164 results about "Program analysis" patented technology

The invention provides a Web application-based slow denial of service attack path acquisition method and device and a medium. The method comprises the following steps of: constructing a program analysis chart of a target Web application program; extracting all program execution paths from an entry node to an exit node based on the graph; calculating the weight of the path by analyzing the key characteristics of the path, and screening candidate paths of which the weight is higher than a threshold value; and further through path state value evaluation, data flow continuity detection and type compatibility detection, finally determining a target path which may have a slow denial of service attack risk. According to the method, a potential attack path is efficiently identified through a static analysis technology, accurate positioning is provided for Web application security protection, and the risk that a system is attacked is reduced.

The present invention discloses a program static analysis method and system based on LLVM, belonging to the technical field of computer program analysis. The technical problem to be solved is that the existing program analysis technologies have low accuracy, low efficiency and limited application scope in estimating program performance characteristics and memory reuse distance distribution. The method includes: converting a source file into an LLVM IR file with source-level debugging information; traversing modules, functions, basic blocks and instructions in the LLVM IR file to obtain static trace information of a target function; constructing a basic block-level control flow graph of the LLVM IR file and annotating relevant information; identifying and annotating loop information when traversing paths to obtain an execution path with loop annotations, replacing basic blocks in the execution path with corresponding memory access information, and generating a static memory trace with loop annotations; calculating the memory access reuse distance distribution through a recursive algorithm based on the static memory trace with loop annotations.

The present disclosure discloses a master pattern generation method which is a major pattern in a repeated cycle by analyzing programmable logic controller (PLC) logic, and a method for training a model that may analyze an error of a cycle using the generated master pattern.The master pattern generation method and the training method for a cycle analysis model according to the present disclosure are different from the related art in that the methods are a technology of processing a machine control language (low-level language) that is difficult for humans to analyze and converting the machine control language into an analyzable language (high-level language), i.e., a machine language processing (MLP)-based technology that analyzes the executed machine language (a language that controls a machine) with a computer and can be understood by humans.

The invention discloses an intelligent contract vulnerability detection method and system based on semantic comprehension and program path analysis, and belongs to the technical field of network security. The method comprises the following steps: firstly, analyzing an intelligent contract code by using a large language model, and reasoning to generate a structured security rule for defining a taint source, a taint sink and a purifier; secondly, guiding a taint analysis engine by using a security rule, and tracking on a data flow and a control flow diagram of a program so as to efficiently screen out a high-risk taint path; then, carrying out reachability verification on the high-risk path by adopting a symbolic execution technology; and finally, performing final context review on the verified vulnerability path by using the large language model again to generate a vulnerability report. According to the method, the semantic comprehension ability of the large language model and the preciseness of traditional program analysis are subjected to multi-stage cooperation, so that the detection precision and efficiency of the intelligent contract logic vulnerability can be remarkably improved, the interpretability of a report result is greatly enhanced, and the method has important application value.

The invention discloses an intelligent detection method for network security vulnerabilities, and relates to the technical field of network security vulnerability detection, and the method comprises the following steps: analyzing source codes to construct an abstract syntax tree, a control flow graph and a call graph, identifying sensitive operation points based on a rule base, and screening hotspot functions in combination with code indexes and the call graph; extracting a candidate path from a program entry to a sensitive operation point, encoding to generate a path context snapshot, and scoring through a pre-training model; selecting a high-risk path to execute sparse symbolic execution, simplifying constraints by using variable interval information, and dynamically feeding back and adjusting scores; poC input verification is generated for the path triggering the vulnerability constraint, a report containing the path constraint, the triggering condition and the PoC is output, program analysis and machine learning are combined, the vulnerability detection efficiency and precision are improved, and the method is suitable for code security analysis of scenes such as an embedded system.

