基于污点分析的源代码脆弱性检测技术

Source Code Vulnerability Detection Technology Based on Taint Analysis

基于源代码的静态分析技术是检测软件脆弱性的一种重要手段.针对不可信数据输入导致软件脆弱性的问题,提出一种基于污点分析的脆弱性检测方法.通过跟踪程序参数、环境变量等各种外部输入,标记输入的类型,在构造控制流图基础上,利用数据流分析中的相关信息,污点传播至各类脆弱性函数,从而解决缓冲区溢出、格式化字符串等问题.利用控制流、数据流分析的相关信息,提高了准确率,降低了漏报率.实验表明,该技术是一种有效的脆弱性分析方法.

Static analysis technology is a significant method to detect software vulnerabilities. To cope with the problem of untrusting data inputs leading to software vulnerabilities, presents a vulnerability detection method based on taint analysis. It tracks various kinds of input including program parameters and environment variables ,marks the type of input, after constructing the control flow graph, makes use of dataflow information, propagating the taint data to the vulnerability functions, to settle the problem of buffer overflow and format string. It utilizes the related information of control flow and dataflow dur- ing this process, thus improves the accuracy and decreases the false negatives. It is proved by experiment that this technology is an effective vulnerability analysis method.