Process flow visualization device, process flow visualization method, and process flow visualization program

Abstract

The present invention contributes to reducing the number of propagation paths for investigating vulnerability. This process flow visualization device comprises: a control path between a certain start point and an end point on a program; a path DB that stores propagation paths between two base points in the control path; a code DB which stores codes that retain a correspondence relationship with each element on the path DB; and a code display unit that acquires a relevant propagation path from the path DB with regard to a base point to focus on, and extracts, from the code DB, a portion of a code on the basis of the propagation path, and displays the portion of the code.

Description

Process flow visualization device, process flow visualization method, and process flow visualization program

[0001] The present invention relates to a process flow visualization device, a process flow visualization method, and a process flow visualization program.

[0002] As one of the countermeasures against supply chain risk, the detection of malicious functions in software known as backdoors is becoming increasingly important. Today's computer systems are so complex that it is difficult to construct them using only products from a single company. Therefore, it is common to procure products from outside and combine them to construct a system. In this case, it is assumed that the manufacturers and supply chains of the procured products are trustworthy. This is because detecting backdoors is also required as part of this.

[0003] However, detecting backdoors in software without source code requires a great deal of time and effort, as it requires reverse engineering, detailed analysis of suspicious functions and execution paths, and manual screening for backdoors. Therefore, for example, Patent Literature 1 proposes a technology that displays data dependence / control dependence propagation for each variable in a program as a graph structure or tree structure, and highlights and visualizes statements in the source code that correspond to selected variables.

[0004] Patent No. 5775829

[0005] The disclosures of the above-mentioned prior art documents are incorporated herein by reference. The following analysis has been carried out by the present inventors.

[0006] Although there are tools available to assist in backdoor detection, data dependence / control dependence propagation at the variable level in a program is complex, and the number of propagation paths between variables increases exponentially with their length, making it difficult to check all propagation paths. As a result, identifying the condition variables of control instructions that could trigger a backdoor takes a long time.

[0007] Therefore, it is necessary to visualize the processing flow of a program from the process that receives external input (src) to the process that seriously affects the system (sink) so that the risk (likelihood of it being a backdoor) can be easily investigated.The risk can be investigated by tracing the propagation of variables, that is, how the condition variables of the control commands that could be the triggers of a backdoor are calculated.

[0008] In view of the above-mentioned problems, an object of the present invention is to provide a process flow visualization device, a process flow visualization method, and a process flow visualization program that contribute to making it easier to investigate software.

[0009] In a first aspect of the present invention, there is provided a process flow visualization device comprising: a path DB that stores a control path between a start point and an end point on a program and a propagation path between two base points on the control path; a code DB that stores code that maintains a correspondence with each element on the path DB; and a code display unit that obtains from the path DB a propagation path associated with a base point of interest, and extracts and displays a portion of code from the code DB based on the propagation path.

[0010] In a second aspect of the present invention, there is provided a processing flow visualization method performed by an information processing device having a path DB that stores a control path between a start point and an end point on a program and a propagation path between two base points on the control path, a code DB that stores code that maintains a correspondence with each element on the path DB, and a code display unit, wherein the processing flow visualization method obtains a related propagation path from the path DB for a base point of interest, extracts a portion of code from the code DB based on the propagation path, and displays it on the code display unit.

[0011] In a third aspect of the present invention, there is provided a process flow visualization program executed by an information processing device including: a path DB storing a control path between a start point and an end point in a program and a propagation path between two base points on the control path; a code DB storing code that maintains correspondences with each element in the path DB; and a code display unit, the process flow visualization program causing the information processing device to perform the following processes: obtain a propagation path associated with a base point of interest from the path DB; and extract a portion of code from the code DB based on the propagation path and display it on the code display unit. This program can be recorded on a computer-readable storage medium. The storage medium can be a non-transient medium such as a semiconductor memory, a hard disk, a magnetic recording medium, or an optical recording medium. The present invention can also be embodied as a computer program product.

[0012] According to each aspect of the present invention, it is possible to provide a process flow visualization device, a process flow visualization method, and a process flow visualization program that contribute to making it possible to easily investigate software.

[0013] FIG. 1 is a schematic diagram of a flow visualization device according to an embodiment. FIG. 2 is a diagram illustrating a control path and a propagation path. FIG. 3 is a diagram illustrating control dependency propagation in a control path. FIG. 4 is a diagram illustrating data dependency propagation in a propagation path. FIG. 5 is a diagram illustrating an example of a list of base points for selecting a base point of interest. FIG. 6 is a diagram illustrating a procedure from selecting a base point of interest to displaying part of the code. FIG. 7 is a diagram illustrating a mechanism for reducing the number of paths to be investigated. FIG. 8 is a diagram illustrating an example of a hardware configuration of a flow visualization device used in an embodiment.