The invention provides a binary code similarity detection method and system based on multi-modal feature fusion, and belongs to the technical field of network security. According to the method, a program analysis method is utilized, disassembling codes are extracted from a binary file to serve as text sequence features, and a control flow graph is extracted to serve as topological graph structure features; aiming at two different modes of text sequence features and topological graph structure features, respectively using different representation models to carry out embedding representation; carrying out fusion processing on the embedded representation vectors of different modals by using a multi-modal fusion representation model, and generating a fused embedded representation vector; and based on the fused embedded representation vector, detecting the similarity degree in combination with a vector distance calculation formula, and completing similarity detection according to a preset threshold. According to the invention, the problems of low detection accuracy and weak detection scene generalization ability caused by incomplete use of the feature level of the binary code similarity detection method are solved.

In variants, the method can include generating mapping model training data, determining the mapping model, and predicting a program based on a transformer. The method can optionally include evaluating the mapping model, running analyses on the program, and / or utilizing the program and / or generated program analyses. The method functions to convert transformer models into programs that can be characterized and / or analyzed using program analysis techniques.

A route change device according to the present disclosure comprises: a program analysis unit that sequentially reads blocks from a control program and analyzes commands by the blocks; a curve formation determination unit that, when two consecutive movement commands include an arc command, detects a reference value related to curve formation in each of the movement commands, and determines, on the basis of the reference value, whether a connecting portion of the route related to the movement commands needs to be curved; and a curve formation processing unit that determines a curve formation parameter on the basis of the reference value related to the curve for the route in which curve formation is needed, and curves the route on the basis of the determined curve formation parameter, wherein the curve formation parameter determined by the curve processing unit is the same value or increases when the reference value increases.

The invention relates to a program analysis method and device, electronic equipment, a storage medium and a computer program product, and the method comprises the steps that before a target program runs, a sampling buffer area is allocated to the target program, and the sampling buffer area comprises sampling buffer partitions allocated for each instruction in the target program; when any sampling moment is reached in the running process of the target program, instruction counter sampling is carried out, a sampling instruction of this time is determined, and a sampling counter in a target sampling buffer partition corresponding to the sampling instruction of this time is updated through atomic operation; after the operation of the target program is finished, determining the total sampling frequency of each instruction in the target program according to the sampling buffer area; and according to the total sampling frequency of each instruction in the target program, performing performance analysis on the target program to obtain a performance analysis result. According to the embodiment of the invention, the operation of the target program is not influenced under the condition that the sampling precision is ensured, and the performance analysis of the target program is effectively realized.

The invention discloses a dependency visualization method and device and a storage medium, and relates to the technical field of program analysis, and the method comprises the steps: obtaining and analyzing a metadata file, constructing a business element mapping relation based on the association between a code element and a use case as well as extension, then traversing all class files through a class reader, a method calling instruction list is generated based on the method calling information obtained through traversal and the business element mapping relation, and the method calling instruction list comprises a caller, a callee, a calling type and business target information; then, on the basis of the method calling instruction list, the method, the use case and the extension serve as nodes, the calling relation serves as an edge, and a graph data structure is constructed; and outputting the interactive dependency graph based on the graph data structure. According to the method, the technical effect of visually displaying the dependency relationship between the methods can be achieved.

This invention provides a privacy protection method and system for preventing misbehavior in mini-programs based on deep learning. It utilizes the collaborative efforts of deep learning and program analysis techniques to detect inconsistencies between the expected and actual behavior of mini-programs. This invention provides a novel mini-program analysis technique that associates UI information of widgets with corresponding program behaviors and determines the actual behavior of widgets based on program analysis, thereby enabling the construction of large-scale, high-quality training datasets. Based on the results of program analysis, deep learning techniques are used to learn an icon-behavior model from unstructured datasets to infer the expected behavior of widgets. This invention uses a defined three-layer standard model to detect differences between actual and expected behavior by calculating outlier scores. If any inconsistency is found, it indicates the presence of a misbehaving mini-program. The risk level of the inappropriate behavior can then be estimated, and countermeasures can be proactively implemented.

A method for machine program analysis, preferably including determining data for a set of programs and determining relationships between the set of programs, and optionally including determining an analysis based on the program relationships, acting based on analyses, and / or operating manufacturing system machines. A system for machine program analysis, preferably including one or more computing systems, and optionally including one or more manufacturing systems.

