WO2022180702A1

WO2022180702A1 - Analysis function addition device, analysis function addition program, and analysis function addition method

Info

Publication number: WO2022180702A1
Application number: PCT/JP2021/006933
Authority: WO
Inventors: 利宣碓井; 知範幾世; 裕平川古谷; 誠岩村; 潤三好
Original assignee: 日本電信電話株式会社
Priority date: 2021-02-24
Filing date: 2021-02-24
Publication date: 2022-09-01
Also published as: JPWO2022180702A1

Abstract

An analysis function addition device (10) that has a virtual machine analysis unit (121) that analyzes a virtual machine of a script engine, a command set architecture analysis unit (122) that analyzes a command set architecture, and an analysis function addition unit (123) that performs hooking to add a multipath execution function to the script engine on the basis of architecture information. The virtual machine analysis unit (121) has a VM command boundary detection unit (1212) that performs clustering on a plurality of execution traces and detects the boundaries of VM commands, a virtual program counter detection unit (1213) that uses the boundaries of the VM commands and differential execution analysis that is focused on a read-in count for memory to detect a virtual program counter, a dispatcher detection unit (1214) that detects a dispatcher on the basis of the boundaries of the VM commands, and a conditional branch flag detection unit (1215) that uses the differential execution analysis that is focused on the read-in count for the memory to detect a conditional branch flag.

Description

Analysis function imparting device, analysis function imparting program, and analysis function imparting method

The present invention relates to an analysis function imparting device, an analysis function imparting program, and an analysis function imparting method.

With the emergence of various forms of attacks such as spam using malware (malspam) and fileless malware, the threat of attacks using scripts that exhibit malicious behavior (malicious scripts) has become apparent.

A malicious script is a script that behaves maliciously, and is a program that exploits the functions provided by the script engine to carry out attacks. In general, attacks are carried out using the default script engine of the operating system (OS), or the script engine of specific applications such as web browsers and document file viewers.

　Many of these script engines may require user permission, but they can also implement actions via the system, such as file operations, network communication, and process startup. Therefore, attacks using malicious scripts pose a threat to users in the same way as attacks using malware in executable files.

In order to take countermeasures against attacks by this malicious script, it is necessary to accurately understand the behavior of the script. Therefore, a technique for clarifying the behavior by analyzing the script is desired.

Code obfuscation is a problem that arises when analyzing malicious scripts. Many malicious scripts are subjected to a process called obfuscation, which hinders analysis. Obfuscation deliberately increases the complexity of the code, making it difficult to analyze the code superficially. That is, it interferes with an analysis method called static analysis, which analyzes information obtained from the code without executing the script.

In particular, when part of the code to be executed is dynamically obtained from the outside, the code cannot be obtained without executing it, so it cannot be analyzed statically. Therefore, static analysis is impossible in principle.

On the other hand, a method called dynamic analysis, in which behavior is learned by running a script and monitoring its behavior, is not affected by obfuscation as described above. For this reason, techniques based on dynamic analysis are mainly used in the analysis of malicious scripts.

In general dynamic analysis, by running a malicious script in an analysis environment and monitoring its behavior, only the behavior of a single execution path executed in the malicious script can be obtained. Therefore, there is a problem that the behavior of paths that have not been executed in the analysis environment cannot be obtained.

In other words, there is the problem that even dynamic analysis cannot analyze all behaviors of malicious scripts that have routes that are executed only under specific conditions.

When there is a path that is executed only under specific conditions, for example, when the execution path after that is determined by a command from the command server, or when analysis obstruction prevents malicious behavior in the analysis environment There is

In the former case, if there is no command from the command server, the execution path ahead is not determined and the path with malicious behavior is not executed. When a malicious script is detected and analyzed, it is not uncommon for the attacker to withdraw and the command server to disappear. In such a case, malicious behavior cannot be observed.

The latter is an analysis obstruction in which a malicious script acquires information about the environment in which it is executed, and does not exhibit malicious behavior unless it meets certain conditions. For example, if a feature that is frequently seen in the analysis environment is found, it is determined that the user is being analyzed, and is used to interrupt analysis by interrupting execution.

FIG. 22 is a diagram showing a code fragment showing an example of anti-analysis. This code fragment acquires the number of cores of the CPU (Central Processing Unit) of the environment being executed, and if it is not 2 or more and 8 or less, it judges that the analysis environment is highly likely and terminates execution. It has an anti-analysis attack. Otherwise, it judges that it is not an analysis environment and shows malignant behavior.

In order to capture the behavior of paths that are executed only under specific conditions, multipath execution that executes multiple execution paths is required.

In multi-pass execution, when execution reaches a conditional branch, the execution state is branched so that each branched execution state follows the respective execution path of the branch. As a result, both of the two execution paths generated by the conditional branch are executed.

Regarding the realization of multipath execution, for example, Non-Patent Document 1 describes a technique for realizing symbolic execution, which is a type of multipath execution, for JavaScript (registered trademark). According to this method, in the conditional branching of a JavaScript script, it is possible to comprehensively follow the executable paths and observe the behavior.

In addition, Non-Patent Document 2 describes a method for realizing route forced execution, which is a type of multipath execution, for JavaScript. According to this method, in the conditional branching of JavaScript scripts, all paths can be exhaustively traced and the behavior can be observed.

In Non-Patent Document 3, after manually remodeling the script engine in advance, by executing the script engine on the symbolic execution infrastructure for binary, the script executed on the script engine , describes a technique for realizing symbolic execution through a script engine. According to this technique, if there is a script engine that can be modified manually, any script language can be used to achieve general-purpose symbolic execution, exhaustively trace executable paths, and observe behavior.

And Non-Patent Document 4 describes a method of analyzing a virtual machine (VM) that malware often uses to obfuscate its own programs. According to this technique, by analyzing the VM, it is possible to obtain information on its architecture. Since it is the VM that controls script execution in the script engine, the concept of this method can be partly diverted.

In Non-Patent Document 5, multipath execution of scripts is enabled by analyzing the script engine and adding code to realize the multipath execution function based on the obtained architecture information. According to this method, multipath execution can be realized for various script languages and engines.

However, the methods described in Non-Patent Document 1 and Non-Patent Document 2 have the problem that it is necessary to design and implement the multipath execution function individually for each script engine. In addition, the methods described in Non-Patent Document 1 and Non-Patent Document 2 have the problem that it is necessary to know the architecture information of the VM of the script engine in advance in order to realize the multipath execution function.

In addition, the method described in Non-Patent Document 3 requires modifications to the script engine, so there is also the problem that it is necessary to know the architecture information of the VM of the script engine in advance. In addition, the method described in Non-Patent Document 3 does not consider detailed architecture such as the mechanism of conditional branching within the script engine, so there is a problem that it is difficult to perform fine-grained multipath execution for the script.

Acquiring the architecture information of this script engine requires analysis work. For an open source script engine, it can be realized by analyzing the source code, but it is limited to the script language from which the source code can be obtained, and a certain number of man-hours are required. Furthermore, proprietary script engines require binary reverse engineering, and manual implementation requires a skilled reverse engineer and a great deal of man-hours, which is not realistic. Furthermore, the automation of its reverse engineering has not been established.

In addition, the method described in Non-Patent Document 4 only targets VMs owned by malware, not VMs owned by script engines, so there is a problem that it cannot be directly applied to script engines. In addition, the method described in Non-Patent Document 4 also has the problem that it does not refer to acquisition of architecture information related to conditional branching, which is important for multipath execution. Furthermore, the technique described in Non-Patent Document 4 focuses only on the analysis of the VM, and has the problem that it does not take into account the addition of functions to the VM, such as the addition of multipath execution.

