WO2018086294A1 - 应用软件安全漏洞检测方法、系统、设备及存储介质 - Google Patents
应用软件安全漏洞检测方法、系统、设备及存储介质 Download PDFInfo
- Publication number
- WO2018086294A1 WO2018086294A1 PCT/CN2017/077988 CN2017077988W WO2018086294A1 WO 2018086294 A1 WO2018086294 A1 WO 2018086294A1 CN 2017077988 W CN2017077988 W CN 2017077988W WO 2018086294 A1 WO2018086294 A1 WO 2018086294A1
- Authority
- WO
- WIPO (PCT)
- Prior art keywords
- point
- external input
- call
- application software
- sensitive
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Ceased
Links
Classifications
-
- G—PHYSICS
- G06—COMPUTING OR CALCULATING; COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F11/00—Error detection; Error correction; Monitoring
- G06F11/36—Prevention of errors by analysis, debugging or testing of software
- G06F11/362—Debugging of software
- G06F11/3636—Debugging of software by tracing the execution of the program
Definitions
- the present invention relates to the field of information security technologies, and in particular, to an application software security vulnerability detection method, system, device, and computer readable storage medium.
- This static scan does not correlate program context data, it is only detected according to the established rules, and there are a lot of false positives of security risks; and, Android
- the smali code has a finer language granularity.
- a semantic requires multiple statements.
- the security vulnerability of the application software is detected, the workload is large and the resources are wasted.
- the high-level language code of Java is coarse, and the single statement may contain hidden semantics.
- the security vulnerability detection of the application software is performed, the granularity of the detection is correspondingly coarse, and there is a hidden risk of the security risk.
- the main purpose of the present invention is to provide an application software security vulnerability detection method, system, device and computer readable storage medium, aiming at solving the technical problem that the application software code language affects the security vulnerability detection efficiency.
- the present invention provides an application software security vulnerability detection method, and the application software security vulnerability detection method includes the following steps:
- the external input point corresponding to the sensitive call point is successfully found, the external input point is determined to be a security vulnerability of the application software.
- the step of searching back the external input point corresponding to the sensitive call point according to the variable parameter of the sensitive call point in the application software and the data association structure includes:
- predecessor call point is based on a return value of the function call output, then backtracking to find the predecessor call point of the predecessor call point argument to determine the source node;
- the source node is an external input point, determining that the external input point is an external input point corresponding to the sensitive call point;
- the backtracking is stopped, and it is determined that the external input point corresponding to the sensitive call point is not found.
- the step of searching back the external input point corresponding to the sensitive calling point according to the variable parameter of the sensitive calling point in the application software and the data association structure further includes:
- the step of searching back the external input point corresponding to the sensitive calling point according to the variable parameter of the sensitive calling point in the application software and the data association structure further includes:
- the precursor call point outputs the variable parameter as an assignment, acquiring an right value corresponding to the variable parameter according to the data association structure;
- the right value is a variable input by the external input point, determining that the external input point is an external input point corresponding to the sensitive call point;
- the backtracking is stopped, and it is determined that the external input point corresponding to the sensitive call point is not found.
- the method further includes:
- the present invention further provides an application software security vulnerability detection system, where the application software security vulnerability detection system includes:
- a compiling module for compiling the application software into a preset intermediate language code text
- An association module configured to acquire a data association structure of the application software according to the code text
- a backtracking module configured to backtrack and search for an external input point corresponding to the sensitive calling point according to the variable parameter of the sensitive calling point in the application software and the data association structure;
- a determining module configured to determine that the external input point is a security vulnerability of the application software if the external input point corresponding to the sensitive calling point is successfully found.
- the backtracking module is further configured to:
- the backtracking module is further configured to:
- the backtracking module is further configured to:
- the precursor call point outputs the variable parameter as an assignment, acquiring an right value corresponding to the variable parameter according to the data association structure; and if the right value is a variable input by the external input point, determining the external The input point is an external input point corresponding to the sensitive call point; if the right value is a constant assignment, the backtracking is stopped, and it is determined that the external input point corresponding to the sensitive call point is not found.
- the determining module is further configured to:
- the present invention further provides an application software security vulnerability detecting device, where the application software security vulnerability detecting device includes a processor and a memory, where the application software security vulnerability detecting program is stored in the memory;
- the processor is configured to execute the application security vulnerability detection program to implement the following steps:
- the external input point corresponding to the sensitive call point is successfully found, the external input point is determined to be a security vulnerability of the application software.
- the processor is further configured to execute the application software security vulnerability detection program to implement the following steps:
- predecessor call point is based on a return value of the function call output, then backtracking to find the predecessor call point of the predecessor call point argument to determine the source node;
- the source node is an external input point, determining that the external input point is an external input point corresponding to the sensitive call point;
- the backtracking is stopped, and it is determined that the external input point corresponding to the sensitive call point is not found.
- the processor is further configured to execute the application software security vulnerability detection program to implement the following steps:
- the processor is further configured to execute the application software security vulnerability detection program to implement the following steps:
- the precursor call point outputs the variable parameter as an assignment, acquiring an right value corresponding to the variable parameter according to the data association structure;
- the right value is a variable input by the external input point, determining that the external input point is an external input point corresponding to the sensitive call point;
- the backtracking is stopped, and it is determined that the external input point corresponding to the sensitive call point is not found.
- the processor is further configured to execute the application software security vulnerability detection program to implement the following steps:
- the present invention also provides a computer readable storage medium storing one or more programs, the one or more programs being executable by one or more processors To achieve the following steps:
- the external input point corresponding to the sensitive call point is successfully found, the external input point is determined to be a security vulnerability of the application software.
- the one or more programs are executable by the one or more processors, and the following steps are also implemented:
- predecessor call point is based on a return value of the function call output, then backtracking to find the predecessor call point of the predecessor call point argument to determine the source node;
- the source node is an external input point, determining that the external input point is an external input point corresponding to the sensitive call point;
- the backtracking is stopped, and it is determined that the external input point corresponding to the sensitive call point is not found.
- the one or more programs are executable by the one or more processors, and the following steps are also implemented:
- the one or more programs are executable by the one or more processors, and the following steps are also implemented:
- the precursor call point outputs the variable parameter as an assignment, acquiring an right value corresponding to the variable parameter according to the data association structure;
- the right value is a variable input by the external input point, determining that the external input point is an external input point corresponding to the sensitive call point;
- the backtracking is stopped, and it is determined that the external input point corresponding to the sensitive call point is not found.
- the one or more programs are executable by the one or more processors, and the following steps are also implemented:
- an application software security vulnerability detection method, system, device and computer readable storage medium are provided by the embodiment of the present invention.
- the translated application software code includes a statement A semantic, no ambiguity, suitable for security vulnerability detection; then, according to the intermediate language code text of the application software, obtain the data association structure of the application software, thereby obtaining the function and parameter specific information of each call point in the application software, for Data traceback; then, according to the variable parameters and data association structure of the sensitive call point in the application software, backtracking to find the external input point corresponding to the sensitive call point; if the external input point corresponding to the sensitive call point is successfully found, then the found External input points are security vulnerabilities in the application software and pose risks to the application software.
- the present invention is directed to Android based
- the false positive problem of smali (Android compiler) or java (computer programming language) rule matching detection method using the intermediate language application software program code for data stream analysis, can avoid the rough check of single program code features, and can Through data association structure, data transfer of associated application software context for data backtracking and vulnerability detection, avoiding false positives and false negatives of loopholes; on the other hand, the invention based on compromised intermediate language analysis avoids smali and java language Disadvantages reduce the workload of security vulnerability detection, making the results of vulnerability detection more accurate. Therefore, the invention solves the problems caused by the existing application software code language to the security vulnerability detection, and greatly improves the efficiency of the application software security vulnerability detection.
- FIG. 1 is a schematic flowchart of a first embodiment of a method for detecting a security vulnerability of an application software according to the present invention
- FIG. 2 is a schematic diagram of a refinement process of the step of searching back the external input point corresponding to the sensitive call point according to the variable parameter of the sensitive call point in the application software and the data association structure;
- FIG. 3 is a schematic diagram of a refinement process of the step of searching back the external input point corresponding to the sensitive call point according to the variable parameter of the sensitive call point in the application software and the data association structure;
- FIG. 4 is a schematic flowchart of a second embodiment of a method for detecting a security vulnerability of an application software according to the present invention
- FIG. 5 is a schematic flowchart of a third embodiment of a method for detecting a security vulnerability of an application software according to the present invention.
- FIG. 6 is a schematic diagram of functional modules of a first embodiment, a second embodiment, and a third embodiment of an application software security vulnerability detection system according to the present invention
- FIG. 7 is a schematic structural diagram of a device in a hardware operating environment according to an embodiment of the present invention.
- a first embodiment of an application security vulnerability detection method of the present invention provides an application security vulnerability detection method, where the application software security vulnerability detection method includes:
- Step S10 Compiling the application software into a preset intermediate language code text.
- the invention compiles the application software to be detected into an intermediate language text, and the obtained application software code contains a semantic statement without ambiguity, and the language strength is relatively fine, and the relatively low-level language is thick, which is suitable for static application.
- the program code of the application software to be detected is compiled into an intermediate language by a compiler, and the compiled application software code text is obtained.
- Intermediate language is also called Intermediate Language, referred to as IL.
- the application software code based on the intermediate language can be regarded as a node tree.
- the classes and methods in the application software are the peripheral nodes of the node tree, and the variable parameters in the class and method are the child nodes of the peripheral nodes. It can be seen that after conversion to an intermediate language, the data structure of the application software is clear and easy to perform data traceback.
- Step S20 Acquire a data association structure of the application software according to the code text.
- the data association structure of the software is extracted according to the code text.
- the resulting data association structure includes the type of each call point method or class, member variables, functions, assignments, execution order, and so on.
- the above parameters can be recorded using a data association structure table.
- Step S30 Backtracking and searching for an external input point corresponding to the sensitive call point according to the variable parameter of the sensitive call point in the application software and the data association structure.
- the external input point corresponding to the sensitive call point is searched through the data association structure according to the variable parameter in the sensitive call point of the application software.
- the sensitive call point is the key call point in the application software, or the call point with high security requirements, and the tester can manually determine the sensitive call point to be detected.
- the sensitive call point uses the formal parameter execution function to output the return value
- the parameter of the sensitive call point is the variable parameter, which needs to be traced to the sensitive call point and the parametric parameter. Assigned arguments.
- the source node of the call point that can affect the value of the variable parameter is an external input point
- the step S30 includes:
- Step S31 backtracking and searching for a precursor call point for outputting the variable parameter according to the variable parameter and the data association structure;
- Step S32 if the precursor call point is based on the return value of the function call output, then backtracking to find the precursor call point of the precursor call point argument, and determining the source node;
- Step S33 if the source node is an external input point, determining that the external input point is an external input point corresponding to the sensitive call point;
- Step S34 If the source node is a constant value, the backtracking is stopped, and it is determined that the external input point corresponding to the sensitive calling point is not found.
- the parameter passed to the sensitive call point is A
- the sensitive call point will output the return value according to the A execution function call, and then the formal parameter of the sensitive call point is determined as the variable parameter.