The invention relates to the technical field of computers, in particular to a metamorphic relation identification method based on program dependency graph features. The method comprises the following steps: obtaining a control flow graph (CFG) of a target program, and obtaining a control dependency graph according to the control flow graph and a forward dominating tree; obtaining a program dependency graph according to the control dependency graph and the data dependency relationship; according to a program analysis requirement slicing criterion C = (N, V) of a target program, graph traversal is conducted on the program dependency graph, program slicing features are obtained, N represents instructions in the target program, and V represents a variable set; and inputting the program slice features into a target prediction model for identification, and obtaining a prediction result corresponding to the metamorphic relationship of the target program. By the adoption of the method and device, the metamorphic relation obtaining accuracy can be improved, the situation that the metamorphic relation cannot be obtained is reduced, program testing convenience can be improved, and software quality is improved.

The invention relates to the technical field of numerical control programming, and provides a numerical control program analysis method and device. The method comprises the following steps: mapping a first numerical control program into a second numerical control program according to instruction conversion information; simulating the second numerical control program to obtain an original simulated processing track; performing parameter-level optimization and / or interaction-level optimization on the original simulation processing track to obtain an optimized simulation processing track, and visualizing the original simulation processing track and the optimized simulation processing track; wherein the instruction conversion information represents a corresponding relation between the first numerical control program and the second numerical control program; the parameter level optimization comprises at least one of arc-to-small line segment conversion, fine smoothing, coarse smoothing and local point processing; interaction level optimization includes at least one of zoom, rotation, and translation. According to the numerical control program analysis method and device provided by the invention, the numerical control program programming and simulation efficiency and accuracy can be improved.

The invention relates to the technical field of program analysis, in particular to a method, a system and equipment for solving a context-independent grammar accessibility problem between program processes and a storage medium. The method comprises the following steps: constructing a hypergraph corresponding to a to-be-solved program, and solving a fact propagation abstract between each pair of function call points and function call return points in the hypergraph to obtain a fact propagation abstract set; edges between function entrances and function calling points of all function bodies in the hypergraph are not reserved, and all fact propagation abstracts in a fact propagation abstract set are added to obtain an air conditioner stack layer; edges between function outlets of all function bodies in the hypergraph and function call return points are not reserved, all fact propagation abstracts in a fact propagation abstract set are added, and a non-air-conditioning stack layer is obtained; and connecting the air-conditioning stack function calling point with the non-air-conditioning stack function inlet to obtain a feasible path diagram. By the adoption of the scheme, accurate solving of the reachability problem of the context-independent grammar between the program processes can be achieved.

The application relates to the technical field of binary program analysis and rewriting, and discloses an immediate number symbolization judgment method and system of a binary rewriting program, which comprises a preprocessing step, a basic evidence analysis step, an intermediate evidence analysis step, a high-level evidence analysis step and a fusion decision step. The preprocessing layer carries out structural analysis and semantic modeling on a binary file, extracts candidate immediate numbers and meta information, the basic evidence layer carries out preliminary weighting based on explicit rules, the intermediate evidence layer carries out quantitative evaluation through heuristics and statistical patterns, the high-level evidence layer carries out high-precision analysis on the immediate numbers with semantic ambiguity, the fusion decision layer summarizes the evidences at all levels, forms a comprehensive tendency value through weighted calculation, classifies the immediate numbers, and generates a final symbolization strategy. The application significantly improves the accuracy and interpretability of symbolization judgment, balances the analysis precision and processing efficiency, and is suitable for binary files of different compilers, platforms and file stripping states.

The invention discloses a Java program analysis-oriented intermediate representation construction method, which comprises the following steps of: performing single assignment form conversion on a Java bytecode to be processed to obtain a single assignment Java bytecode, and constructing a typeless intermediate representation through an abstract interpretation translation algorithm based on the single assignment Java bytecode. Constructing a type constraint and a type constraint graph by using the typeless intermediate representation based on a Java type check rule, and solving the type constraint graph by using a pruned lattice algorithm to obtain a typeless intermediate representation; according to the method, a common byte code mode is well utilized through single assignment transformation and a pruning-based lattice algorithm. Java byte codes based on a stack type virtual machine are converted into typeless three-address code intermediate representation based on a register virtual machine based on abstract interpretation, and generation of redundant statements is avoided as much as possible. And a pruning lattice algorithm is adopted, so that the type of an unknown type variable can be accurately and quickly determined, and a type reasoning result is ensured to be safe.

