WO2022048283A1 - 一种基于pca的密码硬编码检测方法、装置及介质 - Google Patents

一种基于pca的密码硬编码检测方法、装置及介质 Download PDF

Info

Publication number
WO2022048283A1
WO2022048283A1 PCT/CN2021/103381 CN2021103381W WO2022048283A1 WO 2022048283 A1 WO2022048283 A1 WO 2022048283A1 CN 2021103381 W CN2021103381 W CN 2021103381W WO 2022048283 A1 WO2022048283 A1 WO 2022048283A1
Authority
WO
WIPO (PCT)
Prior art keywords
pca
password
coded
hard
code block
Prior art date
Application number
PCT/CN2021/103381
Other languages
English (en)
French (fr)
Inventor
闫利华
Original Assignee
苏州浪潮智能科技有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 苏州浪潮智能科技有限公司 filed Critical 苏州浪潮智能科技有限公司
Priority to US18/012,927 priority Critical patent/US11880471B2/en
Publication of WO2022048283A1 publication Critical patent/WO2022048283A1/zh

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/57—Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
    • G06F21/577—Assessing vulnerabilities and evaluating computer system security
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/55—Detecting local intrusion or implementing counter-measures
    • G06F21/56—Computer malware detection or handling, e.g. anti-virus arrangements
    • G06F21/562—Static detection
    • G06F21/563—Static detection by source code analysis
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
    • G06F21/45—Structures or tools for the administration of authentication
    • G06F21/46—Structures or tools for the administration of authentication by designing passwords or checking the strength of passwords
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F2221/00—Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/03—Indexing scheme relating to G06F21/50, monitoring users, programs or devices to maintain the integrity of platforms
    • G06F2221/033—Test or assess software
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L2209/00—Additional information or applications relating to cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00
    • H04L2209/26—Testing cryptographic entity, e.g. testing integrity of encryption key or encryption algorithm