In addition, the method described in Non-Patent Document 5 has the problem that it can only be applied to the decode/dispatch type script engine and cannot be applied to the threaded code type script engine, which is another major method.

The present invention has been made in view of the above, and does not require separate design and implementation even for a threaded code type script engine, and does not require detailed architecture information such as conditional branching in advance. It is an object of the present invention to provide an analysis function imparting device, an analysis function imparting program, and an analysis function imparting method capable of realizing impartation of a multipath execution function in consideration of architecture.

In order to solve the above-described problems and achieve the object, the analysis function imparting device of the present invention includes a first analysis unit that analyzes the virtual machine of the script engine and an instruction set architecture that is the system of instructions of the virtual machine. A second analysis unit that analyzes, and a virtual Based on a program counter, a conditional branch flag, which is an area that holds a flag indicating whether or not a branch is taken at the time of a conditional branch in the execution state, and a branch VM instruction, which is a virtual machine instruction that causes a branch, the script engine: a first analysis unit that applies a hook that provides a multipath execution function, the first analysis unit analyzes a plurality of execution traces obtained by changing execution conditions using differential execution analysis, A first acquisition unit that acquires a program counter and a conditional branch flag and acquires a plurality of execution traces by changing execution conditions, and a first acquisition unit that clusters the execution traces and detects the boundary of each VM instruction Analyze a plurality of execution traces using the detection unit, the difference execution analysis focusing on the number of times of memory reading, and the boundaries of each VM instruction detected by the first detection unit, and detect the virtual program counter. A third detection unit that analyzes the binary of the script engine based on the boundary of each VM instruction detected by the first detection unit and detects the dispatcher, and a difference that focuses on the number of times the memory is read and a fourth detection unit that analyzes a plurality of execution traces using execution analysis and detects a conditional branch flag.

According to the present invention, even for a threaded code type script engine, a multipath execution function that takes into account detailed architecture such as conditional branching can be implemented without requiring separate design and implementation and without prior architectural information. grant can be realized.

FIG. 1 is a diagram for explaining an example of the configuration of a threaded code type script engine. FIG. 2 is a diagram showing pseudocode of a threaded code type VM that the script engine has. FIG. 3 is a diagram illustrating an example of the configuration of the analysis function imparting device according to the embodiment. FIG. 4 is a diagram showing an example of a test script (first test script) used for virtual program counter detection. FIG. 5 is a diagram showing an example of a test script (second test script) used for branch VM instruction detection. FIG. 6 is a diagram showing an example of an execution trace. FIG. 7 is a diagram illustrating an example of a VM execution trace. FIG. 8 is a diagram explaining processing of the VM instruction boundary detection unit. FIG. 9 is a diagram for explaining processing of the virtual program counter detection unit. FIG. 10 is a diagram explaining processing of the dispatcher detection unit. FIG. 11 is a diagram explaining processing of the branch VM instruction detection unit. FIG. 12 is a flow chart showing a processing procedure of analysis function imparting processing according to the embodiment. FIG. 13 is a flow chart showing a processing procedure of execution trace acquisition processing shown in FIG. FIG. 14 is a flowchart showing the procedure of the VM instruction boundary detection process shown in FIG. 12; FIG. 15 is a flow chart showing the procedure of the virtual program counter detection process shown in FIG. FIG. 16 is a flow chart showing a processing procedure of dispatcher detection processing shown in FIG. FIG. 17 is a flow chart showing the procedure of the conditional branch flag detection process shown in FIG. FIG. 18 is a flowchart of a procedure of a VM execution trace acquisition process shown in FIG. 12; FIG. 19 is a flow chart showing a processing procedure of branch VM instruction detection processing shown in FIG. 12 . FIG. 20 is a flow chart showing the processing procedure of the analysis function imparting process shown in FIG. FIG. 21 is a diagram showing an example of a computer that implements the analysis function imparting device by executing a program. FIG. 22 is a diagram showing a code fragment showing an example of anti-analysis.

Embodiments of the analytical function imparting device, the analytical function imparting program, and the analytical function imparting method according to the present application will be described in detail below based on the drawings. Moreover, the present invention is not limited to the embodiments described below.

[Embodiment]
An analysis function imparting device according to an embodiment is an analysis function imparting device that can be applied to a threaded code type script engine. By analyzing the binary of the script engine using the test script, the analysis function imparting apparatus according to the embodiment can detect the boundary of the VM instruction and the virtual program counter (VPC) which is a variable indicating the VM instruction to be executed next. , a dispatcher, a conditional branch flag, and a branch VM instruction, which is a VM instruction that causes branching, are detected in order.

　These are all components of the script engine and information about the architecture. The structure of a typical script engine and their functions will be described with reference to FIGS. 1 and 2. FIG.

FIG. 1 is a diagram for explaining an example of the configuration of a threaded code type script engine. As shown in FIG. 1, script engine 100 has bytecode compiler 102 and virtual machine (VM) 103 . The bytecode compiler 102 also has a syntax analysis unit 104 and a bytecode generation unit 105 . The VM 103 also has a code cache unit 106, a decode unit 107, a pointer cache unit 108, and a plurality of sets 109-1 to 109-3 of VM instruction handler units and dispatcher units. The script engine 100 accepts script input.

The syntax analysis unit 104 receives a script as an input, generates an abstract syntax tree (AST) through lexical analysis and syntactic analysis, and outputs it to the bytecode generation unit 105 . The bytecode generation unit 105 receives the AST as an input, converts it into bytecode, and stores it in the code cache unit 106 .

The decoding unit 107 collectively reads the codes from the code cache unit 106 and decodes all the read codes. The decoding unit 107 converts all codes into pointers and stores them in the pointer cache unit 108 . Groups 109-1 to 109-3 of distributed VM instruction handler units and dispatcher units execute programs corresponding to VM instructions. The contents described in the script are executed by referring to the pointer in the pointer cache unit 108, executing the VM instruction while checking the pointer one by one, and dispatching to the next VM instruction.

The functions of the components of the script engine will be described with reference to FIG. FIG. 2 is a diagram showing pseudocode of a threaded code type VM that the script engine has. As shown in FIG. 2, the pseudocode first initializes the VPC (line 1). In the pseudo code, the pointer pointed to by the VPC is obtained from the pointer cache as the pointer of the VM instruction handler to be executed next (line 2). In the pseudocode, a goto statement is used to dispatch to the next VM instruction handler (line 3). Then, in the pseudocode, the dispatched VM instruction handler is executed (lines 5, 9, and 13). In the pseudocode, there is a dispatcher behind each VM instruction handler that gets a pointer to the VM instruction handler to be executed next and dispatches to it (lines 6, 7, 10, 11, 14, 15). .

A branch VM instruction is a VM instruction that causes a branch within a script, and a conditional branch flag is an area that holds a flag indicating whether or not a branch is taken at the time of a conditional branch.

[Equipment for providing analysis function]
First, the analysis function imparting apparatus 10 according to the present embodiment acquires an execution trace consisting of a branch trace and a memory access trace by hooking a branch instruction and hooking a memory operation instruction to a script engine binary. However, a branch trace is a record of executed branches, and a memory access trace is a record of executed memory reads and writes.

