WO2018016671A2

WO2018016671A2 - Dangerous code detection system for checking security vulnerability and method thereof

Info

Publication number: WO2018016671A2
Application number: PCT/KR2016/008749
Authority: WO
Inventors: 오승현; 김승준; 이상권
Original assignee: 주식회사 이븐스타
Priority date: 2016-07-20
Filing date: 2016-08-09
Publication date: 2018-01-25
Also published as: WO2018016671A3; KR20180010053A

Abstract

The present invention relates to a dangerous code detection system for checking a security vulnerability and a method thereof and, specifically, to a dangerous code detection system and a method thereof, which can previously detect a source code vulnerable to security risks from a source file to be checked for a security vulnerability and provide information on the same, thereby minimizing the time and system load required to analyze the security vulnerability. Also, the present invention comprises: a compiling unit for compiling a source file to generate a class file from the same; an analysis unit for generating a hierarchical structure tree by analyzing the class file; a detection unit for detecting a method to be analyzed where a dangerous code is assumed to exist, on the basis of the hierarchical structure tree; and a configuration unit for classifying the methods to be analyzed according to predetermined types and generating a priority list for checking a security vulnerability, whereby it is possible to check only a highly dangerous method without a total inspection of the source file. Therefore, the time and system load required to analyze the security vulnerability can be minimized.

Description

Risk Code Detection System and Method for Security Vulnerability Check

The present invention relates to a risk code detection system and method for checking security vulnerabilities. Specifically, an analysis of security vulnerabilities is provided by detecting a source code vulnerable in advance and providing the information in a source file to check security vulnerabilities. A risk code detection system and method for minimizing time and system load are disclosed.

Recently, security problems caused by security vulnerabilities of software have been continuously generated, and exploitation of these vulnerabilities has become a social problem. For example, if there are security vulnerabilities in the software, unauthorized users can illegally execute specific commands, bypass specified access restrictions, access certain data, or perform information denial of service attacks. Security incidents will occur.

Therefore, in order to prevent security incidents caused by security vulnerabilities, a security vulnerability checking system for checking and analyzing security vulnerabilities of software is used.

As described above, the security vulnerability checking system can check and analyze the security vulnerability of the software in various ways. For example, the security vulnerability checking system using symbolic execution assigns a symbol value to an input variable of the software. You can analyze whether there is a security vulnerability in the software.

At this time, the security vulnerability checking system using symbol execution mimics the execution process of software using symbol value rather than actual value. If a branch statement is encountered in the process, it generates the symbol value by following both paths and meets the conditions of several branch statements. At some point in the program, each variable has a value that checks for a vulnerability in the source code of the software.

On the other hand, the conventional security vulnerability check system using the symbol execution can not know in advance which source code of the vulnerability exists in the software, there is a problem that must be thoroughly inspected the entire software.

That is, the conventional security vulnerability checking system using symbol execution has a problem in that the system load increases and the analysis time of the security vulnerability is excessively taken in the process of inspecting the entire software to check the security vulnerability.

The present invention has been made in view of the above problems, and an object thereof is to provide a risk code detection system and method for checking security vulnerabilities that can reduce the analysis time and system load of security vulnerabilities.

The objects of the present invention are not limited to the above-mentioned objects, and other objects which are not mentioned will be clearly understood by those skilled in the art from the following description.

The present invention for achieving the above object is a compilation unit for compiling a source file to check the security vulnerability to generate a class file; An analysis unit for analyzing a class file generated from the compilation unit and generating a hierarchical tree according to a dependency relationship between a class and a method; A detection unit for detecting an analysis target method in which a risk code is estimated based on a hierarchical tree generated from the analysis unit; And a setting unit which classifies the analysis target method detected by the detection unit by a predetermined type, sets a check order of security vulnerabilities, and generates the priority list, thereby providing a risk code detection system for security vulnerability checking.

In a preferred embodiment, the compilation unit, a source file loading module for loading the source file and the compilation library information of the source file; And a compilation module for generating a class file by compiling a source file according to the compilation library information.

In a preferred embodiment, the analysis unit, a class file loading module for loading a class file; A byte code analysis module for analyzing a byte code of the loaded class file; And a hierarchy tree generation module for generating a hierarchy tree based on the analyzed byte code.