Definitions

  • the present application relates to the technical field of password hard-coding detection, and in particular, to a PCA-based password hard-coding detection method, device, and medium.
  • Password hardcoding is to write the password directly into the code in clear text, which may bring serious security risks to enterprises and customers.
  • the main harm is in two aspects: (1) anyone who has access to the code can obtain the username and password; (2) After the code is put into use, the software must be patched to change the encryption key. If an account protected by an encryption key is compromised, the system owner will have to choose between security and usability.
  • the code will be scanned for security before it is put into use.
  • the commonly used scanning tools are the fortify scanning tool. Fortify is a static code scanning tool that helps programmers analyze source code vulnerabilities, and once a security issue is detected, the secure coding rules package provides information about the issue.
  • fortify has a very high false positive rate for hard-coded passwords. In order to confirm whether it is a false positive, developers need to verify the hard-coded passwords scanned by fortify one by one. For false positives, it needs to be added to the filtering rules. If the password is hardcoded with many false positives, it will greatly reduce the productivity of the developer.
  • the purpose of this application is to solve the above problems, and to provide a PCA-based password hard-coded detection method, device and medium, which can reduce the false positive rate of hard-coded detection in code scanning and improve the quality and efficiency of code scanning and code review. .
  • a PCA-based password hardcoding detection method comprising the following steps:
  • Step 1 data collection, collect the function code block where the data of the password hard-coded false positive is located;
  • Step 2 extract the eigenvalues in the function code block collected in step 1 to obtain a feature set
  • Step 3 use the function code block collected in step 1 as a sample to build a PCA model
  • Step 4 Based on the PCA model constructed in Step 3 and the feature set obtained in Step 2, detect whether there is a false positive in the hard-coded password.
  • the cryptographic hard-coded data of the false positive is detected, and the function code block where the false positive cryptographic hard-coded data is located is collected, and the functional code block is the initial sample data.
  • the extracted feature values in the function code block include the code length, the function return value type, the return value type of the calling key, the number of times the key is called in the abnormal code, the number of keywords contained in the code block and The number of keywords included in the comment.
  • the key is a variable in the function that is assigned a specific string.
  • Keywords included in the code block include but are not limited to: 'key', 'password', 'pwd', 'passwd', 'encryption', 'decrypt', 'generate', 'SHA256', 'AES' or 'DES'.
  • Step 3.2 calculate the covariance matrix C
  • Step 3.3 using singular value decomposition to obtain the eigenvalues and corresponding eigenvectors of the covariance matrix C;
  • Step 3.4 Arrange the eigenvectors into a matrix U in rows from top to bottom according to the size of the corresponding eigenvalues.
  • step 3.2 The specific steps of step 3.2 are:
  • the value range of i is [1, m]
  • the value range of j is [1, n]
  • for the i-th feature value, F j is the jth attribute of the sample;
  • Step 4.1 for the code segment to be detected, use the method of step 2 to extract the feature value to obtain the feature set;
  • Step 4.2 calculate the distance d between the feature set obtained in step 4.1 and the matrix U;
  • step 4.3 a threshold ⁇ is set, and the distances calculated in the step 4.2 are all false positives within the threshold range.
  • a PCA-based password hard-coded detection device comprising:
  • the data collection module is used for data collection, to collect the function code block where the data of password hard-coded false positives are located;
  • the feature set calculation module is used to extract the feature value of the function code block to obtain the feature set
  • the detection module is used to detect whether there is a false positive in the hard-coded password.
  • a computer-readable storage medium storing a computer program on the computer-readable storage medium, when the computer program is executed by a processor, implements the steps of the PCA-based password hard-coded detection method.
  • the method of the present application reduces the false positive rate of hard-coded detection in code scanning, and improves the work efficiency of developers and code reviewers.
  • Fig. 1 is the method flow chart of this application