Then, the analysis function imparting device 10 detects the boundaries of each VM instruction. That is, when there are a plurality of pairs of distributed VM instruction handler units and dispatcher units, it is detected where each of them starts and ends. At this time, the analysis function imparting apparatus 10 clusters the execution traces and detects clusters whose number of times of execution is equal to or greater than a threshold value as VM instructions. The analysis function imparting device 10 detects the start point and the end point of the continuous instruction string forming the VM instruction as boundaries. The VM instruction boundary detected here is used in VPC detection and dispatcher detection.

Also, this analysis function imparting device 10 analyzes the execution trace and detects the VPC. The analysis function imparting device applies differential execution analysis focusing on the number of times of memory reading to detect the VPC.

Furthermore, this analysis function imparting device 10 analyzes the binary of the script engine and detects the dispatcher. As a premise, the dispatcher is implemented by referring to the pointer cache and jumping to the pointer of the next VM instruction handler. Dispatchers are distributed behind each VM instruction handler and generally their code is highly identical. By searching for code that exists behind such VM instruction handlers and has a high degree of identity, the analysis function imparting device 10 detects the dispatcher in a predetermined manner.

Then, this analysis function imparting device 10 analyzes the execution trace and detects conditional branch flags. The analysis function imparting device 10 applies differential execution analysis focused on memory reading to detect conditional branch flags.

Subsequently, the analysis function imparting device 10 obtains a VM execution trace for the script engine binary by monitoring the VPC and the pointer of the VM instruction handler dispatched by the dispatcher. However, the VM execution trace records pointers of executed VM instruction handlers and VPCs.

This analysis function imparting device 10 analyzes this VM execution trace and detects branch VM instructions. In detecting a branch VM instruction, the analysis function imparting device 10 first executes a large number of test scripts to obtain a VM execution trace. Then, the analysis function imparting device 10 associates the pointer to the VM instruction with the VM instruction, and virtually assigns a VM opcode to each as an identifier. Then, the analysis function imparting device 10 collects the amount of change in the VPC before and after the execution of each VM opcode. If the VM opcode is anything other than a branch VM instruction, the amount of change in VPC is approximately constant. On the other hand, if the VM opcode is for a branch VM instruction, the VPC varies depending on the branch destination. The analysis function imparting device 10 evaluates variations in the amount of change in the VPC for each VM opcode in terms of variance, and detects those whose variance is equal to or greater than a certain threshold value as branch VM instructions.

Then, the analysis function imparting device 10 hooks the script engine binary based on the VPC, the branch VM instruction, and the conditional branch flag obtained up to this point. With this hook, the analyzer 10 monitors what the VPC points to and branches the execution state when it is a branch VM instruction. Then, the analysis function imparting device 10 executes one execution state as it is, and executes the other execution state after rewriting the conditional branch flag. This causes both execution paths of the conditional branch to be executed. As described above, the analysis function imparting device 10 realizes imparting the multipath function to the crypto engine as a retrofit.

[Configuration of analysis function imparting device]
Next, the configuration of the analysis function imparting device 10 according to the embodiment will be specifically described with reference to FIG. FIG. 3 is a diagram illustrating an example of the configuration of the analysis function imparting device according to the embodiment.

As shown in FIG. 3, the analysis function imparting device 10 has an input unit 11, a control unit 12, a storage unit 13, and an output unit . Then, the analysis function imparting device 10 receives the input of the test script and the script engine binary.

The input unit 11 is composed of input devices such as a keyboard and a mouse, receives input of information from the outside, and inputs the information to the control unit 12 . Further, the input unit 11 has a communication interface for transmitting and receiving various information to and from another device connected via a wired connection or a network, etc., and receives input of information transmitted from the other device. accept. The input unit 11 receives input of test scripts and script engine binaries, and outputs them to the control unit 12 . A test script is a script input when dynamically analyzing a script engine to acquire an execution trace and a VM execution trace. Details of the test script will be described later. Script engine binaries are the executable files that make up the script engine. A script engine binary may consist of multiple executable files.

The control unit 12 has an internal memory for storing programs defining various processing procedures and required data, and executes various processing using these. For example, the control unit 12 is an electronic circuit such as a CPU (Central Processing Unit) or MPU (Micro Processing Unit). The control unit 12 has a virtual machine analysis unit 121 (first analysis unit), an instruction set architecture analysis unit 122 (second analysis unit), and an analysis function addition unit 123 (addition unit).

The virtual machine analysis unit 121 analyzes the VM of the script engine. The virtual machine analysis unit 121 acquires a plurality of execution traces by changing execution conditions, analyzes the plurality of execution traces using differential execution analysis, and acquires VPCs and conditional branch flags. Also, the virtual machine analysis unit 121 statically analyzes the script engine binary to acquire VM instruction boundaries and dispatchers. The virtual machine analysis unit 121 includes an execution trace acquisition unit 1211 (first acquisition unit), a VM instruction boundary detection unit 1212 (first detection unit), a virtual program counter detection unit 1213 (second detection unit), and a dispatcher detection unit. It has a unit 1214 (third detection unit) and a conditional branch flag detection unit 1215 (fourth detection unit).

The execution trace acquisition unit 1211 accepts the test script and script engine binary as input. The execution trace acquisition unit 1211 acquires an execution trace by executing the test script while monitoring execution of the script engine binary.

An execution trace consists of a branch trace and a memory access trace. The branch trace records the type of branch instruction, the branch source address, and the branch destination address at the time of execution. A memory access trace records the type of memory operation and the memory address of the operation target. Branch traces and memory access traces are known to be obtainable by instruction hooks. The execution trace acquired by the execution trace acquisition unit 1211 is stored in the execution trace DB 131 .

The VM instruction boundary detection unit 1212 clusters the execution traces and detects the boundary of each VM instruction. The VM instruction boundary detection unit 1212 clusters the execution trace and detects clusters whose number of executions is equal to or greater than a threshold value as VM instructions. Clustering finds contiguous code regions that are executed multiple times. This may be done, for example, by grouping together code distances between executed instructions, by finding common subsequences of executed code blocks, or by other methods. The analysis function imparting device 10 detects the start point and the end point of the continuous instruction string forming the detected VM instruction as boundaries. The VM instruction boundary detected here is used in VPC detection and dispatcher detection.

The virtual program counter detection unit 1213 extracts and analyzes the execution trace for the first test script stored in the execution trace DB 131 to detect the VPC. The virtual program counter detection unit 1213 analyzes a plurality of execution traces using differential execution analysis focusing on the number of times of memory reading and the boundary of each VM instruction detected by the VM instruction boundary detection unit 1212, and detects a VPC. . The virtual program counter detection unit 1213 utilizes the fact that reading into the memory holding the VPC always occurs after execution of each VM instruction, and detects the VPC by finding the reading destination.

For this reason, the virtual program counter detection unit 1213 uses differential execution analysis focusing on the number of times of memory reading for VPC detection. The virtual program counter detection unit 1213 compares the execution traces of a plurality of test scripts acquired using the test scripts, and finds that the memory read count is proportional to both the number of repetitions and the number of statements to be repeated. Discover changing memory. Then, the virtual program counter detection unit 1213 refers to the boundary of each VM instruction detected by the VM instruction boundary detection unit 1212, and narrows down the read memory values to those that always point to the starting point of the VM instruction. The virtual program counter detection unit 1213 detects this memory as a VPC.

The dispatcher detection unit 1214 cuts out each VM instruction part from the script engine binary based on the VM instruction boundary detected by the VM instruction boundary detection unit 1212, and detects a part with a high degree of similarity between each VM instruction as a dispatcher. A sequence alignment algorithm, for example, may be used to detect portions with a high degree of similarity, or other methods may be used.