[0014] Hereinafter, embodiments of the present invention will be described with reference to the drawings. However, the present invention is not limited to the embodiments described below. In addition, the same or corresponding elements in each drawing are appropriately designated by the same reference numerals. Furthermore, it should be noted that the drawings are schematic, and the dimensional relationships and ratios of each element may differ from those in reality. There may also be parts in which the dimensional relationships and ratios differ between the drawings.

[0015] FIG. 1 is a schematic diagram of a flow visualization device according to an embodiment. As shown in FIG. 1, the flow visualization device 10 includes a path DB 11, a code DB 12, and a code display unit 13. The path DB 11 stores control paths between a start point and an end point in a program and propagation paths between two base points on the control paths. The code DB 12 stores code that maintains a correspondence with each element in the path DB. The code display unit 13 acquires a propagation path associated with a target base point from the path DB 11 and extracts and displays a portion of the code from the code DB 12 based on the propagation path. The code stored in the code DB 12 is preferably source code, but is not limited to source code. It may also be assembly-format code, intermediate code, bytecode, or the like.

[0016] Figure 2 is a diagram explaining control paths and propagation paths. As shown in Figure 2, a control path is a flow of control commands that connects a start point (src) and an end point (sink). The start point (src) is a process that receives external input, and the end point (sink) is a process that has a serious impact on the system. Therefore, in the flow of control commands that connects the start point (src) and the end point (sink), there is a risk that an unexpected control command could be a trigger that activates a backdoor.

[0017] On the other hand, as shown in Figure 2, a propagation path is a flow indicating the dependency relationship of variables between two base points in a control path. Here, the base points in a control path are the start point (src), the end point (sink), or the control instruction, so the propagation path between two base points in a control path corresponds to the propagation path between the start point (src) and the control instruction, between control instructions, and from the control instruction to the end point (sink). In the example of the control path shown in Figure 2, the propagation paths between the start point (src) and control instruction A, between control instruction A and control instruction B, between control instruction B and control instruction C, and from control instruction C to the end point (sink) are flows between two base points in the control path. The path DB 11 stores control paths indicating the dependency relationship of variables between a certain start point and end point in a program as shown in Figure 2, and the propagation paths between two base points in the control path.

[0018] Figure 3 is a diagram explaining control dependency propagation in a control path. As shown in Figure 3, control dependency propagation is propagation that transitions from a condition variable according to a truth value. The control path shown in Figure 2 is a flow that shows control dependency propagation in a control instruction that connects a start point (src) and an end point (sink).

[0019] FIG. 4 is a diagram explaining data dependency propagation in a propagation path. As shown in FIG. 4, variables in a propagation path have a data-dependent propagation relationship. In the example shown in FIG. 4, the variable "param1" and the variable "param2" of the operation "op1" have a relationship in which they propagate to the variable "param0", and the variable "param0" of the operation "op1" has a relationship in which they propagate to the variable "param1" of the operation "op3". The propagation path shown in FIG. 2 also forms a flow in which the data dependency propagation of variables connects the start point (src) and control instruction A, control instruction A and control instruction B, control instruction B and control instruction C, and from control instruction C to the end point (sink).

[0020] FIG. 5 is a diagram showing an example of a list of base points for selecting a base point of interest. A base point in a control path can be a start point (src), an end point (sink), or a control command, so the base point of interest can be considered to be the control command of interest. As already described, the code display unit 13 obtains a propagation path related to the base point of interest from the path DB 11, and extracts and displays a portion of the code from the code DB 12 based on the propagation path. The base point of interest can be specified by the user using an input device such as a keyboard. However, considering ease of operation, it is preferable to present a list such as that shown in FIG. 5 to the user and allow the user to select from the list.

[0021] FIG. 6 is a diagram showing the procedure from selecting a base point of interest to displaying a portion of the code. As already described, the code display unit 13 obtains a propagation path related to the base point of interest from the path DB 11, and extracts and displays a portion of the code from the code DB 12 based on the propagation path. The base point (control command) of interest is selected from the list, as described above. Next, the code display unit 13 obtains a control path related to the selected base point of interest (control command) from the path DB 11, and obtains the propagation path between the control path and the previous base point on that control path. The code display unit 13 then extracts and displays a portion of the code corresponding to the propagation path from the code DB 12. At this time, as shown in FIG. 6, the control command of interest and each variable on the propagation path are highlighted to assist in investigating whether the control command may be a backdoor trigger.