  • FIG. 2 is a block diagram of a PCA-based password hard-coded detection device.
  • a PCA-based password hardcoding detection method includes:
  • Step 1 Data collection: In this application, the data of false positives of hard-coded passwords are collected. That is, according to the project code scanned by the actual fortify code, detect the false positive password hard-coded data, collect the function where the data is located, and the function code block is the initial sample data.
  • Step 2 Feature extraction:
  • Code length There are generally relatively few function codes hard-coded in passwords, while other functional codes have more possibilities, so the code length of the function block can be used as one of the characteristics.
  • Function return value types Password-hardcoded functions are more likely to return strings or be empty, while other functional code return value types are more varied.
  • key refers to the variable in the function that is assigned a specific string.
  • the password hard-coded call to the key is more of a string, while other functional codes are boolean, object and other types.
  • the number of times the key is called in the exception code In the hard-coded password, the probability of the call to the key appearing in the exception block is very small, so the number of times the key is called in the exception code block is also an important feature.
  • the keywords in this algorithm refer to fields including but not only the following: 'key (variable in function)', 'password (password)', 'pwd (password)', ' passwd (password)', 'encryption (encryption)', 'decrypt (decryption)', 'generate (generate)', 'SHA256 (Secure Hash Algorithm 256, secure hash algorithm)', 'AES (Advanced Encryption Standard, advanced) Encryption Standard)', 'DES (Data Encryption Standard, block symmetric encryption algorithm)' and so on. These keywords reflect the function of the function to a certain extent.
  • the number of keywords contained in the comment The function and idea of the function are described in the comment, so the number of keywords in the comment can play a certain role in judging whether the password is hard-coded.
  • PCA Principal Components Analysis
  • principal component analysis technology aims to convert multiple indicators into a few comprehensive indicators by using the idea of dimension reduction.
  • linear transformation many variables of the original data are converted into several linearly independent variables of each dimension, and these variables can maximize the amount of information of the original data.
  • the specific calculation process is as follows:
  • Step 3.2 calculate the covariance matrix C
  • step 3.3 singular value decomposition is used to obtain the eigenvalues and corresponding eigenvectors of the covariance matrix.
  • Step 3.4 Arrange the eigenvectors into a matrix U from top to bottom in rows according to the size of the corresponding eigenvalues;
  • Step 4 Based on the PCA model, detect the hard-coded password:
  • Step 4.1 For the code segment to be detected, use the method of step 2 to extract the feature value to obtain the feature set;
  • Step 4.2 calculate the distance between the feature set obtained in step 4.1 and the matrix U;
  • F j is the value of the j-th column in the matrix F
  • U ji is the value of the j-th row and the i-th column of the matrix U;
  • Step 4.3 Set the threshold ⁇ , all within the threshold range are false positives.
  • a PCA-based password hard-coded detection device includes:
  • the data collection module is used for data collection, to collect the function code block where the data of password hard-coded false positives are located;
  • the feature set calculation module is used to extract the feature values of the function code blocks collected by the data collection module to obtain the feature set;
  • the PCA model building module is used to use the function code blocks collected by the data collection module as samples to build a PCA model
  • the detection module is used to use the PCA model constructed by the PCA model building module and the feature set calculated by the feature set calculation module to detect whether there is a false positive in the hard-coded password.
  • a computer-readable storage medium storing a computer program on the computer-readable storage medium, when the computer program is executed by a processor, implements the steps of the PCA-based password hard-coded detection method.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • General Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Software Systems (AREA)
  • General Physics & Mathematics (AREA)
  • Physics & Mathematics (AREA)
  • Computing Systems (AREA)
  • Virology (AREA)
  • Health & Medical Sciences (AREA)
  • General Health & Medical Sciences (AREA)
  • Storage Device Security (AREA)