- the predecessor call point of the return or output A in the application software is searched, that is, the call point that outputs A as the return value and the execution order is earlier than the sensitive call point is searched.
- the predecessor call point executes the function call earlier than the comparison call point in the execution order of each call point of the application software. For example, in the above "Finding the call point of output A", the function execution order of the predecessor call point should be earlier than the current sensitive call point.
- the parameter output by the precursor call point 1 is the variable input by the external input point, that is, A is output corresponding to the variable input by the precursor call point 1 according to the external input point, it can be confirmed that the external input point is the source node of the data stream, That is, the external input point corresponding to the current sensitive call point.
- the B seeks to return the B caller's call point according to B, that is, the search outputs B as the return value, and the execution order is earlier than the predecessor call point. The call point of 1, and so on, until the source node of the data stream is found.
- the source node is an external input point, it can be determined that the source node is an external input point corresponding to the sensitive call point.
- the source node is assigned a constant, it can be determined that the external input point is not backtracked, the current sensitive call point is safe, and the backtracking is stopped.
- step S30 further includes:
- Step S35 if the precursor call point outputs the variable parameter as an assignment, acquiring an right value corresponding to the variable parameter according to the data association structure;
- Step S36 if the right value is a variable input by the external input point, determining that the external input point is an external input point corresponding to the sensitive call point;
- Step S37 If the right value is a constant assignment, the backtracking is stopped, and it is determined that the external input point corresponding to the sensitive call point is not found.
- variable parameter value of the sensitive call point is determined by the assignment of the predecessor parameter, that is, the parameter that is passed to the sensitive call point and the variable parameter is assigned is the assignment of the predecessor call point, then the corresponding right value is backtracked according to the data association structure. That is, the right value assigned to the variable parameter passed to the sensitive call point.
- the right value is a variable input by an external input point, that is, the precursor call point is assigned to the output parameter according to the variable input by the external input point, it can be determined that the external input point is an external input point corresponding to the sensitive call point.
- Step S40 If the external input point corresponding to the sensitive call point is successfully found, determine that the external input point is a security vulnerability of the application software.
- the found external input point may be used to input the data, and the sensitive call point is called to bring security risks to the application software.
- the external input point is a security vulnerability of the application software, and the vulnerability is reported.
- the application software to be detected is first compiled into a preset intermediate language code text, and the translated application software code contains a semantic statement, which does not cause ambiguity and is suitable for security vulnerability detection; and then, according to the application software
- the intermediate language code text obtains the data association structure of the application software, thereby obtaining the function and parameter specific information of each call point in the application software for data backtracking; then, according to the variable parameters and data association of the sensitive call point in the application software Structure, backtracking to find the external input point corresponding to the sensitive call point; if the external input point corresponding to the sensitive call point is successfully found, it is determined that the found external input point is a security vulnerability of the application software, which may bring risks to the application software.
- the embodiment is based on Android.
- the false positive problem of smali (Android compiler) or java (computer programming language) rule matching detection method using the intermediate language application software program code for data stream analysis, can avoid the rough check of single program code features, and can Through data association structure, data transfer of associated application software context for data backtracking and vulnerability detection, avoiding false positives and false negatives of loopholes; on the other hand, this embodiment avoids smali and java language based on compromised intermediate language analysis.
- the shortcomings reduce the workload of security vulnerability detection, making the results of vulnerability detection more accurate. Therefore, the embodiment solves the problems caused by the existing application software code language to the security vulnerability detection, and greatly improves the efficiency of the application software security vulnerability detection.
- the second embodiment of the application software security vulnerability detection method of the present invention provides an application software security vulnerability detection method, based on the first embodiment of the application software security vulnerability detection method of the present invention, the step S30 further includes :
- Step S38 if a plurality of output variable parameters are found and the execution order precedes the call point of the sensitive call point, determining that the execution order of the plurality of call points is the last of the near-sensitive call points is the precursor Call point.
- variable parameters and data association structure When data backtracking is performed according to variable parameters and data association structure, multiple call point output parameters may be encountered as the variable parameters.
- the execution order is filtered before the sensitive call point.
- the call point can also be called the call point whose execution order is earlier than the sensitive call point.
- the call point is the current search for the data backtracking call point; if the filter has more call points, then according to this The execution order of multiple call points, determining that the execution order is the latest, but the call point earlier than the sensitive call point is the currently searched, used for further data backtracking call point, that is, the execution order is closest to the sensitive call point.
- the precursor call point If there is only one call point after filtering, it can be determined that the call point is the current search for the data backtracking call point; if the filter has more call points, then according to this The execution order of multiple call points, determining that the execution order is the latest, but the call point earlier than the sensitive call point is the currently searched, used for further data backtracking call point, that is, the execution order is closest to the sensitive call point. The precursor call point.
- the execution order of the call point 2 and the call point 3 is obtained. If call point 2 is executed before call point 3 and sensitive call point is executed later than call point 3, the execution order of call point 3 is closer to the sensitive call point, and call point 3 is determined to be the precursor call point; if call point 3 precedes the call Point 2 execution, the sensitive call point is executed later than call point 2, then the execution order of call point 2 is closer to the sensitive call point, and the call point 2 is determined to be the precursor call point.
- the precursor call point can be uniquely determined, and data lookback and external input point search can be performed by calling point timing.
- the execution order is earlier than the current call point and is closest to the current call point. For the predecessor call point, continue data backtracking.
- a third embodiment of the application security vulnerability detection method of the present invention provides an application security vulnerability detection method, based on the first embodiment or the second embodiment of the application security vulnerability detection method of the present invention.
- the embodiment takes the first embodiment of the application security vulnerability detection method of the present invention as an example.
- the method further includes:
- Step S50 Determine a path backtracking to find the external input point as a dangerous path.
- the path information of the external input point is extracted, and the path of the stain data input from the external input point to the sensitive call point and the infected call points on the path are obtained.
- the above-mentioned storage medium may be a read only memory, a magnetic disk or an optical disk or the like.
- the first embodiment of the application software security vulnerability detection system of the present invention provides an application software security vulnerability detection system, where the application software security vulnerability detection system includes:
- the compiling module 10 is configured to compile the application software into preset intermediate language code text.
- the invention compiles the application software to be detected into an intermediate language text, and the obtained application software code contains a semantic statement without ambiguity, and the language strength is relatively fine, and the relatively low-level language is thick, which is suitable for static application.
- the compiling module 10 compiles the program code of the application software to be detected into an intermediate language by using a compiler, and obtains the compiled application software code text.
- Intermediate language is also called Intermediate Language, referred to as IL.
- the application software code based on the intermediate language can be regarded as a node tree.
- the classes and methods in the application software are the peripheral nodes of the node tree, and the variable parameters in the class and method are the child nodes of the peripheral nodes. It can be seen that after conversion to an intermediate language, the data structure of the application software is clear and easy to perform data traceback.
- the association module 20 is configured to acquire a data association structure of the application software according to the code text.
- the association module 20 After obtaining the intermediate language code text of the application software, the association module 20 extracts the data association structure of the software based on the code text.
- the resulting data association structure includes the type of each call point method or class, member variables, functions, assignments, execution order, and so on.
- the association module 20 can record the above parameters using a data association structure table.
- the backtracking module 30 is configured to backtrack and search for an external input point corresponding to the sensitive calling point according to the variable parameter of the sensitive calling point in the application software and the data association structure.
- the backtracking module 30 searches for an external input point corresponding to the sensitive call point through the data association structure according to the variable parameter in the sensitive call point of the application software.
- the sensitive call point is the key call point in the application software, or the call point with high security requirements, and the tester can manually determine the sensitive call point to be detected.
- the traceback module 30 first needs to determine the variable parameters of the sensitive call point.
- the sensitive call point uses the formal parameter execution function to output the return value
- the parameter of the sensitive call point is the variable parameter, which needs to be traced to the sensitive call point.
- the backtracking module 30 performs data backtracking according to the information of other call points in the data association structure, and searches for the source of the parameter value of the variable to obtain a call point that affects the value of the variable parameter until the found parameter that can affect the variable is affected.
- the data callback is stopped when the call point of the value is the source node, such as constant assignment, external input point, and so on.
- the backtracking module 30 determines that the external input point is an external input point corresponding to the sensitive call point, and the data input by the external input point can influence and control the sensitivity. Calling points pose a risk to the application.
- the backtracking module 30 is further configured to:
- the parameter passed to the sensitive call point is A
- the sensitive call point will output the return value according to the A execution function call
- the backtracking module 30 determines the parameter of the sensitive call point as the variable parameter.
- the backtracking module 30 searches for the predecessor call point of the return or output A in the application software according to the information of each call point recorded in the data association structure, that is, finds the call that outputs A as the return value and the execution order is earlier than the sensitive call point. point.
- the predecessor call point executes the function call earlier than the comparison call point in the execution order of each call point of the application software. For example, in the above "Finding the call point of output A", the function execution order of the predecessor call point should be earlier than the current sensitive call point.
- the traceback module 30 determines whether the parameter output by the precursor call point 1 is a variable input by the external input point.
- the traceback module 30 can confirm that the external input point is the data stream.
- the source node which is the external input point corresponding to the current sensitive call point.
- the traceback module 30 continues to search for the precursor call point of return B according to B, that is, the search outputs B as the return value, and the execution order is earlier than The caller invokes point 1 of the caller, and so on, until the source node of the data stream is found.
- the traceback module 30 can determine to find the source node as an external input point corresponding to the sensitive call point.
- the backtracking module 30 can determine that the current input point is not backtracked, the current sensitive call point is safe, and the backtracking is stopped.
- the backtracking module 30 is further configured to:
- the precursor call point outputs the variable parameter as an assignment, acquiring an right value corresponding to the variable parameter according to the data association structure; and if the right value is a variable input by the external input point, determining the external The input point is an external input point corresponding to the sensitive call point; if the right value is a constant assignment, the backtracking is stopped, and it is determined that the external input point corresponding to the sensitive call point is not found.
- variable parameter value of the sensitive call point is determined by the assignment of the predecessor parameter, that is, the parameter that is passed to the sensitive call point and the variable parameter is assigned is the assignment of the predecessor call point
- the backtracking module 30 backtracks the corresponding data according to the data association structure.
- the right value which is the right value that is assigned to the variable parameter passed to the sensitive call point.
- the backtracking module 30 can determine that the external input point is the external corresponding to the sensitive call point. Enter the point.
- the backtracking module 30 can determine the current data chain security, does not go back to the external input point, and stops the backtracking.
- the determining module 40 is configured to determine that the external input point is a security vulnerability of the application software if the external input point corresponding to the sensitive calling point is successfully found.
- the found external input point may be used to input the data, and the sensitive call point is called to bring security risks to the application software.
- the determining module 40 can determine that the external input point is a security vulnerability of the current application software, and perform vulnerability reporting.
- the compiling module 10 first compiles the application software to be detected into a preset intermediate language code text, and the translated application software code contains a semantic statement, which does not cause ambiguity and is suitable for detecting security vulnerabilities;
- the association module 20 obtains the data association structure of the application software according to the intermediate language code text of the application software, thereby obtaining function and parameter specific information of each call point in the application software for data backtracking; then, the backtracking module 30 is according to the application software.
