A Method for Software Vulnerability Detection Based on Improved Control Flow Graph

With the rapid development of software technology, software vulnerability has become a major threat to computer security. The timely detection and repair of potential vulnerabilities in software, are of great significance in reducing system crashes and maintaining system security and integrity. This paper focuses on detecting three common types of vulnerabilities: Unused_Variable, Use_of_Uninitialized_Variable, and Use_After_ Free. We propose a method for software vulnerability detection based on an improved control flow graph(ICFG) and several predicates of vulnerability properties for each type of vulnerability. We also define a set of grammar rules for analyzing and deriving the three mentioned types of vulnerabilities, and design three vulnerability detection algorithms to guide the process of vulnerability detection. In addition, we conduct cases studies of the three mentioned types of vulnerabilities with real vulnerability program segments from Common Weakness Enumeration(CWE). The results of the studies show that the proposed method can detect the vulnerability in the tested program segments. Finally, we conduct manual analysis and experiments on detecting the three types of vulnerability program segments(30 examples for each type) from CWE, to compare the vulnerability detection effectiveness of the proposed method with that of the existing detection tool Cpp Check. The results show that the proposed method performs better. In summary, the method proposed in this paper has certain feasibility and effectiveness in detecting the three mentioned types of vulnerabilities, and it will also have guiding significance for the detection of other common vulnerabilities.

面向代码搜索的函数功能多重图嵌入

如何提高异构的自然语言查询输入和高度结构化程序语言源代码的匹配准确度,是代码搜索的一个基本问题.代码特征的准确提取是提高匹配准确度的关键之一.代码语句表达的语义不仅与其本身有关,还与其所处的上下文相关.代码的结构模型为理解代码功能提供了丰富的上下文信息.提出一个基于函数功能多重图嵌入的代码搜索方法.在所提方法中,使用早期融合的策略,将代码语句的数据依赖关系融合到控制流图中,构建函数功能多重图来表示代码.该多重图通过数据依赖关系显式表达控制流图中缺乏的非直接前驱后继节点的依赖关系,增强语句节点的上下文信息.同时,针对多重图的边的异质性,采用关系图卷积网络方法从函数多重图中提取代码的特征.在公开数据集的实验表明,相比现有基于代码文本和结构模型的方法,所提方法的MRR提高5%以上.通过消融实验也表明控制流图较数据依赖图在搜索准确度上贡献较大.

嵌入式处理器自定义指令迭代识别方法仿真

嵌入式系统中的硬件资源是有限的,并且自定义指令和原始指令之间可能存在冲突,导致指令代码识别精准度降低、运行功耗较高。为此,提出嵌入式处理器自定义指令迭代低功耗识别方法。对嵌入式处理器的指令代码展开可视化处理,将指令图像输入卷积神经网络中,检测指令代码中存在的恶意代码,采用开源编译器将代码转变为控制数据流图,枚举并选择子图,通过代码转换完成嵌入式处理器自定义指令识别。仿真结果表明,所提方法的恶意代码检测精度高、代码识别准确率高,始终保持在70%以上,平均能耗仅为89J。

基于异构指令图的恶意软件分类方法研究

恶意软件是当今互联网上最大的安全威胁之一。目前基于图深度学习的恶意软件分类研究未考虑同家族恶意软件的控制流信息所隐含的内在相似性。针对该问题提出了一种基于异构指令图的恶意软件分类方法MCHIG,包括三个阶段:异构指令图生成、结点嵌入和恶意软件分类,首先生成数据集MyHIG,再应用GraphSAGE对不同类型的边分别进行消息传递,完成异构指令图文件结点分类和指令结点嵌入,最后基于控制流图完成恶意软件分类任务。在BIG2015数据集上嵌入阶段的分类精度达到97.81%,分类阶段分别进行了五折和十折交叉验证,其中十折交叉验证的性能更佳,准确度达到99.91%,在BODMAS_mini少样本数据集上,在嵌入阶段达到96.53%,在分类阶段达到98.76%,优于目前较先进的其他恶意软件分类模型。

