[0013] 1 is a block diagram showing the configuration of a program analysis device according to a first embodiment; FIG. 2 is a flowchart showing processing performed by the program analysis device according to the first embodiment; FIG. 3 is a diagram showing an example of a backdoor included in a control flow of software; FIG. 4 is a diagram for explaining characteristics of a backdoor; FIG. 5 is a diagram for explaining an overview of processing performed by a program analysis device according to a second embodiment; FIG. 6 is a diagram showing sample code for explaining an approach method of the program analysis device according to the second embodiment; FIG. 7 is a block diagram showing the configuration of a program analysis device according to the second embodiment; FIG. 8 is a diagram showing an example of sample code for explaining control dependency and data dependency according to the second embodiment; FIG. 9 is a diagram showing sample code of path traversal according to the second embodiment; FIG. 10 is a diagram showing sample code of a hidden account according to the second embodiment; FIG. 11 is a diagram showing sample code of a hidden account according to the second embodiment; FIG. 12 is a diagram showing sample code for explaining a hierarchy of control dependency according to the second embodiment; FIG. 13 is a diagram showing sample code for supplementary explanation regarding hierarchy according to the second embodiment; FIG. 14 is a diagram schematically showing an example when control dependency is hierarchical according to the second embodiment; FIG. 15 is a diagram showing sample code for explaining a second calculation method according to the second embodiment; FIG. 16 is a diagram showing sample code for explaining a third calculation method according to the second embodiment; FIG. 17 is a diagram showing sample code for explaining a fourth calculation method according to the second embodiment; FIG. 18 is a diagram showing an output example of a backdoor score according to the second embodiment; FIG. 2 is a block diagram illustrating a hardware configuration of a computer that realizes the program analysis device according to the embodiment.

[0014] Hereinafter, embodiments of the present disclosure will be described in detail with reference to the drawings. In each drawing, the same or corresponding elements are designated by the same reference numerals. For clarity of explanation, duplicated explanations will be omitted as necessary.

[0015] First Embodiment A first embodiment will be described with reference to Fig. 1 and Fig. 2. Fig. 1 is a block diagram showing the configuration of a program analysis device 1001 according to this embodiment. The program analysis device 1001 includes a flow length acquisition unit 1003 and a score calculation unit 1004.

[0016] The flow length acquisition unit 1003 acquires flow length information indicating the length of a process flow to be analyzed that includes a sensitive operation and is defined by a predetermined start point and a predetermined end point in a program.

[0017] The score calculation unit 1004 calculates a backdoor score indicating the possibility that the analysis target process flow is a backdoor code, based on the flow length information.

[0018] The program analysis device 1001 includes a processor, a memory, and a storage device (not shown). The storage device stores a computer program that implements the processing according to this embodiment. The processor can load the computer program from the storage device into the memory and execute the computer program. This allows the processor to realize the functions of the flow length acquisition unit 1003 and the score calculation unit 1004.

[0019] Next, the processing performed by the program analysis device 1001 will be described with reference to Fig. 2. Fig. 2 is a flowchart showing the processing performed by the program analysis device 1001.

[0020] First, the flow length acquisition unit 1003 acquires flow length information of a process flow to be analyzed, which is defined by a predetermined start point and a predetermined end point and includes a sensitive operation (S1001). Next, the score calculation unit 1004 calculates a backdoor score based on the flow length information (S1002).

[0021] With this configuration, the program analysis device 1001 according to this embodiment can appropriately identify a process flow that is highly likely to include a backdoor from among a plurality of candidate process flows.

[0022] 3 to 19, a second embodiment will be described. The second embodiment is a specific example of the first embodiment described above. A program analysis device 10 according to this embodiment will be described below. The program analysis device 10 is an information processing device capable of performing a predetermined program analysis process.

[0023] First, a program inspection technique will be described as a technique related to the program analysis device 10 according to this embodiment. In order to inspect whether a program to be analyzed contains a malicious function such as a backdoor, it is necessary to analyze the code contained in the program. There are two analysis methods: one that uses the source code of the program to be analyzed, and one that uses the code contained in the binary of the program to be analyzed (hereinafter referred to as the "target binary").

[0024] In this embodiment, an analysis method using code included in the target binary will be described as an example. By using such an analysis method, it is possible to extract, for example, control flow and data flow that depend on data input from outside the program. This makes it possible to automatically detect backdoor triggers.

[0025] Furthermore, by using this analysis method, it is possible to track inputs and outputs to registers and memory, and extract the relationship between security-sensitive code and backdoor triggers, thereby automatically detecting malicious data flows.

[0026] Here, a sensitive operation is, for example, an operation that, if executed improperly, is considered to have a significant impact on a system including a program and the environment in which the program is executed, and is an operation that has been predetermined by a user. The user may be, for example, a client who requests a program inspection, an analyst who performs the inspection, or a security officer.

[0027] Here, an example of a backdoor installed in a program will be described with reference to Figure 3. Figure 3 is a diagram showing an example of a backdoor included in software control flows CF1 and CF2. In the figure, circles represent functions or procedures. In the following description, functions and procedures may be referred to as "nodes." In addition, in the figure, thin arrows indicate normal processing flows, and thick arrows indicate backdoor processing flows.

[0028] In the control flow CF1 shown in the upper part of Fig. 3, nodes A1 to A5 are the execution path of the regular code. Normally, when a regular user executes the control flow CF1, processing is executed along a path such as nodes A1, A2, A3, A4, and A5.

[0029] However, in the example shown in the figure, a backdoor has been installed to allow processing to proceed from node A4 to node A6. By entering a specific input at node A4, an attacker can execute processing at node A6 without going through the legitimate node A5. The attacker could be, for example, the person who installed the backdoor in the program, or someone related to that person.

[0030] The predetermined input made by the attacker is a special input for realizing a malicious function. The predetermined input is, for example, an input for making a program execute a sensitive operation without going through the normal processing flow. The predetermined input may include, for example, input information known only to the attacker or those involved. The input information may be, for example, information about a hidden function not described in specifications, information for circumventing an authentication function, or a predetermined command string. These are just examples, and the input information may include various input data for realizing a malicious function.

[0031] Node A6 contains code for performing sensitive operations on the system (e.g., command execution, file output, etc.). Attackers attempt to perform unauthorized operations by installing a backdoor to create a process flow that differs from the normal process flow. For example, attackers may install such a backdoor in a program as a hidden function.