The conditional branch flag detection unit 1215 extracts and analyzes the execution trace for the second test script stored in the execution trace DB 131 and finds the conditional branch flag. The conditional branch flag detection unit 1215 analyzes a plurality of execution traces and detects conditional branch flags using differential execution analysis focusing on the number of times of memory reading. The conditional branch flag detection unit 1215 executes conditional branching in various patterns, and compares the memory change pattern at that time with the conditional branching pattern on the test script to detect the memory storing the conditional branching flag. do.

The instruction set architecture analysis unit 122 analyzes the instruction set architecture, which is the system of VM instructions. The instruction set architecture analysis unit 122 has a VM execution trace acquisition unit 1221 (second acquisition unit) and a branch VM instruction detection unit 1222 (fifth detection unit).

As with the execution trace acquisition unit 1211, the VM execution trace acquisition unit 1221 accepts test scripts and script engine binaries as inputs. The VM execution trace acquisition unit 1221 acquires the VM execution trace, which is the execution trace executed on the VM, by executing the test script while monitoring execution of the script engine binary.

A VM execution trace consists of a VPC and a VM opcode for each executed VM instruction. The VPC recording can be realized by monitoring the VPC memory detected by the virtual program counter detection unit 1213 . The VM opcode here is an identifier virtually assigned to each linking a pointer to a VM instruction and a VM instruction. The VM execution trace acquired by the VM execution trace acquisition unit 1221 is stored in the VM execution trace DB 133 .

The branch VM instruction detection unit 1222 extracts and analyzes the VM execution trace stored in the VM execution trace DB 133 to detect branch VM instructions. The branch VM instruction detection unit 1222 pays attention to the fact that the magnitude of variation in the VPC value is different between the branch VM instruction and the other VM instructions, and determines a threshold value to branch the one with the larger variation in the VPC value. Detect as a VM instruction. The branch VM instruction detection unit 1222 detects a branch VM instruction based on variations in the amount of change in the virtual program counter for each VM opcode in the VM execution trace.

Based on the architecture information obtained by the analysis by the virtual machine analysis unit 121 and the instruction set architecture analysis unit 122, the analysis function imparting unit 123 hooks the script engine to impart a multipath execution function. The analysis function imparting unit 123 hooks the script engine using the obtained VPC, branch VM instruction, and conditional branch flag. This hook monitors the VPC to confirm the VM opcode, and branches the execution state if the VM opcode is for a branch VM instruction. This hook executes one execution state as it is, and rewrites the conditional branch flag to execute the other execution state, thereby providing the script engine with a multi-pass execution function.

The storage unit 13 is implemented by a semiconductor memory device such as RAM (Random Access Memory) and flash memory, or a storage device such as a hard disk and an optical disk, and stores a processing program for operating the analysis function imparting device 10, a processing Data used during program execution is stored. The storage unit 13 has an execution trace database (DB) 131 , a VM execution trace DB 133 and an architecture information DB 132 .

The execution trace DB 131 and VM execution trace DB 133 store execution traces and VM execution traces acquired by the execution trace acquisition unit 1211 and VM execution trace acquisition unit 1221, respectively. The execution trace DB 131 and VM execution trace DB 133 are managed by the analysis function imparting device 10 . Of course, the execution trace DB 131 and the VM execution trace DB 133 may be managed by another device (server or the like). Via the communication interface, the acquired execution trace and VM execution trace are output to the management server of the execution trace DB 131 and VM execution trace DB 133 and stored in the execution trace DB 131 and VM execution trace DB 133 .

The output unit 14 is, for example, a liquid crystal display, a printer, etc., and outputs various information including information about the analysis function imparting device 10 . Further, the output unit 14 may be an interface that controls input/output of various data with an external device, and may output various information to the external device.

[Configuration of test script]
Describe the test script. A test script is a script that is input when dynamically analyzing the script engine. This test script focuses on the execution of branch instructions and the number of memory read/writes, and is used to capture the difference in behavior of the script engine that occurs when the test script is executed a different number of times. This test script is prepared in advance for analysis and is created manually. This creation requires knowledge of the specifications of the target script language.

FIG. 4 is a diagram showing an example of a test script (first test script) used for VPC detection. The first test script uses iteration (line 2). In the first test script, by increasing or decreasing the number of repetitions (line 2) and the number of sentences to be repeated (lines 3 to 5) in the test script, the execution conditions are changed and differences are generated. Let

FIG. 5 is a diagram showing an example of a test script (second test script) used for branch VM instruction detection. The second test script uses multiple conditional branches (lines 4 to 8). In the second test script, this multiple conditional branching controls the branching conditions so that branches are taken or not taken in a particular pattern of order (lines 1, 5). In the second test script, the number of conditional branches and the pattern of success or failure of branching are changed to generate a difference.

Execution trace configuration
Next, the execution trace will be explained. FIG. 6 is a diagram showing an example of an execution trace. The execution trace consists of a branch trace and a memory access trace, as described above. FIG. 6 is a diagram showing an example of an execution trace. Hereinafter, the configuration of the execution trace will be shown using FIG.

An execution trace has an element called trace. trace indicates whether the log line is a branch trace or a memory access trace.

A branch trace log line, for example, has the format described in lines 1 to 10 in Figure 6, and consists of three elements: type, src, and dst. type indicates whether the executed branch instruction is a call instruction, a jmp instruction, or a ret instruction. Also, src indicates a branch source address, and dst indicates a branch destination address.

The memory access trace log line, for example, has the format described in lines 11 to 13 in Figure 6, and consists of three elements: type, target, and value. type indicates whether the memory access is read or write. target indicates a memory address to be accessed. In addition, the value of the result of memory access is stored in value.

[Configuration of VM execution trace]
Next, VM execution trace will be described. FIG. 7 is a diagram illustrating an example of a VM execution trace. A VM execution trace is a record of VM opcodes and VPCs, as described above. FIG. 7 is a cutout of a portion of the VM execution trace. Hereinafter, the configuration of the VM execution trace will be shown using FIG.

A VM execution trace log line, for example, has the format shown in Fig. 7 and consists of two elements: vpc and pointer. vpc indicates the value of VPC. Also, pointer indicates the value of the pointer that points to the beginning of the VM instruction handler to be executed, which is obtained from the pointer cache.

[Processing of VM instruction boundary detection unit]
Next, processing of the VM instruction boundary detection unit 1212 will be described. FIG. 8 is a diagram for explaining the processing of the VM instruction boundary detection unit 1212. As shown in FIG.

The VM instruction boundary detection unit 1212 detects the boundary of each VM instruction. At this time, the VM instruction boundary detection unit 1212 detects the VM instruction and its boundary in order to provide the script multipath execution function in the threaded code type VM. Specifically, the VM instruction boundary detection unit 1212 extracts an execution trace from the execution trace DB 131 . Then, as shown in FIG. 8, the VM instruction boundary detection unit 1212 clusters the execution trace by a predetermined method, and sets clusters whose execution count is equal to or greater than a threshold as VM instructions (for example, VM instruction handlers 1 to 3). To detect. The VM instruction boundary detection unit 1212 detects a start point and an end point of a continuous instruction sequence forming a VM instruction as a boundary.

