KR100653122B1 - Real-time detection system and method based rule for safety software development - Google Patents

Abstract

A rule-based real-time detecting system for safe software development and a method thereof are provided to solve a problem generating security accidents caused from vulnerability and develop software safe in a source code level by generating the rule from the vulnerability generated from the software development and detecting the vulnerability from the software with the rule in real-time. An analyzing module(100) analyzes contents of a currently inputted source by analyzing a value inputted from a programmer. A checker module(200) compares the source with the rule inputted from a rule loader module(300) to check whether the analyzed contents are the source code having buffer overflow vulnerability. A highlighter module(400) displays a part of the source code having the buffer overflow vulnerability. An alerter module(500) loads the contents and resolutions for the vulnerability from a resolution loader module(600), and outputs the loaded contents/resolutions to a screen as a message box in case that the source is discriminated as the source having the buffer overflow vulnerability. The ruler loader module defines the rule for the part having the buffer overflow vulnerability.

Description

Rule-based real-time detection system and method for secure software development {REAL-TIME DETECTION SYSTEM AND METHOD BASED RULE FOR SAFETY SOFTWARE DEVELOPMENT}

1 is a screen when the conventional ITS4 is executed

Figure 2 illustrates a conventional StackGuard defense technique

3 is a schematic structural diagram of a system for detecting a vulnerability of a program in real time according to the present invention;

4 is a flow chart for processing of a rule-based real-time detection system according to the present invention.

** Description of symbols for the main parts of the drawing **

100 ... Analysis Module 200 ... Checker Module

300 ... rule Loader Module 400 ... Highlighter Module

500 ... Alerter Module 600 ... Resolution Loader Module

700 Vulnerability Database 800 Resolution Database

The present invention relates to a system that defines a vulnerability that can be a vulnerability when a programmer writes source code at the development stage of the software as a rule, and detects it in real time to provide a solution.

Most of the recent security problems using security vulnerabilities are due to software vulnerabilities. Security vulnerabilities in these software are caused by developer mistakes.

Security vulnerabilities are derived from fundamental problems in the software field and can cause security incidents. When a hacker exploits a security vulnerability, it is embodied as a security vulnerability and causes security incidents.

For example, well-known buffer overflows are security vulnerabilities and a property that can occur in most software. When such a buffer overflow is found in one particular piece of software and poses a security issue, it is called a security vulnerability.

Security vulnerabilities on the other side are not fundamental problems of software in the background, but are security problems on individual software caused by mistakes of software developers.

Thus, the most fundamental solution to these security problems is to make 'safe software' without software vulnerabilities. However, making 100% secure software is a near practical impossibility, and due to this inherent limitation, software vulnerability problems can always exist, and much research has been done to solve this problem.

Among them, the most common and occupied software vulnerabilities are buffer overflow vulnerabilities, and various studies have been conducted to solve the buffer overflow vulnerabilities. Research on buffer overflow detection and prevention techniques includes ITS4, which scans the source code to detect vulnerabilities, StackGuard that modifies the compiler to detect whether a buffer overflow has occurred, and PointGuard, and non-executable buffers. There are techniques such as buffer, array bound checking, and Lipsafe. However, there is no perfect buffer overflow detection and prevention technique yet. Targeting complete source code, ITS4 requires a lot of time and effort to fix vulnerabilities if there are many lines of source code. In addition, Stack Guard and Point Guard only detect whether a buffer overflow has occurred, and do not know what part is vulnerable. US Cigital's ITS4 is a tool that detects vulnerable function calls and indicates the degree of risk for each function compared to a "suspects" database through static scanning of source code written in C and C ++ languages. Vulnerabilities that ITS4 can detect include buffer overflows, as well as race conditions and several other vulnerabilities.

The operation process of ITS4 is as follows.

Accepts more than one C or C ++ language source file as input.

-Cut each source file into a token stream.

Scan the token stream via scanning and compare it to the identifier in the "suspects" database.

-Warn you of the consequences for each risk class.

ITS4 warns against vulnerable function calls according to a predefined risk level, which includes the following:

It alerts you to a brief description of the first problem, how to code it for the second, and the risk rating of the third vulnerability.

1 is a screen when ITS4 is actually executed.