[0032] The lower part of Fig. 3 shows an example of a control flow CF2 including a branch and a rough outline of the processing performed by the program analysis device 10 according to this embodiment. In this example, a backdoor for executing unauthorized processing on the path of nodes B1, B2, B3, and B5 is installed in the control flow CF2. For example, an attacker can input predetermined data at node B1 to cause processing to be executed on the path of nodes B1, B2, B3, and B5. Node B5 includes code for performing sensitive operations on a system, etc.

[0033] Here, node B5 is a node that can also be passed through in the normal processing flow. For example, assume that node B4 is an authentication function for authenticating that the user is a legitimate user. In the normal processing flow, the authentication function is executed in node B4, and if authentication is successful, processing of node B5 is executed, and if authentication is unsuccessful, processing of node B6 is executed. In this way, in the normal processing flow, sensitive operations can be executed only if the user is successfully authenticated, and sensitive operations cannot be executed if authentication is unsuccessful.

[0034] However, in the control flow CF2, an attacker creates a flow that bypasses the authentication function by installing a backdoor that does not go through node B4, which allows the attacker to execute sensitive operations while bypassing the authentication function.

[0035] The program analysis device 10 according to this embodiment performs a predetermined analysis, focusing on the characteristics of a backdoor, which will be described later. Specifically, the program analysis device 10 analyzes a process flow to be analyzed, which includes a predetermined starting point and a predetermined ending point. Furthermore, the program analysis device 10 calculates a backdoor score corresponding to the process flow to be analyzed, using information obtained from the analysis results. In the example shown in the figure, the predetermined starting point is node B1, where an attacker inputs data. Furthermore, the predetermined ending point is node B5, which includes sensitive code. The sensitive code may include a function that can perform a sensitive operation. Hereinafter, a function that can perform a sensitive operation may be referred to as a "sensitive function."

[0036] Examples of sensitive functions include system calls, predetermined library functions, predetermined APIs (Application Programming Interfaces), or functions related to operations that require predetermined privileges. Specifically, a sensitive function is a sink function for outputting information within a system to the outside.

[0037] For example, the program analysis device 10 analyzes a process flow PF1 that starts at node B1 and ends at node B5. For example, the program analysis device 10 performs control flow analysis and data flow analysis on the process flow PF1 to extract a relationship between an external input made by an attacker and a sensitive operation. An external input is an input made to a program to be analyzed from outside the program. The external input may include a special input for realizing a malicious function.

[0038] The program analysis device 10 outputs the results of the backdoor inspection as an inspection report based on the analysis results. The inspection report indicates information about the backdoor, such as, for example, "A shell program is launched by inputting a hidden password from outside" or "Password information is output to a log file by a hidden command from outside." The program analysis device 10 also outputs the calculated backdoor score in the inspection report. For example, the program analysis device 10 outputs information about the backdoor score, such as, "The backdoor score for process flow 1 is 120."

[0039] Next, the characteristics of a backdoor will be described with reference to Fig. 4. Fig. 4 is a diagram for explaining the characteristics of a backdoor. The control flow CF3 shown in the figure includes nodes C1 to C5. The control flow CF3 starts processing from entry point P1, and enables the processing of each node to be executed according to branching.

[0040] In the figure, solid black arrows indicate normal processing flow. Solid white arrows and dashed white arrows indicate processing flow dependent on external input EI, which is information input from outside. In control flow CF3, node C5 contains code for performing sensitive operations. Processing flows that contain backdoors share common characteristics, as explained below.

[0041] The first feature is the presence of input information (trigger) known only to the attacker. The input information known only to the attacker is, for example, hidden authentication information or a predetermined command string. In the figure, a conditional branch T1 is shown as an example of a trigger.

[0042] The second feature is that the execution path satisfies a specific condition. An execution path that satisfies a specific condition is an irregular execution path. An irregular execution path may include a regular execution path in part.

[0043] An attacker may use unauthorized external input information to satisfy a specific condition. For example, the attacker may compare the unauthorized external input with predetermined information and branch the path depending on the comparison result. When an unauthorized external input is accepted, the subsequent processing flow can be executed via an illegal execution path. In the example shown in the figure, an illegal execution path is formed due to the presence of external input EI.

[0044] The third feature is that the above-mentioned irregular path is ultimately used to perform a sensitive operation on the system. The sensitive operation may be, for example, starting a shell, conducting unauthorized communication, or writing confidential data to a file. In the example shown in the figure, the sensitive operation is performed on node C5.

[0045] (Outline of Processing Performed by Program Analysis Apparatus 10) Here, an outline of processing performed by the program analysis apparatus 10 according to this embodiment will be described with reference to Fig. 5. Fig. 5 is a diagram illustrating an outline of processing performed by the program analysis apparatus 10. As shown in the figure, the program analysis apparatus 10 has an analysis function, a modeling function, and a scoring function.

[0046] The analysis function is a function for analyzing a process flow to be analyzed. As shown in sample code 51 in the figure, the process flow to be analyzed is defined by a predetermined start point and end point. DD and CD in the figure are information indicating the relationships between codes included in the process flow to be analyzed. DD indicates data dependency between variables (or between instructions that use variables as input and output). CD indicates control dependency between instructions and conditional branches. The program analysis device 10 extracts data dependency and control dependency within the process flow to be analyzed. Details of each will be described later.

[0047] The modeling function is a function that generates construction information that indicates how a target process flow is constructed based on the analysis results of the target process flow. For example, the program analysis device 10 generates, as construction information, a model 52 for calculating a backdoor score, as shown in the figure as "recv → DD → CD → system." The construction information is not limited to a specific model or format. The program analysis device 10 can generate construction information in any manner.

[0048] The scoring function is a function for calculating a backdoor score based on construction information. The program analysis device 10 calculates the backdoor score based on, for example, a model 52. The program analysis device 10 notifies the inspector of a report 53 including the scoring results. This enables the program analysis device 10 to notify the inspector of dangerous processing flows.

[0049] Although the present embodiment describes a program analysis device 10 that has all of the above-described analysis function, modeling function, and scoring function, the program analysis device 10 may be configured to have only some of these functions. For example, the program analysis device 10 may be configured to acquire analysis results and construction information from another device that has the analysis function and modeling function, and calculate a backdoor score based on the acquired information.

