基于静态分析的安全漏洞检测技术研究

Security Vulnerability Detection Study Based on Static Analysis

消除软件中的安全漏洞是建立安全信息系统的前提。静态分析方法可以自动地提取软件的行为信息,从而检测出软件中的安全漏洞。和其它程序分析方法相比,该方法具有自动化程度高和检测速度快的优点。在本文中,我们首先描述了静态分析的理论基础,然后说明了类型推断、数据流分析和约束分析等主要静态分析方法及其在安全漏洞检测中的应用,并比较这些方法的优缺点。最后给出了几种支持安全漏洞静态检测的编程语言。

Security vulnerability of software is a serious threat for information security. Static： analysis can find security vulnerabilities by automatically deriving information about the behavior of software. Comparing with other program analysis methods, static analysis method can detect security vulnerabilities automatically and effectively. This paper presents the theory basis and principles of static analysis methods, and introduces their applications and characters in security vulnerabilities detection. At last, we show some security languages which can support detection of security vulnerability.