[0022] Furthermore, it is preferable that the code display unit 13 obtains direct dependencies of elements on the corresponding propagation path by selecting a variable in the code and highlights the corresponding element in the code. This is because by sequentially selecting variables of direct dependencies to be highlighted from the condition variable, it is possible to trace how the condition variable is calculated and efficiently investigate whether it is a backdoor trigger.

[0023] According to the flow visualization device 10 of the embodiment of the present invention, the number of paths to be investigated can be reduced by focusing on the dependency relationships between control instructions. FIG. 7 is a diagram illustrating a mechanism for reducing the number of paths to be investigated. As shown in FIG. 7, the dependency relationships between variables do not necessarily have a single path between control instructions, so the number of paths increases exponentially when viewed on a control instruction basis. On the other hand, when investigating by dividing the control instructions into sections, even if there are multiple paths between the control instructions, the paths are not traced across the control instructions, so the number of paths increases only linearly when viewed on a control instruction basis. As a result, the flow visualization device 10 of the embodiment of the present invention can reduce the number of paths to be investigated when detecting a backdoor.

[0024] (Hardware Configuration Example) Fig. 8 is a diagram showing an example of the hardware configuration of a flow visualization device used in the embodiment. That is, the flow visualization device 10 makes it possible to realize each function of the flow visualization device 10 by executing the above-described flow visualization method as a program on an information processing device (computer) 20 employing the hardware configuration shown in Fig. 8. However, the hardware configuration example shown in Fig. 8 is an example of a hardware configuration that realizes each function of the flow visualization device 10, and is not intended to limit the hardware configuration of the flow visualization device 10. The flow visualization device 10 may include hardware not shown in Fig. 8.

[0025] As shown in FIG. 8, the hardware configuration that can be adopted by the flow visualization device 10 includes a CPU (Central Processing Unit) 21, a main memory device 22, an auxiliary memory device 23, and an IF (Interface) unit 24, which are interconnected by, for example, an internal bus.

[0026] The CPU 21 executes each command included in the flow visualization program executed by the information processing device (computer) 20. The main storage device 22 is, for example, a RAM (Random Access Memory), and temporarily stores various programs, such as the process flow visualization program executed by the information processing device (computer) 20, for processing by the CPU 21.

[0027] The auxiliary storage device 23 is, for example, a hard disk drive (HDD), and is capable of storing, for the medium to long term, various programs such as the process flow visualization program executed by the information processing device (computer) 20. Various programs such as the process flow visualization program can be provided as program products recorded on a non-transitory computer-readable storage medium.

[0028] The IF unit 24 provides an interface related to input and output of the flow visualization device 10, for example.

[0029] The information processing device (computer) 20 employing the above-described hardware configuration implements each function of the flow visualization device 10 by executing the above-described flow visualization method as a program.

[0030] Some or all of the above embodiments can be described as, but are not limited to, the following supplementary notes. [Supplementary Note 1] A process flow visualization device comprising: a path DB that stores control paths between a start point and an end point on a program and propagation paths between two base points on the control paths; a code DB that stores code that maintains correspondences with each element in the path DB; and a code display unit that acquires a propagation path associated with a base point of interest from the path DB, and extracts and displays a portion of code from the code DB based on the propagation path. [Supplementary Note 2] The process flow visualization device according to Supplementary Note 1, wherein the code display unit acquires, from the path DB, a control path including the base point of interest and a propagation path between the previous base point on the control path, and acquires and displays partial code corresponding to the propagation path from the code DB. [Supplementary Note 3] The process flow visualization device according to Supplementary Note 1 or Supplementary Note 2, wherein the code display unit displays a list of base points for selecting the base point of interest. [Supplementary Note 4] The process flow visualization device according to any one of Supplementary Notes 1 to 3, wherein a base point in the control path is the start point, the end point, or a control instruction. [Supplementary Note 5] The process flow visualization device according to any one of Supplementary Notes 2 to 4, wherein the code display unit highlights variables in the partial code that depend on each variable on the propagation path. [Supplementary Note 6] The process flow visualization device according to Supplementary Note 5, wherein the code display unit obtains variables that depend on a variable selected in the partial code from the propagation path, and highlights them together with a part in the partial code that corresponds to a variable immediately before in the dependency relationship. [Supplementary Note 7] A process flow visualization method performed by an information processing device having a path DB that stores a control path between a start point and an end point on a program and a propagation path between two base points on the control path, a code DB that stores code that maintains a correspondence with each element on the path DB, and a code display unit, the process flow visualization method comprising: obtaining a propagation path related to a base point of interest from the path DB; and extracting a part of code from the code DB based on the propagation path and displaying it on the code display unit.[Supplementary Note 8] The process flow visualization method according to Supplementary Note 7, further comprising: retrieving from the path DB a control path including the base point of interest and a propagation path between the previous base point on the control path; retrieving from a code DB a partial code corresponding to the propagation path; and displaying the partial code on the code display unit. [Supplementary Note 9] A process flow visualization program executed by an information processing device having a path DB that stores a control path between a certain start point and an end point on a program and a propagation path between two base points on the control path, a code DB that stores code that maintains correspondence with each element on the path DB, and a code display unit, the process flow visualization program causing the information processing device to perform the following processes: retrieving from the path DB a propagation path related to the base point of interest; and extracting from the code DB a portion of code based on the propagation path and displaying the partial code on the code display unit. [Appendix 10] The processing flow visualization program according to Appendix 9, which causes the information processing device to perform a process of retrieving from the path DB a control path including the base point of interest and a propagation path between the base point immediately before the control path, and a process of retrieving from the code DB a partial code corresponding to the propagation path and displaying it on the code display unit.