[Processing of Virtual Program Counter Detector]
Next, processing of the virtual program counter detection unit 1213 will be described. The virtual program counter detection unit 1213 detects VPCs and pointer caches in order to provide a script multipath execution function in a threaded code VM. The detection of the virtual program counter is realized by analyzing the memory access trace log of the acquired execution trace. The virtual program counter detection unit 1213 uses differential execution analysis focusing on the number of times the memory is read. FIG. 9 is a diagram for explaining the processing of the virtual program counter detection unit 1213. As shown in FIG.

The virtual program counter detection unit 1213 extracts one execution trace by the first test script from the execution trace DB 131. The number of VPC reads is proportional to the number of iterations in the test script and the number of statements in the iteration. When the number of repetitions is N and the number of sentences to be repeated is M, approximately MN VPC reads occur. Therefore, the virtual program counter detection unit 1213 extracts memory increased by 4MN and 9MN in the execution trace for the first test script in which N and M are increased by 2N and 2M, and 3N and 3M, respectively. Specifically, as shown in FIG. 9, the virtual program counter detection unit 1213 extracts a memory area that has read/write for each execution of one VM instruction and monotonically increases ((1) in FIG. 9).

Then, the virtual program counter detection unit 1213 detects as a VPC that the read memory value always points to the starting point of the VM instruction. Specifically, the virtual program counter detection unit 1213 collates the destination of the VPC with the address of the VM instruction handler, and narrows down to a matching memory area ((2) in FIG. 9).

[Processing of the dispatcher detector]
Next, processing of the dispatcher detection unit 1214 will be described. The dispatcher detection unit 1214 detects the dispatcher by analyzing the binary of the script engine using a predetermined method. FIG. 10 is a diagram for explaining the processing of the dispatcher detection unit 1214. As shown in FIG.

The dispatcher detection unit 1214 detects dispatchers in order to provide script multipath execution functions in threaded code VMs. The dispatcher detection unit 1214 cuts out each VM instruction part from the script engine binary based on the VM instruction boundary detected by the VM instruction boundary detection unit 1212 . Then, the dispatcher detection unit 1214 calculates the similarity between the codes of each VM instruction based on the assumption that the similarity of the dispatcher code is high ((1) in FIG. 10), and calculates the similarity between all the VM instructions. Detect the high degree part as a dispatcher. The dispatcher detection unit 1214 can detect code that is commonly executed in the second half of a VM instruction as a dispatcher ((1) in FIG. 10).

[Processing of Conditional Branch Flag Detector]
Next, processing of the conditional branch flag detection unit 1215 will be described. The conditional branch flag detection unit 1215 detects the conditional branch flag by analyzing memory access.

The conditional branch flag detection unit 1215 uses the execution trace obtained using the second test script. The conditional branch flag detection unit 1215 detects the conditional branch flag by analyzing the test script and performing two stages of narrowing down. The conditional branch flag has two states: branch taken or not taken. Also, the conditional branch flag is considered to be read a number of times proportional to the number of conditional branches.

From this, the conditional branch flag detection unit 1215 extracts the memories with the number of memory reads proportional to the number of conditional branches as the first stage of narrowing down. Then, as the second stage of narrowing down, the conditional branch flag detection unit 1215 extracts a memory in which two values are exchanged so that the value at the time of reading each memory corresponds to the conditional branch of the test script.

For example, if the conditional branch flag holds X if the branch is taken and Y if not taken, then in the second test script of FIG. will be done, will be done, will not be done. Therefore, the conditional branch flag detection unit 1215 extracts memory addresses that alternate between two values, X, Y, X, X, Y. The conditional branch flag detection unit 1215 detects the conditional branch flag by repeating this while changing the number of times of branching.

[Processing of Branch VM Instruction Detector]
Next, processing of the branch VM instruction detection unit 1222 will be described. The branch VM instruction detection unit 1222 detects the branch VM instruction by analyzing the acquired VM execution trace log. Since the test script here only needs to include a branch VM instruction, any script that includes branch control syntax may be used. For example, prepare a test script by collecting from the Internet or from official documents.

First, the branch VM instruction detection unit 1222 associates a pointer to a VM instruction with a VM instruction for each VM execution trace in the VM execution trace DB 133, and virtually assigns a VM opcode to each as an identifier. FIG. 11 is a diagram for explaining the processing of the branch VM instruction detection unit 1222. As shown in FIG.

Here, when a certain VM instruction is a branch instruction, the advance of the VPC changes depending on the branch destination. On the other hand, for instructions other than branch instructions, the advance of the VPC changes depending on the size of the VM instruction. For this reason, when the sets of the operation code of the VM instruction and the pointer to the VM instruction are collected and the progress of the VPC is observed for each operation code, the progress of the VPC varies depending on the branch destination if the instruction is a branch instruction.

Therefore, the branch VM instruction detector 1222 uses variance to evaluate the dispersion of pointers to this VM instruction. The branch VM instruction detection unit 1222 calculates the variance of the VPC change amount for each VM opcode, and narrows down only the VM opcodes with the calculated variance larger than the threshold. As a result, the branch VM instruction detection unit 1222 detects a VM instruction (in the example of FIG. 11, VM instruction handler 3) with variations in the progress of the VPC as a branch VM instruction while associating the pointer with the VM instruction ( (1) in FIG. 11).

Let O={o ₀ , _o ₁ , . Whether or not is determined as in formula (3) based on the variance s (see formula (2)). Thereby, the branch VM instruction detection unit 1222 detects the branch VM instruction.

For VM instructions other than branching, almost no variation is seen, and the boundary between branching VM instructions and other VM instructions is often clear. For this reason, the threshold is set to a value that can divide the resulting two groups by plotting the obtained variance values on a number line, for example.

[Processing of analysis function imparting unit]
Next, processing of the analysis function imparting unit 123 will be described. The analysis function imparting unit 123 receives as inputs the script engine binary and the hook points and tap points detected in the processing up to this point. The analysis function imparting unit 123 hooks the script engine at the hook point.

Here, the analysis function imparting unit 123 inserts the code for analysis so that the language element corresponding to the hook is executed at the time of hooking, and the memory of the tap point as its argument is output to the log. Code for this analysis can be easily generated if the hook points and tap points are known. As a result, when the script is executed, its behavior will be output to the log, and the addition of the analysis function is realized.

　The addition of the analysis function by this hook may be realized by directly rewriting the binary for the script engine binary, or by rewriting the memory image when the binary is executed and expanded on the process memory.

[Processing procedure of analysis function imparting device]
Next, a processing procedure of analysis function imparting processing by the analysis function imparting device 10 will be described. FIG. 12 is a flow chart showing a processing procedure of analysis function imparting processing according to the embodiment.

First, the input unit 11 receives a test script and a script engine binary as input (step S1).

Then, the execution trace acquisition unit 1211 performs an execution trace acquisition process of executing the test script while monitoring the binary of the script engine and acquiring a branch trace and a memory access trace (step S2). Then, the VM instruction boundary detection unit 1212 detects a VM instruction and performs VM instruction boundary detection processing for detecting the boundary of the VM instruction (step S3).

The virtual program counter detection unit 1213 extracts and analyzes the execution trace for the first test script stored in the execution trace DB 131, and performs virtual program counter detection processing for discovering the VPC (step S4). The dispatcher detection unit 1214 extracts each VM instruction part from the script engine binary, and performs dispatcher detection processing for detecting a part having a high degree of similarity between each VM instruction as a dispatcher (step S5). The conditional branch flag detection unit 1215 extracts and analyzes the execution trace for the second test script stored in the execution trace DB 131, and performs conditional branch detection processing for finding the conditional branch flag (step S6).

