基于污点分析的源代码脆弱性检测技术  

Source Code Vulnerability Detection Technology Based on Taint Analysis

作　　者：孔德光[1] 郑烇[1] 帅建梅[1] 陈超[1] 葛瑶[2] 

机构地区：[1]中国科学技术大学自动化系,安徽合肥230027 [2]中国科学院合肥物质科学研究院网络中心,安徽合肥230031

出　　处：《小型微型计算机系统》2009年第1期78-82,共5页Journal of Chinese Computer Systems

基　　金：国家“八六三”高技术研究发展计划基金项目(2006AA01Z449)资助

摘　　要：基于源代码的静态分析技术是检测软件脆弱性的一种重要手段.针对不可信数据输入导致软件脆弱性的问题,提出一种基于污点分析的脆弱性检测方法.通过跟踪程序参数、环境变量等各种外部输入,标记输入的类型,在构造控制流图基础上,利用数据流分析中的相关信息,污点传播至各类脆弱性函数,从而解决缓冲区溢出、格式化字符串等问题.利用控制流、数据流分析的相关信息,提高了准确率,降低了漏报率.实验表明,该技术是一种有效的脆弱性分析方法.Static analysis technology is a significant method to detect software vulnerabilities. To cope with the problem of untrusting data inputs leading to software vulnerabilities, presents a vulnerability detection method based on taint analysis. It tracks various kinds of input including program parameters and environment variables ,marks the type of input, after constructing the control flow graph, makes use of dataflow information, propagating the taint data to the vulnerability functions, to settle the problem of buffer overflow and format string. It utilizes the related information of control flow and dataflow dur- ing this process, thus improves the accuracy and decreases the false negatives. It is proved by experiment that this technology is an effective vulnerability analysis method.

关 键 词：污点分析 控制流 数据流 脆弱性 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]