[0050] Here, an approach method for the program analysis device 10 according to this embodiment to detect a backdoor will be described with reference to Fig. 6. Fig. 6 is a diagram showing sample code 61 for explaining the approach method of the program analysis device 10 according to this embodiment. The sample code 61 is an example of a hidden command in a program.

[0051] To detect a backdoor, it is necessary to analyze the relationship between external inputs to a program and sensitive operations contained in the program. For this reason, the following two program analysis techniques are used in this embodiment.

[0052] The first analysis technique is control flow analysis. Control flow analysis is a technique for analyzing control dependencies (hereinafter, sometimes referred to as "CD") between instructions and conditional branches. The analysis unit 11 extracts control dependencies contained in the process flow to be analyzed by performing control flow analysis on the process flow to be analyzed.

[0053] The second analysis technique is data flow analysis. Data flow analysis is a technique for analyzing data dependencies (hereinafter sometimes referred to as "DD") between variables (or between instructions that use variables as inputs and outputs). The analysis unit 11 extracts data dependencies contained in the analysis target process flow by performing data flow analysis on the analysis target process flow.

[0054] (Configuration of Program Analysis Apparatus 10) Next, the configuration of the program analysis apparatus 10 according to this embodiment will be described with reference to Fig. 7. Fig. 7 is a block diagram showing the configuration of the program analysis apparatus 10. The program analysis apparatus 10 is an example of the program analysis apparatus 1001 described above.

[0055] As shown in the figure, the program analysis device 10 includes an analysis unit 11 , a construction information generation unit 12 , a flow length acquisition unit 13 , a score calculation unit 14 , an output unit 15 , and a storage unit 19 .

[0056] The analysis unit 11 extracts predetermined start and end points from a program, identifies a process flow to be analyzed that is defined by the start and end points, and analyzes the process flow to be analyzed to obtain relationship information. Here, the relationship information may include at least one of the control dependency and the data dependency described above.

[0057] The starting point of the process flow to be analyzed is a function that acquires external input. The function that acquires external input is, for example, a recv function for acquiring information from outside the system over a network, and these are collectively referred to as src (source) functions.

[0058] Furthermore, the end point of the analysis target process flow may be a sensitive function that, if executed improperly, may perform a sensitive operation on a system including the program. A sensitive function is, for example, a write function for outputting information within the system to the outside, and these are collectively referred to as sink functions.

[0059] For example, suppose the starting point is an src function and the ending point is a sink function. In this case, the analysis unit 11 identifies the process flow from the src function to the sink function as the analysis target process flow. The analysis unit 11 analyzes the analysis target process flow and extracts control dependencies and data dependencies within the flow.

[0060] For example, the analysis unit 11 may extract function call locations indicating locations where sensitive functions are called in the program and identify the call locations as end points. The analysis unit 11 may measure the number of executions or execution frequency of a predetermined function during normal execution of the program for each function call location, and narrow down the analysis locations to be subjected to process flow analysis based on the number of executions or execution frequency.

[0061] Note that normal execution time refers to the timing when a program is executed in a normal execution environment. Normal execution time may be, for example, the timing when the analysis target program is actually running in a service or business, or the timing when the program is being tested using a test environment. The analysis unit 11 can identify the extracted analysis target point as the start point or end point. This allows the analysis unit 11 to identify the analysis target process flow.

[0062] The analysis unit 11 performs at least one of control flow analysis to obtain control flow information indicating control dependencies between multiple pieces of code in the process flow to be analyzed, and data flow analysis to obtain data flow information indicating data dependencies between multiple pieces of code. The analysis unit 11 thereby obtains relationship information. Each piece of code is for executing a function or a procedure.

[0063] For example, the analysis unit 11 acquires relationship information indicating the relationship between the code at the start point and the code at the end point of the process flow to be analyzed. The analysis unit 11 may acquire the relationship information using a code that is neither the start point nor the end point. For example, the analysis unit 11 acquires the relationship information using a first code and a second code that exist between the start point and the end point.

[0064] For example, the first code is code that exists after the starting point and before the second code. Furthermore, the second code is code that exists after the first code and before the end point. In this case, the analysis unit 11 performs at least one of the following analyses: control flow analysis to obtain control flow information indicating control dependency between the first code and the second code; and data flow analysis to obtain data flow information indicating data dependency between the first code and the second code. As a result, the analysis unit 11 obtains relationship information indicating the relationship between the first code and the second code.

[0065] In the above description, an example was shown in which both the first and second codes are located between the start point and the end point, but either the first or second code may correspond to the start point or the end point of the process flow to be analyzed. Also, in the above description, an example was shown in which the analysis unit 11 acquires relationship information indicating the relationship between two codes, but the analysis unit 11 may acquire relationship information indicating the relationship between three or more codes.

[0066] Here, control dependencies will be specifically described. The analysis unit 11 can analyze control dependencies by acquiring conditional branches that control the reach of a certain instruction in the control flow. In this way, the analysis unit 11 acquires control flow information that indicates control dependencies between codes.

[0067] For example, consider the following two codes, denoted as S1 and S2: S1: if (A) then S2: B = C * D

[0068] In this case, S2 depends on S1, so it can be said that there is control dependency between S1 and S2.

[0069] Next, data dependency will be specifically described. The analysis unit 11 can analyze data dependency by tracking data input and output. In this way, the analysis unit 11 obtains data flow information indicating data dependency between codes. Note that the analysis unit 11 may obtain information analyzed by another analysis framework.

[0070] For example, consider the following two codes, denoted as S3 and S4: S3: A = B * C S4: D = A * E + 1

[0071] In this case, S4 depends on S3, so it can be said that there is a data dependency between S3 and S4.

[0072] The analysis unit 11 performs data flow analysis and control flow analysis, for example, by forward analysis from the start point of the process flow to be analyzed, and continuously tracks data dependencies and control dependencies to the end point of the analysis. As a result of the analysis, the analysis unit 11 extracts how control dependencies and data dependencies are related from the start point to the end point of the analysis.

[0073] Figure 8 shows an example of sample code for explaining control dependency and data dependency. In the figure, solid arrows indicate control dependency, and dashed arrows indicate data dependency. This also applies to Figures 9 to 11, which will be described later.

[0074] The input function, which is a src function, is called in the code 811 of the code block 81. The system function, which is a sink function, is called in the code 821 of the code block 82.