The VM execution trace acquisition unit 1221 receives a test script and a script engine binary as inputs, and performs VM execution trace acquisition processing for acquiring a VM execution trace by executing the test script while monitoring the execution of the script engine binary. (Step S7). The branch VM instruction detection unit 1222 extracts and analyzes the VM execution trace stored in the VM execution trace DB 133, and performs branch VM instruction detection processing for detecting the branch VM instruction (step S8).

The analysis function imparting unit 123 performs the analysis function imparting process of hooking the script engine using the obtained VPC, branch VM instruction and conditional branch flag (step S9). Then, the output unit 14 outputs the script engine binary provided with the multipath execution function (step S10).

[Execution trace acquisition process procedure]
Next, the flow of execution trace acquisition processing shown in FIG. 13 will be described. FIG. 13 is a flow chart showing a processing procedure of execution trace acquisition processing shown in FIG.

First, the execution trace acquisition unit 1211 receives the test script and the script engine binary as inputs (step S11). The execution trace acquisition unit 1211 hooks the received script engine to acquire a branch trace (step S12). The execution trace acquisition unit 1211 also hooks the received script engine to acquire a memory access trace (step S13).

Then, the execution trace acquisition unit 1211 inputs the test script received in that state to the script engine to execute it (step S14), and stores the execution trace acquired thereby in the execution trace DB 131 (step S15).

The execution trace acquisition unit 1211 determines whether all the input test scripts have been executed (step S16). If the execution trace acquisition unit 1211 has finished executing all of the input test scripts (step S16: Yes), the execution trace acquisition unit 1211 ends the process. On the other hand, if the execution trace acquisition unit 1211 has not executed all of the input test scripts (step S16: No), it returns to execution of the test scripts in step S14 and continues processing.

[Processing Procedure of VM Instruction Boundary Detection Processing]
Next, the flow of VM instruction boundary detection processing shown in FIG. 12 will be described. FIG. 14 is a flowchart showing the procedure of the VM instruction boundary detection process shown in FIG. 12;

First, the VM instruction boundary detection unit 1212 extracts an execution trace from the execution trace DB 131 (step S21). The VM instruction boundary detection unit 1212 clusters the execution traces by a predetermined method (step S22). Any method may be used for the clustering.

The VM instruction boundary detection unit 1212 detects clusters whose number of executions is equal to or greater than the threshold as VM instructions (step S23). Then, the VM instruction boundary detection unit 1212 sets the start point and the end point of the continuous instruction sequence forming the VM instruction as the boundary (step S24). The VM instruction boundary detection unit 1212 outputs the VM instruction boundary as a return value (step S25), and ends the VM instruction boundary detection process.

[Processing procedure of virtual program counter detection processing]
Next, the flow of the virtual program counter detection process shown in FIG. 12 will be described. FIG. 15 is a flow chart showing the procedure of the virtual program counter detection process shown in FIG.

First, the virtual program counter detection unit 1213 extracts one execution trace by the first test script from the execution trace DB 131 (step S31). Subsequently, the virtual program counter detection unit 1213 focuses on the memory access trace of the execution trace, and counts the number of times of reading for each memory reading destination (step S32).

The virtual program counter detection unit 1213 receives as an input the first test script used to acquire the execution trace (step S33), analyzes the first test script, and detects the number of repetitions and the number of sentences to be repeated. Acquire (step S34).

Subsequently, the virtual program counter detection unit 1213 extracts from the execution trace DB 131 one more execution trace by the first test script with a different repetition count and number of repeated sentences (step S35). Then, the virtual program counter detection unit 1213 pays attention to the memory access trace and counts the number of readings for each memory reading destination (step S36). In addition, the virtual program counter detection unit 1213 receives as an input the first test script used to acquire the execution trace (step S37), analyzes the test script, and acquires the number of repetitions and the number of repeated sentences. (step S38).

Here, the virtual program counter detection unit 1213 narrows down only memory read destinations whose read count changes in proportion to the number of repetitions and the increase or decrease in the number of repeated sentences (step S39). Furthermore, the virtual program counter detection unit 1213 narrows down the memory read destinations narrowed down in step S39 to those in which the read memory value always points to the start point of the VM instruction (step S40).

Then, the virtual program counter detection unit 1213 determines whether or not the memory reading destination has been narrowed down to only one (step S41). If the virtual program counter detection unit 1213 cannot narrow down the memory reading destination to only one (step S41: No), the process returns to step S35, extracts the next execution trace, and continues the process. On the other hand, if the virtual program counter detection unit 1213 narrows down the memory reading destination to only one (step S41: Yes), it stores the narrowed down memory reading destination in the architecture information DB 132 as a virtual program counter (step S42). ) and terminate the process.

[Processing procedure of dispatcher detection processing]
Next, the flow of dispatcher detection processing shown in FIG. 12 will be described. FIG. 16 is a flow chart showing a processing procedure of dispatcher detection processing shown in FIG.

First, the dispatcher detection unit 1214 receives the script engine binary as an input (step S51). The dispatcher detector 1214 receives the boundary of the VM instruction from the VM instruction boundary detector 1212 (step S52).

The dispatcher detection unit 1214 cuts out each VM instruction part from the script engine binary based on the boundary of the VM instruction received from the VM instruction boundary detection unit 1212 (step S53). The dispatcher detection unit 1214 calculates the code similarity between each VM instruction by a predetermined method (step S54). Any similarity calculation method can be used as long as it can calculate the similarity between codes.

The dispatcher detection unit 1214 extracts a portion with a high degree of similarity among all VM instructions based on the degree of similarity calculated in step S54 (step S55). Then, the dispatcher detection unit 1214 determines whether it is the end part of the VM instruction (step S56).

If it is not the end part of the VM instruction (step S56: No), the dispatcher detection unit 1214 returns to step S55 and continues processing. If it is the end part of the VM instruction (step S56: Yes), the dispatcher detection unit 1214 outputs the extracted part as the dispatcher (step S57), and ends the process.

[Processing procedure of conditional branch flag detection processing]
Next, the flow of the conditional branch flag detection process shown in FIG. 12 will be described. FIG. 17 is a flow chart showing the procedure of the conditional branch flag detection process shown in FIG.

First, the conditional branch flag detection unit 1215 extracts one execution trace by the second test script from the execution trace DB 131 (step S71). Then, the conditional branch flag detection unit 1215 focuses on the memory access trace and counts the number of readings for each memory reading destination (step S72).

Also, the conditional branch flag detection unit 1215 receives as an input the second test script used to acquire the execution trace (step S73), analyzes this second test script, and determines the number of conditional branches and True/ A False order pattern is obtained (step S74). Then, the conditional branch flag detection unit 1215 narrows down only memory read destinations whose number of times of reading changes in proportion to the number of times of conditional branching (step S75). Furthermore, the conditional branch flag detection unit 1215 narrows down the read memory values to memory read destinations where two values are exchanged according to the order pattern of True/False (step S76).

The conditional branch flag detection unit 1215 determines whether or not the memory reading destination has been narrowed down to only one (step S77). If the conditional branch flag detection unit 1215 cannot narrow down the memory reading destination to only one (step S77: No), the process returns to step S71, extracts the next execution trace, and continues the process. On the other hand, if the memory read destination is narrowed down to only one (step S77: Yes), the conditional branch flag detection unit 1215 stores the narrowed down read destination in the architecture information DB 132 as a virtual program counter (step S78). End the process.

