Learning method for detecting cryptographic api misuse and computing apparatus for performing the same

Abstract

A learning method for detecting cryptographic API misuse performed by a computing device according to one embodiment comprises: a step of decompiling an application package file to generate source code; a step of detecting code lines in which a cryptographic API is used in the generated source code; a step of performing code slicing on the detected code lines to extract only the code parts related to the cryptographic API; a step of simplifying the structure of the extracted code parts related to the cryptographic API by removing or generalizing at least one of user-defined functions, variables, and comments; and a step of learning using the result with the simplified structure so that an artificial neural network model can detect cryptographic API misuse patterns.

Description

Technology Field

[0001] The present invention relates to the detection of cryptographic API (application programming interface) misuse, and more specifically, to a method for learning cryptographic API misuse patterns and a computing device for performing the same. Background Technology

[0002] As is well known, cryptographic APIs are tools that help developers implement secure software by simplifying the complex implementation of encryption algorithms. However, cryptographic APIs are highly susceptible to misuse. One study indicates that approximately 88% of Android applications contain instances of improper use of cryptographic APIs. To address this issue, tools such as CryptoGuard, CogniCrypt, and SpotBugs have been developed. However, these tools have several drawbacks: they rely on fixed rules, failing to detect small code variations or new patterns; they exhibit high false positive and false negative rates in code where rules are not applied; and they are costly to maintain because rules must be updated whenever a new vulnerability is discovered. Prior art literature

[0003] https: / / doi.org / 10.1109 / SecDev.2019.00017, Sharmin Afrose and others, CryptoAPI-Bench: A Comprehensive Benchmark on Java Cryptographic API Misuses, 2019.09.23. The problem to be solved

[0004] According to one embodiment, a learning method for detecting cryptographic API misuse and a computing device for performing the same are provided, wherein a code portion related to a cryptographic API is extracted from source code generated by decompiling an application package file, the structure is simplified, and then an artificial neural network model learns.

[0005] The problems to be solved by the present invention are not limited to those mentioned above, and other problems not mentioned will be clearly understood by those skilled in the art to which the present invention pertains from the description below. means of solving the problem

[0006] A learning method for detecting cryptographic API misuse performed by a computing device according to the first aspect comprises: a step of decompiling an application package file to generate source code; a step of detecting code lines in which a cryptographic API is used in the generated source code; a step of performing code slicing on the detected code lines to extract only the code parts related to the cryptographic API; a step of simplifying the structure of the extracted code parts related to the cryptographic API by removing or generalizing at least one of user-defined functions, variables, and comments; and a step of training using the result with the simplified structure so that an artificial neural network model can detect cryptographic API misuse patterns.

[0007] A computing device according to the second aspect comprises: a memory unit storing at least one instruction; and a processor unit; wherein the processor unit performs a learning method for detecting cryptographic API misuse by executing the at least one instruction, and the learning method for detecting cryptographic API misuse comprises: a step of decompiling an application package file to generate source code; a step of detecting code lines in which a cryptographic API is used in the generated source code; a step of performing code slicing on the detected code lines to extract only the code parts related to the cryptographic API; a step of simplifying the structure of the extracted code parts related to the cryptographic API by removing or generalizing at least one of user-defined functions, variables, and comments; and a step of learning using the result with the simplified structure so that an artificial neural network model can detect cryptographic API misuse patterns.

[0008] The computer program on the computer-readable recording medium, on which the computer program according to the third aspect is stored, includes instructions for causing the processor to perform a learning method for detecting misuse of the encryption API when executed by the processor.

[0009] The computer program stored on a computer-readable recording medium according to the fourth aspect includes instructions for the processor to perform a learning method for detecting misuse of the encryption API when executed by the processor. Effects of the invention

[0010] According to one embodiment, the limitations of rule-based detection tools are overcome to improve the accuracy of detecting cryptographic API misuse, and stable high detection performance is maintained even in modified code. According to an embodiment, when utilizing a large dataset and a large language model (LLM), it is possible to flexibly respond to new vulnerability patterns. Brief explanation of the drawing

[0011] FIG. 1 is a configuration diagram of a computing device for performing a learning method for detecting encryption API misuse according to an embodiment of the present invention. FIG. 2 is a conceptual flowchart illustrating a learning method for detecting encryption API misuse according to an embodiment of the present invention. Specific details for implementing the invention

[0012] The advantages and features of the present invention and the methods for achieving them will become clear by referring to the embodiments described below in conjunction with the accompanying drawings. However, the present invention is not limited to the embodiments disclosed below but may be implemented in various different forms. These embodiments are provided merely to ensure that the disclosure of the present invention is complete and to fully inform those skilled in the art of the scope of the invention, and the present invention is defined only by the scope of the claims.