- the variable parameter and the data association structure of the sensitive call point are backtracked to find the external input point corresponding to the sensitive call point; if the external input point corresponding to the sensitive call point is successfully found, the determining module determines that the found external input point is the security of the application software.
- Vulnerabilities can pose risks to applications.
- it is based on Android.
- the false positive problem of smali (Android compiler) or java (computer programming language) rule matching detection method using the intermediate language application software program code for data stream analysis, can avoid the rough check of single program code features, and can Through data association structure, data transfer of associated application software context for data backtracking and vulnerability detection, avoiding false positives and false negatives of loopholes; on the other hand, this embodiment avoids smali and java language based on compromised intermediate language analysis.
- the shortcomings reduce the workload of security vulnerability detection, making the results of vulnerability detection more accurate. Therefore, the embodiment solves the problems caused by the existing application software code language to the security vulnerability detection, and greatly improves the efficiency of the application software security vulnerability detection.
- the second embodiment of the application software security vulnerability detection system of the present invention provides an application software security vulnerability detection system. Based on the first embodiment of the application software security vulnerability detection system of the present invention, the backtracking module 30 further Used for
- the traceback module 30 first selects the execution order before the execution order of each call point.
- the call point of a sensitive call point can also be called the call point whose execution order is earlier than the sensitive call point.
- the backtracking module 30 can determine that the call point is the currently searched for the data backtracking call point; if the screen has more than one call point, then The backtracking module 30 determines, according to the execution order of the plurality of call points, that the call point that is executed at the latest but earlier than the sensitive call point is the currently searched, and is used for further data backtracking call point, that is, the execution order is determined. Near the sensitive call point is the precursor call point.
- the execution order of the call point 2 and the call point 3 is obtained. If call point 2 is executed before call point 3 and sensitive call point is executed later than call point 3, the execution order of call point 3 is closer to the sensitive call point, and call point 3 is determined to be the precursor call point; if call point 3 precedes the call Point 2 execution, the sensitive call point is executed later than call point 2, then the execution order of call point 2 is closer to the sensitive call point, and the call point 2 is determined to be the precursor call point.
- the traceback module 30 can uniquely determine the precursor call point, and realizes data backtracking and external input point search by calling point timing.
- the traceback module 30 selects the execution order earlier than the current call point and is closest.
- the current call point is the predecessor call point, and the data backtracking is continued.
- the traceback module 30 determines that the execution order closest to the sensitive call point among the plurality of call points is the precursor call point. This embodiment solves the problem that the data of the front-end call point cannot be determined when the variable parameters that need to be traced back are outputted by multiple call points during the data back-tracking process, so that the data backtracking can be smoothly performed.
- the third embodiment of the application security vulnerability detection system of the present invention provides an application security vulnerability detection system, based on the first embodiment or the second embodiment of the application security vulnerability detection system of the present invention.
- the determining module 40 is also used to,
- the determining module 40 extracts the path information of the external input point, obtains the path of the stain data input from the external input point to the sensitive call point, and the infected each on the path. Call point.
- the determining module 40 marks the path as a dangerous path, so that the developer can understand the specific risk of the sensitive calling point to improve the completeness of the application software.
- the determining module 40 determines that the path of the corresponding call point corresponding to the external input point is found to be a dangerous path, so that the developer can further analyze the cause of the vulnerability and improve the security of the application software.
- the above compiling module 10, the associating module 20, the backtracking module 30, and the determining module 40 may be embedded in or independent of the application software security vulnerability detecting system in hardware form, or may be in the form of software. Stored in the memory of the application security vulnerability detection system, so that the processor calls to perform the operations corresponding to the above modules.
- the processor can be a central processing unit (CPU), a microprocessor, a microcontroller, or the like.
- FIG. 7 is a schematic structural diagram of a device in a hardware operating environment according to an embodiment of the present invention.
- the application security vulnerability detecting device in the embodiment of the present invention may be a PC, or may be a terminal device such as a smart phone, a tablet computer, an e-book reader, or a portable computer.
- the application software security vulnerability detecting device may include a processor 1001, such as a CPU, and a memory 1002. Connection communication between these components can be achieved via a communication bus.
- the memory 1002 may be a high speed RAM memory or a stable memory (non-volatile) Memory), such as disk storage.
- the memory 1002 can also optionally be a storage device independent of the aforementioned processor 1001.
- the application security vulnerability detecting device may further include a user interface, a network interface, a camera, and an RF (Radio). Frequency, RF) circuits, sensors, audio circuits, WiFi modules, and more.
- the user interface may include a display, an input unit such as a keyboard, and the optional user interface may also include a standard wired interface and a wireless interface.
- the network interface can optionally include a standard wired interface or a wireless interface (such as a WI-FI interface).
- the application software security vulnerability detecting device structure shown in FIG. 7 does not constitute a limitation on the application software security vulnerability detecting device, and may include more or less components than the illustration, or a combination of some Parts, or different parts.
- an operating system and an application software security vulnerability detecting program may be included in the memory 1002 as a computer storage medium.
- the operating system is a program that manages and controls the hardware and software resources of the application security vulnerability detection device, and supports the operation of the application security vulnerability detection program and other software or programs.
- the processor 1001 can be configured to execute an application security vulnerability detection program stored in the memory 1002 to implement the following steps:
- the external input point corresponding to the sensitive call point is successfully found, the external input point is determined to be a security vulnerability of the application software.
- processor 1001 can also execute an application security vulnerability detection program stored in the memory 1002 to implement the following steps:
- predecessor call point is based on a return value of the function call output, then backtracking to find the predecessor call point of the predecessor call point argument to determine the source node;
- the source node is an external input point, determining that the external input point is an external input point corresponding to the sensitive call point;
- the backtracking is stopped, and it is determined that the external input point corresponding to the sensitive call point is not found.
- processor 1001 can also execute an application security vulnerability detection program stored in the memory 1002 to implement the following steps:
- processor 1001 can also execute an application security vulnerability detection program stored in the memory 1002 to implement the following steps:
- the precursor call point outputs the variable parameter as an assignment, acquiring an right value corresponding to the variable parameter according to the data association structure;
- the right value is a variable input by the external input point, determining that the external input point is an external input point corresponding to the sensitive call point;
- the backtracking is stopped, and it is determined that the external input point corresponding to the sensitive call point is not found.
- processor 1001 can also execute an application security vulnerability detection program stored in the memory 1002 to implement the following steps:
- the specific embodiment of the application software security vulnerability detecting device of the present invention is basically the same as the foregoing embodiment of the application software security vulnerability detecting method and system, and details are not described herein.
- the present invention provides a computer readable storage medium storing one or more programs, the one or more programs being executable by one or more processors to implement the following steps:
- the external input point corresponding to the sensitive call point is successfully found, the external input point is determined to be a security vulnerability of the application software.
- the one or more programs may be executed by the one or more processors, and the following steps are also implemented:
- predecessor call point is based on a return value of the function call output, then backtracking to find the predecessor call point of the predecessor call point argument to determine the source node;
- the source node is an external input point, determining that the external input point is an external input point corresponding to the sensitive call point;
- the backtracking is stopped, and it is determined that the external input point corresponding to the sensitive call point is not found.
- the one or more programs may be executed by the one or more processors, and the following steps are also implemented:
- the one or more programs may be executed by the one or more processors, and the following steps are also implemented:
- the precursor call point outputs the variable parameter as an assignment, acquiring an right value corresponding to the variable parameter according to the data association structure;
- the right value is a variable input by the external input point, determining that the external input point is an external input point corresponding to the sensitive call point;
- the backtracking is stopped, and it is determined that the external input point corresponding to the sensitive call point is not found.
- the one or more programs may be executed by the one or more processors, and the following steps are also implemented:
- the technical solution of the present invention which is essential or contributes to the prior art, may be embodied in the form of a software product stored in a storage medium (such as ROM/RAM, disk,
- a storage medium such as ROM/RAM, disk,
- the optical disc includes a number of instructions for causing a terminal device (which may be a cell phone, a computer, a server, or a network device, etc.) to perform the methods described in various embodiments of the present invention.