[0075] In code 811, an external input is accepted. In code 812, function funcA is called and a value is assigned to variable d. Therefore, there is a data dependency between codes 811 and 812. Furthermore, in code 812, the value of d depends on funcA(a). Therefore, there is a data dependency between d and funcA(a).

[0076] Furthermore, in code 813, a conditional branch is performed using variable d. Therefore, control of the call of the system function in code 821 depends on the value of variable d. Therefore, code 821 and code 813 are in a control-dependent relationship.

[0077] Next, examples of unauthorized functions detected by the analysis unit 11 will be described with reference to Figures 9 to 11. Figure 9 is a diagram showing sample code for path traversal. Figures 10 and 11 are diagrams showing sample code for hidden accounts.

[0078] 9 is a diagram showing sample code 91 according to an example of path traversal. Sample code 91 includes code 911 to 916. The recv function shown in code 912 is an example of an src function. The fopen function shown in code 914 is an example of a sink function.

[0079] As shown in the figure, sample code 91 includes multiple data dependencies. For example, sample code 91 includes data dependencies between code 912 and 913, between code 913 and 914, between code 913 and 915, between code 915 and 916, and between arguments of the strcpy function in code 916.

[0080] In this way, the process flow to be analyzed may include only data dependency relationships without control dependency relationships. Also, although not shown, the process flow to be analyzed may include only control dependency relationships without data dependency relationships.

[0081] 10 and 11 are diagrams showing examples of hidden accounts. FIG. 10 shows sample code 101 as a first example of a hidden account. Sample code 101 includes one control dependency relationship. FIG. 11 shows sample code 111 as a second example of a hidden account. Sample code 111 includes multiple control dependency relationships.

[0082] Returning to Fig. 7 , the explanation will be continued. The construction information generation unit 12 acquires relationship information indicating the relationships between multiple codes included in the analysis target process flow from the analysis unit 11. The construction information generation unit 12 generates construction information indicating how the analysis target process flow is constructed based on the relationship information. The construction information generation unit 12 generates, as construction information, model information indicating control dependencies and data dependencies included in the analysis target process flow, such as the above-mentioned model 52. The construction information generation unit 12 may perform modeling using AI (artificial intelligence) or the like to generate the construction information.

[0083] Here, we will explain the relationship between external inputs and sensitive operations. A process flow with an illegal function activated by an external input is constructed by data dependencies (DD) and control dependencies (CD) between the external input (EI) and the sensitive operation (SO).

[0084] The following (C1) to (C4) are examples of construction information.

[0085] (C1) A sensitive operation (SO) is executed by branching based on the propagation result of the external input (EI) (control dependency) EI -> DD -> CD -> SO

[0086] (C2) Execute a sensitive operation (SO) using the propagation result of the external input (EI) as a runtime argument (data dependency) EI -> DD -> SO_arg

[0087] (C3) A variable indicating the authentication status (authentication variable) is set by a conditional branch based on the propagation result of the external input (EI). After that, a sensitive operation (SO) is executed by a branch based on the authentication variable: EI -> DD -> CD -> auth_flag -> (DD ->) CD -> SO

[0088] (C4) A conditional branch based on the propagation result of the external input (EI) sets a value (fixed value) to the argument variable of the sensitive operation (SO). After that, the sensitive operation (SO) is executed with the argument variable as an argument (the argument variable and the sensitive operation have a data dependency). EI -> DD -> CD -> arg_var -> (DD ->) SO_arg

[0089] The above example is just an example, and the construction information can be combined as appropriate. Note that there can be zero or more control dependencies and data dependencies in the analysis target process flow. There can be multiple control dependencies and multiple data dependencies.

[0090] Based on the construction information described above, the following knowledge can be obtained. (Knowledge 1) The relationship between an external input (EI) and a sensitive operation (SO) can be expressed in one of the following two types of regular expressions using data dependency (DD) and control dependency (CD). Note that the symbol "*" represents the repetition of the symbol immediately preceding it 0 or more times. For example, "(CD|DD)*" indicates that CD or DD is repeated 0 or more times.

[0091] 1. By always inserting a control dependency, if there is no "direct" data dependency between the external input and the sensitive operation, Relation(EI, SOtype1) = (CD|DD)* CD (CD|DD)*

[0092] 2. When there is a "direct" data dependency between an external input and a sensitive operation without any control dependency between them, Relation(EI,SOtype2) = (DD)* DD

[0093] (Insight 2) The depth of control dependencies is expected to be less than a predetermined level. For example, the depth of control dependencies is expected to be at most two to three levels. For example, the sample code 111 shown in FIG. 11 above is an example of a control dependency with a two-level depth. Control dependencies deeper than this increase the complexity of activating malicious functions via external input, and are therefore unlikely from the perspective of attack implementation. Therefore, control dependencies with a depth greater than a certain level may be excluded from the calculation of the backdoor score by the score calculation unit 14, which will be described later. The method of calculating the backdoor score will be described in detail later.

[0094] (Regarding the Hierarchy of Control Dependencies) Here, the generation of construction information by the construction information generator 12 will be specifically described with reference to Fig. 12. Fig. 12 is a diagram showing sample code 121 for explaining the hierarchy of control dependencies. The sample code 121 has codes 1211 to 1215.

[0095] The hierarchy indicates the complexity of the control relationships between multiple nodes. The larger the hierarchy, the more complex the control dependencies between the nodes. Therefore, if a node in a control dependency relationship contains a sensitive operation, it is assumed that the larger the hierarchy, the less likely the sensitive operation will be triggered.

[0096] As shown in the figure, code 1211 is an src function. In code 1211, a variable "input" is defined according to an external input.

[0097] A control dependency exists between the conditional branch in code 1212 and the operation of code 1213 controlled by the conditional branch in code 1212. There is one control dependency between code 1212 and 1213. In this way, when there is one control dependency between two pieces of code, the two pieces of code are in a one-level control dependency relationship.

[0098] Furthermore, a new variable "new_a" is defined in code 1213. Furthermore, a conditional branch different from that in code 1212 is executed in code 1214. As a result, code 1214 controls the operation of code 1215. In this case, a control dependency different from the above-mentioned control dependency exists between the operation of code 1214 and the operation of code 1215.