[0013] The terms used in this specification will be briefly explained, and the invention will be described in detail.

[0014] The terms used in this invention have been selected based on currently widely used general terms, taking into account their functions within the invention; however, these terms may vary depending on the intent of those skilled in the art, case law, the emergence of new technologies, etc. Additionally, in specific cases, terms have been arbitrarily selected by the applicant, and in such cases, their meanings will be described in detail in the relevant description of the invention. Therefore, the terms used in this invention should be defined not merely by their names, but based on their meanings and the overall content of the invention.

[0015] When a part of a specification is described as 'comprising' a certain component, this means that, unless specifically stated otherwise, it does not exclude other components but may include additional components.

[0016] Additionally, the term "part" as used in the specification refers to software or hardware components, such as FPGAs or ASICs, and the "part" performs certain roles. However, the meaning of "part" is not limited to software or hardware. The "part" may be configured to reside in an addressable storage medium or configured to run one or more processors. Thus, by example, the "part" includes components such as software components, object-oriented software components, class components, and task components, as well as processes, functions, attributes, procedures, subroutines, segments of program code, drivers, firmware, microcode, circuits, data, databases, data structures, tables, arrays, and variables. The functions provided within the components and "parts" may be combined into a smaller number of components and "parts" or further separated into additional components and "parts."

[0017] Below, embodiments of the present invention are described in detail with reference to the attached drawings so that those skilled in the art can easily implement the invention. Additionally, parts of the drawings that are irrelevant to the description are omitted to clearly explain the invention.

[0018] FIG. 1 is a configuration diagram of a computing device for performing a learning method for detecting encryption API misuse according to an embodiment of the present invention.

[0019] Referring to FIG. 1, a computing device (100) for performing a learning method for detecting encryption API misuse includes a memory unit (110) and a processor unit (120), and may further include an input unit (130) and / or an output unit (140).

[0020] The input unit (130) provides the application package file, which is the target of encryption API misuse detection, to the processor unit (120) when input. Alternatively, the application package file, which is the target of encryption API misuse detection, may be stored in the memory unit (110).

[0021] A computer program (111) containing at least one instruction is stored in the memory unit (110). For example, various information necessary for the execution of the computer program (111) containing the instruction may be further stored in the memory unit (110). When the processor unit (120) executes at least one instruction, the processor unit (120) may execute a learning method for detecting misuse of an encryption API according to an embodiment of the present invention.

[0022] The processor unit (120) can execute at least one instruction stored in the memory unit (110) to execute a learning method for detecting encryption API misuse according to an embodiment of the present invention. The processor unit (120) decompiles an application package file to generate source code, detects code lines in which encryption APIs are used in the generated source code, performs code slicing on the detected code lines to extract only the code parts related to encryption APIs, simplifies the structure of the extracted code parts related to encryption APIs by removing or generalizing at least one of user-defined functions, variables, and comments, and learns using the result with the simplified structure so that an artificial neural network model can detect encryption API misuse patterns.

[0023] Here, when generating source code, the processor unit (120) can generate Java source code through decompilation using a Jadx tool. Also, when detecting code lines, the processor unit (120) can detect code lines by setting slicing criteria for the decompiled code. Also, when detecting code lines, the processor unit (120) can extract crypto lines through the slicing criteria. Also, when extracting only the code parts related to encryption APIs, the processor unit (120) can slice the code using a control flow graph (CFG) and a data flow graph (DFG). Also, when simplifying the structure, the processor unit (120) can perform this using an abstract syntax tree (AST).

[0024] Such a processor (120) may be composed of one or more processors. For example, one or more processors may be a general-purpose processor such as a CPU (central process unit) or DSP (digital signal processor), a graphics-dedicated processor such as a GPU (graphic process unit) or VPU (vision process unit), or an artificial intelligence-dedicated processor such as an NPU (neural process unit).

[0025] The output unit (140) can be used to learn encryption API misuse patterns by outputting the result of the learning method performed by the processor unit (120) for detecting encryption API misuse, under the control of the processor unit (120). Here, output by the output unit (140) may include outputting to a peripheral device through a data interface, etc., or transmitting to the outside through a communication channel.

[0026] Hereinafter, with reference to FIGS. 1 and FIGS. 2, we will examine the process of a computing device learning an encryption API misuse pattern according to an embodiment of the present invention.