Landscapes
- Engineering & Computer Science (AREA)
- Theoretical Computer Science (AREA)
- Computer Hardware Design (AREA)
- Quality & Reliability (AREA)
- Physics & Mathematics (AREA)
- General Engineering & Computer Science (AREA)
- General Physics & Mathematics (AREA)
- Debugging And Monitoring (AREA)
Abstract
一种应用软件安全漏洞检测方法、系统、设备和计算机可读存储介质。该方法包括：将应用软件编译为预设的中间语言代码文本（S10）；根据所述代码文本，获取所述应用软件的数据关联结构（S20）；根据所述应用软件中敏感调用点的变量参数及所述数据关联结构，回溯查找所述敏感调用点对应的外部输入点（S30）；若成功查找到所述敏感调用点对应的外部输入点，则确定所述外部输入点为所述应用软件的安全漏洞（S40）。该方法大大提升了应用软件安全漏洞检测的效率。
Description
技术领域
本发明涉及信息安全技术领域，尤其涉及一种应用软件安全漏洞检测方法、系统、设备及计算机可读存储介质。
背景技术
现有应用软件漏洞静态检测方案通常是基于Android
smali（安卓编译器）或者java（计算机编程语言）源码的规则扫描，通过采用预定义的正则或字符串特征的匹配检查方式，判断应用软件的代码模式是否存在问题。
由于这种静态扫描未关联程序上下文数据，仅根据既定的规则检测，容易存在大量安全隐患的误报；并且，Android
smali代码的语言粒度较细，一个语义需要多条语句表示，在进行应用软件的安全漏洞检测时，工作量大，浪费资源；而java高级语言代码的粒度偏粗，单一语句可能包含隐藏的语义，在进行应用软件的安全漏洞检测时，检测的粒度也相应较粗，存在安全隐患漏报。
可见，现有的应用软件安全漏洞检测方式受代码语言影响，检测效率较低。
发明内容
本发明的主要目的在于提供一种应用软件安全漏洞检测方法、系统、设备及计算机可读存储介质，旨在解决应用软件代码语言影响安全漏洞检测效率的技术问题。
为实现上述目的，本发明提供一种应用软件安全漏洞检测方法，所述应用软件安全漏洞检测方法包括以下步骤：
将应用软件编译为预设的中间语言代码文本；
根据所述代码文本，获取所述应用软件的数据关联结构；
根据所述应用软件中敏感调用点的变量参数及所述数据关联结构，回溯查找所述敏感调用点对应的外部输入点；
若成功查找到所述敏感调用点对应的外部输入点，则确定所述外部输入点为所述应用软件的安全漏洞。
优选地，所述根据所述应用软件中敏感调用点的变量参数及所述数据关联结构，回溯查找所述敏感调用点对应的外部输入点的步骤包括：
根据所述变量参数及所述数据关联结构，回溯查找输出所述变量参数的前驱调用点；
若所述前驱调用点是基于函数调用输出的返回值，则再次回溯查找返回所述前驱调用点实参的前驱调用点，确定源节点；
若所述源节点为外部输入点，则确定所述外部输入点为所述敏感调用点对应的外部输入点；
若所述源节点为常量赋值，则停止回溯，确定未找到所述敏感调用点对应的外部输入点。
优选地，所述根据所述应用软件中敏感调用点的变量参数及所述数据关联结构，回溯查找所述敏感调用点对应的外部输入点的步骤，还包括：
若找到多个输出所述变量参数且执行顺序先于所述敏感调用点的调用点，则确定所述多个调用点中执行顺序最接所述近敏感调用点的为所述前驱调用点。
优选地，所述根据所述应用软件中敏感调用点的变量参数及所述数据关联结构，回溯查找所述敏感调用点对应的外部输入点的步骤，还包括：
若所述前驱调用点将所述变量参数作为赋值输出，则根据所述数据关联结构获取所述变量参数对应的右值；
若所述右值为外部输入点输入的变量，则确定所述外部输入点为所述敏感调用点对应的外部输入点；
若所述右值为常量赋值，则停止回溯，确定未找到所述敏感调用点对应的外部输入点。
优选地，所述确定所述外部输入点为所述应用软件的安全漏洞的步骤之后，还包括：
确定回溯找到所述外部输入点的路径为危险路径。
此外，为实现上述目的，本发明还提供一种应用软件安全漏洞检测系统，所述应用软件安全漏洞检测系统包括：
编译模块，用于将应用软件编译为预设的中间语言代码文本；
关联模块，用于根据所述代码文本，获取所述应用软件的数据关联结构；
回溯模块，用于根据所述应用软件中敏感调用点的变量参数及所述数据关联结构，回溯查找所述敏感调用点对应的外部输入点；
确定模块，用于若成功查找到所述敏感调用点对应的外部输入点，则确定所述外部输入点为所述应用软件的安全漏洞。
优选地，所述回溯模块还用于，
根据所述变量参数及所述数据关联结构，回溯查找输出所述变量参数的前驱调用点；若所述前驱调用点是基于函数调用输出的返回值，则再次回溯查找返回所述前驱调用点实参的前驱调用点，确定源节点；若所述源节点为外部输入点，则确定所述外部输入点为所述敏感调用点对应的外部输入点；若所述源节点为常量赋值，则停止回溯，确定未找到所述敏感调用点对应的外部输入点。
优选地，所述回溯模块还用于，
若找到多个输出所述变量参数且执行顺序先于所述敏感调用点的调用点，则确定所述多个调用点中执行顺序最接所述近敏感调用点的为所述前驱调用点。
优选地，所述回溯模块还用于，
若所述前驱调用点将所述变量参数作为赋值输出，则根据所述数据关联结构获取所述变量参数对应的右值；若所述右值为外部输入点输入的变量，则确定所述外部输入点为所述敏感调用点对应的外部输入点；若所述右值为常量赋值，则停止回溯，确定未找到所述敏感调用点对应的外部输入点。
优选地，所述确定模块还用于，
确定回溯找到所述外部输入点的路径为危险路径。
此外，为实现上述目的，本发明还提供一种应用软件安全漏洞检测设备，所述应用软件安全漏洞检测设备包括处理器和存储器，所述存储器中存储有应用软件安全漏洞检测程序；
所述处理器用于执行所述应用软件安全漏洞检测程序，以实现以下步骤：
将应用软件编译为预设的中间语言代码文本；
根据所述代码文本，获取所述应用软件的数据关联结构；
根据所述应用软件中敏感调用点的变量参数及所述数据关联结构，回溯查找所述敏感调用点对应的外部输入点；
若成功查找到所述敏感调用点对应的外部输入点，则确定所述外部输入点为所述应用软件的安全漏洞。
优选地，所述处理器还用于执行所述应用软件安全漏洞检测程序，以实现以下步骤：
根据所述变量参数及所述数据关联结构，回溯查找输出所述变量参数的前驱调用点；
若所述前驱调用点是基于函数调用输出的返回值，则再次回溯查找返回所述前驱调用点实参的前驱调用点，确定源节点；
若所述源节点为外部输入点，则确定所述外部输入点为所述敏感调用点对应的外部输入点；
若所述源节点为常量赋值，则停止回溯，确定未找到所述敏感调用点对应的外部输入点。
优选地，所述处理器还用于执行所述应用软件安全漏洞检测程序，以实现以下步骤：
若找到多个输出所述变量参数且执行顺序先于所述敏感调用点的调用点，则确定所述多个调用点中执行顺序最接所述近敏感调用点的为所述前驱调用点。
优选地，所述处理器还用于执行所述应用软件安全漏洞检测程序，以实现以下步骤：
若所述前驱调用点将所述变量参数作为赋值输出，则根据所述数据关联结构获取所述变量参数对应的右值；
若所述右值为外部输入点输入的变量，则确定所述外部输入点为所述敏感调用点对应的外部输入点；
若所述右值为常量赋值，则停止回溯，确定未找到所述敏感调用点对应的外部输入点。
优选地，所述处理器还用于执行所述应用软件安全漏洞检测程序，以实现以下步骤：
确定回溯找到所述外部输入点的路径为危险路径。
此外，为实现上述目的，本发明还提供一种计算机可读存储介质，所述计算机可读存储介质存储有一个或者多个程序，所述一个或者多个程序可被一个或者多个处理器执行，以实现以下步骤：
将应用软件编译为预设的中间语言代码文本；
根据所述代码文本，获取所述应用软件的数据关联结构；
根据所述应用软件中敏感调用点的变量参数及所述数据关联结构，回溯查找所述敏感调用点对应的外部输入点；
若成功查找到所述敏感调用点对应的外部输入点，则确定所述外部输入点为所述应用软件的安全漏洞。
优选地，所述一个或者多个程序可被所述一个或者多个处理器执行，还实现以下步骤：
根据所述变量参数及所述数据关联结构，回溯查找输出所述变量参数的前驱调用点；
若所述前驱调用点是基于函数调用输出的返回值，则再次回溯查找返回所述前驱调用点实参的前驱调用点，确定源节点；
若所述源节点为外部输入点，则确定所述外部输入点为所述敏感调用点对应的外部输入点；
若所述源节点为常量赋值，则停止回溯，确定未找到所述敏感调用点对应的外部输入点。
优选地，所述一个或者多个程序可被所述一个或者多个处理器执行，还实现以下步骤：
若找到多个输出所述变量参数且执行顺序先于所述敏感调用点的调用点，则确定所述多个调用点中执行顺序最接所述近敏感调用点的为所述前驱调用点。
优选地，所述一个或者多个程序可被所述一个或者多个处理器执行，还实现以下步骤：
若所述前驱调用点将所述变量参数作为赋值输出，则根据所述数据关联结构获取所述变量参数对应的右值；
若所述右值为外部输入点输入的变量，则确定所述外部输入点为所述敏感调用点对应的外部输入点；
若所述右值为常量赋值，则停止回溯，确定未找到所述敏感调用点对应的外部输入点。
优选地，所述一个或者多个程序可被所述一个或者多个处理器执行，还实现以下步骤：
确定回溯找到所述外部输入点的路径为危险路径。
本发明实施例提出的一种应用软件安全漏洞检测方法、系统、设备和计算机可读存储介质，通过将待检测应用软件编译为预设的中间语言代码文本，转换后的应用软件代码一条语句包含一条语义，不会产生歧义，适合做安全漏洞检测；然后，根据应用软件的中间语言代码文本，获取应用软件的数据关联结构，从而得到应用软件中各调用点的函数及参数具体信息，以供进行数据回溯；然后，根据应用软件中敏感调用点的变量参数及数据关联结构，回溯查找敏感调用点对应的外部输入点；若成功查找到敏感调用点对应的外部输入点，则确定此找到的外部输入点为应用软件的安全漏洞，会给应用软件带来风险。本发明针对基于Android
smali（安卓编译器）或者java（计算机编程语言）的规则匹配检测方法存在的误报问题，采用中间语言的应用软件程序代码进行数据流分析，既可避免单一程序代码特征的粗糙检查，又能够通过数据关联结构，关联应用软件上下文的数据传递进行数据回溯、漏洞检测，避免了漏洞的误报和漏报；另一方面，本发明基于折中的中间语言的分析规避了smali和java语言的缺点，降低了安全漏洞检测的工作量，使得漏洞检测的结果更准确。由此，本发明解决了现有的应用软件代码语言给安全漏洞检测带来的各项困扰，大大提升了应用软件安全漏洞检测的效率。
附图说明
图1为本发明应用软件安全漏洞检测方法第一实施例的流程示意图；
图2为图1中根据所述应用软件中敏感调用点的变量参数及所述数据关联结构，回溯查找所述敏感调用点对应的外部输入点的步骤的细化流程示意图；
图3为图1中根据所述应用软件中敏感调用点的变量参数及所述数据关联结构，回溯查找所述敏感调用点对应的外部输入点的步骤的细化流程示意图；
图4为本发明应用软件安全漏洞检测方法第二实施例的流程示意图；
图5为本发明应用软件安全漏洞检测方法第三实施例的流程示意图；
图6为本发明应用软件安全漏洞检测系统第一实施例、第二实施例、第三实施例的功能模块示意图；
图7是本发明实施例方案涉及的硬件运行环境的设备结构示意图。
本发明目的的实现、功能特点及优点将结合实施例，参照附图做进一步说明。
具体实施方式
应当理解，此处所描述的具体实施例仅仅用以解释本发明，并不用于限定本发明。
参照图1，本发明应用软件安全漏洞检测方法第一实施例提供一种应用软件安全漏洞检测方法，所述应用软件安全漏洞检测方法包括：
步骤S10、将应用软件编译为预设的中间语言代码文本。
本发明通过将待检测应用软件编译为中间语言文本，得到的应用软件代码一条语句包含一条语义，不会产生歧义，而且语言力度相对高级语言较细，相对低级语言较粗，适合进行静态的应用软件安全漏洞检测；而且，本发明综合应用软件的数据关联结构，结合程序上下文的语言传递，避免单一代码特征的粗糙检测造成的漏洞的误报、漏报，并且提高了安全漏洞检测效率。