In an exemplary embodiment, the detection unit may include: a first analysis target detection module configured to detect an analysis target method in which a risk code is estimated based on a position on a hierarchical tree; And a second analysis target detection module for detecting again an analysis target method matching a preset vulnerability pattern among the analysis target methods detected by the first analysis target detection module.

In an exemplary embodiment, the setting unit may include: an analysis target classification module classifying the analysis target method by a parameter number and a parameter type; An analysis object list generation module for generating an analysis object list for an analysis object method classified from the analysis object classification module; And a priority list generation module for rearranging the analysis method on the analysis target list according to the complexity of the logic and generating the priority list.

In a preferred embodiment, the storage unit for storing the analysis result of the class file analyzed by the analysis unit, the analysis target method detected by the detection unit and the priority list set from the setting unit;

In addition, the present invention is a risk code detection method performed in a risk code detection system, comprising: (1) generating a class file by compiling a source file to check a security vulnerability by the risk code detection system; (2) the risk code detection system analyzing a class file to generate a hierarchical tree according to the dependency relationship between the class and the method; (3) the risk code detection system detecting a method to be analyzed in which a risk code is estimated based on a hierarchical tree; And (4) generating, by the risk code detection system, a method of classifying the analysis target method by a predetermined type and setting a check order of security vulnerabilities to generate a priority list. to provide.

In a preferred embodiment, the step (1) may include (1-1) loading, by the risk code detection system, a source file and compilation library information of the source file; And (1-2) generating a class file by compiling a source file according to the compilation library information by the dangerous code detection system.

In a preferred embodiment, the step (2) comprises: (2-1) the risk code detection system loading a class file; (2-2) the risk code detection system analyzing the byte code of the loaded class file; And (2-3) the risk code detection system generating a hierarchical tree based on the analyzed byte code.

In a preferred embodiment, the step (3) may include: (3-1) detecting, by the risk code detection system, a method to be analyzed in which a risk code is estimated based on a position on a hierarchical tree; And (3-2) re-detecting, by the risk code detection system, an analysis target method that matches a preset vulnerability pattern among the detected analysis target methods.

In a preferred embodiment, the step (4) may include: (4-1) classifying the method to be analyzed by the number of parameters and the parameter types by the risk code detection system; (4-2) generating, by the risk code detection system, an analysis object list for the classified analysis object method; And (4-3) generating the priority list by rearranging the analysis method on the analysis object list according to the complexity of the logic by the risk code detection system.

In a preferred embodiment, the analysis result of the class file, the method to be analyzed and the priority list are respectively stored in the database.

According to the above-mentioned problem solving means, the present invention provides a compilation unit for compiling a source file and generating a class file, an analysis unit for generating a hierarchical tree by analyzing the class file, and a risk code based on the hierarchical tree. A detection unit for detecting the estimated analysis target method and a setting unit for classifying the analysis target method by predetermined types and generating a priority list for checking security vulnerabilities. By selectively inspecting bays, it is possible to minimize the analysis time and system load of security vulnerabilities.

1 is a view for explaining a risk code detection system according to an embodiment of the present invention.

2 is a diagram for explaining a compilation unit of a risk code detection system;

3 is a view for explaining an analysis unit of the risk code detection system.

4 is a diagram for explaining a detection unit of a risk code detection system.

5 is a diagram for explaining a setting unit of a risk code detection system.

6 is a view for explaining a risk code detection method according to an embodiment of the present invention.

In the following description certain details of the invention have been presented to provide a more general understanding of the invention, which is a common practice in the art that the invention may be readily practiced without these specific details and by variations thereof. It will be obvious to those who have knowledge.

First, the risk code detection system and method for security vulnerability check according to an embodiment of the present invention may be implemented in hardware, but preferably, may be implemented through software operating with hardware.

Here, the software may be stored in a computer-readable storage medium such as a hard disk drive, an SSD, a USB memory, and an SD card so that the computer functions by being read from the computer. It may be installed to operate in the server device.

Hereinafter, a preferred embodiment according to the present invention will be described in detail with reference to the accompanying drawings 1 to 6, with the focus on the parts necessary to understand the operation and action according to the present invention.