[0099] The conditional branch of code 1214 is conditional on the output of code 1213. In other words, the conditional branch of code 1214 is called under the control of a value ("new_a") defined under the control of an external input ("input"). In this case, code 1214 has a control dependency relationship one level higher than code 1212. In other words, code 1214 has a two-level control dependency relationship with code 1211.

[0100] The construction information indicating the structure of the sample code 121 can be expressed as follows: input -> CD -> new_a -> CD -> system()

[0101] The above-mentioned hierarchy of control dependencies will be further explained with reference to Fig. 13. Fig. 13 shows sample code 131 for providing a supplementary explanation of the hierarchy. The sample code 131 includes code 1311 to 1314.

[0102] Sample code 131 has two conditional branches for controlling the system function call. The conditional branches are codes 1312 and 1313. In this case, there is not a two-level control dependency relationship from the perspective of the src function shown in code 1311, but rather there are two conditional branches at the first level from the perspective of the src function. This is because the condition variable of the second conditional branch (code 1313) is not defined by the operation controlled by the first conditional branch (code 1312).

[0103] The construction information indicating the structure of the sample code 131 is expressed as follows: input[0] -> CD -> system() input[1] -> CD -> system()

[0104] In this way, the control dependency relationship between the code 1311 and the code 1312 is one level deep. Similarly, the control dependency relationship between the code 1311 and the code 1313 is also one level deep.

[0105] 14 is a diagram showing an example of a case where control dependencies are layered. As shown in the diagram, it is assumed that there is construction information expressed as follows:

[0106] Variable definition A i -> Variable A i Conditional branch based on -> variable definition A i+1 -> Variable A i+1 Conditional branch based on -> variable definition A i+2 ...

[0107] In the above case, "variable A ｉ "Conditional branch with condition " followed by "Variable definition A ｉ＋１ If " is performed, the hierarchy increases by 1. ｉ＋１ "Conditional branch with condition " followed by "Variable definition A ｉ＋２If " is performed, the hierarchy level increases by one.

[0108] 7, the description will be continued. The flow length acquisition unit 13 is an example of the above-mentioned flow length acquisition unit 1003. The flow length acquisition unit 13 acquires flow length information indicating the length of a processing flow to be analyzed that includes a sensitive operation and is defined by a predetermined start point and a predetermined end point in a program.

[0109] The flow length information is information related to the ease of triggering a backdoor. The flow length information is used by the score calculation unit 14, which will be described later, to calculate a backdoor score. The flow length information may include, for example, information indicating the number of function nodes existing between two pieces of code. The flow length information may also include information regarding the number of layers described above. In this embodiment, the flow length acquisition unit 13 acquires the flow length information based on the construction information generated by the construction information generation unit 12.

[0110] The flow length information is, for example, information indicating the complexity of the control dependency from the starting point to the end point. The flow length information may also be information indicating the length of the processing flow from the starting point to the backdoor trigger candidate. A backdoor trigger candidate indicates a process that could trigger a backdoor. A backdoor trigger candidate is, for example, code that performs a conditional branch. The flow length information may also be information indicating the length of the processing flow from the backdoor trigger candidate to the end point.

[0111] The score calculation unit 14 is an example of the score calculation unit 1004 described above. The score calculation unit 14 calculates a backdoor score based on the flow length information acquired by the flow length acquisition unit 13. The backdoor score is a score indicating the possibility that the analysis target process flow is a backdoor code. The backdoor score is, for example, a numerical representation of the likelihood that the analysis target process flow is a backdoor code. The backdoor score may be expressed using the maliciousness of the analysis target process flow, etc.

[0112] For example, the score calculation unit 14 calculates the backdoor score according to the feature quantities of the process flow to be analyzed. The feature quantities of the process flow to be analyzed are information indicating the characteristics of the process flow to be analyzed. The feature quantities may include the number of hierarchical levels indicated by the control dependencies included in the process flow to be analyzed. Furthermore, the feature quantities may include, for example, the number of function nodes included in the process flow to be analyzed.

[0113] The score calculation unit 14 assigns the calculated backdoor score to the analysis target process flow. If there are multiple analysis target process flows, the score calculation unit 14 calculates a backdoor score for each of the multiple analysis target process flows and assigns the calculated backdoor score to each analysis target process flow. The score calculation unit 14 may store the analysis target process flow and the backdoor score in association with each other in the storage unit 19.

[0114] The score calculation unit 14 can calculate a backdoor score using a predetermined scoring policy based on the flow length information. The scoring policy is information that serves as a standard for calculating the backdoor score. In this embodiment, it is assumed that a scoring policy 191 is stored in advance in the storage unit 19. The score calculation unit 14 calculates the backdoor score by referring to the scoring policy 191.

[0115] The score calculation unit 14 can select a calculation method from a plurality of calculation methods. The following are examples of backdoor score calculation methods. Each calculation method will be described below. The score calculation unit 14 can appropriately select a calculation method according to the inspector's viewpoint.

[0116] (First Calculation Method) When the number of hierarchical levels indicated by the control dependency included in the process flow to be analyzed is n or less (n is a natural number equal to or greater than 2), the score calculation unit 14 calculates the backdoor score so that the backdoor score is higher than when the number of hierarchical levels is greater than n. n is assumed to be 2, for example. n can be set in advance by an inspector or the like. n can also be changed as appropriate. Note that the score calculation unit 14 may calculate the same backdoor score when n=1 and when n=2.

[0117] For example, assume that n = 2. When the number of layers is 1 or 2, the score calculation unit 14 calculates a higher backdoor score than when the number of layers is 3 or more. For example, when the number of layers is 1 or 2, the score calculation unit 14 calculates a backdoor score of 10. On the other hand, when the number of layers is 3 or more, the score calculation unit 14 calculates a backdoor score of 0.

[0118] In the above example, the score calculation unit 14 may calculate the backdoor score so that the backdoor score increases as the number of layers decreases. In this case, the score calculation unit 14 calculates a higher backdoor score when the number of layers is 1 than when the number of layers is 2.

[0119] (Second Calculation Method) The score calculation unit 14 may calculate the backdoor score based on the number of function nodes between a first code indicating an external input and a second code indicating control dependency at the first level from the first code.

[0120] FIG. 15 is a diagram showing sample code 151 for explaining the second calculation method. In the diagram, the starting point is the external input (src function) shown in code 1511. The score calculation unit 14 calculates the backdoor score based on the length of the function node from the external input to code 1515, which indicates the control dependency at the first level. The length of the function node corresponds to the number of function nodes through which the external input passes. The length of the function node indicates the proximity of the distance from the external input to the trigger. The conditional branch in code 1515 is a function that triggers the backdoor.