[0027] First, an application package file that is the target of encryption API misuse detection can be input through the input unit (130), and the input unit (130) provides the input application package file to the processor unit (120). At this time, the processor unit (120) may be in a state where it has loaded the computer program (111) by executing instructions included in the computer program (111) stored in the memory unit (110), and thereby may be in a state where it can perform the encryption API misuse pattern learning method according to one embodiment of the present invention.

[0028] Then, the processor unit (120) decompiles (S201) the application package file that is the target of encryption API misuse detection to generate source code to be analyzed. Alternatively, the application package file that is the target of encryption API misuse detection may be stored in the memory unit (110), and in this case, the processor unit (120) can load and decompile the application package file that was stored in the memory unit (110). For example, the processor unit (120) can use the Jadx tool to decompile the application package file and generate Java source code.

[0029] Next, the processor unit (120) sets slicing criteria to identify code using cryptographic APIs in the decompiled code (S203). This may include lines of cryptographic API calls such as Cipher.getInstance. Regular expressions can be used to detect lines of code containing specified API calls. For example, crypto lines using cryptographic APIs can be extracted from the decompiled code through predefined slicing criteria.

[0030] Then, the processor unit (120) extracts only the code parts directly related to the encryption API by slicing the code (S205) through a control flow graph (CFG) and a data flow graph (DFG) that can identify the dependencies between the structure of the code and the data. This process can be carried out focusing on parameters of interest, and finally, only the necessary API-related code lines can be collected to generate a core code snippet.

[0031] Next, the processor unit (120) removes unnecessary code by removing or generalizing user-defined functions, variables, comments, etc. through an abstract syntax tree (AST) to increase the efficiency of code analysis (S207). For example, user-defined functions can be replaced with names such as FUNi and variables with names such as VARi, thereby simplifying the structure of the code while maintaining its essential meaning.

[0032] The code snippet generated by the processor unit (120) in this way can be used for training to enable an artificial neural network model (e.g., LLM, etc.) to perform binary classification tasks in order to learn encryption API misuse patterns. For example, the processor unit (120) can train the encryption API misuse pattern on the artificial neural network model stored in the memory unit (110) (S209). Alternatively, the processor unit (120) can control the output unit (140) to output the code snippet generated in step S so that it can be used for learning encryption API misuse patterns. Here, output by the output unit (140) may include outputting to a peripheral device through a data interface, etc., or transmitting to the outside through a communication channel.

[0033] An artificial neural network model trained on such encryption API misuse patterns can detect encryption API misuse in an application package file when the file to be diagnosed is input. In other words, it can determine whether the code files within the application package are secure or contain vulnerabilities.

[0034] As described above, according to one embodiment of the present invention, the limitations of rule-based detection tools are overcome to improve the accuracy of detecting cryptographic API misuse, and stable high detection performance is maintained even in modified code. According to the embodiment, when utilizing a large dataset and a large-scale language model (LLM), it is possible to flexibly respond to new vulnerability patterns. According to the embodiment, an f1 score of 0.935 was recorded on the benchmark dataset (CryptoAPI-Bench), and an f1 score of 0.898 was recorded for an actual Android app. For modified code, an f1 score of 0.989 was recorded by training with augmented data. Through this, improved effectiveness and robustness were demonstrated compared to existing tools.

[0035] Meanwhile, each step included in the learning method for detecting misuse of encryption API according to the above-described embodiment may be implemented as a computer program recorded on a recording medium, including instructions for a processor to perform such steps.

[0036] Combinations of each step of each flowchart attached to the present invention may be performed by computer program instructions. Since these computer program instructions may be loaded into the processor of a general-purpose computer, a computer for special purposes, or other programmable data processing equipment, the instructions performed through the processor of the computer or other programmable data processing equipment create means for performing the functions described in each step of the flowchart. Since these computer program instructions may also be stored in a computer-available or computer-readable recording medium that can be oriented toward the computer or other programmable data processing equipment to implement the function in a specific manner, the instructions stored in the computer-available or computer-readable recording medium may also produce a manufactured item containing instruction means for performing the function described in each step of the flowchart. Since computer program instructions can be loaded onto a computer or other programmable data processing equipment, instructions that execute a computer or other programmable data processing equipment by performing a series of operation steps on the computer or other programmable data processing equipment to create a process executed by the computer can also provide steps for executing the functions described in each step of the flowchart.