1 is a view for explaining a risk code detection system according to an embodiment of the present invention, Figure 2 is a view for explaining the compilation of the risk code detection system, Figure 3 is a view for explaining the analysis of the risk code detection system 4 is a view for explaining a detection unit of the risk code detection system, and FIG. 5 is a view for explaining a setting unit of the danger code detection system.

1 to 5, the risk code detection system 100 according to an embodiment of the present invention includes a compiling unit 110, an analyzing unit 120, a detecting unit 130, a setting unit 140, and a storage unit. And 150.

Here, the risk code detection system 100 according to an embodiment of the present invention may detect a risk code that is vulnerable to security from the software before performing a vulnerability analysis of the software. In addition, the information of the aforementioned risk code may be provided to the security vulnerability checking system 10 using symbol execution for actually analyzing and checking the security vulnerability.

The compilation unit 110 performs a function of compiling a source file, which is software to check security vulnerabilities, to create a class file. As shown in FIG. 2, the compiling unit 110 includes a source file loading module 111 and a compiling module 112.

In addition, the source file loading module 111 loads a source file and library information of the source file. For example, the source file loading module 111 may load a source file uploaded by a user input or stored in a repository on a project basis.

In the process of loading the source file by the source file loading module 111, package information including information on a directory, import information including information about a library, compilation option information, Sourcepath information, including information about the location of source files, and compilation library information for compilation can also be loaded.

In addition, the compilation module 112 performs a function of generating a class file by compiling a source file according to the compilation library information. To this end, the compilation module 112 analyzes the compilation library information loaded by the source file loading module 111 and applies the appropriate library to the corresponding source file to compile.

When the compilation by the compilation module 112 is completed, the above-described class file is generated. In addition, by using the generated class file, the analysis is performed by the analysis unit 120 to be described later.

The analysis unit 120 analyzes the class file generated by the compilation unit 110 and generates a hierarchical tree according to the dependency relationship between the class and the method.

As shown in FIG. 3, the analyzer 120 may include a class file loading module 121, a byte code analysis module 122, and a hierarchical tree generation module 123.

In addition, the class file loading module 121 performs a function of loading a class file. In addition, the byte code analysis module 122 performs a function of analyzing the byte code of the class file loaded by the class file loading module 121.

In this case, the byte code analysis module 122 may collect and analyze information including a class included in a class file, a method defined in the class, a line position, a return type of a method, and whether a user class exists.

In particular, the byte code analysis module 122 analyzes information including a class calling or receiving another class from a class file, a method calling or receiving another method, and a line position calling or receiving another line position. .

In addition, the analysis result analyzed by the byte code analysis module 122 is stored in the storage unit 150 to be described later. In this case, the above-described analysis result may include class-specific correlation, method-specific correlation, and information on logic in the method for generating a hierarchical tree, which will be described later.

In addition, the hierarchical tree generation module 123 performs a function of generating a hierarchical tree by connecting in accordance with a correlation between a class, a class, a method, and a method based on the analyzed byte code.

Preferably, the hierarchical tree generation module 123 uses the analysis result analyzed by the byte code analysis module 122 to display a program flow according to dependency and dependency between each class or method. Create a tree.

In addition, by using the generated hierarchical tree, the detection of the risk code by the detection unit 130 to be described later is made.

The detector 130 detects an analysis target method in which a risk code is estimated based on the hierarchical tree generated from the analyzer 120.

As shown in FIG. 4, the detector 130 may include a first analysis target detection module 131 and a second analysis target detection module 132.

In addition, the first analysis target detecting module 131 detects an analysis target method in which a risk code is estimated based on a position on the hierarchical tree.

In addition, the first analysis object detection module 131 detects a method of a class located at the end of the hierarchical tree, a method having no logic but a parameter, and a method having at least n logic between the start and the return. It may be provided to.

In addition, the second analysis target detection module 132 performs a function of detecting again the analysis target method matching the preset vulnerability pattern among the analysis target methods detected by the first analysis target detection module 131. . In this case, the risk pattern list for matching the vulnerability pattern may be stored in advance in the storage unit 150 to be described later.