具体的，作为一种实施方式，首先，通过编译器将待检测应用软件的程序代码编译为中间语言，得到编译后的应用软件代码文本。中间语言也称为Intermediate
Language，简称IL。
基于中间语言的应用软件代码可视为节点树，应用软件中的类、方法为节点树的外围节点，类、方法中的变量参数等为外围节点的子节点。可以看出，转换为中间语言后，应用软件的数据结构清楚明了，便于进行数据回溯。
步骤S20、根据所述代码文本，获取所述应用软件的数据关联结构。
在得到应用软件的中间语言代码文本后，根据代码文本，提取用软件的数据关联结构。
得到的数据关联结构包括各调用点方法或类的类型、成员变量、函数、赋值、执行顺序等。为便于使用，可使用数据关联结构表记载上述参数。
步骤S30、根据所述应用软件中敏感调用点的变量参数及所述数据关联结构，回溯查找所述敏感调用点对应的外部输入点。
在得到应用软件的数据关联结构后，根据应用软件的敏感调用点中的变量参数，通过数据关联结构查找敏感调用点对应的外部输入点。其中，敏感调用点是应用软件中的关键调用点，或是安全性要求要高的调用点，可以由测试人员人为确定需检测的敏感调用点。
具体的，首先需要确定敏感调用点的变量参数，例如，敏感调用点使用形参执行函数输出返回值，则敏感调用点的形参即为变量参数，需要追踪传递给敏感调用点、对形参赋值的实参。
然后，根据数据关联结构中其他调用点的信息，进行数据回溯，查找此变量参数数值的来源，以获取影响此变量参数的值的调用点，直至查找到的能够影响此变量参数的值的调用点为源节点，例如常量赋值、外部输入点等时，停止数据回溯。
需要说明的是，源节点的参数不再受应用软件内部其他调用点的影响。
若能够影响此变量参数的值的调用点的源节点为外部输入点，则确定此外部输入点为敏感调用点对应的外部输入点，此外部输入点输入的数据能够影响、控制敏感调用点，给应用软件造成风险。
作为一种实施方式，参照图2，所述步骤S30包括：
步骤S31、根据所述变量参数及所述数据关联结构，回溯查找输出所述变量参数的前驱调用点；
步骤S32、若所述前驱调用点是基于函数调用输出的返回值，则再次回溯查找返回所述前驱调用点实参的前驱调用点，确定源节点；
步骤S33、若所述源节点为外部输入点，则确定所述外部输入点为所述敏感调用点对应的外部输入点；
步骤S34、若所述源节点为常量赋值，则停止回溯，确定未找到所述敏感调用点对应的外部输入点。
例如，主函数调用当前敏感调用点时，传递给敏感调用点的参数为A，敏感调用点根据A执行函数调用后会对应输出返回值，则确定敏感调用点的形参为变量参数。
然后，根据数据关联结构中记载的各调用点的信息，查找应用软件中返回或输出A的前驱调用点，也即查找将A作为返回值输出且执行顺序早于敏感调用点的调用点。
需要说明的是，前驱调用点在应用软件的各调用点执行顺序中，早于对比调用点执行函数调用。例如上述“查找输出A的前驱调用点”中，前驱调用点的函数执行顺序应当早于当前敏感调用点。
若前驱调用点1输出的返回值为A，则判断前驱调用点1输出的参数是否为外部输入点输入的变量。
若前驱调用点1输出的参数是外部输入点输入的变量，也即A是由前驱调用点1根据外部输入点输入的变量对应输出的，则可以确认此外部输入点为数据流的源节点，也就是当前敏感调用点对应的外部输入点。
若前驱调用点1是根据输入的实参B，执行函数调用运算得到A，则根据B继续查找返回B的前驱调用点，也即查找将B作为返回值输出，且执行顺序早于前驱调用点1的调用点，以此类推，直至找到数据流的源节点。
若源节点为外部输入点，则可以确定找到源节点为敏感调用点对应的外部输入点。
若源节点为常量赋值，则可以确定未回溯到外部输入点，当前敏感调用点安全，停止回溯。
进一步地，作为另一种实施方式，参照图3，所述步骤S30还包括：
步骤S35、若所述前驱调用点将所述变量参数作为赋值输出，则根据所述数据关联结构获取所述变量参数对应的右值；
步骤S36、若所述右值为外部输入点输入的变量，则确定所述外部输入点为所述敏感调用点对应的外部输入点；
步骤S37、若所述右值为常量赋值，则停止回溯，确定未找到所述敏感调用点对应的外部输入点。
若敏感调用点的变量参数值是由前驱参数的赋值决定的，也即传递给敏感调用点、对变量参数进行赋值的参数是前驱调用点的赋值，则根据数据关联结构回溯对应的右值，也即对传递给敏感调用点的变量参数进行赋值的右值。
若此右值是外部输入点输入的变量，也即前驱调用点是根据外部输入点输入的变量对输出的参数进行赋值的，则可以确定此外部输入点为敏感调用点对应的外部输入点。
若右值为常量赋值，则可以确定当前数据链安全，未回溯到外部输入点，停止回溯。
由此，实现了对函数调用和赋值的数据追踪，保障了回溯调用点的完整性和准确性。
步骤S40、若成功查找到所述敏感调用点对应的外部输入点，则确定所述外部输入点为所述应用软件的安全漏洞。
若成功回溯数据找到敏感调用点对应的外部输入点，则找到的外部输入点可能会被利用输入数据，调用此敏感调用点，给应用软件带来安全隐患。
由此，可以确定此外部输入点为应用软件的安全漏洞，进行漏洞上报。
在本实施例中，首先将待检测应用软件编译为预设的中间语言代码文本，转换后的应用软件代码一条语句包含一条语义，不会产生歧义，适合做安全漏洞检测；然后，根据应用软件的中间语言代码文本，获取应用软件的数据关联结构，从而得到应用软件中各调用点的函数及参数具体信息，以供进行数据回溯；然后，根据应用软件中敏感调用点的变量参数及数据关联结构，回溯查找敏感调用点对应的外部输入点；若成功查找到敏感调用点对应的外部输入点，则确定此找到的外部输入点为应用软件的安全漏洞，会给应用软件带来风险。本实施例中针对基于Android
smali（安卓编译器）或者java（计算机编程语言）的规则匹配检测方法存在的误报问题，采用中间语言的应用软件程序代码进行数据流分析，既可避免单一程序代码特征的粗糙检查，又能够通过数据关联结构，关联应用软件上下文的数据传递进行数据回溯、漏洞检测，避免了漏洞的误报和漏报；另一方面，本实施例基于折中的中间语言的分析规避了smali和java语言的缺点，降低了安全漏洞检测的工作量，使得漏洞检测的结果更准确。由此，本实施例解决了现有的应用软件代码语言给安全漏洞检测带来的各项困扰，大大提升了应用软件安全漏洞检测的效率。
进一步地，参照图4，本发明应用软件安全漏洞检测方法第二实施例提供一种应用软件安全漏洞检测方法，基于上述本发明应用软件安全漏洞检测方法第一实施例，所述步骤S30还包括：
步骤S38、若找到多个输出所述变量参数且执行顺序先于所述敏感调用点的调用点，则确定所述多个调用点中执行顺序最接所述近敏感调用点的为所述前驱调用点。
在根据变量参数及数据关联结构进行数据回溯时，可能会遇到多个调用点输出参数均为此变量参数，此时，首先根据各调用点的执行顺序，筛选出执行顺序先于敏感调用点的调用点，也可称为执行顺序早于敏感调用点的调用点。
若筛选后，得到的调用点只有一个，则就可以确定此调用点为当前查找的、用于进一步进行数据回溯前驱调用点；若筛选后，得到的调用点有多个，则此时根据这多个调用点的执行顺序，确定执行顺序最晚、但早于敏感调用点的调用点为当前查找的、用于进一步进行数据回溯前驱调用点，也即确定执行顺序最接近敏感调用点的为前驱调用点。
例如，基于上述本发明应用软件安全漏洞检测方法第一实施例，若输出变量参数A的调用点包括调用点2、调用点3，则获取调用点2、调用点3的执行顺序。若调用点2先于调用点3执行，敏感调用点晚于调用点3执行，则调用点3的执行顺序更加接近敏感调用点，确定调用点3为前驱调用点；若调用点3先于调用点2执行，敏感调用点晚于调用点2执行，则调用点2的执行顺序更加接近敏感调用点，确定调用点2为前驱调用点。
由此，在有多个调用点输出变量参数时，可以唯一确定前驱调用点，实现了通过调用点时序，进行数据回溯和外部输入点的查找。
同理，在后续回溯数据时，若遇到多个调用点输出的参数均为当前回溯的参数、无法确定前驱调用点的情况时，选取执行顺序早于当前调用点、且最接近当前调用点的为前驱调用点，继续进行数据回溯。
在本实施例中，若找到多个输出变量参数且执行顺序先于敏感调用点的调用点，则确定多个调用点中执行顺序最接近敏感调用点的为前驱调用点。本实施例解决了在数据回溯过程中，遇到多个调用点输出所需要回溯的变量参数时无法确定前驱调用点的问题，使得数据回溯能够顺利进行。
进一步地，参照图5，本发明应用软件安全漏洞检测方法第三实施例提供一种应用软件安全漏洞检测方法，基于上述本发明应用软件安全漏洞检测方法第一实施例或第二实施例（本实施例以上述本发明应用软件安全漏洞检测方法第一实施例为例），所述步骤S40之后，还包括：
步骤S50、确定回溯找到所述外部输入点的路径为危险路径。
当成功找到敏感调用点对应的外部输入点时，将找到外部输入点的路径信息提取出来，得到从外部输入点输入的污点数据流向敏感调用点的路径，以及路径上被感染的各调用点。
然后，标记此路径为危险路径，便于研发人员了解敏感调用点的具体风险，以提高应用软件的完全性。
在本实施例中，确定回溯找到敏感调用点对应外部输入点的路径为危险路径，以便于研发人员进行进一步地漏洞原因分析、提升应用软件的安全性。
需要说明的是，本领域普通技术人员可以理解实现上述实施例的全部或部分步骤可以通过硬件来完成，也可以通过程序来指令相关的硬件完成，所述的程序可以存储于一种计算机可读存储介质中，上述提到的存储介质可以是只读存储器，磁盘或光盘等。
参照图6，本发明应用软件安全漏洞检测系统第一实施例提供一种应用软件安全漏洞检测系统，所述应用软件安全漏洞检测系统包括：
编译模块10，用于将应用软件编译为预设的中间语言代码文本。
本发明通过将待检测应用软件编译为中间语言文本，得到的应用软件代码一条语句包含一条语义，不会产生歧义，而且语言力度相对高级语言较细，相对低级语言较粗，适合进行静态的应用软件安全漏洞检测；而且，本发明综合应用软件的数据关联结构，结合程序上下文的语言传递，避免单一代码特征的粗糙检测造成的漏洞的误报、漏报，并且提高了安全漏洞检测效率。
具体的，作为一种实施方式，首先，编译模块10通过编译器将待检测应用软件的程序代码编译为中间语言，得到编译后的应用软件代码文本。中间语言也称为Intermediate
Language，简称IL。
基于中间语言的应用软件代码可视为节点树，应用软件中的类、方法为节点树的外围节点，类、方法中的变量参数等为外围节点的子节点。可以看出，转换为中间语言后，应用软件的数据结构清楚明了，便于进行数据回溯。
关联模块20，用于根据所述代码文本，获取所述应用软件的数据关联结构。
在得到应用软件的中间语言代码文本后，关联模块20根据代码文本，提取用软件的数据关联结构。
得到的数据关联结构包括各调用点方法或类的类型、成员变量、函数、赋值、执行顺序等。为便于使用，关联模块20可使用数据关联结构表记载上述参数。
回溯模块30，用于根据所述应用软件中敏感调用点的变量参数及所述数据关联结构，回溯查找所述敏感调用点对应的外部输入点。
在得到应用软件的数据关联结构后，回溯模块30根据应用软件的敏感调用点中的变量参数，通过数据关联结构查找敏感调用点对应的外部输入点。其中，敏感调用点是应用软件中的关键调用点，或是安全性要求要高的调用点，可以由测试人员人为确定需检测的敏感调用点。
具体的，回溯模块30首先需要确定敏感调用点的变量参数，例如，敏感调用点使用形参执行函数输出返回值，则敏感调用点的形参即为变量参数，需要追踪传递给敏感调用点、对形参赋值的实参。
然后，回溯模块30根据数据关联结构中其他调用点的信息，进行数据回溯，查找此变量参数数值的来源，以获取影响此变量参数的值的调用点，直至查找到的能够影响此变量参数的值的调用点为源节点，例如常量赋值、外部输入点等时，停止数据回溯。
需要说明的是，源节点的参数不再受应用软件内部其他调用点的影响。
若能够影响此变量参数的值的调用点的源节点为外部输入点，则回溯模块30确定此外部输入点为敏感调用点对应的外部输入点，此外部输入点输入的数据能够影响、控制敏感调用点，给应用软件造成风险。
作为一种实施方式，所述回溯模块30还用于，