Abstract

一种基于PCA的密码硬编码检测方法、装置及介质，检测方法包括：步骤一，数据搜集，搜集密码硬编码误报的数据所在的函数代码块；步骤二，提取步骤一所搜集的函数代码块中的特征值，得到特征集；步骤三，利用步骤一中搜集到的函数代码块作为样本构建PCA模型；步骤四，基于步骤三构建的PCA模型及步骤二得到的特征集，检测密码硬编码是否存在误报。所述方法降低了代码扫描中对硬编码检测的误报率，提高了开发人员和代码审核人员的工作效率。

Description

一种基于PCA的密码硬编码检测方法、装置及介质
本申请要求于2020年09月03日提交至中国专利局、申请号为202010917043.1、发明名称为“一种基于PCA的密码硬编码检测方法、装置及介质”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及密码硬编码检测技术领域，尤其涉及一种基于PCA的密码硬编码检测方法、装置及介质。
背景技术
密码硬编码就是将密码以明文的形式直接写到代码中，这种方式可能给企业、客户带来严重的安全风险。主要危害表现在两个方面：(1)只要能够拿到该代码的人都能够获得该用户名和密码；(2)在代码投入使用之后，必须对软件进行修补才能更改加密密钥。如果受加密密钥保护的帐户遭受入侵，系统所有者将必须在安全性和可用性之间做出选择。
因此，为了降低存在的安全风险，会在代码投入使用之前对其进行安全扫描，常用的扫描工具有fortify扫描工具。Fortify是一款静态代码扫描工具，可以帮助程序员分析源码漏洞，一旦检测出安全问题，安全编码规则包会提供有关问题的信息。但是fortify对密码硬编码的误报率非常高，为了确认是否是误报，开发人员需要对fortify扫描出来的密码硬编码问题逐一的进行二次核实确认。对误报的情况，需要把其添加到过滤规则中去。如果密码硬编码的误报比较多，这会极其降低开发人员的工作效率。
人工进行二次复核的方式存在以下两个问题：
1、开发人员花费大量的精力用在复核和记录上，降低开发效率。
2、在对项目代码进行安全审核时，需要对每个问题进行审核，降低了审核的效率。
所以，降低代码中密码硬编码的误报率是非常有必要的。
发明内容
本申请的目的就是为了解决上述问题，提供一种基于PCA的密码硬编码检测方法、装置及介质，可以降低代码扫描中对硬编码检测的误报率，提高代码扫描和代码审核的质量和效率。
为了实现上述目的，本申请采用如下技术方案：
一种基于PCA的密码硬编码检测方法，包括以下步骤：
步骤一，数据搜集，搜集密码硬编码误报的数据所在的函数代码块；
步骤二，提取步骤一所搜集的函数代码块中的特征值，得到特征集；
步骤三，利用步骤一中搜集到的函数代码块作为样本构建PCA模型；
步骤四，基于步骤三构建的PCA模型及步骤二得到的特征集，检测密码硬编码是否存在误报。
所述步骤一中，根据实际的fortify代码扫描的项目代码，检测误报的密码硬编码数据，搜集该误报的密码硬编码数据所在的函数代码块，该函数代码块为初始的样本数据。
所述步骤二中，提取的函数代码块中的特征值包括代码长度、函数返回值类型、调用key的返回值类型、key在异常代码中调用的次数、代码块中包含的关键字个数及注释中包含的关键字个数。
所述key为函数中被赋值为特定字符串的变量。
所述代码块中包含的关键字包括但不限于：‘key’、‘password’、‘pwd’、‘passwd’、‘encryption’、‘decrypt’、‘generate’、‘SHA256’、‘AES’或‘DES’。
所述步骤三的具体步骤为：
步骤3.1，步骤一中搜集到的函数代码块为样本，个数为n，n为大于0的整数，每个样本有m种属性，m为大于0的整数，则每个样本提取一组特征集F得到F＝(F 1，F 2...F m)，其中，Fm为样本的第m个属性；
步骤3.2，计算协方差矩阵C；
步骤3.3，采用奇异值分解，获取协方差矩阵C的特征值和对应的特征向量；
步骤3.4，将特征向量按对应特征值大小从上到下按行排列成矩阵U。
所述步骤3.2的具体步骤为：
Figure PCTCN2021103381-appb-000001
i的取值范围[1,m]，j的取值范围[1，n]，
Figure PCTCN2021103381-appb-000002
为第i个特 征的
Figure PCTCN2021103381-appb-000003
值，F j为样本的第j个属性；
Figure PCTCN2021103381-appb-000004
指的是第n个样本的第m个特征的
Figure PCTCN2021103381-appb-000005
值。
所述步骤四的具体步骤为：
步骤4.1，对待检测的代码段，利用步骤二的方法提取出特征值，得到特征集；
步骤4.2，计算步骤4.1得到的特征集与矩阵U距离d；
步骤4.3，设置阈值σ，所述步骤4.2计算得到的距离在阈值范围内都属于误报。
一种基于PCA的密码硬编码检测装置，包括：
数据搜集模块，用于数据搜集，搜集密码硬编码误报的数据所在的函数代码块；
特征集计算模块，用于提取函数代码块的特征值，得到特征集；
PCA模型构建模块，用于构建PCA模型；
检测模块，用于检测密码硬编码是否存在误报。