[0121] The more function nodes that are passed through, the greater the distance from the src function to the point that indicates control dependency up to the first layer, so it is assumed that it becomes more difficult to trigger the sensitive function. By utilizing this, the score calculation unit 14 can calculate a smaller backdoor score as the distance increases.

[0122] In this calculation method, if x is the number of function nodes, the backdoor score fa(x) is expressed by the following formula (1): fa(x) = 1 / x (1)

[0123] In the example shown in the figure, the external input passes through three functions from the src function in code 1511 to "if (var_x)" in code 1515, which is the point indicating the control dependency in the first layer. Therefore, in this example, the score calculation unit 14 calculates the backdoor score as 1 / 3.

[0124] This allows the score calculation unit 14 to calculate the backdoor score according to the number of function nodes through which the external input passes from the src function to the point indicating the control dependency up to the first layer.

[0125] (Third Calculation Method) The score calculation unit 14 may calculate the backdoor score based on the number of function nodes between a first code indicating a sensitive operation and a second code that has control dependency on the first code and is located closest to the first code.

[0126] 16 is a diagram showing sample code 161 for explaining the third calculation method. Sample code 161 has code 1611 to 1618. In the analysis target process flow shown in the diagram, the starting point is the external input (src function) shown in code 1611. The ending point is the system function (sink function) shown in code 1618. The code that has control dependency on code 1618 and is closest to that code is code 1615, which indicates a conditional branch.

[0127] The score calculation unit 14 calculates the backdoor score according to the number of function nodes from the control dependency located at the first layer with respect to the sink function to the sink function. Therefore, the score calculation unit 14 calculates the backdoor score based on the number of function nodes between the code 1615 and the code 1618.

[0128] The more function nodes that are passed through, the farther the sink function is from the point that indicates the control dependency up to the nth layer. Therefore, it is assumed that it becomes more difficult for an attacker to trigger a sensitive function.

[0129] In this calculation method, if x is the number of function nodes, the backdoor score fb(x) is expressed by the following formula (2): fb(x) = 1 / x (2)

[0130] In the example shown in the figure, there are two function call locations from the point indicating the control dependency of the target to the sink function. Including the sink function call itself, there are three function nodes. Therefore, the score calculation unit 14 calculates the backdoor score as 1 / 3.

[0131] In this way, the score calculation unit 14 can calculate a backdoor score according to the number of function nodes that exist from the point indicating the control dependency up to the nth layer to the sink function.

[0132] (Fourth Calculation Method) The score calculation unit 14 may calculate the backdoor score based on the number of nodes on the function flow that is traversed between a first code indicating a sensitive operation and a second code that has control dependency on the first code and is located closest to the first code.

[0133] 17 is a diagram showing sample code 171 for explaining the fourth calculation method. Sample code 171 includes code 1711 to 1721. In addition to sample code 171, a function flow 172 corresponding to sample code 171 is also shown.

[0134] In this calculation method, the score calculation unit 14 calculates the backdoor score according to the number of nodes on the function flow that pass from code having one level of control dependency on the sink function to the sink function call.

[0135] It is expected that the more function nodes that are passed through, the greater the distance from the point indicating the control dependency up to the nth layer to the sink function, making it more difficult to trigger.

[0136] In this calculation method, if the number of nodes on the function flow that is passed through is x, the backdoor score fc(x) is expressed by the following formula (3): fc(x) = 1 / x (3)

[0137] In the example shown in the figure, processing is performed via funcB and funcC on the function flow from code 1716, which is a point indicating control dependency with code 1721, which is a sink function, to code 1721. Therefore, including the sink function call itself, there are three function nodes traversed. Therefore, the score calculation unit 14 calculates the backdoor score as 1 / 3.

[0138] Returning to FIG. 7 , the explanation will be continued. The output unit 15 outputs the backdoor score calculated by the score calculation unit 14. The output unit 15 may output the relationship information acquired by the analysis unit 11 or the construction information generated by the construction information generation unit 12. The output unit 15 is, for example, a display device or other display device. The output unit 15 may output the analysis results or the like in other ways. For example, the output unit 15 may output information to an information terminal used by a user via a network (not shown).

[0139] 18 is a diagram showing an output example 15a of a backdoor score. For example, the output unit 15 notifies the inspector of only the process flows for which a score above a certain level has been calculated. The inspector can efficiently perform the inspection by checking the notified process flows.

[0140] 7, the description will be continued. The storage unit 19 stores a scoring policy 191. The storage unit 19 can also store a computer program (not shown) that implements the processing of the program analysis method according to this embodiment.

[0141] The above describes the configuration of the program analysis device 10. Note that the above-described configuration of the program analysis device 10 is merely an example and may be modified as appropriate. For example, when some or all of the components of the program analysis device 10 are realized by multiple information processing devices, circuits, etc., the multiple information processing devices, circuits, etc. may be centrally or decentralized. For example, the information processing devices, circuits, etc. may be realized as a client-server system, a cloud computing system, or the like, in a form in which each device is connected via a communication network. Furthermore, the functions of the program analysis device 10 may be provided in a SaaS (Software as a Service) format.

[0142] In the above description, it is assumed that the program to be analyzed is in binary format and that the binary of the program is input. However, the source code may also be the target of analysis. In this case, for example, the analysis unit 11 inputs the source code to be analyzed, compiles the input source code, and converts it into binary format. Furthermore, the analysis unit 11, the construction information generation unit 12, the flow length acquisition unit 13, the score calculation unit 14, or a processing unit (not shown) may appropriately use information obtained from the source code for analysis.

[0143] (Processing of Program Analysis Apparatus 10) Next, processing performed by the program analysis apparatus 10 according to this embodiment will be described with reference to Fig. 19. Fig. 19 is a flowchart showing processing performed by the program analysis apparatus 10.

[0144] First, the analysis unit 11 analyzes the process flow to be analyzed and obtains relationship information (S11). For example, the analysis unit 11 extracts a predetermined start point and end point from the program to identify the process flow to be analyzed, and obtains relationship information by analyzing the process flow to be analyzed. The relationship information indicates the relationships between multiple codes included in the process flow to be analyzed.