根据所述变量参数及所述数据关联结构，回溯查找输出所述变量参数的前驱调用点；若所述前驱调用点是基于函数调用输出的返回值，则再次回溯查找返回所述前驱调用点实参的前驱调用点，确定源节点；若所述源节点为外部输入点，则确定所述外部输入点为所述敏感调用点对应的外部输入点；、若所述源节点为常量赋值，则停止回溯，确定未找到所述敏感调用点对应的外部输入点。
例如，主函数调用当前敏感调用点时，传递给敏感调用点的参数为A，敏感调用点根据A执行函数调用后会对应输出返回值，则回溯模块30确定敏感调用点的形参为变量参数。
然后，回溯模块30根据数据关联结构中记载的各调用点的信息，查找应用软件中返回或输出A的前驱调用点，也即查找将A作为返回值输出且执行顺序早于敏感调用点的调用点。
需要说明的是，前驱调用点在应用软件的各调用点执行顺序中，早于对比调用点执行函数调用。例如上述“查找输出A的前驱调用点”中，前驱调用点的函数执行顺序应当早于当前敏感调用点。
若前驱调用点1输出的返回值为A，则回溯模块30判断前驱调用点1输出的参数是否为外部输入点输入的变量。
若前驱调用点1输出的参数是外部输入点输入的变量，也即A是由前驱调用点1根据外部输入点输入的变量对应输出的，则回溯模块30可以确认此外部输入点为数据流的源节点，也就是当前敏感调用点对应的外部输入点。
若前驱调用点1是根据输入的实参B，执行函数调用运算得到A，则回溯模块30根据B继续查找返回B的前驱调用点，也即查找将B作为返回值输出，且执行顺序早于前驱调用点1的调用点，以此类推，直至找到数据流的源节点。
若源节点为外部输入点，则回溯模块30可以确定找到源节点为敏感调用点对应的外部输入点。
若源节点为常量赋值，则回溯模块30可以确定未回溯到外部输入点，当前敏感调用点安全，停止回溯。
进一步地，作为另一种实施方式，所述回溯模块30还用于，
若所述前驱调用点将所述变量参数作为赋值输出，则根据所述数据关联结构获取所述变量参数对应的右值；若所述右值为外部输入点输入的变量，则确定所述外部输入点为所述敏感调用点对应的外部输入点；若所述右值为常量赋值，则停止回溯，确定未找到所述敏感调用点对应的外部输入点。
若敏感调用点的变量参数值是由前驱参数的赋值决定的，也即传递给敏感调用点、对变量参数进行赋值的参数是前驱调用点的赋值，则回溯模块30根据数据关联结构回溯对应的右值，也即对传递给敏感调用点的变量参数进行赋值的右值。
若此右值是外部输入点输入的变量，也即前驱调用点是根据外部输入点输入的变量对输出的参数进行赋值的，则回溯模块30可以确定此外部输入点为敏感调用点对应的外部输入点。
若右值为常量赋值，则回溯模块30可以确定当前数据链安全，未回溯到外部输入点，停止回溯。
由此，实现了对函数调用和赋值的数据追踪，保障了回溯调用点的完整性和准确性。
确定模块40，用于若成功查找到所述敏感调用点对应的外部输入点，则确定所述外部输入点为所述应用软件的安全漏洞。
若成功回溯数据找到敏感调用点对应的外部输入点，则找到的外部输入点可能会被利用输入数据，调用此敏感调用点，给应用软件带来安全隐患。
由此，确定模块40可以确定此外部输入点为当前应用软件的安全漏洞，进行漏洞上报。
在本实施例中，首先编译模块10将待检测应用软件编译为预设的中间语言代码文本，转换后的应用软件代码一条语句包含一条语义，不会产生歧义，适合做安全漏洞检测；然后，关联模块20根据应用软件的中间语言代码文本，获取应用软件的数据关联结构，从而得到应用软件中各调用点的函数及参数具体信息，以供进行数据回溯；然后，回溯模块30根据应用软件中敏感调用点的变量参数及数据关联结构，回溯查找敏感调用点对应的外部输入点；若成功查找到敏感调用点对应的外部输入点，则确定模块确定此找到的外部输入点为应用软件的安全漏洞，会给应用软件带来风险。本实施例中针对基于Android
smali（安卓编译器）或者java（计算机编程语言）的规则匹配检测方法存在的误报问题，采用中间语言的应用软件程序代码进行数据流分析，既可避免单一程序代码特征的粗糙检查，又能够通过数据关联结构，关联应用软件上下文的数据传递进行数据回溯、漏洞检测，避免了漏洞的误报和漏报；另一方面，本实施例基于折中的中间语言的分析规避了smali和java语言的缺点，降低了安全漏洞检测的工作量，使得漏洞检测的结果更准确。由此，本实施例解决了现有的应用软件代码语言给安全漏洞检测带来的各项困扰，大大提升了应用软件安全漏洞检测的效率。
进一步地，参照图6，本发明应用软件安全漏洞检测系统第二实施例提供一种应用软件安全漏洞检测系统，基于上述本发明应用软件安全漏洞检测系统第一实施例，所述回溯模块30还用于，
若找到多个输出所述变量参数且执行顺序先于所述敏感调用点的调用点，则确定所述多个调用点中执行顺序最接所述近敏感调用点的为所述前驱调用点。
在根据变量参数及数据关联结构进行数据回溯时，可能会遇到多个调用点输出参数均为此变量参数，此时，回溯模块30首先根据各调用点的执行顺序，筛选出执行顺序先于敏感调用点的调用点，也可称为执行顺序早于敏感调用点的调用点。
若筛选后，得到的调用点只有一个，则回溯模块30就可以确定此调用点为当前查找的、用于进一步进行数据回溯前驱调用点；若筛选后，得到的调用点有多个，则此时回溯模块30根据这多个调用点的执行顺序，确定执行顺序最晚、但早于敏感调用点的调用点为当前查找的、用于进一步进行数据回溯前驱调用点，也即确定执行顺序最接近敏感调用点的为前驱调用点。
例如，基于上述本发明应用软件安全漏洞检测方法第一实施例，若输出变量参数A的调用点包括调用点2、调用点3，则获取调用点2、调用点3的执行顺序。若调用点2先于调用点3执行，敏感调用点晚于调用点3执行，则调用点3的执行顺序更加接近敏感调用点，确定调用点3为前驱调用点；若调用点3先于调用点2执行，敏感调用点晚于调用点2执行，则调用点2的执行顺序更加接近敏感调用点，确定调用点2为前驱调用点。
由此，在有多个调用点输出变量参数时，回溯模块30可以唯一确定前驱调用点，实现了通过调用点时序，进行数据回溯和外部输入点的查找。
同理，在后续回溯数据时，若遇到多个调用点输出的参数均为当前回溯的参数、无法确定前驱调用点的情况时，回溯模块30选取执行顺序早于当前调用点、且最接近当前调用点的为前驱调用点，继续进行数据回溯。
在本实施例中，若找到多个输出变量参数且执行顺序先于敏感调用点的调用点，则回溯模块30确定多个调用点中执行顺序最接近敏感调用点的为前驱调用点。本实施例解决了在数据回溯过程中，遇到多个调用点输出所需要回溯的变量参数时无法确定前驱调用点的问题，使得数据回溯能够顺利进行。
进一步地，参照图6，本发明应用软件安全漏洞检测系统第三实施例提供一种应用软件安全漏洞检测系统，基于上述本发明应用软件安全漏洞检测系统第一实施例或第二实施例，所述确定模块40还用于，
确定回溯找到所述外部输入点的路径为危险路径。
当成功找到敏感调用点对应的外部输入点时，确定模块40将找到外部输入点的路径信息提取出来，得到从外部输入点输入的污点数据流向敏感调用点的路径，以及路径上被感染的各调用点。
然后，确定模块40标记此路径为危险路径，便于研发人员了解敏感调用点的具体风险，以提高应用软件的完全性。
在本实施例中，确定模块40确定回溯找到敏感调用点对应外部输入点的路径为危险路径，以便于研发人员进行进一步地漏洞原因分析、提升应用软件的安全性。
需要说明的是，在硬件实现上，以上编译模块10、关联模块20、回溯模块30以及确定模块40等可以以硬件形式内嵌于或独立于应用软件安全漏洞检测系统中，也可以以软件形式存储于应用软件安全漏洞检测系统的存储器中，以便于处理器调用执行以上各个模块对应的操作。该处理器可以为中央处理单元（CPU)、微处理器、单片机等。
如图7所示，图7是本发明实施例方案涉及的硬件运行环境的设备结构示意图。
本发明实施例应用软件安全漏洞检测设备可以是PC，也可以是智能手机、平板电脑、电子书阅读器、便携计算机等终端设备。
如图7所示，应用软件安全漏洞检测设备可以包括：处理器1001，例如CPU，以及存储器1002。这些组件之间的连接通信可以通过通信总线实现。存储器1002可以是高速RAM存储器，也可以是稳定的存储器（non-volatile
memory），例如磁盘存储器。存储器1002可选的还可以是独立于前述处理器1001的存储装置。
可选地，应用软件安全漏洞检测设备还可以包括用户接口、网络接口、摄像头、RF（Radio
Frequency，射频）电路，传感器、音频电路、WiFi模块等等。其中，用户接口可以包括显示屏（Display）、输入单元比如键盘（Keyboard），可选用户接口还可以包括标准的有线接口、无线接口。网络接口可选的可以包括标准的有线接口、无线接口（如WI-FI接口）。
本领域技术人员可以理解，图7中示出的应用软件安全漏洞检测设备结构并不构成对应用软件安全漏洞检测设备的限定，可以包括比图示更多或更少的部件，或者组合某些部件，或者不同的部件布置。
如图7所示，作为一种计算机存储介质的存储器1002中可以包括操作系统、应用软件安全漏洞检测程序。其中，操作系统是管理和控制应用软件安全漏洞检测设备硬件与软件资源的程序，支持应用软件安全漏洞检测程序及其他软件或程序的运行。
在图7所示的应用软件安全漏洞检测设备中，处理器1001可以用于执行存储器1002中存储的应用软件安全漏洞检测程序，以实现以下步骤：
将应用软件编译为预设的中间语言代码文本；
根据所述代码文本，获取所述应用软件的数据关联结构；
根据所述应用软件中敏感调用点的变量参数及所述数据关联结构，回溯查找所述敏感调用点对应的外部输入点；
若成功查找到所述敏感调用点对应的外部输入点，则确定所述外部输入点为所述应用软件的安全漏洞。
进一步地，处理器1001还可以执行存储器1002中存储的应用软件安全漏洞检测程序，以实现以下步骤：
根据所述变量参数及所述数据关联结构，回溯查找输出所述变量参数的前驱调用点；
若所述前驱调用点是基于函数调用输出的返回值，则再次回溯查找返回所述前驱调用点实参的前驱调用点，确定源节点；
若所述源节点为外部输入点，则确定所述外部输入点为所述敏感调用点对应的外部输入点；
若所述源节点为常量赋值，则停止回溯，确定未找到所述敏感调用点对应的外部输入点。
进一步地，处理器1001还可以执行存储器1002中存储的应用软件安全漏洞检测程序，以实现以下步骤：
若找到多个输出所述变量参数且执行顺序先于所述敏感调用点的调用点，则确定所述多个调用点中执行顺序最接所述近敏感调用点的为所述前驱调用点。
进一步地，处理器1001还可以执行存储器1002中存储的应用软件安全漏洞检测程序，以实现以下步骤：
若所述前驱调用点将所述变量参数作为赋值输出，则根据所述数据关联结构获取所述变量参数对应的右值；
若所述右值为外部输入点输入的变量，则确定所述外部输入点为所述敏感调用点对应的外部输入点；
若所述右值为常量赋值，则停止回溯，确定未找到所述敏感调用点对应的外部输入点。
进一步地，处理器1001还可以执行存储器1002中存储的应用软件安全漏洞检测程序，以实现以下步骤：
确定回溯找到所述外部输入点的路径为危险路径。
本发明应用软件安全漏洞检测设备的具体实施例与上述应用软件安全漏洞检测方法和系统各实施例基本相同，在此不作赘述。
本发明提供了一种计算机可读存储介质，所述计算机可读存储介质存储有一个或者多个程序，所述一个或者多个程序可被一个或者多个处理器执行，以实现以下步骤：
将应用软件编译为预设的中间语言代码文本；
根据所述代码文本，获取所述应用软件的数据关联结构；
根据所述应用软件中敏感调用点的变量参数及所述数据关联结构，回溯查找所述敏感调用点对应的外部输入点；
若成功查找到所述敏感调用点对应的外部输入点，则确定所述外部输入点为所述应用软件的安全漏洞。
进一步地，所述一个或者多个程序可被所述一个或者多个处理器执行，还实现以下步骤：
根据所述变量参数及所述数据关联结构，回溯查找输出所述变量参数的前驱调用点；
若所述前驱调用点是基于函数调用输出的返回值，则再次回溯查找返回所述前驱调用点实参的前驱调用点，确定源节点；
若所述源节点为外部输入点，则确定所述外部输入点为所述敏感调用点对应的外部输入点；
若所述源节点为常量赋值，则停止回溯，确定未找到所述敏感调用点对应的外部输入点。