[Processing Procedure of VM Execution Trace Acquisition Processing]
Next, the flow of the VM execution trace acquisition process shown in FIG. 12 will be described. FIG. 18 is a flowchart of a procedure of a VM execution trace acquisition process shown in FIG. 12;

First, the VM execution trace acquisition unit 1221 receives the test script and the script engine binary as input (step S81). Then, the VM execution trace acquisition unit 1221 hooks the received script engine to record the VPC and VM operation code (step S82).

The VM execution trace acquisition unit 1221 inputs the test script received in that state to the script engine to execute it (step S83), and stores the VM execution trace acquired thereby in the VM execution trace DB 133 (step S84).

The VM execution trace acquisition unit 1221 determines whether all the input test scripts have been executed (step S85). If the VM execution trace acquisition unit 1221 has finished executing all the input test scripts (step S85: Yes), the process ends. If the VM execution trace acquisition unit 1221 has not finished executing all of the input test scripts (step S85: No), it returns to execution of the test scripts in step S83 and continues processing.

[Processing Procedure of Branch VM Instruction Detection Processing]
Next, the flow of branch VM instruction detection processing shown in FIG. 12 will be described. FIG. 19 is a flow chart showing a processing procedure of branch VM instruction detection processing shown in FIG. 12 .

First, the branch VM instruction detection unit 1222 extracts one VM execution trace from the VM execution trace DB 133 (step S91). The branch VM instruction detection unit 1222 associates the pointer to the VM instruction with the VM instruction, and assigns a VM opcode to each as an identifier (step S92). Then, the branch VM instruction detection unit 1222 aggregates the amount of change in VPC before and after execution for each VM opcode (step S93).

The branch VM instruction detection unit 1222 determines whether or not all VM execution traces in the VM execution trace DB 133 have been processed (step S94). If all VM execution traces in the VM execution trace DB 133 have not been processed (step S94: No), the branch VM instruction detection unit 1222 returns to step S91 to extract and process the next VM execution trace.

If all VM execution traces in the VM execution trace DB 133 have been processed (step S94: Yes), the branch VM instruction detection unit 1222 calculates the variance of the VPC variation for each VM opcode (step S95). The branch VM instruction detection unit 1222 then receives the threshold as an input (step S96). The branch VM instruction detection unit 1222 narrows down to only VM opcodes whose variance is larger than the threshold (step S97), stores them as branch VM instructions in the architecture information DB 132 (step S98), and ends the process.

[Processing procedure of processing for adding analysis function]
Next, the flow of the analysis function imparting process shown in FIG. 12 will be described. FIG. 20 is a flow chart showing the processing procedure of the analysis function imparting process shown in FIG.

First, the analysis function imparting unit 123 receives a script engine binary as an input (step S101). Then, the analysis function imparting unit 123 extracts the VPC, the conditional branch flag, and the conditional branch VM instruction from the architecture information DB 132 (step S102). Subsequently, the analysis function imparting unit 123 applies a hook to the hook point of the script engine (step S103). The analysis function imparting unit 123 generates a code and inserts it into the script engine so that the multipath execution code is executed at the time of this hook (step S104). The analysis function imparting unit 123 outputs the hooked script engine thus obtained as a script engine with a multipath execution function (step S105), and terminates the process.

[Effects of Embodiment]
As described above, the analysis function imparting apparatus 10 according to the present embodiment executes the test script while monitoring the binary of the script engine, and acquires the branch trace and the memory access trace. Then, the analysis function imparting device 10 analyzes the virtual machine based on the execution trace, and acquires architecture information such as VM instruction boundaries, VPC, dispatchers, and conditional branch flags. Furthermore, the analysis function imparting device 10 executes the test script to acquire the VM execution trace, analyzes the instruction set architecture using the VM execution trace, and acquires the branch VM instruction as architecture information. Then, the analysis function imparting device 10 imparts the multipath execution function to the script engine based on the obtained architecture information.

As a result, the analysis function imparting device 10 according to the embodiment detects various types of architecture information through analysis based on acquisition of execution traces and VM execution traces, even for proprietary script engines for which only binaries are available. A multipath execution function can be added without manual reverse engineering.

In addition, the analysis function imparting device 10 can automatically impart a multipath execution function to various script engines as long as a test script is prepared. can be realized.

Furthermore, since the analysis function imparting device 10 considers detailed architecture such as conditional branching, it is possible to implement an accurate multipath execution function against the conditional branching of the script.

In addition, since the analysis function imparting device 10 focuses on the threaded code type script engine, it is possible to impart the multipath execution function even to the script engine having the threaded code type VM.

As described above, the analysis function imparting apparatus 10 according to the present embodiment analyzes the script engine and retrofits the multipath execution function to the script engine of various script languages including threaded code type. On the other hand, it is possible to automatically provide the multipath execution function.

As described above, the analysis function imparting apparatus 10 according to the present embodiment is useful for analyzing the behavior of malicious scripts written in a wide variety of script languages, and has a route that cannot be executed unless a specific condition is met. It is suitable for comprehensively analyzing the behavior of a malicious script that is not affected by it. For this reason, the behavior of malicious scripts can be analyzed by providing multipath execution functions to various script engines using the analysis function imparting device 10, the analysis function imparting program, and the analysis function imparting method according to the present embodiment. It is possible to utilize it for countermeasures such as detection.

[About the system configuration of the embodiment]
Each component of the analysis function imparting apparatus 10 shown in FIG. 3 is functionally conceptual, and does not necessarily need to be physically configured as shown. That is, the specific form of distributing and integrating the functions of the analysis function imparting device 10 is not limited to the illustrated one, and all or part of it can be functionally or It can be physically distributed or integrated.

Further, all or any part of each process performed in the analysis function imparting device 10 may be realized by a CPU and a program that is analyzed and executed by the CPU. Further, each process performed in the analysis function imparting device 10 may be realized as hardware by wired logic.

Also, among the processes described in the embodiments, all or part of the processes described as being performed automatically can also be performed manually. Alternatively, all or part of the processes described as being performed manually can be performed automatically by known methods. In addition, the above-described and illustrated processing procedures, control procedures, specific names, and information including various data and parameters can be changed as appropriate unless otherwise specified.

[program]
FIG. 21 is a diagram showing an example of a computer that implements the analysis function imparting device 10 by executing a program. The computer 1000 has a memory 1010 and a CPU 1020, for example. Computer 1000 also has hard disk drive interface 1030 , disk drive interface 1040 , serial port interface 1050 , video adapter 1060 and network interface 1070 . These units are connected by a bus 1080 .

The memory 1010 includes a ROM 1011 and a RAM 1012. The ROM 1011 stores a boot program such as BIOS (Basic Input Output System). Hard disk drive interface 1030 is connected to hard disk drive 1090 . A disk drive interface 1040 is connected to the disk drive 1100 . A removable storage medium such as a magnetic disk or optical disk is inserted into the disk drive 1100 . Serial port interface 1050 is connected to mouse 1110 and keyboard 1120, for example. Video adapter 1060 is connected to display 1130, for example.

The hard disk drive 1090 stores, for example, an OS 1091, application programs 1092, program modules 1093, and program data 1094. That is, a program that defines each process of the analysis function imparting apparatus 10 is implemented as a program module 1093 in which code executable by the computer 1000 is described. Program modules 1093 are stored, for example, on hard disk drive 1090 . For example, the hard disk drive 1090 stores a program module 1093 for executing processing similar to the functional configuration of the analysis function imparting apparatus 10 . The hard disk drive 1090 may be replaced by an SSD (Solid State Drive).