一种计算机可读存储介质，所述计算机可读存储介质上存储有计算机程序，所述计算机程序被处理器执行时实现所述的一种基于PCA的密码硬编码检测方法的步骤。
本申请的有益效果：
本申请的方法降低了代码扫描中对硬编码检测的误报率，提高了开发人员和代码审核人员的工作效率。
附图说明
图1为本申请的方法流程图；
图2为一种基于PCA的密码硬编码检测装置的模块图。
具体实施方式
下面结合附图与实施例对本申请作进一步说明。
如图1所示，一种基于PCA的密码硬编码检测方法，包括：
步骤一、数据搜集：在本申请中，搜集的是密码硬编码误报的数据。即根据实际的fortify代码扫描的项目代码，检测误报的密码硬编码数据，搜集该数据所在的函数，该函数代码块即为初始的样本数据。
步骤二、特征提取：
提取步骤一所搜集的函数代码块中的特征值，得到特征集。
要从函数代码块中、判断该函数功能是否是密码硬编码，可以从函数代码块的整体特性进行分析：
代码长度：密码硬编码的函数代码一般相对不多，而其他功能性的代码则存在更多的可能性，因此函数块的代码长度可以作为其中的一个特征。
函数返回值类型：密码硬编码的函数返回字符串或为空的可能性更大，而其他功能性的代码返回值类型更多样。
调用key的返回值类型：这里key是指函数中被赋值为特定字符串的变量。密码硬编码对key的调用更多返回的是字符串，而其他功能性代码则有布尔、对象等多种类型。
key在异常代码中调用的次数：在密码硬编码中，对key的调用出现在异常块中的可能性很小，因此key在异常代码块中被调用的次数也是重要的一个特性。
代码块中包含的关键字个数：本算法中的关键字是指包含但不仅仅如下字段：‘key(函数中的变量)’、‘password(密码)’、‘pwd(密码)’、‘passwd(密码)’、‘encryption(加密)’、‘decrypt(解密)’、‘generate(生成)’、‘SHA256(Secure Hash Algorithm 256，安全散列算法)’、‘AES(Advanced Encryption Standard，高级加密标准)’、‘DES(Data Encryption Standard，分组对称加密算法)’等。这些关键字在一定程度上反映了函数的功能。
注释中包含的关键字个数：注释中对函数的功能和思想进行了描述，所以注释中关键字的个数在判断是否是密码硬编码上可以起到一定的作用。
综上，对每个代码块提取如上的6个特征，作为代码块的特征，得到特征集。
步骤三、PCA构建模型：
PCA，Principal Components Analysis，主成分分析技术，旨在利用降 维的思想，把多指标转化为少数几个综合指标。是通过线性变换，将原始数据众多的变量转换为若干个各维度线性无关的变量，这些变量能最大化的表示原来数据的信息量。具体计算过程为：
步骤3.1，步骤一中搜集到的函数代码块为样本，个数为n，n的取值越大越好，最佳的n>500，每个样本有m种属性，F＝(F 1，F 2...F m)，本实施例中m取6，F m为样本的第m个属性；
步骤3.2，计算协方差矩阵C
Figure PCTCN2021103381-appb-000006
是普通的变量，指的是特征值标准化后的值，即当前特征值-当前特征值的均值的值，
Figure PCTCN2021103381-appb-000007
为第i个特征的
Figure PCTCN2021103381-appb-000008
值，i的取值范围[1,m]，j的取值范围[1，n]，F j为样本的第j个属性；
Figure PCTCN2021103381-appb-000009
指的是第n个样本的第m个特征的
Figure PCTCN2021103381-appb-000010
值；
步骤3.3，采用奇异值分解，获取协方差矩阵的特征值和对应的特征向量。
步骤3.4，将特征向量按对应特征值大小从上到下按行排列成矩阵U；
步骤四、基于PCA模型，检测密码硬编码：
步骤4.1、对待检测的代码段，利用步骤二的方法提取出特征值，得到特征集；
步骤4.2、计算步骤4.1得到的特征集与矩阵U的距离；
步骤4.1得到的特征集为一个1*m的矩阵F＝(F 1，F 2...F m)，矩阵U为m*m的矩阵，计算得到的距离d为：
Figure PCTCN2021103381-appb-000011
F j为矩阵F中第j列的值，U ji为矩阵U中第j行第i列的值；
步骤4.3、设置阈值σ，在阈值范围内都属于误报。
一种基于PCA的密码硬编码检测装置，如图2所示，包括：
数据搜集模块，用于数据搜集，搜集密码硬编码误报的数据所在的函数代码块；
特征集计算模块，用于提取数据搜集模块搜集到的函数代码块的特征值，得到特征集；
PCA模型构建模块，用于利用数据搜集模块搜集到的函数代码块作为样本构建PCA模型；
检测模块，用于利用PCA模型构建模块构建的PCA模型及特征集计算模块计算得到的特征集检测密码硬编码是否存在误报。
一种计算机可读存储介质，所述计算机可读存储介质上存储有计算机程序，所述计算机程序被处理器执行时实现所述的一种基于PCA的密码硬编码检测方法的步骤。
上述虽然结合附图对本申请的具体实施方式进行了描述，但并非对本申请保护范围的限制，所属领域技术人员应该明白，在本申请的技术方案的基础上，本领域技术人员不需要付出创造性劳动即可做出的各种修改或变形仍在本申请的保护范围以内。