进一步地，所述一个或者多个程序可被所述一个或者多个处理器执行，还实现以下步骤：
若找到多个输出所述变量参数且执行顺序先于所述敏感调用点的调用点，则确定所述多个调用点中执行顺序最接所述近敏感调用点的为所述前驱调用点。
进一步地，所述一个或者多个程序可被所述一个或者多个处理器执行，还实现以下步骤：
若所述前驱调用点将所述变量参数作为赋值输出，则根据所述数据关联结构获取所述变量参数对应的右值；
若所述右值为外部输入点输入的变量，则确定所述外部输入点为所述敏感调用点对应的外部输入点；
若所述右值为常量赋值，则停止回溯，确定未找到所述敏感调用点对应的外部输入点。
进一步地，所述一个或者多个程序可被所述一个或者多个处理器执行，还实现以下步骤：
确定回溯找到所述外部输入点的路径为危险路径。
本发明计算机可读存储介质的具体实施例与上述应用软件安全漏洞检测方法和系统各实施例基本相同，在此不作赘述。
还需要说明的是，在本文中，术语“包括”、“包含”或者其任何其他变体意在涵盖非排他性的包含，从而使得包括一系列要素的过程、方法、物品或者装置不仅包括那些要素，而且还包括没有明确列出的其他要素，或者是还包括为这种过程、方法、物品或者装置所固有的要素。在没有更多限制的情况下，由语句“包括一个……”限定的要素，并不排除在包括该要素的过程、方法、物品或者装置中还存在另外的相同要素。
上述本发明实施例序号仅仅为了描述，不代表实施例的优劣。通过以上的实施方式的描述，本领域的技术人员可以清楚地了解到上述实施例方法可借助软件加必需的通用硬件平台的方式来实现，当然也可以通过硬件，但很多情况下前者是更佳的实施方式。基于这样的理解，本发明的技术方案本质上或者说对现有技术做出贡献的部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质（如ROM/RAM、磁碟、光盘）中，包括若干指令用以使得一台终端设备（可以是手机，计算机，服务器，或者网络设备等）执行本发明各个实施例所述的方法。
以上仅为本发明的可选实施例，并非因此限制本发明的专利范围，凡是利用本发明说明书及附图内容所作的等效结构或等效流程变换，或直接或间接运用在其他相关的技术领域，均同理包括在本发明的专利保护范围内。
Claims (20)
- 一种应用软件安全漏洞检测方法，其特征在于，所述应用软件安全漏洞检测方法包括以下步骤：将应用软件编译为预设的中间语言代码文本；根据所述代码文本，获取所述应用软件的数据关联结构；根据所述应用软件中敏感调用点的变量参数及所述数据关联结构，回溯查找所述敏感调用点对应的外部输入点；若成功查找到所述敏感调用点对应的外部输入点，则确定所述外部输入点为所述应用软件的安全漏洞。
- 如权利要求1所述的应用软件安全漏洞检测方法，其特征在于，所述根据所述应用软件中敏感调用点的变量参数及所述数据关联结构，回溯查找所述敏感调用点对应的外部输入点的步骤包括：根据所述变量参数及所述数据关联结构，回溯查找输出所述变量参数的前驱调用点；若所述前驱调用点是基于函数调用输出的返回值，则再次回溯查找返回所述前驱调用点实参的前驱调用点，确定源节点；若所述源节点为外部输入点，则确定所述外部输入点为所述敏感调用点对应的外部输入点；若所述源节点为常量赋值，则停止回溯，确定未找到所述敏感调用点对应的外部输入点。
- 如权利要求2所述的应用软件安全漏洞检测方法，其特征在于，所述根据所述应用软件中敏感调用点的变量参数及所述数据关联结构，回溯查找所述敏感调用点对应的外部输入点的步骤，还包括：若找到多个输出所述变量参数且执行顺序先于所述敏感调用点的调用点，则确定所述多个调用点中执行顺序最接所述近敏感调用点的为所述前驱调用点。
- 如权利要求2所述的应用软件安全漏洞检测方法，其特征在于，所述根据所述应用软件中敏感调用点的变量参数及所述数据关联结构，回溯查找所述敏感调用点对应的外部输入点的步骤，还包括：若所述前驱调用点将所述变量参数作为赋值输出，则根据所述数据关联结构获取所述变量参数对应的右值；若所述右值为外部输入点输入的变量，则确定所述外部输入点为所述敏感调用点对应的外部输入点；若所述右值为常量赋值，则停止回溯，确定未找到所述敏感调用点对应的外部输入点。
- 如权利要求1所述的应用软件安全漏洞检测方法，其特征在于，所述确定所述外部输入点为所述应用软件的安全漏洞的步骤之后，还包括：确定回溯找到所述外部输入点的路径为危险路径。
- 一种应用软件安全漏洞检测系统，其特征在于，所述应用软件安全漏洞检测系统包括：编译模块，用于将应用软件编译为预设的中间语言代码文本；关联模块，用于根据所述代码文本，获取所述应用软件的数据关联结构；回溯模块，用于根据所述应用软件中敏感调用点的变量参数及所述数据关联结构，回溯查找所述敏感调用点对应的外部输入点；确定模块，用于若成功查找到所述敏感调用点对应的外部输入点，则确定所述外部输入点为所述应用软件的安全漏洞。
- 如权利要求6所述的应用软件安全漏洞检测系统，其特征在于，所述回溯模块还用于，根据所述变量参数及所述数据关联结构，回溯查找输出所述变量参数的前驱调用点；若所述前驱调用点是基于函数调用输出的返回值，则再次回溯查找返回所述前驱调用点实参的前驱调用点，确定源节点；若所述源节点为外部输入点，则确定所述外部输入点为所述敏感调用点对应的外部输入点；若所述源节点为常量赋值，则停止回溯，确定未找到所述敏感调用点对应的外部输入点。
- 如权利要求7所述的应用软件安全漏洞检测系统，其特征在于，所述回溯模块还用于，若找到多个输出所述变量参数且执行顺序先于所述敏感调用点的调用点，则确定所述多个调用点中执行顺序最接所述近敏感调用点的为所述前驱调用点。
- 如权利要求7所述的应用软件安全漏洞检测系统，其特征在于，所述回溯模块还用于，若所述前驱调用点将所述变量参数作为赋值输出，则根据所述数据关联结构获取所述变量参数对应的右值；若所述右值为外部输入点输入的变量，则确定所述外部输入点为所述敏感调用点对应的外部输入点；若所述右值为常量赋值，则停止回溯，确定未找到所述敏感调用点对应的外部输入点。
- 如权利要求6所述的应用软件安全漏洞检测系统，其特征在于，所述确定模块还用于，确定回溯找到所述外部输入点的路径为危险路径。
- 一种应用软件安全漏洞检测设备，其特征在于，所述应用软件安全漏洞检测设备包括处理器和存储器，所述存储器中存储有应用软件安全漏洞检测程序；所述处理器用于执行所述应用软件安全漏洞检测程序，以实现以下步骤：将应用软件编译为预设的中间语言代码文本；根据所述代码文本，获取所述应用软件的数据关联结构；根据所述应用软件中敏感调用点的变量参数及所述数据关联结构，回溯查找所述敏感调用点对应的外部输入点；若成功查找到所述敏感调用点对应的外部输入点，则确定所述外部输入点为所述应用软件的安全漏洞。
- 如权利要求11所述的应用软件安全漏洞检测设备，其特征在于，所述处理器还用于执行所述应用软件安全漏洞检测程序，以实现以下步骤：根据所述变量参数及所述数据关联结构，回溯查找输出所述变量参数的前驱调用点；若所述前驱调用点是基于函数调用输出的返回值，则再次回溯查找返回所述前驱调用点实参的前驱调用点，确定源节点；若所述源节点为外部输入点，则确定所述外部输入点为所述敏感调用点对应的外部输入点；若所述源节点为常量赋值，则停止回溯，确定未找到所述敏感调用点对应的外部输入点。
- 如权利要求12所述的应用软件安全漏洞检测设备，其特征在于，所述处理器还用于执行所述应用软件安全漏洞检测程序，以实现以下步骤：若找到多个输出所述变量参数且执行顺序先于所述敏感调用点的调用点，则确定所述多个调用点中执行顺序最接所述近敏感调用点的为所述前驱调用点。
- 如权利要求12所述的应用软件安全漏洞检测设备，其特征在于，所述处理器还用于执行所述应用软件安全漏洞检测程序，以实现以下步骤：若所述前驱调用点将所述变量参数作为赋值输出，则根据所述数据关联结构获取所述变量参数对应的右值；若所述右值为外部输入点输入的变量，则确定所述外部输入点为所述敏感调用点对应的外部输入点；若所述右值为常量赋值，则停止回溯，确定未找到所述敏感调用点对应的外部输入点。
- 如权利要求11所述的应用软件安全漏洞检测设备，其特征在于，所述处理器还用于执行所述应用软件安全漏洞检测程序，以实现以下步骤：确定回溯找到所述外部输入点的路径为危险路径。
- 一种计算机可读存储介质，其特征在于，所述计算机可读存储介质存储有一个或者多个程序，所述一个或者多个程序可被一个或者多个处理器执行，以实现以下步骤：将应用软件编译为预设的中间语言代码文本；根据所述代码文本，获取所述应用软件的数据关联结构；根据所述应用软件中敏感调用点的变量参数及所述数据关联结构，回溯查找所述敏感调用点对应的外部输入点；若成功查找到所述敏感调用点对应的外部输入点，则确定所述外部输入点为所述应用软件的安全漏洞。
- 如权利要求16所述的计算机可读存储介质，其特征在于，所述一个或者多个程序可被所述一个或者多个处理器执行，还实现以下步骤：根据所述变量参数及所述数据关联结构，回溯查找输出所述变量参数的前驱调用点；若所述前驱调用点是基于函数调用输出的返回值，则再次回溯查找返回所述前驱调用点实参的前驱调用点，确定源节点；若所述源节点为外部输入点，则确定所述外部输入点为所述敏感调用点对应的外部输入点；若所述源节点为常量赋值，则停止回溯，确定未找到所述敏感调用点对应的外部输入点。
- 如权利要求17所述的计算机可读存储介质，其特征在于，所述一个或者多个程序可被所述一个或者多个处理器执行，还实现以下步骤：若找到多个输出所述变量参数且执行顺序先于所述敏感调用点的调用点，则确定所述多个调用点中执行顺序最接所述近敏感调用点的为所述前驱调用点。
- 如权利要求17所述的计算机可读存储介质，其特征在于，所述一个或者多个程序可被所述一个或者多个处理器执行，还实现以下步骤：若所述前驱调用点将所述变量参数作为赋值输出，则根据所述数据关联结构获取所述变量参数对应的右值；若所述右值为外部输入点输入的变量，则确定所述外部输入点为所述敏感调用点对应的外部输入点；若所述右值为常量赋值，则停止回溯，确定未找到所述敏感调用点对应的外部输入点。
- 如权利要求16所述的计算机可读存储介质，其特征在于，所述一个或者多个程序可被所述一个或者多个处理器执行，还实现以下步骤：确定回溯找到所述外部输入点的路径为危险路径。
Applications Claiming Priority (2)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201611036441.2 | 2016-11-14 | ||
| CN201611036441.2A CN107038115B (zh) | 2016-11-14 | 2016-11-14 | 应用软件安全漏洞检测方法和系统 |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| WO2018086294A1 true WO2018086294A1 (zh) | 2018-05-17 |
Family
ID=59531123
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| PCT/CN2017/077988 Ceased WO2018086294A1 (zh) | 2016-11-14 | 2017-03-24 | 应用软件安全漏洞检测方法、系统、设备及存储介质 |
Country Status (2)
| Country | Link |
|---|---|
| CN (1) | CN107038115B (zh) |
| WO (1) | WO2018086294A1 (zh) |
Cited By (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN109214190A (zh) * | 2018-08-30 | 2019-01-15 | 腾讯科技（深圳）有限公司 | 确定漏洞利用样本文件的方法和设备 |
| CN111506900A (zh) * | 2020-04-15 | 2020-08-07 | 北京字节跳动网络技术有限公司 | 漏洞检测方法、装置、电子设备及计算机存储介质 |