ITS4 has the advantage of being relatively slow but relatively fast. In addition, upgrade issues in the "suspects" database, analysis of vulnerabilities, and integration into programming environments such as Microsoft's Visual Studio have been addressed.

StackGuard is a compiler defense strategy to prevent buffer overflows. StackGuard checks whether the return address was changed by a buffer overflow by inserting a random value called 'canary' between the return address and the stack and examining the 'canary' word before jumping to the address pointed to by the return address. . In StackGuard, the 'canary' value is placed before the return address. Therefore, in order to change the return address due to the buffer overflow, the 'canary' value is also changed, so it is possible to check whether the return address has changed by checking whether the 'canary' value has changed before jumping to the address pointed to by the return address. have. There are two kinds of 'canary' values, 'Terminator canary' and 'Random canary', each having the following values.

Terminator canary: In C language, the character indicating the end of a string has the value 'canary'.

Random canary: has a 32 bit random number selected as a 'canary' value each time the program starts

2 illustrates a StackGuard defense technique.

The random canary value is determined by the 32-bit random number at the start of the program to prevent the attacker from predicting it in advance.In the event of a buffer overflow attack, the return address value and the canary value are also XORed together with the canary value for a normal return. Done. The terminator canary value is a canary value of characters such as 0 (null), CR, LF, and -1 (EOF) that indicate the end of a string in C. If an attacker finds a canary value and reflects the buffer overflow attack, Even if it tries, it stops the operation by encountering the end of string in the middle of input value when performing string operation of string series function. In other words, copying long strings does not occur as the attacker intended, and thus, buffer overflow attacks can be prevented.

However, StackGuard is not a defense against full buffer overflows, because it does not completely prevent buffer overflows, but rather provides a level of difficulty to attack.

The present invention has been made to solve the problem that a security incident caused by the vulnerability by developing an insecure program during the production of the program and to develop a secure software at the source code level, the vulnerability of the software generated during the program production It is an object of the present invention to provide a rule-based real-time detection system for software development that detects the vulnerability of software in real time using the rule after generating the rule as a rule.

The present invention is a system for verifying security vulnerabilities of software, in the development stage of the software to define the vulnerabilities that can be vulnerabilities when creating source code as a rule (rule) and analyzes the input source and the rules defined above If a security vulnerability is found by comparing / verifying the present invention, the present invention relates to a system that provides a solution by detecting the security vulnerability in real time.

Hereinafter, the present invention will be described with reference to the accompanying drawings.

Figure 3 shows a schematic configuration diagram of a system for detecting a vulnerability of a program in real time according to the present invention, the configuration is,

An analysis module 100 for analyzing a value input by a programmer through a system to analyze contents of source codes inputted to date;

A Checker module (200) for comparing a source inputted from a rule loader to check whether the content analyzed from the analysis module is source code having a buffer overflow vulnerability;

A Highlighter module 400 for displaying a portion of source code having a buffer overflow vulnerability by the Checker module;

An alerter module (500) which, when determined by the Checker module as a source having a buffer overflow vulnerability, obtains the content of the vulnerability and a solution for the vulnerability from the Resolution Loader module and outputs the content on the screen in a message box;

Define a rule for the part with the buffer overflow vulnerability, open the vulnerability database (Vulnerability rule repository) 700 where the rule is stored, and open the vulnerability database (Vulnerability rule repository) 700 when the system is running. A rule loader module (300) for loading);

A solution repository (800) that stores information about the types of buffer overflow vulnerabilities in the vulnerability database (Vulnerability repository, 700) and how to resolve them. a Resolution Loader module 600 for opening the repository 800 and loading data; Is made of.

In the above, a rule is defined for a part having a buffer overflow vulnerability, and the buffer overflow vulnerability in the vulnerability database (Vulnerability rule repository) 700 and the vulnerability database (Vulnerability repository) 700 is stored. The Solution Repository (800), which stores information about awareness and how to resolve the vulnerability, is a database that defines known content.

That is, as the system starts, the rule loader module 300 and the resolution loader module 600 open the vulnerability database (Vulnerability rule repository, 700) and the solution database (Resolution repository, 800), respectively, and load a rule ( If a security vulnerability is detected, the solution for the security vulnerability is transmitted to the Alerter module in real time.