Claims (10)

  1. 一种基于PCA的密码硬编码检测方法，其特征是，包括以下步骤：
    步骤一，数据搜集，搜集密码硬编码误报的数据所在的函数代码块；
    步骤二，提取步骤一所搜集的函数代码块中的特征值，得到特征集；
    步骤三，利用步骤一中搜集到的函数代码块作为样本构建PCA模型；
    步骤四，基于步骤三构建的PCA模型及步骤二得到的特征集，检测密码硬编码是否存在误报。
  2. 如权利要求1所述一种基于PCA的密码硬编码检测方法，其特征是，所述步骤一中，根据实际的fortify代码扫描的项目代码，检测误报的密码硬编码数据，搜集该误报的密码硬编码数据所在的函数代码块，该函数代码块为初始的样本数据。
  3. 如权利要求1所述一种基于PCA的密码硬编码检测方法，其特征是，所述步骤二中，提取的函数代码块中的特征值包括代码长度、函数返回值类型、调用key的返回值类型、key在异常代码中调用的次数、代码块中包含的关键字个数及注释中包含的关键字个数。
  4. 如权利要求3所述一种基于PCA的密码硬编码检测方法，其特征是，所述key为函数中被赋值为特定字符串的变量。
  5. 如权利要求3所述一种基于PCA的密码硬编码检测方法，其特征是，所述代码块中包含的关键字包括但不限于：‘key’、‘password’、‘pwd’、‘passwd’、‘encryption’、‘decrypt’、‘generate’、‘SHA256’、‘AES’或‘DES’。
  6. 如权利要求1所述一种基于PCA的密码硬编码检测方法，其特征是，所述步骤三的具体步骤为：
    步骤3.1，步骤一中搜集到的函数代码块为样本，个数为n，n为大于0的整数，每个样本有m种属性，m为大于0的整数，则每个样本提取一组特征集F得到F＝(F 1，F 2...F m)，其中，F m为样本的第m个属性；
    步骤3.2，计算协方差矩阵C；
    步骤3.3，采用奇异值分解，获取协方差矩阵C的特征值和对应的特征向量；
    步骤3.4，将特征向量按对应特征值大小从上到下按行排列成矩阵U。
  7. 如权利要求6所述一种基于PCA的密码硬编码检测方法，其特征 是，所述步骤3.2的具体步骤为：
    Figure PCTCN2021103381-appb-100001
    为第i个特征的
    Figure PCTCN2021103381-appb-100002
    值，i取值范围是[1，m]，F j为样本的第j个属性；j的取值范围[1，n]；
    Figure PCTCN2021103381-appb-100003
    指的是第n个样本的第m个特征的
    Figure PCTCN2021103381-appb-100004
    值。
  8. 如权利要求6所述一种基于PCA的密码硬编码检测方法，其特征是，所述步骤四的具体步骤为：
    步骤4.1，对待检测的代码段，利用步骤二的方法提取出特征值，得到特征集；
    步骤4.2，计算步骤4.1得到的特征集与矩阵U距离d；
    步骤4.3，设置阈值σ，所述步骤4.2计算得到的距离在阈值范围内都属于误报。
  9. 一种基于PCA的密码硬编码检测装置，其特征是，包括：
    数据搜集模块，用于数据搜集，搜集密码硬编码误报的数据所在的函数代码块；
    特征集计算模块，用于提取函数代码块的特征值，得到特征集；
    PCA模型构建模块，用于构建PCA模型；
    检测模块，用于检测密码硬编码是否存在误报。
  10. 一种计算机可读存储介质，其特征是，所述计算机可读存储介质上存储有计算机程序，所述计算机程序被处理器执行时实现如权利要求1-8任意一项所述的一种基于PCA的密码硬编码检测方法的步骤。
PCT/CN2021/103381 2020-09-03 2021-06-30 一种基于pca的密码硬编码检测方法、装置及介质 WO2022048283A1 (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
US18/012,927 US11880471B2 (en) 2020-09-03 2021-06-30 Password hardcoding checking method and apparatus based on PCA, and medium

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202010917043.1A CN112131570B (zh) 2020-09-03 2020-09-03 一种基于pca的密码硬编码检测方法、装置及介质
CN202010917043.1 2020-09-03

Publications (1)

Publication Number Publication Date
WO2022048283A1 true WO2022048283A1 (zh) 2022-03-10

Family

ID=73848881

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2021/103381 WO2022048283A1 (zh) 2020-09-03 2021-06-30 一种基于pca的密码硬编码检测方法、装置及介质

Country Status (3)

Country Link
US (1) US11880471B2 (zh)
CN (1) CN112131570B (zh)
WO (1) WO2022048283A1 (zh)

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112131570B (zh) * 2020-09-03 2022-06-24 苏州浪潮智能科技有限公司 一种基于pca的密码硬编码检测方法、装置及介质

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN108897678A (zh) * 2018-06-20 2018-11-27 中国联合网络通信集团有限公司 静态代码检测方法和静态代码检测系统、存储设备
CN109446107A (zh) * 2019-01-23 2019-03-08 长沙软工信息科技有限公司 一种源代码检测方法及装置、电子设备
CN109726120A (zh) * 2018-12-05 2019-05-07 北京计算机技术及应用研究所 一种基于机器学习的软件缺陷确认方法
US20190180035A1 (en) * 2017-12-07 2019-06-13 Virtual Forge GmbH Method for detecting vulnerabilities in software
CN111399848A (zh) * 2020-03-17 2020-07-10 北京百度网讯科技有限公司 一种硬编码数据检测方法、装置、电子设备和介质
CN112131570A (zh) * 2020-09-03 2020-12-25 苏州浪潮智能科技有限公司 一种基于pca的密码硬编码检测方法、装置及介质