| CN111753302A (zh) * | 2020-07-15 | 2020-10-09 | 腾讯科技（深圳）有限公司 | 检测代码漏洞的方法、装置、计算机可读介质及电子设备 |
| CN112131122A (zh) * | 2020-09-27 | 2020-12-25 | 北京软安科技有限公司 | 一种源代码缺陷检测工具误报评估方法及装置 |
Families Citing this family (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN111723375A (zh) * | 2020-06-09 | 2020-09-29 | 杭州孝道科技有限公司 | 一种基于运行时非执行态模式的软件安全漏洞检测方法 |
| CN112162777B (zh) * | 2020-09-27 | 2022-11-18 | 北京智联安行科技有限公司 | 一种源代码特征提取方法及装置 |
| CN114510409B (zh) * | 2020-11-17 | 2024-07-12 | 腾讯科技（深圳）有限公司 | 一种应用程序代码检测方法和计算机可读存储介质 |
Citations (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN102955914A (zh) * | 2011-08-19 | 2013-03-06 | 百度在线网络技术（北京）有限公司 | 一种源文件安全漏洞的检测方法及检测装置 |
| CN103164331A (zh) * | 2011-12-15 | 2013-06-19 | 阿里巴巴集团控股有限公司 | 一种应用程序的漏洞检测方法和装置 |
| US20150020205A1 (en) * | 2013-07-15 | 2015-01-15 | Tencent Technology (Shenzhen) Company Limited | Method and apparatus for detecting security vulnerability for animation source file |
| CN104298921A (zh) * | 2013-07-15 | 2015-01-21 | 深圳市腾讯计算机系统有限公司 | 动画源文件安全漏洞检查方法及装置 |
| CN104462981A (zh) * | 2013-09-12 | 2015-03-25 | 深圳市腾讯计算机系统有限公司 | 漏洞检测方法及装置 |
| CN105550594A (zh) * | 2015-12-17 | 2016-05-04 | 西安电子科技大学 | 安卓应用文件的安全性检测方法 |
-
2016
- 2016-11-14 CN CN201611036441.2A patent/CN107038115B/zh active Active
-
2017
- 2017-03-24 WO PCT/CN2017/077988 patent/WO2018086294A1/zh not_active Ceased
Patent Citations (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN102955914A (zh) * | 2011-08-19 | 2013-03-06 | 百度在线网络技术（北京）有限公司 | 一种源文件安全漏洞的检测方法及检测装置 |
| CN103164331A (zh) * | 2011-12-15 | 2013-06-19 | 阿里巴巴集团控股有限公司 | 一种应用程序的漏洞检测方法和装置 |
| US20150020205A1 (en) * | 2013-07-15 | 2015-01-15 | Tencent Technology (Shenzhen) Company Limited | Method and apparatus for detecting security vulnerability for animation source file |
| CN104298921A (zh) * | 2013-07-15 | 2015-01-21 | 深圳市腾讯计算机系统有限公司 | 动画源文件安全漏洞检查方法及装置 |
| CN104462981A (zh) * | 2013-09-12 | 2015-03-25 | 深圳市腾讯计算机系统有限公司 | 漏洞检测方法及装置 |
| CN105550594A (zh) * | 2015-12-17 | 2016-05-04 | 西安电子科技大学 | 安卓应用文件的安全性检测方法 |
Cited By (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN109214190A (zh) * | 2018-08-30 | 2019-01-15 | 腾讯科技（深圳）有限公司 | 确定漏洞利用样本文件的方法和设备 |
| CN111506900A (zh) * | 2020-04-15 | 2020-08-07 | 北京字节跳动网络技术有限公司 | 漏洞检测方法、装置、电子设备及计算机存储介质 |
| CN111506900B (zh) * | 2020-04-15 | 2023-07-18 | 抖音视界有限公司 | 漏洞检测方法、装置、电子设备及计算机存储介质 |
| CN111753302A (zh) * | 2020-07-15 | 2020-10-09 | 腾讯科技（深圳）有限公司 | 检测代码漏洞的方法、装置、计算机可读介质及电子设备 |
| CN112131122A (zh) * | 2020-09-27 | 2020-12-25 | 北京软安科技有限公司 | 一种源代码缺陷检测工具误报评估方法及装置 |
| CN112131122B (zh) * | 2020-09-27 | 2022-09-30 | 北京智联安行科技有限公司 | 一种源代码缺陷检测工具误报评估方法及装置 |
Also Published As
| Publication number | Publication date |
|---|---|
| CN107038115A (zh) | 2017-08-11 |
| CN107038115B (zh) | 2018-05-04 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| WO2018086294A1 (zh) | 应用软件安全漏洞检测方法、系统、设备及存储介质 | |
| WO2018086292A1 (zh) | 应用软件安全漏洞检测方法、系统、设备及存储介质 | |
| WO2018086293A1 (zh) | 数据泄露接口检测方法、装置、设备及存储介质 | |
| WO2018023981A1 (zh) | 舆情分析方法、装置、设备及计算机可读存储介质 | |
| WO2019051908A1 (zh) | 终端控制方法、装置及计算机可读存储介质 | |
| WO2019051944A1 (zh) | 一种进程保护方法、装置、设备以及计算机可读存储介质 | |
| WO2021002696A1 (en) | Method for transferring subscription and electronic device for supporting the same | |
| WO2019056752A1 (zh) | 家电设备的配网方法、装置、系统及计算机可读存储介质 | |
| WO2015158133A1 (zh) | 语音控制指令纠错方法和系统 | |
| WO2015127859A1 (en) | Sensitive text detecting method and apparatus | |
| WO2019019378A1 (zh) | 业务处理方法、装置、适配器及计算机可读存储介质 | |
| WO2020027578A1 (en) | Home appliance and online system that performs pairing of the same | |
| WO2012055343A1 (zh) | 一种.net程序加密后的执行方法 | |
| WO2019051895A1 (zh) | 终端控制方法、装置及存储介质 | |
| EP4189992A1 (en) | Method and apparatus for moving profiles with different versions during device change | |
| EP4186258A1 (en) | Method and apparatus for recovering profile in case of device change failure | |
| WO2017080190A1 (zh) | 二维码生成显示方法和装置 | |
| WO2015124073A1 (en) | Process monitoring method, apparatus, and system | |
| WO2019056462A1 (zh) | 名单分配方法、装置、设备以及计算机可读存储介质 | |
| WO2021086127A1 (en) | Hub device, multi-device system including the hub device and plurality of devices, and operating method of the hub device and multi-device system | |
| WO2013115565A2 (ko) | 가상 머신 관리 방법 및 이를 위한 장치 | |
| WO2023277527A1 (en) | Interface and laundry treating apparatus having the same | |
| WO2018149194A1 (zh) | 团险投保方法、系统、设备和计算机可读存储介质 | |
| WO2017219479A1 (zh) | 智能电视的字符输入方法及系统 | |
| WO2023017931A1 (ko) | 사이버 위협 정보 처리 장치, 사이버 위협 정보 처리 방법 및 사이버 위협 정보 처리하는 프로그램을 저장하는 저장매체 |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| 121 | Ep: the epo has been informed by wipo that ep was designated in this application |
Ref document number: 17869119 Country of ref document: EP Kind code of ref document: A1 |
|
| NENP | Non-entry into the national phase |
Ref country code: DE |
|
| 32PN | Ep: public notification in the ep bulletin as address of the adressee cannot be established |
Free format text: NOTING OF LOSS OF RIGHTS PURSUANT TO RULE 112(1) EPC (EPO FORM 1205A DATED 11/09/2019) |
|
| 122 | Ep: pct application non-entry in european phase |
Ref document number: 17869119 Country of ref document: EP Kind code of ref document: A1 |