[0037] Additionally, each step may represent a module, segment, or part of code containing one or more executable instructions for executing a specified logical function(s). Also, it should be noted that in some alternative embodiments, the functions mentioned in the steps may occur out of order. For example, two steps described in succession may actually be performed substantially simultaneously, or the steps may sometimes be performed in reverse order according to the corresponding function.

[0038] The above description is merely an illustrative explanation of the technical concept of the present invention, and those skilled in the art to which the present invention pertains will be able to make various modifications and variations within the scope of the essential quality of the present invention. Accordingly, the embodiments disclosed in the present invention are intended to explain, not limit, the technical concept of the present invention, and the scope of the technical concept of the present invention is not limited by such embodiments. The scope of protection of the present invention shall be interpreted by the claims below, and all technical concepts within the equivalent scope shall be interpreted as being included within the scope of rights of the present invention. Explanation of the symbols

[0039] 100: Computing device 110: Memory section 120: Processor 130: Input section 140: Output section

Claims

Claim 1 A learning method for detecting cryptographic API misuse performed by a computing device, comprising: a step of decompiling an application package file to generate source code; a step of detecting code lines in which a cryptographic API is used in the generated source code; a step of performing code slicing on the detected code lines to extract only the code parts related to the cryptographic API; a step of simplifying the structure of the extracted code parts related to the cryptographic API by removing or generalizing at least one of user-defined functions, variables, and comments; and a step of training an artificial neural network model using the result with the simplified structure so that the model can detect cryptographic API misuse patterns. Claim 2 In claim 1, the step of generating the source code is a learning method for detecting cryptographic API misuse, which generates Java source code through decompilation using a Jadx tool. Claim 3 In claim 1, the step of detecting the code line is a learning method for detecting encryption API misuse, wherein slicing criteria are set for the decompiled code to detect the code line. Claim 4 A learning method for detecting cryptographic API misuse according to claim 3, wherein, when detecting the code line, a crypto line is extracted through the slicing criterion. Claim 5 In claim 1, the step of extracting only the code portion related to the encryption API is a learning method for detecting encryption API misuse that slices the code through a control flow graph (CFG) and a data flow graph (DFG). Claim 6 In claim 1, the step of simplifying the structure is a learning method for detecting cryptographic API misuse performed through an abstract syntax tree (AST). Claim 7 A computing device comprising: a memory unit storing at least one instruction; and a processor unit; wherein the processor unit performs a learning method for detecting encryption API misuse by executing the at least one instruction, and the learning method for detecting encryption API misuse comprises: a step of decompiling an application package file to generate source code; a step of detecting code lines in which an encryption API is used in the generated source code; a step of performing code slicing on the detected code lines to extract only the code parts related to the encryption API; a step of simplifying the structure of the extracted code parts related to the encryption API by removing or generalizing at least one of user-defined functions, variables, and comments; and a step of training using the result with the simplified structure so that an artificial neural network model can detect encryption API misuse patterns. Claim 8 In claim 7, the step of generating the source code is a computing device that generates Java source code through decompilation using a Jadx tool. Claim 9 In claim 7, the step of detecting the code line is a computing device that detects the code line by setting a slicing criterion for the decompiled code. Claim 10 In claim 9, a computing device that extracts a crypto line through the slicing criterion when detecting the code line. Claim 11 In claim 7, the step of extracting only the code portion related to the encryption API is a computing device that slices the code through CFG and DFG. Claim 12 In claim 7, the step of simplifying the above structure is performed by a computing device through an AST. Claim 13 A computer-readable recording medium having a computer program stored therein, wherein the computer program, when executed by a processor, comprises instructions for the processor to perform a method including: decompiling an application package file to generate source code; detecting code lines in which an encryption API is used in the generated source code; performing code slicing on the detected code lines to extract only the code portion related to the encryption API; simplifying the structure of the extracted code portion related to the encryption API by removing or generalizing at least one of user-defined functions, variables, and comments; and training an artificial neural network model using the result with the simplified structure so that the model can detect patterns of misuse of the encryption API. Claim 14 A computer program stored on a computer-readable recording medium, comprising instructions for the processor to perform a method comprising: a step of decompiling an application package file to generate source code when executed by a processor; a step of detecting code lines in which an encryption API is used in the generated source code; a step of performing code slicing on the detected code lines to extract only the code portion related to the encryption API; a step of simplifying the structure of the extracted code portion related to the encryption API by removing or generalizing at least one of user-defined functions, variables, and comments; and a step of training an artificial neural network model using the result with the simplified structure so that the model can detect patterns of misuse of the encryption API.

Images