基于混合图表示的软件变更预测方法

软件变更预测旨在识别出具有变更倾向的模块,可以帮助软件管理者和开发人员有效地分配资源,降低维护开销.从代码中提取有效的特征在构建准确的预测模型中起着重要作用.近年来,研究人员从利用传统的手工特征进行预测转向具有强大表示能力的语义特征,他们从抽象语法树(abstract syntax tree,AST)的节点序列中提取语义特征构建模型.但已有研究忽略了AST的结构信息以及代码中丰富的语义信息,如何提取代码的语义特征仍然是一个具有挑战性的问题.为此,提出一种基于混合图表示的变更预测方法.该模型首先结合AST、控制流图(control flow graph,CFG)、数据流图(data flow graph,DFG)等结构信息构建代码的程序图表示,接着利用图神经网络学习出程序图的语义特征,根据该特征预测变更倾向性.所提模型能够融合各种语义信息以更好地表征代码.在多组变更数据集上开展与最新变更预测方法的对比实验,验证了所提方法的有效性.

基于图神经网络的源代码漏洞检测研究综述

随着开源软件在各个领域的广泛应用,源代码漏洞已经导致了一系列严重的安全问题。鉴于这些漏洞对计算机系统的潜在威胁,检测软件中的源代码漏洞以防止网络攻击已成为一个重要的研究领域。为了实现自动化检测并降低人力成本,研究人员提出了许多基于传统深度学习的方法。然而,这些方法大多将源代码视为自然语言序列而没有充分考虑代码的结构信息,因此其检测效果受到了限制。近年来,基于代码图表示和图神经网络的源代码漏洞检测方法应运而生。全面综述了图神经网络在源代码漏洞检测中的应用,并提出了一个基于图神经网络的源代码漏洞检测通用框架。从文件级别、函数级别和切片级别3种漏洞检测粒度出发,系统地总结和阐述了现有的方法和相关数据集。最后,讨论了该领域所面临的挑战,并对未来可能的研究重点进行了展望。

基于符号执行的智能合约重入漏洞检测

在智能合约安全问题中,利用重入漏洞是最具破坏性的攻击之一。针对目前相关检测工作漏报率和误报率高的问题,提出一种基于符号执行的重入漏洞检测方法。该方法基于静态符号执行技术,在模拟以太坊虚拟机指令执行过程中,通过将可能被外部合约多次调用的公有函数控制流子图连接到被调用合约的控制流图,构建出能够模拟重入攻击的完全控制流图,再结合合约状态一致性检测,实现同函数、跨函数和跨合约等3种不同类型的重入漏洞检测。基于该方法设计的检测工具Lucifer与相关工作Oyente、Securify、DefectChecker、Sailfish在已知标签数据集、漏洞注入数据集、自定义数据集和以太坊智能合约真实数据集上进行对比,实验结果表明,Lucifer在误报率、漏报率和容错性上均分别获得第一或者第二的成绩,部分检测情形准确率达到100%,由综合评价指标可以看出,Lucifer的检测率优于现有检测工具,在对于部分特定重入合约的情形尤其在与互斥锁和函数修饰符有关的重入漏洞的识别中有较好的识别能力,在检测时长上,Lucifer的检测时间较久但也在可控范围,并未出现检测超时。

基于局部路径图的自动化漏洞成因分析方法

快速的漏洞成因分析是漏洞修复中的关键一环,也一直是学术界和工业界关注的热点.现有基于大量测试样本执行记录进行统计特征分析的漏洞成因分析方法,存在随机性噪声、重要逻辑关联指令缺失等问题,其中根据测试集测量,现有统计方法中的随机性噪声占比达到了61%以上.针对上述问题,提出一种基于局部路径图的漏洞成因分析方法,其从执行路径中,提取函数间调用图和函数内控制流转移图等漏洞关联信息.并以此为基础筛除漏洞成因无关指令(即噪声指令),构建成因点逻辑关系并补充缺失的重要指令,实现一个面向二进制软件的自动化漏洞成因分析系统LGBRoot.系统在20个公开的CVE内存破坏漏洞数据集上进行验证.单个样本成因分析平均耗时12.4 s,实验数据表明,系统可以自动剔除56.2%噪声指令和补充并联结20个可视化漏洞成因相关点指令间的逻辑结构,加快分析人员的漏洞分析速度.

Research of the Control Domain of Edges in Regression Testing

Regression testing is the process of validating modified software to provide confidence that the changed parts of the software behave as intended and that the unchanged parts have not been adversely affected by the modifications. The goal of regression testing is to reduce the test suit by testing the new characters and the modified parts of a program with the original test suit. Regression testing is a high cost testing method. This paper presents a regression testing selection technique that can reduce the test suit on the basis of Control Flow Graph (CFG). It import the inherit strategy of object-oriented language to ensure an edge’s control domain to reduce the test suit size effectively. We implement the idea by coding the edge. An algorithm is also presented at last.

