The invention discloses a sensitive information flow tracking and tracing method and
system based on a high-order function abstract, and relates to the technical field of
program analysis and supply chain safety. The method comprises the steps of receiving and preprocessing a to-be-tested program, performing dependency analysis on a function module of the to-be-tested program, converting the to-be-tested program into an
intermediate language, constructing a cross-module function
call graph and a
control flow graph, traversing the function
call graph according to an inverse topological sequence, and determining a
function analysis sequence; carrying out analysis parameter configuration, and defining a related sensitive source, a related sensitive sink and a control probability set; and constructing an in-
process analysis framework. According to the method, through high-order function abstract and dependency matrix operation, a data flow path in an
open source software supply chain can be effectively analyzed, the dependency relationship between functions can be captured, tracing is carried out, an abstract matrix is stored as a
sparse matrix, therefore, the space overhead in the analysis process can be effectively reduced, and the analysis efficiency is improved. And the detection efficiency of the sensitive information flow in the process is improved on the premise of not losing the detection precision.