Numerical control device capable of providing an interface that performs safe task control for adding an original function, wherein the numerical control device comprises: - a memory management unit that is set up to develop or initialize a program executed by a task in memory, analyze the program, and gather information about the program, - an execution time calculation unit that is set up to calculate an execution time of the task, - an execution condition setting unit configured to set an execution condition of the task based on the execution results of the memory management unit and the execution time calculation unit, - a task monitoring unit that is configured to monitor the state of a computing unit and to determine the computing unit to which the task is assigned, and - a task control unit that is configured to register and start the task in the assigned computing unit based on the execution condition.

The invention discloses a DSP architecture-oriented worst run time program analysis method and system, and belongs to the technical field of binary program static analysis. The method comprises the following steps: generating a control flow diagram of a target program; according to the control flow diagram, an LASW loop structure in a target program is extracted, and the upper bound of the minimum number of cycles of the LASW loop structure is calculated; and based on the control flow diagram and the minimum cycle index upper bound, carrying out worst running time analysis on the target program to obtain a worst running time analysis result of the target program. According to the method, the accuracy and the automation degree of worst running time analysis can be improved.

This disclosure provides a program analysis method, apparatus, and electronic device, relating to the field of computer technology, and particularly to the field of computer software technology. The specific implementation scheme is as follows: Obtaining the abstract syntax tree (AST) corresponding to the program file to be analyzed; searching the AST based on the preset feature codes to determine a first code file containing the preset feature codes, wherein the preset feature codes identify the execution process of the program file to be analyzed; counting the number of preset feature codes contained in the first code file and the number of sub-preset feature codes of the preset feature codes to obtain a first statistical result, wherein the sub-preset feature codes are sub-codes containing the preset feature codes; displaying the first statistical result. This demonstrates the reliability of the program file to be analyzed, enabling developers to more accurately determine whether the program file to be analyzed is reliable.

The invention discloses a malicious software escape behavior detection method based on a high-order function and dependency algebra, and relates to the technical field of functional programming and program analysis. The method comprises the steps that source codes of the escape failure malicious software are received, dependency relationships among functions in the source codes are analyzed on the basis of the dependency algebraic theory, a related set is constructed, and the dependency relationships comprise data dependency, control dependency and parameter dependency; and constructing a function abstract by utilizing a high-order function so as to formally represent the dependency relationship. According to the method, the function calling relation, the data flow and the control flow in malicious software codes can be accurately analyzed by constructing the high-order function dependency matrix and the function abstract, compared with a traditional static analysis method, the malicious software key path can be rapidly extracted, and particularly under the condition that complex function calling and dependency relations exist, the malicious software key path can be rapidly extracted. The most critical malicious behavior path can be effectively identified, and the analysis efficiency and accuracy are remarkably improved, so that the detection capability of a related detector is enhanced.

This control device disclosed herein comprises a program analysis unit that sequentially reads instruction blocks from a control program for controlling the control axes of an industrial machine and analyzes the read instruction blocks; an interpolation unit that, based on the analysis result, generates an interpolation pulse for each interpolation period for controlling the control axis; a block start determination unit that, based on start remote data defining a start time of a movement by the next instruction block during a movement based on a predetermined instruction block, determines the start of the execution of the instruction blocks; and several acceleration / deceleration control units to accelerate / decelerate each of the axes in response to the interpolation pulse and to generate a velocity pulse.an acceleration / deceleration control selection unit that selects the acceleration / deceleration control unit for each of the command blocks based on at least one of an overlap extent, a processing process, a command type, a type of acceleration / deceleration, and a command velocity; and a velocity pulse summing unit that summates the velocity pulses generated by the multiple acceleration / deceleration control units for each of the control axes.

