基于隐式模式的输入验证漏洞挖掘技术研究

Research on the Mining Technology of Input Verification Vulnerability Based on Implicit Model

输入验证漏洞可能是由于程序完整性影响控制流或者数据流输入数据进行验证或处理不当导致漏洞出现。针对Android应用输入验证漏洞提出基于源代码分析静态挖掘方案,使用后向程序切片算法在控制流图上提取事务切片和约束切片,通过频繁模式挖掘获得切片级隐式安全规范,验证规范并将违规现象报告为可疑漏洞,根据收集的路径约束条件推断输入取值范围,自动化生成测试用例并在虚拟机上半自动的验证漏洞报告。实现了原型系统,从源代码中有效地提取出隐式安全规范并挖掘漏洞,通过自动化验证显著降低误报率。

Input validation vulnerabilities may result in vulnerabilities due to procedural integrity affecting control flow or data flow data validation or improper handling.In this paper, a static mining scheme based on source code analysis is proposed for the Android application input verification vulnerability. The transaction slice and constraint slice are extracted from the control flow graph using the back program slicing algorithm.Through the frequent pattern mining, we obtain sectioning level implicit security speeification,verify the specification and report the violation phenomenon as a suspicious vulnerability.Inferring the input range based on the collected path eonstraints, automatically generating test cases and verifying the vulnerability reports on the virtual machine automatieally.A prototype system is implemented to extract implicit security rules from source code and mine vulnerabilities, which significantly reduces false positive rate through automated verification.