Also, the setting data used in the processing of the above-described embodiment is stored as program data 1094 in the memory 1010 or the hard disk drive 1090, for example. Then, the CPU 1020 reads out the program module 1093 and the program data 1094 stored in the memory 1010 and the hard disk drive 1090 to the RAM 1012 as necessary and executes them.

The program modules 1093 and program data 1094 are not limited to being stored in the hard disk drive 1090, but may be stored in a removable storage medium, for example, and read by the CPU 1020 via the disk drive 1100 or the like. Alternatively, the program modules 1093 and program data 1094 may be stored in another computer connected via a network (LAN (Local Area Network), WAN (Wide Area Network), etc.). Program modules 1093 and program data 1094 may then be read by CPU 1020 through network interface 1070 from other computers.

Although the embodiment to which the invention made by the present inventor is applied has been described above, the present invention is not limited by the description and drawings forming part of the disclosure of the present invention according to the present embodiment. That is, other embodiments, examples, operation techniques, etc. made by those skilled in the art based on the present embodiment are all included in the scope of the present invention.

REFERENCE SIGNS LIST 10 analysis function imparting device 11 input unit 12 control unit 13 storage unit 14 output unit 100 script engine 102 bytecode compiler 103 virtual machine (VM)
104 syntax analysis unit 105 bytecode generation unit 106 code cache unit 107 decode unit 108 pointer cache unit 121 virtual machine analysis unit 122 instruction set architecture analysis unit 123 analysis function addition unit 131 execution trace database (DB)
132 Architecture information DB
133 VM execution trace DB
1211 execution trace acquisition unit 1212 VM instruction boundary detection unit 1213 virtual program counter detection unit 1214 dispatcher detection unit 1215 conditional branch flag detection unit 1221 VM execution trace acquisition unit 1222 branch VM instruction detection unit

Claims

a first analysis unit that analyzes the virtual machine of the script engine;
a second analysis unit that analyzes an instruction set architecture, which is a system of instructions of the virtual machine;
A virtual program counter, which is a variable indicating the instruction of the virtual machine to be executed next, which is architecture information obtained by the analysis by the first analysis unit and the second analysis unit; Based on the conditional branch flag, which is an area that holds a flag indicating whether or not to be executed, and the branch virtual machine instruction, which is a virtual machine instruction that causes branching, a hook that gives the script engine a multipath execution function is provided. an applicator for administering;
has
The first analysis unit is
analyzing a plurality of execution traces obtained by changing execution conditions using differential execution analysis to obtain the virtual program counter and the conditional branch flag;
a first acquisition unit that acquires a plurality of execution traces by changing execution conditions;
a first detection unit that clusters the execution traces and detects boundaries of each VM instruction;
A second detection of analyzing the plurality of execution traces using a differential execution analysis focusing on the number of times of memory reading and the boundary of each VM instruction detected by the first detection unit to detect the virtual program counter. Department and
a third detection unit that analyzes the binary of the script engine based on the boundary of each VM instruction detected by the first detection unit and detects a dispatcher;
a fourth detection unit that analyzes the plurality of execution traces using differential execution analysis focused on the number of times of memory reading and detects the conditional branch flag;
An analysis function imparting device characterized by having:
　The analysis function imparting device according to claim 1, wherein the first analysis unit and the second analysis unit perform analysis using a test script.
The first detection unit clusters the execution trace, detects a cluster whose execution count is equal to or greater than a threshold value as a VM instruction, and defines a boundary between a start point and an end point of a continuous instruction string that constitutes the detected VM instruction. 3. The analytical function imparting device according to claim 1, wherein the detection is performed as follows.
The second detection unit analyzes the test script used to acquire the execution trace, and the memory read count changes in proportion to the increase/decrease of both the number of repetitions and the number of repeated sentences. 4. The analysis according to claim 3, wherein the memory is narrowed down, the value of the read memory always points to the starting point of the VM instruction, and the narrowed-down memory is detected as the virtual program counter. Functional device.
A third detection unit cuts out each VM instruction portion from the binary of the script engine based on the boundary of the VM instruction detected by the first detection unit, and detects a portion having a high degree of similarity between the VM instructions. 5. The analysis function imparting device according to claim 1, wherein the analysis function imparting device is detected as a dispatcher.
The second analysis unit is
a second acquisition unit that acquires a virtual machine execution trace that is an execution trace executed in the virtual machine;
a fifth detection unit that detects the branch virtual machine instruction based on variations in the amount of change in the virtual program counter for each virtual machine opcode of the virtual machine execution trace;
The analysis function imparting device according to any one of claims 1 to 5, characterized by having:
a first parsing step of parsing the virtual machine of the script engine;
a second analysis step of analyzing an instruction set architecture, which is a system of instructions of the virtual machine;
A virtual program counter, which is a variable indicating the instruction of the virtual machine to be executed next, which is architecture information obtained by the analysis in the first analysis step and the second analysis step, and a branch when a conditional branch of the execution state occurs Based on the conditional branch flag, which is an area that holds a flag indicating whether or not to be executed, and the branch virtual machine instruction, which is a virtual machine instruction that causes branching, a hook that gives the script engine a multipath execution function is provided. an imparting step of administering;
on the computer, and
The first analysis step analyzes a plurality of execution traces obtained by changing execution conditions using differential execution analysis to obtain the virtual program counter and the conditional branch flag;
The first analysis step includes
a first acquisition step of acquiring a plurality of execution traces under different runtime conditions;
a first detection step of clustering the execution trace to detect the boundary of each VM instruction; a differential execution analysis focusing on the number of memory reads; and a boundary of each VM instruction detected in the first detection step. a second detection step of analyzing the plurality of execution traces to detect the virtual program counter using
a third detection step of analyzing the binary of the script engine and detecting the dispatcher based on the boundaries of each VM instruction detected in the first detection step;
a fourth detection step of analyzing the plurality of execution traces using differential execution analysis focused on the number of times of memory reading, and detecting the conditional branch flag;
Analysis function imparting program for executing on a computer.
An analytical function imparting method executed by an analytical function imparting device,
a first analysis step of analyzing the virtual machine of the script engine;
a second analysis step of analyzing an instruction set architecture, which is a system of instructions of the virtual machine;
A virtual program counter, which is a variable indicating the instruction of the virtual machine to be executed next, which is architecture information obtained by the analysis in the first analysis step and the second analysis step; Based on the conditional branch flag, which is an area that holds a flag indicating whether or not to be executed, and the branch virtual machine instruction, which is a virtual machine instruction that causes branching, a hook that gives the script engine a multipath execution function is provided. an application step of applying;
including
The first analysis step analyzes a plurality of execution traces obtained by changing execution conditions using differential execution analysis to obtain the virtual program counter and the conditional branch flag;
The first analysis step includes
a first acquiring step of acquiring a plurality of execution traces under different runtime conditions;
a first detection step of clustering the execution trace to detect the boundaries of each VM instruction; a differential execution analysis focusing on the number of times the memory is read; and a boundary of each VM instruction detected in the first detection step. a second detection step of analyzing the plurality of execution traces to detect the virtual program counter using
a third detection step of analyzing the binary of the script engine and detecting the dispatcher based on the boundaries of each VM instruction detected in the first detection step;
a fourth detection step of analyzing the plurality of execution traces using differential execution analysis focused on the number of times of memory reading, and detecting the conditional branch flag;
A method for providing an analysis function, comprising: