KR101606276B1 - Apparatus and method for setting taint based in control dependency - Google Patents

Abstract

A tent setting apparatus and method based on control dependency are disclosed.
A step of extracting second data dependent on the first data that is currently tentative among the data constituting the program; Temporary tenting the extracted second data; And temporarily tenneling the temporary tensed second data according to whether the temporary tenned second data is calculated with the first data.

Description

[0001] APPARATUS AND METHOD FOR SETTING TAINT BASED IN CONTROL DEPENDENCY [0002]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a tent setting apparatus and method based on control dependency, and more particularly, to an apparatus and a method for setting a tent used for tent analysis based on control dependency.

Dynamic Taint Analysis is a technology that analyzes and tests vulnerabilities of programs by tiling at least one of the data contained in the program and propagating the taints according to the operation of the data.

However, dynamic taint analysis can result in underutting that is not tentative, even though it is the data that needs to be tent- ed. For example, if the tainted data is used only as a branch statement condition, undertining can occur because the tent is not propagated to other data contained in the conditional statement.

There are DYTAN and DTA ++ as a way to prevent conventional under-tinting.

At this time, DYTAN determines all control dependencies of the program and tries to prevent under-tinting. However, DYTAN has a limitation in that overtining in which the data to be touched increases excessively occurs because the data having all the control dependencies is tied.

In addition, DTA ++ tried to prevent under-tainting by judging the control dependency of a branch with a single branch condition and treading data according to the judgment result. However, DTA ++ could not completely prevent under-tinting, since under-tinting can also occur in branches where the solution does not have a single branch condition.

Therefore, there is a demand for a method that can prevent under-fitting without occurrence of over-tinning.

The present invention can provide an apparatus and method for preventing under-tainting while minimizing data tent by adding only tentative data and arithmetic operation data to all the data in the branch statement .

According to another aspect of the present invention, there is provided a method of establishing a timetable, the method comprising: extracting second data dependent on first data that is currently tentative among data constituting a program; Temporary tenting the extracted second data; And temporarily tenneling the temporary tensed second data according to whether the temporary tenned second data is calculated with the first data.

The step of extracting the second data of the step setting method according to an embodiment of the present invention may include the step of, when the conditional statement of the branch statement includes the first data that is normally tentatively drawn in the program, 2 data can be extracted.

The method of setting a timetable according to an embodiment of the present invention may further include the step of determining data to be additionally temporally tentatively based on second data temporarily tentatively stored in the program, In the program, if the conditional statement of the branch statement includes the first data that is normally tentatively drawn, the at least one data included in the branching statement may be extracted as the second data.

In the case where data to be additionally temporarily tent is not determined based on the second data until the branch statement including the temporary tent second data is terminated, 2 < / RTI > data. ≪ RTI ID = 0.0 >

The method of establishing a task according to an embodiment of the present invention is characterized in that when the second data is not tentently till the end of the branch statement including the temporary tent second data, The step of releasing may include the step of releasing.

The step of continuously tenting the second data of the tent setting method according to an embodiment of the present invention can check whether or not the arithmetic operation including the arithmetic operation between the temporarily tentative second data and the first data is performed have.

According to an embodiment of the present invention, there is provided a method of setting a time point, the method comprising: identifying data that is normally tentative to be analyzed; And further additionally < RTI ID = 0.0 > tenting < / RTI > data in an arithmetic operation relationship with the identified normally tethered data.

The step of regularly tentting the method of establishing a timetable according to an embodiment of the present invention comprises the steps of: temporarily tentatively relocating data depending on the currently timed data; And tentatively stating the temporary tent data according to whether the temporary tent data is arithmetically operated with the currently tentained data.

The temporary tenting step of the tent setting method according to an embodiment of the present invention is a step of temporarily tentting all the data included in the branch statement when the conditional statement of the branch statement includes the data that is normally tentted have.

A tent setting apparatus according to an embodiment of the present invention includes a data extracting unit for extracting second data that is dependent on first data that is currently tentative among data constituting a program; A temporary tent unit for temporary tenting the extracted second data; And a temporary tent unit for temporarily tentatively performing the temporary tent second data according to whether the temporary tent second data is calculated with the first data.

The data extracting unit of the tent setting apparatus according to an embodiment of the present invention extracts all the data included in the branch statement as the second data when the conditional statement of the branch statement includes the first data that is always tentatively .

The tentative setting unit of the tent setting apparatus according to an embodiment of the present invention may be configured such that when the second tentative data is not tentatively till the branching tent containing the temporarily tentatively set second data ends, The temporary tent can be released.