4 is a flowchart of the processing of a rule-based real-time detection system according to the present invention.

When explaining the attached flowchart

Opening a vulnerability database (Vulnerability rule repository) 700 and a solution database (Resolution repository 800) and loading data (S_10);

Loading source code of the input software (S_20);

Analyzing the input source code by analyzing a document through a parser (S_30);

Delivering the analyzed data to a checker module (S_40);

Comparing / verifying the analyzed content with a rule of a Vulnerability rule repository whether the source has a buffer overflow vulnerability (S_50);

If a vulnerability is found in the checker module, transmitting information about the vulnerability to a highlighter module and an alerter module (S_60);

Retrieving a stored solution from a solution repository for a vulnerability transmitted to the alerter module (S_70);

Displaying a solution for solving the found vulnerability (S_80);

Changing a source code with respect to the information transmitted to the highlighter module (S_71);

Displaying the changed source code on a user's monitor (S_81);

If there is no vulnerability in the comparing / verifying step (S_50), it ends.

Changing the source code in the step of changing the source code with respect to the information transmitted to the highlighter module (S_71) means changing the text color of the source code or underlining the source code.

The Vulnerability Rule Repository and the Solution Repository are separate databases. When a source where security vulnerabilities are found is found, the vulnerability is generated as a rule and stored in the vulnerability database. The solution is stored in the solution database for easy updating and management.

The present invention verifies the security vulnerabilities of the program, the modification of the source code after the program development can be a complex and difficult problem, but the system of the present invention, if one line is input at the program development stage, the input source Security vulnerability is displayed in real time.

According to the present invention, since the development of a program is mostly using a complex algorithm rather than a simple form, it is possible to provide a system capable of developing a stable program by verifying a security vulnerability of the program at the program development stage and displaying a weak part of the system security. Can be.

Therefore, it is possible to reduce the security incidents occurring after the program execution by reducing the security vulnerabilities at the program development stage in advance, thereby reducing the time and cost of security prevention.

Claims (3)

In systems that verify security vulnerabilities in software, An analysis module 100 for analyzing a value input by a programmer through a system to analyze contents of source codes inputted to date; A Checker module (200) for comparing a source inputted from a rule loader to check whether the content analyzed from the analysis module is source code having a buffer overflow vulnerability; A Highlighter module 400 for displaying a portion of source code having a buffer overflow vulnerability by the Checker module; An alerter module (500) which, when determined by the Checker module as a source having a buffer overflow vulnerability, obtains the content of the vulnerability and a solution for the vulnerability from the Resolution Loader module and outputs the content on the screen in a message box; Define a rule for the part with the buffer overflow vulnerability, open the vulnerability database (Vulnerability rule repository) 700 where the rule is stored, and open the vulnerability database (Vulnerability rule repository) 700 when the system is running. A rule loader module (300) for loading); A solution repository (800) that stores information about the types of buffer overflow vulnerabilities in the vulnerability database (Vulnerability repository, 700) and how to resolve them. a Resolution Loader module 600 for opening the repository 800 and loading data; Rule-based real-time detection system for secure software development, characterized in that consisting of. In the method of verifying the security vulnerability of the software, Opening a vulnerability database (Vulnerability rule repository) 700 and a solution database (Resolution repository 800) and loading data (S_10); Loading source code of the input software (S_20); Analyzing the input source code by analyzing a document through a parser (S_30); Delivering the analyzed data to a checker module (S_40); Comparing / verifying the analyzed content with a rule of a Vulnerability rule repository whether the source has a buffer overflow vulnerability (S_50); Transmitting information on the vulnerability to a highlighter module and an alerter module with respect to the vulnerability found in the checker module (S_60); Retrieving a stored solution from a solution repository for a vulnerability transmitted to the alerter module (S_70); Displaying a solution for solving the found vulnerability (S_80); Terminating if there is no vulnerability in the comparing / verifying step (S_50); Rule-based real-time detection method for secure software development comprising a. The method of claim 2, Changing a source code with respect to the information transmitted to the highlighter module (S_71); Displaying the changed source code on a user's monitor (S_81); Rule-based real-time detection method for secure software development, characterized in that it further comprises.

Images