基于因果序图的氢能一体化电站运行过程建模及能量流控制策略

为解决大规模的“间歇性电源”接入造成的电能供需不平衡的问题,该文提出氢能一体化电站及其运行过程中电-氢-电能量流控制策略。首先,根据一体化电站电-氢-电能量转换特点,基于因果序图(COG)建立了面向控制的制储氢发电一体化电站运行动态模型,该模型能够清晰地反映一体化电站不同物理量之间的关系,实现一体化电站运行过程的表征;其次,在所建模型基础上基于自然因果关系原理设计了一体化电站运行过程的功率流和氢气流控制策略,该策略对于刚性关系过程采用反转模型控制,减少了误差反馈耗时,增强了控制器性能;最后,在基于RT-Lab的硬件在环仿真平台上进行了测试,分析了一体化电站不同物理量之间的变化关系。与比例-积分-微分(PID)控制和自抗扰控制(ADRC)方法的对比结果表明,所提控制策略在响应速度、收敛精度和运行效率上优于传统方法,可以更有效地实现氢能一体化电站运行过程的能量流管理。

一种基于FlowDroid的Android隐私保护方法

随着移动设备市场的扩大,Android智能系统占据了手机市场的很大份额,手机设备是承载用户隐私数据较多的移动设备。由于Android系统的开源特性,其存在很多安全隐患。提出一种基于FlowDroid的Android增强型隐私保护方法。对Android应用进行静态污点分析,判断其是否存在隐私泄露,并基于FlowDroid静态污点分析工具实现与验证。通过验证表明提出的方法是有效的。

进程控制流完整性保护技术综述

控制流劫持攻击利用程序内存漏洞获取程序的控制权,进而控制程序执行恶意代码,对系统安全造成极大的威胁.为了应对控制流劫持攻击,研究人员提出了一系列的防御手段.控制流完整性是一种运行时防御方法,通过阻止进程控制流的非法转移,来确保控制流始终处于程序要求的范围之内.近年来,越来越多的研究致力于解决控制流完整性的相关问题,例如提出新的控制流完整性方案、新的控制流完整性方案评估方法等.首先阐述了控制流完整性的基本原理,然后对现有控制流完整性方案进行了分类,并分别进行了分析,同时介绍了现有针对控制流完整性方案的评估方法与评价指标.最后,对控制流完整性的未来工作进行了展望,以期对未来的控制流完整性研究提供参考.

供热管网水力平衡调节方法研究

水力失调是供热系统能耗大的主要原因,在实际工程中很难解决。本文采用邻近调节法,搭建了一种基于图论理论的二次供热管网水力调节模型,依此评估和比较不同的调节方法。结果表明:邻近调节法从水力失调度最差的用户开始按邻近顺序进行依次调节,调节效果好、调节次数少,有利于精准控制,可用于二次管网初调节和运行过程调节。本文研究成果可以为现场调试和控制提供指导。

基于多表征融合的函数级代码漏洞检测方法

针对采用单一表征结构时,网络模型无法全面学习代码所承载的语义信息的问题,提出一种多表征融合的函数级代码漏洞检测(Sequence and Structure Fusion based Vulnerability Detector,S 2FVD)方法。该方法使用针对序列的神经网络TextCNN和针对图结构的图卷积神经网络,分别从函数的Token序列和属性控制流图中,提取深层语义特征并进行有机融合,从而实现函数级漏洞的精准检测。在公共数据集上开展的实验结果表明,S 2FVD能够在函数级上有效检测漏洞的存在,且相比现有方法表现出更好的检测性能。

舰船显控设备测试性建模与应用研究

为了实现舰船显控设备快速准确的故障定位,从实际装备中获取设备构成信息和故障模式信息,提出了基于相关矩阵的多信号流图的测试性建模方法,分析了显控设备四类典型全局故障模式,建立了多信号流图模型、故障-测试相关矩阵及故障诊断树,对测试性模型进行了定性评价分析,并建立了基于故障树模型的显控设备诊断软件架构及诊断策略,为显控设备的故障诊断和健康管理软硬件设计提供了有益指导。