The application belongs to the technical field of automatic software testing and program analysis, and relates to a precise testing service system based on software code analysis reasoning, which comprises a data acquisition and initial graph construction module, an initial context-aware probability execution graph being constructed in combination with static potential call edges; a syntax change semantic analysis module, a structured syntax disturbance signature being generated; a probability disturbance instruction generation module, conditional probability disturbance instructions and polymorphic distribution disturbance instructions being generated, and a probability disturbance instruction set being aggregated; a graph real-time reconstruction module, a reconstructed probability execution graph being generated; an influence domain propagation analysis module, affected nodes being determined and an affected function set being generated; and a regression test subset generation module, a minimized regression test subset being generated. The application solves the problem that, when a traditional regression test selection method faces context-related program behaviors, the actual runtime influence probability of changes cannot be quantified, resulting in inaccurate test range selection.

A control device according to the present disclosure comprises: a program analysis unit that sequentially reads and analyzes commands related to a block of a control program for additive manufacturing processing; a control unit that controls the operation of an industrial machine that performs the additive manufacturing processing on the basis of an analysis result by the program analysis unit; an execution state grasping unit that grasps information related to an execution state including at least an interrupted position when the additive manufacturing processing is interrupted; and an adjustment unit that calculates the retrograde amount from the interrupted position and adjusts a processing restart position on the basis of the retrograde amount. The control unit resumes the additive manufacturing processing from the processing restart position after the adjustment by the adjustment unit.

The application discloses a function equivalent function pair extraction method and device based on a large model, and aims to solve the technical problem of low extraction efficiency of function equivalent function pairs caused by the existing function equivalent function pair extraction method. The method comprises the following steps: acquiring multiple programming language versions and corresponding document code data, and determining multiple programming language function equivalent versions; performing program analysis on a to-be-tested programming language project, and determining multiple test cases; screening each test case, determining multiple target test cases, and respectively analyzing each target test case to determine the target function corresponding to each target test case and multiple external functions; determining multiple candidate function pairs according to the target function corresponding to each target test case and the multiple external functions; outputting multiple initial function equivalent function pairs from a preset large model according to the multiple candidate function pairs; and performing function pair function confirmation on each initial function equivalent function pair to determine multiple target function equivalent function pairs.

A method for blocking external debugger application from analysing code of software program installed on computing device. The method including initializing software program including an application program and an internal debugger application. The software program, upon initialization thereof, instructs internal debugger application to load application program in internal debugger application. The internal debugger application is configured to utilize kernel resources of an operating system of the computing device. The method includes executing internal debugger application to set one or more break-points in code of application program to define execution path for code of application program, executing application program as per defined execution path for code thereof, stopping execution of code of application program upon reaching any of one or more break-points therein, and handing control to internal debugger application to provide an address for next instruction to be executed in defined execution path for code of application program.

The invention discloses a Rust program slicing method and system based on a high-order function, and relates to the technical field of functional programming and program analysis. The method comprises the steps of program preprocessing; analyzing in the process; inter-process analysis and program slice calculation. According to the method, slice information in the process is obtained by utilizing high-order function characteristics, and the function abstract expressed in the high-order function form is generated, so that function parameters in the function abstract can be conveniently substituted at a calling point as required during inter-process calling, and a corresponding relation between the function parameters and actual parameters can be quickly obtained; compared with a traditional abstract-based analysis method, more information can be carried in the parameter transmission process, so that the inter-process slicing efficiency can be effectively improved, various hypergraphs do not need to be constructed, the problem of low analysis efficiency caused by huge graphs and complex composition process is avoided, and the analysis efficiency is improved. Therefore, the space overhead in the analysis process can be effectively reduced, and the inter-process program slicing efficiency is improved on the premise that the detection precision is not lost.

A system (100) or method (500) for preventing or mitigating malicious processes in a computing environment having one or more processors (204) and memory (202) operatively coupled to the one or more processors can include computer instructions which when executed causes the one or more processors to perform certain operations. The operations can include intercepting (502) all file system input and output paths using a kernel driver (103), analyzing (504) for suspect behaviors in real time on data being processed through the input and output paths and data access patterns on a live system implemented in a kernel of an operating system for the computing environment, flagging (512) the data for any suspect behaviors, and preventing (514) further processing upon detection of the suspect behaviors.