基于动态符号执行技术的代码安全检测模型研究
|
摘要
为了更高效地进行代码安全检测,文章基于动态符号执行技术,针对其存在的执行路径空间爆炸、高效约束求解开销以及程序设计语言兼容性这3个不足进行优化,并在此基础上提出了一种基于优化搜索策略动态符号执行的代码安全检测模型。该模型结合了当前主流的代码安全检测技术,提出了一种新型的安全缺陷分类方法,并优化了路径搜索策略,从而可以更加准确、高效地检测出代码中存在的安全问题。
In order to carry out code security detection more efficiently,based on dynamic symbol execution technology,this paper optimizes its three limitations of execution path space explosion,efficient constraint solution overhead,and programming language compatibility,and proposes a code security detection model based on dynamic symbol execution of optimized search strategy.This model combines the current mainstream code security detection technology,using a new classification method of security defects,and the path search strategy is optimized to detect the security problems in the code more accurately and efficiently.
In order to carry out code security detection more efficiently,based on dynamic symbol execution technology,this paper optimizes its three limitations of execution path space explosion,efficient constraint solution overhead,and programming language compatibility,and proposes a code security detection model based on dynamic symbol execution of optimized search strategy.This model combines the current mainstream code security detection technology,using a new classification method of security defects,and the path search strategy is optimized to detect the security problems in the code more accurately and efficiently.
引文
[1]宋雪勦.符号执行在软件安全领域中的研究与应用[D].成都:西华大学,2018
[2]张亚楠,谢冬红,邵学彬.静态代码缺陷定位技术研究[J].信息与电脑,2017,11(23):16-19.ZHANG Yanan,XIE Donghong,SHAO Xuebin.Research on static code defect location technology[J].China Computer&Communication,2017,11(23):16-19.
[3]季晓慧,张健.约束问题求解[J].自动化学报,2007,45(2):256-262.JI Xiaohui,ZHANG Jian.Constraint problem solving[J].Acta Automatica Sinica,2007,45(2):256-262.
[4]董齐兴,曾凡平,严俊,等.改进动态符号执行中的非线性约束求解过程[J].小型微型计算机系统,2014,35(11):2396-2401.DONG Qixing,ZENG Fanping,YAN Jun,et al.Improving the nonlinear constraint solving process in dynamic symbol execution[J].Journal of Chinese Computer Systems,2014,35(11):2396-2401.
[5]王磊.动态符号执行中路径搜索策略的研究与实现[D].西安:西安电子科技大学,2017.
[6]张羽丰.符号执行可扩展性及可行性关键技术研究[D].长沙:国防科学技术大学,2013.
[7]刘经德,陈振邦,王戟.基于求解开销预测的符号执行搜索策略研究[J].计算机研究与发展,2016,59(5):1086-1094.LIU Jingde,CHEN Zhenbang,WANG Ji.Solving cost prediction based search in symbolic execution[J].Journal of Computer Research and Development,2016,59(5):1086-1094.
[8]国鹏飞.基于动态符号执行的二进制代码漏洞挖掘系统研究与设计[D].北京:北京邮电大学,2011.
[9]袁健.基于符号执行的代码安全检查技术研究与实现[D].成都:电子科技大学,2016.
[10]吉小丽.动态符号执行的性能优化[D].成都:电子科技大学,2013.
[11]康文涛.符号执行工具KLEE约束求解优化设计与实现[D].成都:电子科技大学,2014.
[12]赵祖威,冯世宁,汤恩义,等.一种符号执行制导的循环内界分析方法[J].电子学报,2017,56(11):2582-2592.ZHAO Zuwei,FENG Shining,TANG Enyi,et al.A cyclic interior bound analysis method for symbolic execution guidance[J].Acta Electronica Sinica,2017,56(11):2582-2592.
[13]李朝君,蒋凡.符号执行中高语句覆盖率的路径调度[J].计算机工程与应用,2010,47(14):66-68,125.LI Chaojun,JIANG Fan.Path scheduling for high-state statement coverage in symbol execution[J].Computer Engineering and Applications,2010,47(14):66-68,125.
[14]王雅丽.安全检证工具中抽象语法树的设计与实现[D].西安:西北农林科技大学,2013.
[15]蔡军,邹鹏,熊达鹏,等.结合静态分析与动态符号执行的软件漏洞检测方法[J].计算机工程与科学,2016,44(12):2536-2541.CAI Jun,ZOU Peng,XIONG Dapeng,et al.Software vulnerability detection method combining static analysis and dynamic symbol execution[J].Computer Engineering&Science,2016,44(12):2536-2541.
[16]方登辉.基于抽象语法树的代码静态缺陷检测工具开发[D].北京:北京邮电大学,2018.