According to an embodiment of the present invention, only the data that is always tent and all the data for which arithmetic operation is performed are extracted from all the data in the branch statement, and the data is added at all times, thereby minimizing the data tent and preventing under-tinting .

1 is a view showing a tent setting apparatus according to an embodiment of the present invention.
2 is a diagram showing a tent adding unit of the tent setting apparatus according to an embodiment of the present invention.
3 is an example of a code for setting a tent according to an embodiment of the present invention.
4 is a flowchart showing a method of setting a tie according to an embodiment of the present invention.
5 is a flowchart showing a method of setting a tie according to an embodiment of the present invention.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings. The method of setting a timetable according to an embodiment of the present invention can be performed by a timetable setting apparatus.

1 is a view showing a tent setting apparatus according to an embodiment of the present invention.

The tent setting apparatus 100 further tries to second data dependent on the first data based on the first data that the dynamic tent setting apparatus has tasted, thereby preventing undetaining in the dynamic tent analyzing process can do.

Referring to FIG. 1, a tent setting apparatus 100 according to an embodiment of the present invention may include a data identification unit 110 and a tentative tent adding unit 120.

The data identification unit 110 can identify the tentatively tentatively analyzed data of the program. At this time, the data that is always tained may be the data that the dynamic tent setting apparatus has touched in the program for dynamic tent analysis.

The always-tennel adding unit 120 may additionally tent data at an arithmetic operation relationship with the data identified by the data identifying unit 110 to add the tentatively-drawn data.

More specifically, the normal tent adding unit 120 can temporally tentatively control data that is dependent on control. At this time, the data having control dependence on the always-tenned data may be data that may cause under-tinting.

The normal tent adding unit 120 may determine whether or not the temporarily tentated data is an arithmetic operation with the data currently tentained. If the temporary tained data is an arithmetic operation with the normally tained data, the temporary tained data can be under-tinted. Therefore, the constant tent adding unit 120 can always tentatively temporary tent data, thereby preventing the temporary tent data from being under-tinted.

The concrete configuration and operation of the constant tent adding unit 120 will be described below in detail with reference to FIG.

2 is a diagram showing a tent adding unit of the tent setting apparatus according to an embodiment of the present invention.

Under-tinting is a problem that occurs because the data that needs to be tinted is not being tinted. At this time, the data in which the under-tinting occurs may be data that is calculated with the tentatively tentative data while having control dependence on the data that is normally tentatively included in the branch tentative data. Therefore, the normal tent adder 120 extracts only the data that is always tent and all the arithmetic operation data among all the data in the branch tent and adds it to the normal tent to thereby minimize the data tent and prevent under-tinting .

2, the constant tent adding unit 120 according to an embodiment of the present invention includes a data extracting unit 210, a temporary tent unit 220, a tentative wave unit 230, (240).

The data extracting unit 210 may extract second data that is dependent on the first data that is currently tentative among data constituting the program. In this case, the first data may be data identified by the data identification unit 110.

Specifically, if the conditional statement of the branch statement includes the first data that is normally tentatively displayed in the program, the data extraction unit 210 may extract all the data included in the branching statement as the second data.

In addition, when the program includes the first data that is normally tentained in the branch statement, the data extracting unit 210 may extract at least one data included in the branching statement as the second data. At this time, the data extracting unit 210 extracts not only all the data included in the branch statement but also some data among the data included in the branch statement as the second data, so that the second data dependent on the first data There is a possibility that it exists. Accordingly, the normal tent adding unit 120 may add data to be temporarily tentored, including the tent radio wave portion 230. [

The temporary tent unit 220 can temporally tent second data extracted by the data extraction unit 210. [

The tread propagation unit 230 can propagate the second data temporarily tentatively set by the temporary tent unit 220 in the program. Specifically, the tread propagation unit 230 can further determine data to be temporally tentatively based on the second data. For example, if the program contains the a: = b expression and b is the temporary tained data, then the table propagation unit 230 stores the temporary tated b and a computed as temporary tent data You can decide.

The taint propagating unit 230 may operate when the data extracting unit 210 extracts at least one data included in the branch statement as the second data.

The temporary tent unit 240 can temporarily tent second data temporarily tent depending on whether or not the second data temporarily tentatively operated by the temporary tent unit 220 is calculated with the first data. Specifically, the constant tent unit 240 can check whether or not an arithmetic operation including a fourth arithmetic operation between the temporary data of the second tentative data and the first data has been performed. When an arithmetic operation is performed between the temporarily-cached second data and the first data, the second data can be always tentatively displayed.

In addition, if the second tentative data is not always tentained until the valid range of the second tentative data ends, the tentative tent 240 can release the temporary tent of the second data.

Then, the data to be additionally temporarily tentatively determined based on the second data is determined until the tent radio wave portion 230 propagates the second tentatively transmitted data and the validity range of the temporarily tentatively second data ends The normal tent unit 240 can release the temporary tent of the second data.

3 is an example of a code for setting a tent according to an embodiment of the present invention.

At this time, the weighted Scoring variable 310 and the rawScore variable 320 may be data that is always tentative. Also, the score variable 330, which is declared and initialized in the fifth line, is a local variable, so it may not be tied in line 5.

An embodiment in which under-fitting occurs based on Fig. 3 will be described.

Assuming that the value of weightedScoring is FALSE and the value of rawScore is 380, the function shown in FIG. 3 executes lines 4, 5, 7, 13, 15, and 20, and outputs 0 as a return value. At this time, in the line 13, the tent set in the rawScore variable 320 can be propagated to the score variable 330. That is, since the instructions including the normally tethered data are lines 7, 13, and 15, the dynamic tie-setting device can perform vulnerability checks on lines 7, 13, and 15.

However, if the attacker changes the weighted Scoring variable 310 to a value greater than 0, the function shown in FIG. 3 will be executed when lines 4, 5, 7, 8, 9, 10, 11, 13, 15, 16, And 400 can be output as a return value. That is, since the difference between the return value of 0 in the normal operation and the return value of 400 in the attack is large, the attacker can judge that the control flow change of the program is successful.

At this time, as the attacker changes the weighted Scoring variable 310, the place where the control flow of the program is changed may be score + = WEIGHT of line 9. Therefore, line 9 should be constantly tied to the tent analysis to test the vulnerability of the program.

However, since the score variable 320 of line 9 is a local variable and is not always tentatively underlined, it can not be verified by the tent analysis for the vulnerability check.

3, an embodiment for preventing under-fitting according to an embodiment of the present invention will be described.

In the case where the conditional statement of the branch statement includes data that is normally tained, the permanent tent adding unit 120 of the present invention can temporarily tent all the data included in the corresponding branching statement. When the temporary tained data is an arithmetic operation with the data currently tentained, the tentative tent adding unit 120 always tentatively tentatively tentatively stores the temporary tent data so that the temporary tent data is under- Can be prevented.

That is, since the weighted Scoring> FALSE, which is the conditional statement of the branch statement on the line 7, includes the weighted Scoring variable 310, which is the data that is normally tentained, the tent adder 120 always adds all the data included in the branch of the line 7 to the temporary You can taint. Thus, the score variable 320 may also be temporarily tentatively.

Next, the normal tent adding unit 120 can check whether the temporary tent data is arithmetically operated with the normally tent data. At this time, the score variable 320 can be arithmetically operated (score + = rawScore) with the rawScore variable 320, which is data that is always tentatively rendered on line 9. Accordingly, the tent adder 120 can always tentatively score the score variable 320, thereby preventing under-fitting due to the score variable 320 being not tent.

That is, when the conventional Tain analysis is used, only the lines 7, 13, 15, and 17 including the data tainted in FIG. 3 are analyzed, so that undertting due to the score variable 320 being not tent . On the other hand, the present invention can additionally tie the line 9, which can change the control flow of the program, thereby preventing under-tinting.

4 is a flowchart showing a method of setting a tie according to an embodiment of the present invention.

In step 410, the data identification unit 110 can identify the currently tentatively analyzed data of the program.

In step 420, the tent adder 120 may extract data in an arithmetic operation relationship with the data identified in step 410. [ Specifically, the normal tent adding unit 120 may temporarily tentatively control the data having the control dependence on the data identified in the step 410. [ The normal tent adding unit 120 may determine whether or not the temporarily tentated data is an arithmetic operation with the data currently tentained. In addition, the normal tent adding unit 120 can extract the data that is always tentative from the temporary tent data and the data that is an arithmetic operation.

In step 430, the normal tent adding unit 120 may tentatively extract the data extracted in step 420 and add the data that is normally tentative.

5 is a flowchart showing a method of setting a tie according to an embodiment of the present invention.

5 is an operation of the constant tent adding unit according to an embodiment of the present invention, and steps 510 to 540 may be included in step 420 of FIG.

In step 510, the data extracting unit 210 may extract second data that is dependent on the first data that is currently being tentatively selected from the data constituting the program. Specifically, if the conditional statement of the branch statement includes the first data that is normally tentatively displayed in the program, the data extraction unit 210 may extract all the data included in the branching statement as the second data.

In step 520, the temporary tent unit 220 may temporarily tentatively retrieve the second data extracted in step 510.