Bipartite graph-based control flow checking for COTS-based small satellites

Abstract Single event upset （SEU） effect, caused by highly energized particles in aerospace, threatens the reliability and security of small satellites composed of commercialofftheshelves （COTS）. SEU induced control flow errors （CFEs） may cause unpredictable behavior or crashes of COTSbased small satellites. This paper proposes a generic softwarebased control flow checking technique （CFC） and bipartite graphbased control flow checking （BGCFC）. To simplify the types of illegal branches, it transforms the conventional control flow graph into the equivalent bipartite graph. It checks the legal ity of control flow at runtime by comparing a global signature with the expected value and introduces consecutive IDs and bitmaps to reduce the time and memory overhead. Theoretical analysis shows that BGCFC can detect all types of internode CFEs with constant time and memory overhead. Practical tests verify the result of theoretical analysis. Compared with previous techniques, BGCFC achieves the highest error detection rate, lower time and memory overhead; the composite result in evaluation fac tor shows that BGCFC is the most effective one among all these techniques. The results in both theory and practice verify the applicability of BGCFC for COTSbased small satellites.

Graph-tree-based software control flow checking for COTS processors on pico-satellites

This paper proposes a generic high-performance and low-time-overhead software control flow checking solution, graph-tree-based control flow checking （GTCFC） for space-borne commercial-off-the-shelf （COTS） processors. A graph tree data structure with a topology similar to common trees is introduced to transform the control flow graphs of target programs. This together with design of IDs and signatures of its vertices and edges allows for an easy check of legality of actual branching during target program execution. As a result, the algorithm not only is capable of detecting all single and multiple branching errors with low latency and time overheads along with a linear-complexity space overhead, but also remains generic among arbitrary instruction sets and independent of any specific hardware. Tests of the algorithm using a COTS-processor-based onboard computer （OBC） of in-service ZDPS-1A pico-satellite products show that GTCFC can detect over 90% of the randomly injected and all-pattern-covering branching errors for different types of target programs, with performance and overheads consistent with the theoretical analysis; and beats well-established preeminent control flow checking algorithms in these dimensions. Furthermore, it is validated that GTCGC not only can be accommodated in pico-satellites conveniently with still sufficient system margins left, but also has the ability to minimize the risk of control flow errors being undetected in their space missions. Therefore, due to its effectiveness, efficiency, and compatibility, the GTCFC solution is ready for applications on COTS processors on pico-satellites in their real space missions.

Approach to evaluating exception handling of programs

To solve the problems that the exception handling code is hard to test and maintain and that it affects the robustness and reliability of software, a method for evaluating the exception handling of programs is presented. The exception propagation graph （EPG） that describes the large programs with exception handling constructs is proposed by simplifying the control flow graph and it is applied to a case to verify its validity. According to the EPG, the exception handling code that never executes is identified; the points that are the most critical to controlling exception propagation are found; and the irrational exception handling code is corrected. The constructing algorithm for the EPG is given; thus, this provides a basis for automatically constructing the EPG and automatically correcting the irrational exception handling code.

Method for test case selection and execution of web application regression testing

In order to improve the efficiency of regression testing in web application,the control flow graph and the greedy algorithm are adopted.This paper considers a web page as a basic unit and introduces a test case selection method for web application regression testing based on the control flow graph.This method is safe enough to the test case selection.On the base of features of request sequence in web application,the minimization technique and the priority of test cases are taken into consideration in the process of execution of test cases in regression testing for web application.The improved greedy algorithm is also raised resulting in optimization of execution of test cases.The experiments indicate that the number of test cases which need to be retested is reduced,and the efficiency of execution of test cases is also improved.

一种基于异常传播分析的数据流分析方法

异常处理是一种用来检测异常并对其进行处理的技术.异常传播改变了程序原来的执行路线,从而改变了程序中的数据流.在进行数据流分析时,如果不考虑异常传播对其造成的影响,则得到的信息将是不准确的.在分析C++异常传播机制和异常传播对数据流分析影响的基础上,提出一种包含异常传播信息的函数间控制流图的构建方法.该控制流图可以清晰地表示出异常的隐式控制流和异常的传播路径;然后提出了基于异常传播分析的数据流分析方法,并给出相应的算法.该方法既克服了因忽略异常传播对数据流影响而造成分析结果不准确的不足,又有助于实现异常传播数据流分析的自动处理;最后用一个实例验证了该方法的可用性.该方法可以为结构测试、回归测试、程序切片等软件工程任务提供相关信息.