模型学习与符号执行结合的安全协议代码分析技术

Security protocol code analysis method combining model learning and symbolic execution

符号执行技术从理论上可以全面分析程序执行空间,但对安全协议这样的大型程序,路径空间爆炸和约束求解困难的局限性导致其在实践上不可行。结合安全协议程序自身特点,提出用模型学习得到的协议状态机信息指导安全协议代码符号执行思路;同时,通过将协议代码中的密码学逻辑与协议交互逻辑相分离,避免了因密码逻辑的复杂性导致路径约束无法求解的问题。在SSH协议开源项目Dropbear上的成功实践表明了所提方法的可行性;通过与Dropbear自带的模糊测试套件对比,验证了所提方法在代码覆盖率与错误点发现上均具有一定优势。

Symbolic execution can comprehensively analyze program execution space in theory,but it is not feasible in practice for large programs like security protocols,due to the explosion of path space and the limitation of difficulty in solving path constraints.According to the characteristics of security protocol program,a method to guide the symbolic execution of security protocol code by using protocol state machine information obtained from model learning was proposed.At the same time,by separating cryptographic logic from protocol interaction logic,the problem that path constraints cannot be solved caused by the complexity of cryptographic logic is avoided.The feasibility of the method is demonstrated by the practice on the SSH open source project Dropbear.Compared with Dropbear's test suite,the proposed method has advantages in code coverage and error point discovery.