[0145] Next, the construction information generator 12 generates construction information based on the relationship information (S12). The construction information indicates how the analysis target process flow is constructed. The construction information generator 12 may generate the construction information using a predetermined model.

[0146] Next, the flow length acquisition unit 13 acquires flow length information indicating the length of the analysis target process flow including the sensitive operation based on the construction information (S13). The flow length information may include, for example, information indicating the number of function nodes existing between two codes and information regarding the number of layers described above.

[0147] Next, the score calculation unit 14 calculates a backdoor score for the analysis target process flow based on the flow length information (S14). The score calculation unit 14 can calculate the backdoor score using, for example, any one of the above-mentioned calculation methods. The score calculation unit 14 may also calculate the backdoor score using a combination of the above-mentioned calculation methods.

[0148] Then, the output unit 15 outputs information about the analysis target process flow for which a backdoor score equal to or greater than a predetermined value has been calculated (S15).

[0149] As described above, the program analysis device 10 according to this embodiment acquires flow length information indicating the length of a process flow to be analyzed that includes a sensitive operation and is defined by a predetermined start point and a predetermined end point in a program. The program analysis device 10 can also calculate a backdoor score based on the flow length information.

[0150] With this configuration, the program analysis device 10 can automatically detect a process flow to be analyzed that triggers the execution of a sensitive operation due to an external input, and further score the malignancy of each process flow.

[0151] As a result, the program analysis device 10 according to the present embodiment can appropriately identify a process flow that is likely to contain a backdoor from among multiple candidate process flows, and can also prioritize subsequent inspection result confirmation work by inspectors.

[0152] <Example of Hardware Configuration> Each functional component of the program analysis devices 1001 and 10 (hereinafter referred to as the "program analysis device 1001, etc.") may be realized by hardware that realizes each functional component (e.g., a hardwired electronic circuit, etc.), or may be realized by a combination of hardware and software (e.g., a combination of an electronic circuit and a program that controls it). Below, a case where each functional component of the program analysis device 1001, etc., is realized by a combination of hardware and software will be further described.

[0153] 20 is a block diagram illustrating an example of a hardware configuration of a computer 900 that realizes the program analysis device 1001, etc. The computer 900 may be a dedicated computer designed to realize the program analysis device 1001, etc., or may be a general-purpose computer. The computer 900 may also be a portable computer such as a smartphone or a tablet terminal.

[0154] For example, by installing a predetermined application on the computer 900, the computer 900 realizes each function of the program analysis device 1001, etc. The application is configured by a program for realizing the functional components of the program analysis device 1001, etc.

[0155] The computer 900 has a bus 902, a processor 904, a memory 906, a storage device 908, an input / output interface 910, and a network interface 9120. The bus 902 is a data transmission path for the processor 904, the memory 906, the storage device 908, the input / output interface 910, and the network interface 9120 to transmit and receive data to and from each other. However, the method of connecting the processor 904 and the like to each other is not limited to a bus connection.

[0156] The processor 904 is a variety of processors, such as a central processing unit (CPU), a graphics processing unit (GPU), a field-programmable gate array (FPGA), or a quantum processor (quantum computer control chip). The memory 906 is a main storage device realized using a random access memory (RAM) or the like. The storage device 908 is an auxiliary storage device realized using a hard disk, a solid state drive (SSD), a memory card, a read only memory (ROM), or the like.

[0157] The input / output interface 910 is an interface for connecting the computer 900 with input / output devices. For example, the input / output interface 910 is connected to an input device such as a keyboard and an output device such as a display device.

[0158] The network interface 9120 is an interface for connecting the computer 900 to a network. This network may be a LAN (Local Area Network) or a WAN (Wide Area Network).

[0159] The storage device 908 stores a program (a program that realizes the above-mentioned application) that realizes each functional component of the program analysis device 1001, etc. The processor 904 reads this program into the memory 906 and executes it, thereby realizing each functional component of the program analysis device 1001, etc.

[0160] Each processor executes one or more programs containing instructions for causing a computer to perform the algorithms described with reference to the figures. The programs contain instructions (or software code) that, when loaded into a computer, cause the computer to perform one or more functions described in the embodiments. The programs may be stored on various types of non-transitory computer-readable or tangible storage media. By way of example and not limitation, non-transitory computer-readable or tangible storage media include random-access memory (RAM), read-only memory (ROM), flash memory, solid-state drive (SSD) or other memory technologies, CD-ROM, digital versatile disc (DVD), Blu-ray disc or other optical disk storage, magnetic cassette, magnetic tape, magnetic disk storage or other magnetic storage devices. The programs may also be transmitted over various types of transitory computer-readable or communication media. By way of example and not limitation, transitory computer-readable or communication media include electrical, optical, acoustic, or other forms of propagated signals.

[0161] The present disclosure is not limited to the above-described embodiments, and can be appropriately modified without departing from the spirit and scope of the present disclosure. In addition, the above-described embodiments can be combined in any manner.