Family Cites Families (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US9336381B1 (en) * 2013-04-08 2016-05-10 Amazon Technologies, Inc. Entropy-based detection of sensitive information in code
US20150178264A1 (en) * 2013-12-24 2015-06-25 Ca, Inc. Reporting the presence of hardcoded strings on a user interface (ui)
CN105426711B (zh) * 2015-11-18 2018-05-15 北京理工大学 一种计算机软件源代码相似度检测方法
CN107688748B (zh) * 2017-09-05 2019-09-24 中国人民解放军信息工程大学 基于漏洞指纹的脆弱性代码克隆检测方法及其装置
US10387659B1 (en) * 2018-10-31 2019-08-20 Capital One Services, Llc Methods and systems for de-duplication of findings
CN109697162B (zh) * 2018-11-15 2021-05-14 西北大学 一种基于开源代码库的软件缺陷自动检测方法
US11288376B2 (en) * 2019-05-02 2022-03-29 International Business Machines Corporation Identifying hard-coded secret vulnerability inside application source code
US11481501B2 (en) * 2020-01-31 2022-10-25 Sap Se Low false positive token identification in source code repositories using machine learning

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20190180035A1 (en) * 2017-12-07 2019-06-13 Virtual Forge GmbH Method for detecting vulnerabilities in software
CN108897678A (zh) * 2018-06-20 2018-11-27 中国联合网络通信集团有限公司 静态代码检测方法和静态代码检测系统、存储设备
CN109726120A (zh) * 2018-12-05 2019-05-07 北京计算机技术及应用研究所 一种基于机器学习的软件缺陷确认方法
CN109446107A (zh) * 2019-01-23 2019-03-08 长沙软工信息科技有限公司 一种源代码检测方法及装置、电子设备
CN111399848A (zh) * 2020-03-17 2020-07-10 北京百度网讯科技有限公司 一种硬编码数据检测方法、装置、电子设备和介质
CN112131570A (zh) * 2020-09-03 2020-12-25 苏州浪潮智能科技有限公司 一种基于pca的密码硬编码检测方法、装置及介质

Also Published As

Publication number Publication date
CN112131570B (zh) 2022-06-24
CN112131570A (zh) 2020-12-25
US11880471B2 (en) 2024-01-23
US20230195903A1 (en) 2023-06-22

Similar Documents

Publication Publication Date Title
CN109325326A (zh) 非结构化数据访问时的数据脱敏方法、装置、设备及介质
CN111343161B (zh) 异常信息处理节点分析方法、装置、介质及电子设备
CN106250769B (zh) 一种多级过滤的源代码数据检测方法及装置
US20070226791A1 (en) Method for securely supporting password change
US20220019658A1 (en) Systems and methods for improving accuracy in recognizing and neutralizing injection attacks in computer services
CN106776515A (zh) 数据处理的方法及装置
CN104516882B (zh) 确定sql语句的危害度的方法和设备
CN106934274A (zh) 一种弱口令检测方法、装置及系统
Saccente et al. Project achilles: A prototype tool for static method-level vulnerability detection of Java source code using a recurrent neural network
CN107273752B (zh) 基于词频统计和朴素贝叶斯融合模型的漏洞自动分类方法
WO2021135919A1 (zh) 基于机器学习的sql语句安全检测方法、装置、设备及介质
WO2022048283A1 (zh) 一种基于pca的密码硬编码检测方法、装置及介质
CN112765578A (zh) 一种基于浏览器客户端的安全隐私计算的实现方法
US10002254B2 (en) Systems and methods for SQL type evaluation to detect evaluation flaws
US20240012623A1 (en) Programming code vulnerability remediation
CN108038381A (zh) 一种密钥安全性检测方法及系统
US20170068820A1 (en) Systems and methods for sql value evaluation to detect evaluation flaws
CN108268462A (zh) 一种关系完整性的数据质量检测系统
Xia et al. Source Code Vulnerability Detection Based On SAR-GIN
WO2017049254A1 (en) Systems and methods for sql type and/or value evaluation to detect evaluation flaws
CN111934949A (zh) 一种基于数据库注入测试的安全测试系统
CN111563269A (zh) 基于影子系统的敏感数据安全保护方法及系统
Guo et al. Intelligent mining vulnerabilities in python code snippets
CN117592092B (zh) 一种数据库内容的保密检查方法及系统
CN115221857B (zh) 一种含数值类型的数据相似性检测方法及装置

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 21863351

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 21863351

Country of ref document: EP

Kind code of ref document: A1