[0031] The disclosures of the above-cited patent documents and other documents are incorporated herein by reference. Modifications and adjustments of the embodiments and examples are possible within the scope of the entire disclosure of the present invention (including the claims), and further based on the basic technical concepts thereof. Furthermore, various combinations and selections (including partial deletions) of various disclosed elements (including elements of each claim, each element of each embodiment or example, each element of each drawing, etc.) are possible within the scope of the entire disclosure of the present invention. In other words, the present invention naturally embraces various modifications and alterations that would be possible by a person skilled in the art in accordance with the entire disclosure and technical concepts, including the claims. In particular, with regard to the numerical ranges described herein, any numerical value or subrange within the range should be construed as specifically described, even if not otherwise specified. Furthermore, the disclosures of the above-cited documents, when used in part or in whole in combination with the disclosures herein as part of the disclosure of the present invention, in accordance with the spirit of the present invention, are also deemed to be included in the disclosures of this application.

[0032] REFERENCE SIGNS LIST 10 Flow visualization device 11 Route DB 12 Code DB 13 Code display unit 20 Information processing device 21 CPU 22 Main storage device 23 Auxiliary storage device 23 IF unit

Claims

1. a path DB that stores a control path between a start point and an end point on a program and a propagation path between two base points on the control path; a code DB that stores codes that maintain correspondences with each element on the route DB; a code display unit that acquires a propagation path related to a base point of interest from the path DB, and extracts and displays a part of a code from the code DB based on the propagation path; A process flow visualization device comprising:

2. the code display unit acquires from the path DB a control path including the target base point and a propagation path between the target base point and the previous base point on the control path, and acquires from the code DB a partial code corresponding to the propagation path and displays the partial code. The process flow visualization device according to claim 1 .

3. the code display unit displays a list of base points for selecting the base point of interest.

3. The process flow visualization device according to claim 1.

4. 3. The process flow visualization device according to claim 1, wherein the base point in the control path is the start point, the end point, or a control command.

5. The process flow visualization device according to claim 2 , wherein the code display unit highlights variables of the partial code that depend on each variable on the propagation path.

6. 6. The process flow visualization device according to claim 5, wherein the code display unit obtains variables that depend on the variable selected in the partial code from the propagation path and highlights the variables together with a part of the partial code that corresponds to the variable immediately before the variable in the dependency relationship.

7. A process flow visualization method performed by an information processing device including: a path DB that stores a control path between a start point and an end point on a program and a propagation path between two base points on the control path; a code DB that stores codes that hold correspondences with each element on the path DB; and a code display unit, The information processing device acquires a related propagation route from the route DB for the base point of interest; The processing flow visualization method includes the information processing device extracting a part of the code from the code DB based on the propagation path and displaying the part of the code on the code display unit.

8. 8. The process flow visualization method according to claim 7, further comprising: obtaining from the path DB a control path including the base point of interest and a propagation path between the base point immediately preceding the control path; obtaining from the code DB a partial code corresponding to the propagation path; and displaying the partial code in the code display section.

9. A process flow visualization program executed by an information processing device including: a path DB that stores a control path between a start point and an end point on a program and a propagation path between two base points on the control path; a code DB that stores codes that hold correspondences with each element on the path DB; and a code display unit, A process of acquiring a propagation route related to a base point of interest from the route DB; and extracting a part of the code from the code DB based on the propagation path and displaying the part of the code on the code display unit.

10. 10. The processing flow visualization program according to claim 9, wherein the information processing device is caused to perform a process of retrieving from the path DB a control path including the base point of interest and a propagation path between the base point immediately before the control path, and a process of retrieving from the code DB a partial code corresponding to the propagation path and displaying it on the code display unit.