[0162] Some or all of the above embodiments can be described as, but are not limited to, the following supplementary notes. (Supplementary Note 1) A program analysis device comprising: flow length acquisition means for acquiring flow length information indicating the length of a process flow to be analyzed that includes a sensitive operation defined by a predetermined start point and a predetermined end point in a program; and score calculation means for calculating a backdoor score indicating the possibility that the process flow to be analyzed is backdoor code based on the flow length information. (Supplementary Note 2) The program analysis device according to Supplementary Note 1 further comprises construction information generation means for acquiring relationship information indicating relationships between multiple codes included in the process flow to be analyzed and generating construction information indicating how the process flow to be analyzed is constructed based on the relationship information, wherein the flow length acquisition means acquires the flow length information based on the construction information. (Supplementary Note 3) The program analysis device according to Supplementary Note 2 further comprises analysis means for extracting the predetermined start point and end point from the program to identify the process flow to be analyzed and analyzing the process flow to be analyzed to acquire the relationship information, wherein the construction information generation means generates the construction information based on the relationship information acquired by the analysis means. (Supplementary Note 4) The program analysis device according to Supplementary Note 3, wherein the analysis means acquires the relationship information by performing at least one of control flow analysis for obtaining control flow information indicating control dependency between the plurality of codes and data flow analysis for obtaining data flow information indicating data dependency between the plurality of codes. (Supplementary Note 5) The program analysis device according to Supplementary Note 1 or 2, wherein the score calculation means calculates the backdoor score according to feature quantities of the analysis target process flow including the number of hierarchies indicated by control dependency included in the analysis target process flow. (Supplementary Note 6) The program analysis device according to Supplementary Note 5, wherein the score calculation means calculates the backdoor score so that when the number of hierarchies is n (n is a natural number greater than or equal to 2) or less, the backdoor score is higher than when the number of hierarchies is greater than n.(Supplementary Note 7) The program analysis device according to Supplementary Note 5 or 6, wherein the score calculation means calculates the backdoor score so that the backdoor score increases as the number of layers decreases. (Supplementary Note 8) The program analysis device according to any one of Supplements 5 to 7, wherein the flow length information includes the number of function nodes between a plurality of codes included in the analysis target process flow, and the score calculation means calculates the backdoor score based on the number of function nodes between a first code indicating an external input and a second code indicating a control dependency at a first layer from the first code. (Supplementary Note 9) The program analysis device according to any one of Supplements 5 to 8, wherein the flow length information includes the number of function nodes between a plurality of codes included in the analysis target process flow, and the score calculation means calculates the backdoor score based on the number of function nodes between a first code indicating a sensitive operation and a second code that has a control dependency on the first code and is closest to the first code. (Supplementary Note 10) The program analysis device according to any one of Supplementary Notes 5 to 9, wherein the flow length information includes the number of function nodes between a plurality of codes included in the analysis target process flow, and the score calculation means calculates the backdoor score based on the number of nodes in the function flow traversed between a first code indicating a sensitive operation and a second code that has control dependency on the first code and is closest to the first code. (Supplementary Note 11) The program analysis device according to any one of Supplementary Notes 1 to 10, wherein the starting point is a function that obtains an external input, and the ending point is a function that, when executed maliciously, can perform a sensitive operation on a system including the program. (Supplementary Note 12) A program analysis method comprising: acquiring flow length information indicating the length of an analysis target process flow that includes a sensitive operation, the analysis target process flow being defined by a predetermined starting point and a predetermined ending point in a program; and calculating a backdoor score that indicates the possibility that the analysis target process flow is a backdoor code, based on the flow length information.(Supplementary Note 13) The program analysis method according to Supplementary Note 12, further comprising: acquiring relationship information indicating the relationships between multiple codes included in the analysis target process flow; and generating construction information indicating how the analysis target process flow is constructed based on the relationship information; wherein acquiring the flow length information acquires the flow length information based on the construction information. (Supplementary Note 14) A non-transitory computer-readable medium storing a program that causes a computer to execute the following steps: acquiring flow length information indicating the length of an analysis target process flow that includes a sensitive operation defined by a predetermined start point and a predetermined end point in a program; and calculating a backdoor score indicating the possibility that the analysis target process flow is backdoor code based on the flow length information. (Supplementary Note 15) The non-transitory computer-readable medium according to Supplementary Note 14, further causing a computer to execute the following steps: acquiring relationship information indicating the relationships between multiple codes included in the analysis target process flow; and generating construction information indicating how the analysis target process flow is constructed based on the relationship information; wherein acquiring the flow length information acquires the flow length information based on the construction information.

[0163] 10, 1001 Program analysis device 11 Analysis unit 12 Construction information generation unit 13, 1003 Flow length acquisition unit 14, 1004 Score calculation unit 15 Output unit 19 Storage unit 52 Model 53 Report 51, 61, 91, 101, 111, 121, 131, 151, 161, 171 Sample code 81, 82 Code block 172 Function flow 191 Scoring policy A1 to A6 Nodes B1 to B6 Nodes C1 to C5 Nodes CF1 to CF3 Control flow CD Control dependency DD Data dependency EI External input P1 Entry point T1 Conditional branch 900 Computer 904 Processor 906 Memory 908 Storage device 910 Input / output interface 9120 Network interface

Claims

1. a flow length acquisition means for acquiring flow length information indicating the length of a processing flow to be analyzed, the processing flow including a sensitive operation, defined by a predetermined start point and a predetermined end point in a program; and a score calculation means for calculating a backdoor score indicating the possibility that the analysis target process flow is a backdoor code based on the flow length information. Program analysis device.

2. further comprising: a construction information generating means for acquiring relationship information indicating relationships between a plurality of codes included in the analysis target process flow, and generating construction information indicating how the analysis target process flow is constructed based on the relationship information; The flow length acquisition means acquires the flow length information based on the configuration information. The program analysis device according to claim 1 .

3. further comprising an analysis means for extracting the predetermined start point and end point from the program to identify the analysis target process flow, and acquiring the relationship information by analyzing the analysis target process flow; The construction information generating means generates the construction information based on the relationship information acquired by the analyzing means. The program analysis device according to claim 2 .

4. The analysis means acquires the relationship information by performing, as the analysis, at least one of a control flow analysis for obtaining control flow information indicating control dependencies between the plurality of codes and a data flow analysis for obtaining data flow information indicating data dependencies between the plurality of codes. The program analysis device according to claim 3 .

5. The score calculation means calculates the backdoor score according to a feature amount of the analysis target process flow, including the number of hierarchical levels indicated by the control dependency included in the analysis target process flow.

3. The program analysis device according to claim 1.

6. The score calculation means calculates the backdoor score so that when the number of layers is n (n is a natural number equal to or greater than 2), the backdoor score is higher than when the number of layers is greater than n.

6. The program analysis device according to claim 5.

7. The score calculation means calculates the backdoor score so that the backdoor score increases as the number of layers decreases.

6. The program analysis device according to claim 5.

8. the flow length information includes the number of function nodes between a plurality of codes included in the analysis target process flow, The score calculation means calculates the backdoor score based on the number of function nodes between a first code indicating an external input and a second code indicating a control dependency at a first level from the first code.

6. The program analysis device according to claim 5.

9. A computer comprising: In the program, flow length information indicating the length of a processing flow to be analyzed that includes a sensitive operation and is defined by a predetermined start point and a predetermined end point is obtained; A backdoor score indicating the possibility that the analysis target process flow is a backdoor code is calculated based on the flow length information. Program analysis methods.

10. A process of acquiring flow length information indicating the length of a process flow to be analyzed that includes a sensitive operation and is defined by a predetermined start point and a predetermined end point in a program; calculating a backdoor score indicating the possibility that the analysis target process flow is a backdoor code based on the flow length information; A program that causes a computer to execute the following.