[17]付江龙,杨阳,陈素军,等.可满足性问题的约束求解器应用浅析[J].河北建筑工程学院学报,2017,34(2):132-134.FU Jianglong,YANG Yang,CHEN Sujun,et al.Analysis of the application of constraint solver for satisfiability problems[J].Journal of Hebei Institute of Architecture and Civil Engineering,2017,34(2):132-134.
[18]陈锦山,唐志军,何燕玲,等.智能变电站二次系统信息安全测试方法[J].广东电力,2017,30(9):75-80.CHEN Jinshan,TANG Zhijun,HE Yanling,et al.Testing method for information security of secondary system of intelligent substation[J].Guangdong Electric Power,2017,30(9):75-80.
[2]张亚楠,谢冬红,邵学彬.静态代码缺陷定位技术研究[J].信息与电脑,2017,11(23):16-19.ZHANG Yanan,XIE Donghong,SHAO Xuebin.Research on static code defect location technology[J].China Computer&Communication,2017,11(23):16-19.
[3]季晓慧,张健.约束问题求解[J].自动化学报,2007,45(2):256-262.JI Xiaohui,ZHANG Jian.Constraint problem solving[J].Acta Automatica Sinica,2007,45(2):256-262.
[4]董齐兴,曾凡平,严俊,等.改进动态符号执行中的非线性约束求解过程[J].小型微型计算机系统,2014,35(11):2396-2401.DONG Qixing,ZENG Fanping,YAN Jun,et al.Improving the nonlinear constraint solving process in dynamic symbol execution[J].Journal of Chinese Computer Systems,2014,35(11):2396-2401.
[5]王磊.动态符号执行中路径搜索策略的研究与实现[D].西安:西安电子科技大学,2017.
[6]张羽丰.符号执行可扩展性及可行性关键技术研究[D].长沙:国防科学技术大学,2013.
[7]刘经德,陈振邦,王戟.基于求解开销预测的符号执行搜索策略研究[J].计算机研究与发展,2016,59(5):1086-1094.LIU Jingde,CHEN Zhenbang,WANG Ji.Solving cost prediction based search in symbolic execution[J].Journal of Computer Research and Development,2016,59(5):1086-1094.
[8]国鹏飞.基于动态符号执行的二进制代码漏洞挖掘系统研究与设计[D].北京:北京邮电大学,2011.
[9]袁健.基于符号执行的代码安全检查技术研究与实现[D].成都:电子科技大学,2016.
[10]吉小丽.动态符号执行的性能优化[D].成都:电子科技大学,2013.
[11]康文涛.符号执行工具KLEE约束求解优化设计与实现[D].成都:电子科技大学,2014.
[12]赵祖威,冯世宁,汤恩义,等.一种符号执行制导的循环内界分析方法[J].电子学报,2017,56(11):2582-2592.ZHAO Zuwei,FENG Shining,TANG Enyi,et al.A cyclic interior bound analysis method for symbolic execution guidance[J].Acta Electronica Sinica,2017,56(11):2582-2592.
[13]李朝君,蒋凡.符号执行中高语句覆盖率的路径调度[J].计算机工程与应用,2010,47(14):66-68,125.LI Chaojun,JIANG Fan.Path scheduling for high-state statement coverage in symbol execution[J].Computer Engineering and Applications,2010,47(14):66-68,125.
[14]王雅丽.安全检证工具中抽象语法树的设计与实现[D].西安:西北农林科技大学,2013.
[15]蔡军,邹鹏,熊达鹏,等.结合静态分析与动态符号执行的软件漏洞检测方法[J].计算机工程与科学,2016,44(12):2536-2541.CAI Jun,ZOU Peng,XIONG Dapeng,et al.Software vulnerability detection method combining static analysis and dynamic symbol execution[J].Computer Engineering&Science,2016,44(12):2536-2541.
[16]方登辉.基于抽象语法树的代码静态缺陷检测工具开发[D].北京:北京邮电大学,2018.
[17]付江龙,杨阳,陈素军,等.可满足性问题的约束求解器应用浅析[J].河北建筑工程学院学报,2017,34(2):132-134.FU Jianglong,YANG Yang,CHEN Sujun,et al.Analysis of the application of constraint solver for satisfiability problems[J].Journal of Hebei Institute of Architecture and Civil Engineering,2017,34(2):132-134.
[18]陈锦山,唐志军,何燕玲,等.智能变电站二次系统信息安全测试方法[J].广东电力,2017,30(9):75-80.CHEN Jinshan,TANG Zhijun,HE Yanling,et al.Testing method for information security of secondary system of intelligent substation[J].Guangdong Electric Power,2017,30(9):75-80.