Preferably, the second analysis object detecting module 132 may detect an analysis object method having a thread, an analysis object method having a calculation formula for a parameter, and an analysis object method in which a parameter is a conditional clause.

In addition, the analysis target method finally detected by the second analysis target detection module 132 is stored in the storage unit 150 to be described later, so that the list is generated by the setting unit 140 to be described later using this. do.

The setting unit 140 performs a function of classifying the analysis target method detected by the detection unit 130 by a predetermined type and generating a priority list for setting a check order of security vulnerabilities.

As shown in FIG. 5, the setting unit 140 may include an analysis object classification module 141, an analysis object list generation module 142, and a priority list generation module 143.

In addition, the analysis object classification module 141 performs a function of classifying the analysis object method detected by the detection unit 130 by the number of parameters and the parameter types.

In addition, the analysis object list generation module 142 performs a function of generating an analysis object list for an analysis object method classified from the analysis object classification module 141.

In addition, the priority list generation module 143 rearranges the analysis target methods on the analysis target list according to the complexity of the logic to generate a priority list. At this time, the analysis target method may be sorted in the order of high complexity of method logic.

Preferably, the priority list generation module 143 defines the complexity of the method logic as a numerical value and sets the priority using the same, for example, whether a parameter type and an argument received as a parameter of the method go through a calculation formula. And how many branch statements are affected, whether or not to use arithmetic operations, whether to determine the return value through the argument value of the parameter, and which threads affect the return value in the method. Complexity can be defined numerically depending on whether or not there is.

Meanwhile, the complexity value to be defined in the priority list generation module 143 is set in advance by a user input.

The storage unit 150 stores the analysis result of the class file analyzed by the analysis unit 120, the analysis target method detected by the detection unit 130, and a priority list set by the setting unit 140. Do this.

Preferably, the storage unit 150 may be implemented as a database, the detection of the analysis target method from the detection unit 130 is completed, the generation of the priority list by the setting unit 140 is completed and stored Once stored in the unit 150, the process of detecting the hazard code is terminated.

Therefore, the risk code detection system 100 according to an exemplary embodiment of the present invention may provide information on an analysis target method and a priority of a risk code that should check a security vulnerability from a source file.

By using this, in the security vulnerability checking system 10 using the conventional symbol execution, the analysis target method can be selectively checked according to its priority without having to perform a full inspection of the entire source file. And system load can be minimized.

Referring to FIG. 6, a risk code detection method performed in a risk code detection system according to an embodiment of the present invention will be described.

However, since all functions performed in the risk code detection method illustrated in FIG. 6 are performed in the risk code detection system described with reference to FIGS. 1 to 5, all of the functions described with reference to FIGS. 1 to 5 are not required. It should be noted that the function is performed in the risk code detection method according to the preferred embodiment of the present invention, and all the functions described with reference to FIG. 6 are performed as it is in the risk code detection system according to the preferred embodiment of the present invention.

First, the compilation unit generates a class file by compiling a source file to check the security vulnerability (S100).

In this case, the compilation unit loads the source file and the compiled library information of the corresponding source file (S110), and compiles the source file according to the compiled library information to generate a class file (S120).

Next, the analysis unit analyzes the class file to generate a hierarchical tree according to the dependency relationship between the class and the method (S200).

At this time, the analysis unit loads the class file (S210), analyzes the byte code of the class file (S220), and generates a hierarchical tree based on the analyzed byte code information (S230).

Next, the detection unit detects an analysis target method in which a risk code is present based on the hierarchical tree (S300).

In this case, the detection unit first detects an analysis target method in which a risk code is estimated based on a position on the hierarchical tree (S310), and then analyzes an analysis target method matching a predetermined vulnerability pattern among the detected analysis target methods. The process of detecting again is performed (S320).

Next, the setting unit classifies the analysis target method by a predetermined type and sets a check order of security vulnerabilities to generate a priority list (S400).

In this case, the setting unit classifies the analysis target method by the number of parameters and the parameter type (S410), generates an analysis target list of the classified analysis target method (S420), and then analyzes the analysis target method on the corresponding analysis target list in logic. The priority list is generated by rearranging according to the complexity (S430).

Meanwhile, in each of the above-described steps, the analysis result of the class file, the analysis target method, and the priority list may be stored in storage units which are databases.

In addition, after the step S400 is completed, the process of detecting the risk code of the source file is terminated, and the process of selectively checking the analysis target method according to the priority is performed by the security vulnerability check system using symbol execution. Can be.

Although the preferred embodiments of the present invention have been described above by way of example, the scope of the present invention is not limited to these specific embodiments, and may be appropriately changed within the scope described in the claims.

Claims

Compiling unit for compiling the source file to check the security vulnerability to create a class file;

An analysis unit for analyzing a class file generated from the compilation unit and generating a hierarchical tree according to a dependency relationship between a class and a method;

A detection unit for detecting an analysis target method in which a risk code is estimated based on a hierarchical tree generated from the analysis unit; And

And a setting unit classifying the analysis target method detected by the detection unit by a predetermined type, and setting a check order of security vulnerabilities to generate a priority list.
The method of claim 1, wherein the compilation unit,

A source file loading module for loading source files and compilation library information of the source files; And

Compilation module for generating a class file by compiling a source file according to the compilation library information; risk code detection system for security vulnerability check, comprising a.
The method of claim 1, wherein the analysis unit,

A class file loading module for loading class files;

A byte code analysis module for analyzing a byte code of the loaded class file; And

And a hierarchy tree generation module for generating a hierarchy tree based on the analyzed byte code.
The method of claim 1, wherein the detection unit,

A first analyte detection module that detects an analyte method in which a risk code is estimated based on a position on a hierarchical tree; And

Risk analysis for the security vulnerability check, including; a second analysis target detection module for detecting again the analysis target method matching a predetermined vulnerability pattern among the analysis target method detected from the first analysis target detection module; Code detection system.
The method of claim 1, wherein the setting unit,

An analysis object classification module that classifies the analysis object method according to the number of parameters and the parameter types;

An analysis object list generation module for generating an analysis object list for an analysis object method classified from the analysis object classification module; And

And a priority list generation module for rearranging the analysis target methods on the analysis target list according to the complexity of the logic to generate a priority list.
The method according to any one of claims 1 to 5,

And a storage unit for storing an analysis result of the class file analyzed by the analysis unit, an analysis target method detected by the detection unit, and a priority list set by the setting unit. Code detection system.
A risk code detection method performed in a risk code detection system,

(1) the dangerous code detection system generating a class file by compiling a source file to check a security vulnerability;

(2) the risk code detection system analyzing a class file to generate a hierarchical tree according to the dependency relationship between the class and the method;

(3) the risk code detection system detecting a method to be analyzed in which a risk code is estimated based on a hierarchical tree; And

(4) generating a priority list by the risk code detection system, classifying the analysis target method by a predetermined type and setting a check order of security vulnerabilities.
The method of claim 7, wherein the step (1),

(1-1) the dangerous code detection system loading a source file and compiled library information of the source file; And

(1-2) generating a class file by compiling a source file according to the compilation library information by the risk code detection system.
The method of claim 7, wherein the (2) step,

(2-1) the risk code detection system loading a class file;

(2-2) the risk code detection system analyzing the byte code of the loaded class file; And

(2-3) the risk code detection system, generating a hierarchical tree based on the analyzed byte code.
The method of claim 7, wherein the step (3),

(3-1) detecting, by the risk code detection system, a method to be analyzed in which a risk code is estimated based on a position on a hierarchical tree; And

(3-2) the risk code detection system, further detecting, from among the detected analysis target methods, an analysis target method matching a preset vulnerability pattern; Code detection method.
The method of claim 7, wherein the (4) step,

(4-1) classifying, by the risk code detection system, a method to be analyzed by a parameter number and a parameter type;

(4-2) generating, by the risk code detection system, an analysis object list for the classified analysis object method; And

(4-3) a risk code for security vulnerability check, wherein the risk code detection system includes generating a priority list by rearranging the analysis method on the analysis target list according to the complexity of logic; Detection method.
The method according to any one of claims 7 to 11,

The result of analyzing the class file, the method and priority list of the analysis target are stored in the database, respectively.