In step 530, the tread propagation unit 230 may propagate the second data temporarily tentatively transited by the temporary tent unit 220 in step 520. Specifically, the tread propagation unit 230 can further determine data to be temporally tentatively based on the second data. In addition, step 530 may be performed if data of a part of the data included in the branch statement is extracted in step 510. If all the data included in the branch statement is extracted in step 510, step 530 may be omitted.

In step 540, the tent unit 240 always can check whether the second tentatively tentative data in step 520 is arithmetically operated with the first data. If an arithmetic operation is performed between the temporary tent second data and the first data, the tent unit 240 may perform step 550. When an arithmetic operation is performed between the temporary data and the first data until the branch statement including the temporarily tied second data is terminated, the tentative unit 240 always performs step 560 ) Can be performed.

In step 550, the tent unit 240 can always tent the first data and the second data to be arithmetically operated.

The temporary tent unit 240 in step 550 can release the temporary tent of the second data that has not been arithmetically operated between the first data until the branch statement including the temporarily tentatively second data ends have.

In the present invention, only the data which is always tent and arithmetic operation is extracted from all the data in the branch statement, and the data is added at all times, thereby minimizing the data tent and preventing under-tinting.

While the invention has been shown and described with reference to certain preferred embodiments thereof, it will be understood by those of ordinary skill in the art that various changes in form and details may be made therein without departing from the spirit and scope of the invention as defined by the appended claims. This is possible.

Therefore, the scope of the present invention should not be limited to the described embodiments, but should be determined by the equivalents of the claims, as well as the claims.

100: Tent setting device
110: Data identification unit
120: Continuous tent addition section

Claims (12)

A data extracting unit; Temporary tent parts; And a tent setting apparatus including a tentative tent unit, the method comprising:
Extracting second data that is dependent on first data that is currently tentative among data constituting the data extracting unit program;
Temporary tentting the extracted second data by the temporary tent unit; And
Wherein the temporary tent unit judges whether or not the temporary tent second data is to be underlined and tentatively tentatively temporarily stores the temporary tent second data according to a determination result
Wherein the step of setting a tent is performed. The method according to claim 1,
Wherein the extracting of the second data comprises:
Wherein the data extraction unit extracts all the data included in the branch statement as the second data when the conditional statement of the branch statement includes the first data that is normally tentatively included in the program. The method according to claim 1,
Wherein the temporary tent unit determines data to be additionally temporally tentatively based on second data temporarily tentative in the program
Further comprising:
Wherein the extracting of the second data comprises:
Wherein the data extracting unit extracts at least one data included in the branch statement as the second data when the conditional statement of the branch statement includes the first data that is normally tentatively included in the program. The method of claim 3,
If the additional tentative data is not determined based on the second data until the branch statement including the temporarily tentatively-accessed second data is terminated, the temporary tent unit releases the temporary tent of the second data Step
Further comprising the steps of: The method according to claim 1,
If the second tentative data is not to be tentatively till the end of the branch tent containing the second tentative data, releasing the temporary tent of the second data
Further comprising the steps of: The method according to claim 1,
The step of continuously tenting the second data comprises:
Wherein the always-tent unit confirms whether or not to perform an arithmetic operation including an arithmetic operation between the temporary tent second data and the first data. A data identification unit; And a data adding unit, the method comprising the steps of:
Identifying data that is always tentative to be analyzed by the data identification application program; And
Wherein the data adding unit further additionally tentently data in an arithmetic operation relationship with the identified normally tethered data
Lt; / RTI >
Wherein the step of continuously tenting comprises:
Temporarily tentting data that is dependent on the currently-tethered data; And
Wherein the data addition unit continually tentresses the temporary tained data according to whether the temporary tained data is arithmetically operated with the currently tained data
Wherein the step of setting a tent is performed. delete 8. The method of claim 7,
The temporary tenting step may include:
Wherein the data adder temporarily tempests all the data included in the branch statement when the conditional statement of the branch statement includes the data that is normally tentative in the program. A data extracting unit for extracting second data that is dependent on the first data that is normally tentative among data constituting the program;
A temporary tent unit for temporary tenting the extracted second data; And
A temporary tent unit for temporarily tentting the temporary data of the second tentative data according to a result of the determination, determining whether the temporary tentative second data is to be undertinted,
The tent setting apparatus comprising: 11. The method of claim 10,
The data extracting unit extracts,
Wherein the program extracts all the data included in the branch statement as the second data when the branch statement condition includes the first data that is normally tentatively set in the program. 11. The method of claim 10,
Wherein the normally-
And releases the temporary tent of the second data if the second data is not tentently till the end of the branch statement including the temporary tent second data.

Images